Edit tour

Windows Analysis Report
D8wwrB9ZCB.exe

Overview

General Information

Sample name:	D8wwrB9ZCB.exe (renamed file extension from none to exe, renamed because original name is a hash value)
Original sample name:	22b90d638d1da32f8e2f2fdbecf4cad4
Analysis ID:	1524643
MD5:	22b90d638d1da32f8e2f2fdbecf4cad4
SHA1:	d333c074053ee90bb2f7a5a2f4923285e8c92952
SHA256:	dc2535caf6f685dbaadc3a18c6fcfabc043d75a1b76245247eab02bf766c9320

Errors Corrupt sample or wrongly selected analyzer. Details: 36b1

Detection

Score:	3
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality to query locales information (e.g. system language)

Detected potential crypto function

Found potential string decryption / allocating functions

PE file contains more sections than normal

PE file contains sections with non-standard names

Program does not show much activity (idle)

Sample file is different than original file name gathered from version info

Classification

Process Tree

System is w10x64

D8wwrB9ZCB.exe (PID: 6336 cmdline: "C:\Users\user\Desktop\D8wwrB9ZCB.exe" MD5: 22B90D638D1DA32F8E2F2FDBECF4CAD4)

cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: D8wwrB9ZCB.exe

Static PE information: certificate valid

Source: D8wwrB9ZCB.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source:

Binary string: C:\b\s\w\ir\cache\builder\src\out\Release_x64\initialexe\chrome.exe.pdb source: D8wwrB9ZCB.exe

Source: C:\Users\user\Desktop\D8wwrB9ZCB.exe	Code function: 0_2_00007FF69B3696F0 GetLastError,FindNextFileW,GetLastError,FindClose,GetFileAttributesW,FindFirstFileExW,		0_2_00007FF69B3696F0
Source: C:\Users\user\Desktop\D8wwrB9ZCB.exe	Code function: 0_2_00007FF69B4E6630 FindFirstFileExW,GetLastError,		0_2_00007FF69B4E6630

Source: D8wwrB9ZCB.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: D8wwrB9ZCB.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: D8wwrB9ZCB.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: D8wwrB9ZCB.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: D8wwrB9ZCB.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: D8wwrB9ZCB.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: D8wwrB9ZCB.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: D8wwrB9ZCB.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: D8wwrB9ZCB.exe	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: D8wwrB9ZCB.exe	String found in binary or memory: http://ocsp.digicert.com0
Source: D8wwrB9ZCB.exe	String found in binary or memory: http://ocsp.digicert.com0A
Source: D8wwrB9ZCB.exe	String found in binary or memory: http://ocsp.digicert.com0C
Source: D8wwrB9ZCB.exe	String found in binary or memory: http://ocsp.digicert.com0X
Source: D8wwrB9ZCB.exe	String found in binary or memory: http://www.digicert.com/CPS0
Source: D8wwrB9ZCB.exe	String found in binary or memory: https://crashpad.chromium.org/
Source: D8wwrB9ZCB.exe	String found in binary or memory: https://crashpad.chromium.org/bug/new
Source: D8wwrB9ZCB.exe	String found in binary or memory: https://crashpad.chromium.org/https://crashpad.chromium.org/bug/new

Source: C:\Users\user\Desktop\D8wwrB9ZCB.exe	Code function: 0_2_00007FF69B46DC8C	0_2_00007FF69B46DC8C
Source: C:\Users\user\Desktop\D8wwrB9ZCB.exe	Code function: 0_2_00007FF69B34CCB0	0_2_00007FF69B34CCB0
Source: C:\Users\user\Desktop\D8wwrB9ZCB.exe	Code function: 0_2_00007FF69B42EC60	0_2_00007FF69B42EC60
Source: C:\Users\user\Desktop\D8wwrB9ZCB.exe	Code function: 0_2_00007FF69B491CF8	0_2_00007FF69B491CF8
Source: C:\Users\user\Desktop\D8wwrB9ZCB.exe	Code function: 0_2_00007FF69B332CC0	0_2_00007FF69B332CC0
Source: C:\Users\user\Desktop\D8wwrB9ZCB.exe	Code function: 0_2_00007FF69B33FCD0	0_2_00007FF69B33FCD0
Source: C:\Users\user\Desktop\D8wwrB9ZCB.exe	Code function: 0_2_00007FF69B389CE0	0_2_00007FF69B389CE0
Source: C:\Users\user\Desktop\D8wwrB9ZCB.exe	Code function: 0_2_00007FF69B46BB78	0_2_00007FF69B46BB78
Source: C:\Users\user\Desktop\D8wwrB9ZCB.exe	Code function: 0_2_00007FF69B469B70	0_2_00007FF69B469B70
Source: C:\Users\user\Desktop\D8wwrB9ZCB.exe	Code function: 0_2_00007FF69B351C20	0_2_00007FF69B351C20
Source: C:\Users\user\Desktop\D8wwrB9ZCB.exe	Code function: 0_2_00007FF69B417BD0	0_2_00007FF69B417BD0
Source: C:\Users\user\Desktop\D8wwrB9ZCB.exe	Code function: 0_2_00007FF69B34BBF0	0_2_00007FF69B34BBF0
Source: C:\Users\user\Desktop\D8wwrB9ZCB.exe	Code function: 0_2_00007FF69B46DA80	0_2_00007FF69B46DA80
Source: C:\Users\user\Desktop\D8wwrB9ZCB.exe	Code function: 0_2_00007FF69B40BA60	0_2_00007FF69B40BA60
Source: C:\Users\user\Desktop\D8wwrB9ZCB.exe	Code function: 0_2_00007FF69B404B30	0_2_00007FF69B404B30
Source: C:\Users\user\Desktop\D8wwrB9ZCB.exe	Code function: 0_2_00007FF69B35CAD0	0_2_00007FF69B35CAD0
Source: C:\Users\user\Desktop\D8wwrB9ZCB.exe	Code function: 0_2_00007FF69B35DAE0	0_2_00007FF69B35DAE0
Source: C:\Users\user\Desktop\D8wwrB9ZCB.exe	Code function: 0_2_00007FF69B46F980	0_2_00007FF69B46F980
Source: C:\Users\user\Desktop\D8wwrB9ZCB.exe	Code function: 0_2_00007FF69B4C79B0	0_2_00007FF69B4C79B0
Source: C:\Users\user\Desktop\D8wwrB9ZCB.exe	Code function: 0_2_00007FF69B3DD9A0	0_2_00007FF69B3DD9A0
Source: C:\Users\user\Desktop\D8wwrB9ZCB.exe	Code function: 0_2_00007FF69B4CF9A0	0_2_00007FF69B4CF9A0
Source: C:\Users\user\Desktop\D8wwrB9ZCB.exe	Code function: 0_2_00007FF69B33E940	0_2_00007FF69B33E940
Source: C:\Users\user\Desktop\D8wwrB9ZCB.exe	Code function: 0_2_00007FF69B3C5960	0_2_00007FF69B3C5960
Source: C:\Users\user\Desktop\D8wwrB9ZCB.exe	Code function: 0_2_00007FF69B4B8960	0_2_00007FF69B4B8960
Source: C:\Users\user\Desktop\D8wwrB9ZCB.exe	Code function: 0_2_00007FF69B3C7A10	0_2_00007FF69B3C7A10
Source: C:\Users\user\Desktop\D8wwrB9ZCB.exe	Code function: 0_2_00007FF69B36AA10	0_2_00007FF69B36AA10
Source: C:\Users\user\Desktop\D8wwrB9ZCB.exe	Code function: 0_2_00007FF69B4769CC	0_2_00007FF69B4769CC
Source: C:\Users\user\Desktop\D8wwrB9ZCB.exe	Code function: 0_2_00007FF69B34B9D0	0_2_00007FF69B34B9D0
Source: C:\Users\user\Desktop\D8wwrB9ZCB.exe	Code function: 0_2_00007FF69B43F090	0_2_00007FF69B43F090
Source: C:\Users\user\Desktop\D8wwrB9ZCB.exe	Code function: 0_2_00007FF69B381090	0_2_00007FF69B381090
Source: C:\Users\user\Desktop\D8wwrB9ZCB.exe	Code function: 0_2_00007FF69B3C3050	0_2_00007FF69B3C3050
Source: C:\Users\user\Desktop\D8wwrB9ZCB.exe	Code function: 0_2_00007FF69B469F78	0_2_00007FF69B469F78
Source: C:\Users\user\Desktop\D8wwrB9ZCB.exe	Code function: 0_2_00007FF69B350F90	0_2_00007FF69B350F90
Source: C:\Users\user\Desktop\D8wwrB9ZCB.exe	Code function: 0_2_00007FF69B3F7FA0	0_2_00007FF69B3F7FA0
Source: C:\Users\user\Desktop\D8wwrB9ZCB.exe	Code function: 0_2_00007FF69B401F40	0_2_00007FF69B401F40
Source: C:\Users\user\Desktop\D8wwrB9ZCB.exe	Code function: 0_2_00007FF69B42BF70	0_2_00007FF69B42BF70
Source: C:\Users\user\Desktop\D8wwrB9ZCB.exe	Code function: 0_2_00007FF69B409F70	0_2_00007FF69B409F70
Source: C:\Users\user\Desktop\D8wwrB9ZCB.exe	Code function: 0_2_00007FF69B345020	0_2_00007FF69B345020
Source: C:\Users\user\Desktop\D8wwrB9ZCB.exe	Code function: 0_2_00007FF69B415FD0	0_2_00007FF69B415FD0
Source: C:\Users\user\Desktop\D8wwrB9ZCB.exe	Code function: 0_2_00007FF69B441E90	0_2_00007FF69B441E90
Source: C:\Users\user\Desktop\D8wwrB9ZCB.exe	Code function: 0_2_00007FF69B46DE98	0_2_00007FF69B46DE98
Source: C:\Users\user\Desktop\D8wwrB9ZCB.exe	Code function: 0_2_00007FF69B3FEEB0	0_2_00007FF69B3FEEB0
Source: C:\Users\user\Desktop\D8wwrB9ZCB.exe	Code function: 0_2_00007FF69B36CEB0	0_2_00007FF69B36CEB0
Source: C:\Users\user\Desktop\D8wwrB9ZCB.exe	Code function: 0_2_00007FF69B3EFF00	0_2_00007FF69B3EFF00
Source: C:\Users\user\Desktop\D8wwrB9ZCB.exe	Code function: 0_2_00007FF69B3C7F10	0_2_00007FF69B3C7F10
Source: C:\Users\user\Desktop\D8wwrB9ZCB.exe	Code function: 0_2_00007FF69B430ED0	0_2_00007FF69B430ED0
Source: C:\Users\user\Desktop\D8wwrB9ZCB.exe	Code function: 0_2_00007FF69B341ED0	0_2_00007FF69B341ED0
Source: C:\Users\user\Desktop\D8wwrB9ZCB.exe	Code function: 0_2_00007FF69B3F1D80	0_2_00007FF69B3F1D80
Source: C:\Users\user\Desktop\D8wwrB9ZCB.exe	Code function: 0_2_00007FF69B42AD80	0_2_00007FF69B42AD80
Source: C:\Users\user\Desktop\D8wwrB9ZCB.exe	Code function: 0_2_00007FF69B451D40	0_2_00007FF69B451D40
Source: C:\Users\user\Desktop\D8wwrB9ZCB.exe	Code function: 0_2_00007FF69B469D74	0_2_00007FF69B469D74
Source: C:\Users\user\Desktop\D8wwrB9ZCB.exe	Code function: 0_2_00007FF69B474E30	0_2_00007FF69B474E30
Source: C:\Users\user\Desktop\D8wwrB9ZCB.exe	Code function: 0_2_00007FF69B4CFE20	0_2_00007FF69B4CFE20
Source: C:\Users\user\Desktop\D8wwrB9ZCB.exe	Code function: 0_2_00007FF69B44CDE0	0_2_00007FF69B44CDE0
Source: C:\Users\user\Desktop\D8wwrB9ZCB.exe	Code function: 0_2_00007FF69B488494	0_2_00007FF69B488494
Source: C:\Users\user\Desktop\D8wwrB9ZCB.exe	Code function: 0_2_00007FF69B499480	0_2_00007FF69B499480
Source: C:\Users\user\Desktop\D8wwrB9ZCB.exe	Code function: 0_2_00007FF69B4514B0	0_2_00007FF69B4514B0
Source: C:\Users\user\Desktop\D8wwrB9ZCB.exe	Code function: 0_2_00007FF69B4944A0	0_2_00007FF69B4944A0
Source: C:\Users\user\Desktop\D8wwrB9ZCB.exe	Code function: 0_2_00007FF69B35C440	0_2_00007FF69B35C440
Source: C:\Users\user\Desktop\D8wwrB9ZCB.exe	Code function: 0_2_00007FF69B3EE450	0_2_00007FF69B3EE450
Source: C:\Users\user\Desktop\D8wwrB9ZCB.exe	Code function: 0_2_00007FF69B46F474	0_2_00007FF69B46F474
Source: C:\Users\user\Desktop\D8wwrB9ZCB.exe	Code function: 0_2_00007FF69B347460	0_2_00007FF69B347460
Source: C:\Users\user\Desktop\D8wwrB9ZCB.exe	Code function: 0_2_00007FF69B34E460	0_2_00007FF69B34E460
Source: C:\Users\user\Desktop\D8wwrB9ZCB.exe	Code function: 0_2_00007FF69B480510	0_2_00007FF69B480510
Source: C:\Users\user\Desktop\D8wwrB9ZCB.exe	Code function: 0_2_00007FF69B456510	0_2_00007FF69B456510
Source: C:\Users\user\Desktop\D8wwrB9ZCB.exe	Code function: 0_2_00007FF69B33E530	0_2_00007FF69B33E530
Source: C:\Users\user\Desktop\D8wwrB9ZCB.exe	Code function: 0_2_00007FF69B40E520	0_2_00007FF69B40E520
Source: C:\Users\user\Desktop\D8wwrB9ZCB.exe	Code function: 0_2_00007FF69B48E51C	0_2_00007FF69B48E51C
Source: C:\Users\user\Desktop\D8wwrB9ZCB.exe	Code function: 0_2_00007FF69B3394D0	0_2_00007FF69B3394D0
Source: C:\Users\user\Desktop\D8wwrB9ZCB.exe	Code function: 0_2_00007FF69B3374E0	0_2_00007FF69B3374E0
Source: C:\Users\user\Desktop\D8wwrB9ZCB.exe	Code function: 0_2_00007FF69B46A380	0_2_00007FF69B46A380
Source: C:\Users\user\Desktop\D8wwrB9ZCB.exe	Code function: 0_2_00007FF69B3C43A0	0_2_00007FF69B3C43A0
Source: C:\Users\user\Desktop\D8wwrB9ZCB.exe	Code function: 0_2_00007FF69B4CF360	0_2_00007FF69B4CF360
Source: C:\Users\user\Desktop\D8wwrB9ZCB.exe	Code function: 0_2_00007FF69B48F408	0_2_00007FF69B48F408
Source: C:\Users\user\Desktop\D8wwrB9ZCB.exe	Code function: 0_2_00007FF69B3E4410	0_2_00007FF69B3E4410
Source: C:\Users\user\Desktop\D8wwrB9ZCB.exe	Code function: 0_2_00007FF69B3D0420	0_2_00007FF69B3D0420
Source: C:\Users\user\Desktop\D8wwrB9ZCB.exe	Code function: 0_2_00007FF69B44B3E0	0_2_00007FF69B44B3E0
Source: C:\Users\user\Desktop\D8wwrB9ZCB.exe	Code function: 0_2_00007FF69B47228C	0_2_00007FF69B47228C
Source: C:\Users\user\Desktop\D8wwrB9ZCB.exe	Code function: 0_2_00007FF69B3452A0	0_2_00007FF69B3452A0
Source: C:\Users\user\Desktop\D8wwrB9ZCB.exe	Code function: 0_2_00007FF69B3D3250	0_2_00007FF69B3D3250
Source: C:\Users\user\Desktop\D8wwrB9ZCB.exe	Code function: 0_2_00007FF69B378260	0_2_00007FF69B378260
Source: C:\Users\user\Desktop\D8wwrB9ZCB.exe	Code function: 0_2_00007FF69B40D2D0	0_2_00007FF69B40D2D0
Source: C:\Users\user\Desktop\D8wwrB9ZCB.exe	Code function: 0_2_00007FF69B3692C0	0_2_00007FF69B3692C0
Source: C:\Users\user\Desktop\D8wwrB9ZCB.exe	Code function: 0_2_00007FF69B4672D0	0_2_00007FF69B4672D0
Source: C:\Users\user\Desktop\D8wwrB9ZCB.exe	Code function: 0_2_00007FF69B4C32F0	0_2_00007FF69B4C32F0
Source: C:\Users\user\Desktop\D8wwrB9ZCB.exe	Code function: 0_2_00007FF69B46A17C	0_2_00007FF69B46A17C
Source: C:\Users\user\Desktop\D8wwrB9ZCB.exe	Code function: 0_2_00007FF69B3ED190	0_2_00007FF69B3ED190
Source: C:\Users\user\Desktop\D8wwrB9ZCB.exe	Code function: 0_2_00007FF69B4881AC	0_2_00007FF69B4881AC
Source: C:\Users\user\Desktop\D8wwrB9ZCB.exe	Code function: 0_2_00007FF69B34D1A0	0_2_00007FF69B34D1A0
Source: C:\Users\user\Desktop\D8wwrB9ZCB.exe	Code function: 0_2_00007FF69B3EE150	0_2_00007FF69B3EE150
Source: C:\Users\user\Desktop\D8wwrB9ZCB.exe	Code function: 0_2_00007FF69B331150	0_2_00007FF69B331150
Source: C:\Users\user\Desktop\D8wwrB9ZCB.exe	Code function: 0_2_00007FF69B43D170	0_2_00007FF69B43D170
Source: C:\Users\user\Desktop\D8wwrB9ZCB.exe	Code function: 0_2_00007FF69B3C8200	0_2_00007FF69B3C8200
Source: C:\Users\user\Desktop\D8wwrB9ZCB.exe	Code function: 0_2_00007FF69B466230	0_2_00007FF69B466230
Source: C:\Users\user\Desktop\D8wwrB9ZCB.exe	Code function: 0_2_00007FF69B3401C0	0_2_00007FF69B3401C0
Source: C:\Users\user\Desktop\D8wwrB9ZCB.exe	Code function: 0_2_00007FF69B407880	0_2_00007FF69B407880
Source: C:\Users\user\Desktop\D8wwrB9ZCB.exe	Code function: 0_2_00007FF69B48888C	0_2_00007FF69B48888C
Source: C:\Users\user\Desktop\D8wwrB9ZCB.exe	Code function: 0_2_00007FF69B431850	0_2_00007FF69B431850
Source: C:\Users\user\Desktop\D8wwrB9ZCB.exe	Code function: 0_2_00007FF69B467868	0_2_00007FF69B467868
Source: C:\Users\user\Desktop\D8wwrB9ZCB.exe	Code function: 0_2_00007FF69B3F0870	0_2_00007FF69B3F0870
Source: C:\Users\user\Desktop\D8wwrB9ZCB.exe	Code function: 0_2_00007FF69B344910	0_2_00007FF69B344910
Source: C:\Users\user\Desktop\D8wwrB9ZCB.exe	Code function: 0_2_00007FF69B3F88C0	0_2_00007FF69B3F88C0
Source: C:\Users\user\Desktop\D8wwrB9ZCB.exe	Code function: 0_2_00007FF69B4B88E0	0_2_00007FF69B4B88E0
Source: C:\Users\user\Desktop\D8wwrB9ZCB.exe	Code function: 0_2_00007FF69B4268E0	0_2_00007FF69B4268E0
Source: C:\Users\user\Desktop\D8wwrB9ZCB.exe	Code function: 0_2_00007FF69B4BC780	0_2_00007FF69B4BC780
Source: C:\Users\user\Desktop\D8wwrB9ZCB.exe	Code function: 0_2_00007FF69B42C780	0_2_00007FF69B42C780
Source: C:\Users\user\Desktop\D8wwrB9ZCB.exe	Code function: 0_2_00007FF69B40D780	0_2_00007FF69B40D780
Source: C:\Users\user\Desktop\D8wwrB9ZCB.exe	Code function: 0_2_00007FF69B34D7A0	0_2_00007FF69B34D7A0
Source: C:\Users\user\Desktop\D8wwrB9ZCB.exe	Code function: 0_2_00007FF69B381750	0_2_00007FF69B381750
Source: C:\Users\user\Desktop\D8wwrB9ZCB.exe	Code function: 0_2_00007FF69B3CC760	0_2_00007FF69B3CC760
Source: C:\Users\user\Desktop\D8wwrB9ZCB.exe	Code function: 0_2_00007FF69B377760	0_2_00007FF69B377760
Source: C:\Users\user\Desktop\D8wwrB9ZCB.exe	Code function: 0_2_00007FF69B401820	0_2_00007FF69B401820
Source: C:\Users\user\Desktop\D8wwrB9ZCB.exe	Code function: 0_2_00007FF69B429820	0_2_00007FF69B429820
Source: C:\Users\user\Desktop\D8wwrB9ZCB.exe	Code function: 0_2_00007FF69B43D820	0_2_00007FF69B43D820
Source: C:\Users\user\Desktop\D8wwrB9ZCB.exe	Code function: 0_2_00007FF69B4667E0	0_2_00007FF69B4667E0
Source: C:\Users\user\Desktop\D8wwrB9ZCB.exe	Code function: 0_2_00007FF69B3A8680	0_2_00007FF69B3A8680
Source: C:\Users\user\Desktop\D8wwrB9ZCB.exe	Code function: 0_2_00007FF69B3CE690	0_2_00007FF69B3CE690
Source: C:\Users\user\Desktop\D8wwrB9ZCB.exe	Code function: 0_2_00007FF69B4DC6A0	0_2_00007FF69B4DC6A0
Source: C:\Users\user\Desktop\D8wwrB9ZCB.exe	Code function: 0_2_00007FF69B3CD640	0_2_00007FF69B3CD640
Source: C:\Users\user\Desktop\D8wwrB9ZCB.exe	Code function: 0_2_00007FF69B411670	0_2_00007FF69B411670
Source: C:\Users\user\Desktop\D8wwrB9ZCB.exe	Code function: 0_2_00007FF69B3E1710	0_2_00007FF69B3E1710
Source: C:\Users\user\Desktop\D8wwrB9ZCB.exe	Code function: 0_2_00007FF69B42E700	0_2_00007FF69B42E700
Source: C:\Users\user\Desktop\D8wwrB9ZCB.exe	Code function: 0_2_00007FF69B3696F0	0_2_00007FF69B3696F0
Source: C:\Users\user\Desktop\D8wwrB9ZCB.exe	Code function: 0_2_00007FF69B46A584	0_2_00007FF69B46A584
Source: C:\Users\user\Desktop\D8wwrB9ZCB.exe	Code function: 0_2_00007FF69B37B5A0	0_2_00007FF69B37B5A0
Source: C:\Users\user\Desktop\D8wwrB9ZCB.exe	Code function: 0_2_00007FF69B419550	0_2_00007FF69B419550
Source: C:\Users\user\Desktop\D8wwrB9ZCB.exe	Code function: 0_2_00007FF69B3EC560	0_2_00007FF69B3EC560
Source: C:\Users\user\Desktop\D8wwrB9ZCB.exe	Code function: 0_2_00007FF69B3EA620	0_2_00007FF69B3EA620
Source: C:\Users\user\Desktop\D8wwrB9ZCB.exe	Code function: 0_2_00007FF69B396630	0_2_00007FF69B396630
Source: C:\Users\user\Desktop\D8wwrB9ZCB.exe	Code function: 0_2_00007FF69B4035D0	0_2_00007FF69B4035D0
Source: C:\Users\user\Desktop\D8wwrB9ZCB.exe	Code function: 0_2_00007FF69B43C5E0	0_2_00007FF69B43C5E0

Source: C:\Users\user\Desktop\D8wwrB9ZCB.exe	Code function: String function: 00007FF69B44EDF0 appears 62 times
Source: C:\Users\user\Desktop\D8wwrB9ZCB.exe	Code function: String function: 00007FF69B362290 appears 31 times
Source: C:\Users\user\Desktop\D8wwrB9ZCB.exe	Code function: String function: 00007FF69B49D6D0 appears 42 times

Source: D8wwrB9ZCB.exe

Static PE information: Number of sections : 12 > 10

Source: D8wwrB9ZCB.exe, 00000000.00000000.1667099125.00007FF69B58B000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamechrome.exe< vs D8wwrB9ZCB.exe
Source: D8wwrB9ZCB.exe	Binary or memory string: OriginalFilenamechrome.exe< vs D8wwrB9ZCB.exe

Source: D8wwrB9ZCB.exe	Binary string: \Device\DeviceApi
Source: D8wwrB9ZCB.exe	Binary string: \Device\KsecDD
Source: D8wwrB9ZCB.exe	Binary string: PathSystemDriveSystemRootTEMPTMPCHROME_CRASHPAD_PIPE_NAMEprocessIdtaglockdownLeveljobLeveldesiredIntegrityLeveldesiredMitigationsplatformMitigationscomponentFiltersappContainerSidappContainerCapabilitiesappContainerInitialCapabilitieslowboxSidpolicyRulesdisabledenableddisconnectCsrsszeroAppShimhandlesToCloseLockdownLimitedInteractiveRestricted Same AccessRestricted Non AdminLimited UserUnprotectedS-1-16-16384 SystemS-1-16-12288 HighS-1-16-8192 MediumS-1-16-6144 Medium LowS-1-16-4096 LowS-1-16-2048 Below LowS-1-16-0 Untrusted%016llx%016llx%016llx%08lx!(p[%d] == %xp[%d] == %pp[%d] & %x(p[%d], '%ls')exactprefixscanendsaskBrokerdenyalarmfakeSuccessfakeDeniedUnusedPing1Ping2NtOpenFileNtSetInfoRenameGdiDllInitializeGetStockObjectRegisterClassW*\windows_shell_global_counters\Device\DeviceApi\Device\KsecDDALPC Port

Source: classification engine

Classification label: unknown3.winEXE@1/0@0/0

Source: C:\Users\user\Desktop\D8wwrB9ZCB.exe

Code function: 0_2_00007FF69B4BA080 FormatMessageW,LocalFree,GetLastError,

0_2_00007FF69B4BA080

Source: D8wwrB9ZCB.exe	String found in binary or memory: Try '%ls --help' for more information.
Source: D8wwrB9ZCB.exe	String found in binary or memory: Try '%ls --help' for more information.
Source: D8wwrB9ZCB.exe	String found in binary or memory: partition_alloc/address_space
Source: D8wwrB9ZCB.exe	String found in binary or memory: --help display this help and exit
Source: D8wwrB9ZCB.exe	String found in binary or memory: --help display this help and exit
Source: D8wwrB9ZCB.exe	String found in binary or memory: free-invalid-address
Source: D8wwrB9ZCB.exe	String found in binary or memory: ..\..\components\gwp_asan\crash_handler\crash_handler.ccDetected GWP-ASan crash with missing metadata.Detected GWP-ASan crash for allocation at 0x) of type Invalid address passed to free() is Experienced internal error: partitionallocunexpected allocator typeheap-use-after-freeheap-buffer-underflowheap-buffer-overflowdouble-freefree-invalid-addressunexpected error type

Source: D8wwrB9ZCB.exe

Static PE information: certificate valid

Source: D8wwrB9ZCB.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: D8wwrB9ZCB.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: D8wwrB9ZCB.exe

Static file information: File size 2762856 > 1048576

Source: D8wwrB9ZCB.exe

Static PE information: Raw size of .text is bigger than: 0x100000 < 0x1eb600

Source: D8wwrB9ZCB.exe

Static PE information: More than 200 imports for KERNEL32.dll

Source: D8wwrB9ZCB.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: D8wwrB9ZCB.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: D8wwrB9ZCB.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: D8wwrB9ZCB.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: D8wwrB9ZCB.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: D8wwrB9ZCB.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: D8wwrB9ZCB.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source: D8wwrB9ZCB.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:

Binary string: C:\b\s\w\ir\cache\builder\src\out\Release_x64\initialexe\chrome.exe.pdb source: D8wwrB9ZCB.exe

Source: D8wwrB9ZCB.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: D8wwrB9ZCB.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: D8wwrB9ZCB.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: D8wwrB9ZCB.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: D8wwrB9ZCB.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\D8wwrB9ZCB.exe

Code function: 0_2_00007FF69B3D2C80 LoadLibraryW,GetProcAddress,

0_2_00007FF69B3D2C80

Source: D8wwrB9ZCB.exe	Static PE information: section name: .gxfg
Source: D8wwrB9ZCB.exe	Static PE information: section name: .retplne
Source: D8wwrB9ZCB.exe	Static PE information: section name: CPADinfo
Source: D8wwrB9ZCB.exe	Static PE information: section name: _RDATA
Source: D8wwrB9ZCB.exe	Static PE information: section name: malloc_h

Source: C:\Users\user\Desktop\D8wwrB9ZCB.exe

Code function: 0_2_00007FF69B41D9B0 rdtsc

0_2_00007FF69B41D9B0

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\D8wwrB9ZCB.exe	Code function: 0_2_00007FF69B3696F0 GetLastError,FindNextFileW,GetLastError,FindClose,GetFileAttributesW,FindFirstFileExW,		0_2_00007FF69B3696F0
Source: C:\Users\user\Desktop\D8wwrB9ZCB.exe	Code function: 0_2_00007FF69B4E6630 FindFirstFileExW,GetLastError,		0_2_00007FF69B4E6630

Source: C:\Users\user\Desktop\D8wwrB9ZCB.exe

Code function: 0_2_00007FF69B41D9B0 rdtsc

0_2_00007FF69B41D9B0

Source: C:\Users\user\Desktop\D8wwrB9ZCB.exe

Code function: 0_2_00007FF69B487BDC RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00007FF69B487BDC

Source: C:\Users\user\Desktop\D8wwrB9ZCB.exe

Code function: 0_2_00007FF69B3D2C80 LoadLibraryW,GetProcAddress,

0_2_00007FF69B3D2C80

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\D8wwrB9ZCB.exe	Code function: 0_2_00007FF69B487BDC RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		0_2_00007FF69B487BDC
Source: C:\Users\user\Desktop\D8wwrB9ZCB.exe	Code function: 0_2_00007FF69B463828 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		0_2_00007FF69B463828

Source: C:\Users\user\Desktop\D8wwrB9ZCB.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	0_2_00007FF69B48BC78
Source: C:\Users\user\Desktop\D8wwrB9ZCB.exe	Code function: EnumSystemLocalesW,	0_2_00007FF69B486B68
Source: C:\Users\user\Desktop\D8wwrB9ZCB.exe	Code function: EnumSystemLocalesW,	0_2_00007FF69B48B9E8
Source: C:\Users\user\Desktop\D8wwrB9ZCB.exe	Code function: EnumSystemLocalesW,GetUserDefaultLCID,ProcessCodePage,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	0_2_00007FF69B48B3CC
Source: C:\Users\user\Desktop\D8wwrB9ZCB.exe	Code function: GetLocaleInfoW,	0_2_00007FF69B486334
Source: C:\Users\user\Desktop\D8wwrB9ZCB.exe	Code function: EnumSystemLocalesW,	0_2_00007FF69B48B6CC

Source: C:\Users\user\Desktop\D8wwrB9ZCB.exe

Code function: 0_2_00007FF69B463AD4 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00007FF69B463AD4

Source: C:\Users\user\Desktop\D8wwrB9ZCB.exe

Code function: 0_2_00007FF69B47BB64 _get_daylight,_get_daylight,_get_daylight,GetTimeZoneInformation,

0_2_00007FF69B47BB64

Source: C:\Users\user\Desktop\D8wwrB9ZCB.exe

Code function: 0_2_00007FF69B33CC90 GetVersionExW,GetProductInfo,GetNativeSystemInfo,

0_2_00007FF69B33CC90

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	Path Interception	Path Interception	1 Deobfuscate/Decode Files or Information	OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Obfuscated Files or Information	LSASS Memory	2 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	1 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	12 System Information Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
D8wwrB9ZCB.exe	0%	ReversingLabs
D8wwrB9ZCB.exe	0%	Virustotal		Browse

Source	Detection	Scanner	Link
https://crashpad.chromium.org/bug/new	0%	Virustotal	Browse
https://crashpad.chromium.org/	0%	Virustotal	Browse
https://crashpad.chromium.org/https://crashpad.chromium.org/bug/new	0%	Virustotal	Browse

Name	Source	Malicious	Antivirus Detection	Reputation
https://crashpad.chromium.org/	D8wwrB9ZCB.exe	false	0%, Virustotal, Browse	unknown
https://crashpad.chromium.org/https://crashpad.chromium.org/bug/new	D8wwrB9ZCB.exe	false	0%, Virustotal, Browse	unknown
https://crashpad.chromium.org/bug/new	D8wwrB9ZCB.exe	false	0%, Virustotal, Browse	unknown

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1524643
Start date and time:	2024-10-03 02:39:39 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 2m 26s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	1
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	D8wwrB9ZCB.exe (renamed file extension from none to exe, renamed because original name is a hash value)
Original Sample Name:	22b90d638d1da32f8e2f2fdbecf4cad4
Detection:	UNKNOWN
Classification:	unknown3.winEXE@1/0@0/0
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 173
Cookbook Comments:	Unable to launch sample, stop analysis

Errors

Corrupt sample or wrongly selected analyzer. Details: 36b1

Warnings

Execution Graph export aborted for target D8wwrB9ZCB.exe, PID 6336 because there are no executed function
Report size exceeded maximum capacity and may have missing disassembly code.

File type:	PE32+ executable (GUI) x86-64, for MS Windows
Entropy (8bit):	6.54179387553059
TrID:	Win64 Executable GUI (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	D8wwrB9ZCB.exe
File size:	2'762'856 bytes
MD5:	22b90d638d1da32f8e2f2fdbecf4cad4
SHA1:	d333c074053ee90bb2f7a5a2f4923285e8c92952
SHA256:	dc2535caf6f685dbaadc3a18c6fcfabc043d75a1b76245247eab02bf766c9320
SHA512:	ab67dcf791be486592660c325cb024922f0ec4340bf0b4ecc108c19bedf65ee23df69eb589a55a42e797deb9c353b64e3f771f2978d3761d2eae76a91eac913e
SSDEEP:	49152:Cncz/J3r7qXRSr0Zslz6buc4hwCOWzh9sVpzaDSyFvcP:44p7wjUzah4hrNaMR
TLSH:	A8D58C13F29940D9D01AC074C74A8632EAB2BC99473166EF0790BA562F77FE46B3D721
File Content Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...8..f.........."..........>.......:.........@.............................0+.....\|.+...`........................................

File Icon


Icon Hash:	173149cccc490307

Static PE Info

General

Entrypoint:	0x140133ac0
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x140000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
Time Stamp:	0x66F1C538 [Mon Sep 23 19:44:56 2024 UTC]
TLS Callbacks:	0x4002b360, 0x1, 0x40132d30, 0x1, 0x4006bc90, 0x1, 0x40132420, 0x1, 0x4000f220, 0x1, 0x4009ec40, 0x1
CLR (.Net) Version:
OS Version Major:	10
OS Version Minor:	0
File Version Major:	10
File Version Minor:	0
Subsystem Version Major:	10
Subsystem Version Minor:	0
Import Hash:	8aa69bfb46216fa413519fb53924b2f9

Authenticode Signature

Signature Valid:	true
Signature Issuer:	CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1, O="DigiCert, Inc.", C=US
Signature Validation Error:	The operation completed successfully
Error Number:	0
Not Before, Not After	08/04/2024 01:00:00 11/04/2027 00:59:59
Subject Chain	CN=Google LLC, O=Google LLC, L=Mountain View, S=California, C=US, SERIALNUMBER=3582691, OID.2.5.4.15=Private Organization, OID.1.3.6.1.4.1.311.60.2.1.2=Delaware, OID.1.3.6.1.4.1.311.60.2.1.3=US
Version:	3
Thumbprint MD5:	F87B1BFA8FFB860CE59A8D63EC60262F
Thumbprint SHA-1:	607A3EDAA64933E94422FC8F0C80388E0590986C
Thumbprint SHA-256:	2029505D14BAF18AF60A0D1A7D8B56447DB643B32FAA849D4C08D2AB1FF3A4FD
Serial:	0B50CF246B263EFD85A729315158F3FF

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
call 00007FE2D1544100h
dec eax
add esp, 28h
jmp 00007FE2D1543F6Fh
int3
int3
dec eax
mov dword ptr [esp+18h], ebx
push ebp
dec eax
mov ebp, esp
dec eax
sub esp, 30h
dec eax
mov eax, dword ptr [000F7558h]
dec eax
mov ebx, 2DDFA232h
cdq
sub eax, dword ptr [eax]
add byte ptr [eax+3Bh], cl
ret
jne 00007FE2D1544166h
dec eax
and dword ptr [ebp+10h], 00000000h
dec eax
lea ecx, dword ptr [ebp+10h]
call dword ptr [000EC112h]
dec eax
mov eax, dword ptr [ebp+10h]
dec eax
mov dword ptr [ebp-10h], eax
call dword ptr [000EBFCCh]
mov eax, eax
dec eax
xor dword ptr [ebp-10h], eax
call dword ptr [000EBFA8h]
mov eax, eax
dec eax
lea ecx, dword ptr [ebp+18h]
dec eax
xor dword ptr [ebp-10h], eax
call dword ptr [000EC260h]
mov eax, dword ptr [ebp+18h]
dec eax
lea ecx, dword ptr [ebp-10h]
dec eax
shl eax, 20h
dec eax
xor eax, dword ptr [ebp+18h]
dec eax
xor eax, dword ptr [ebp-10h]
dec eax
xor eax, ecx
dec eax
mov ecx, FFFFFFFFh

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x21f0b2	0x87	.rdata
IMAGE_DIRECTORY_ENTRY_IMPORT	0x21f13c	0x64	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x25b000	0x54380	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x245000	0xd074	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x2a0000	0x2868	.rsrc
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x2b0000	0x227c	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x21c84c	0x38	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x21c720	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x1ee170	0x140	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x21f8f8	0x758	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x21e1e8	0x180	.rdata
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x1eb483	0x1eb600	bf0a8cfe101f495e6987c6f3dbb8d6a6	False	0.5041745500508776	data	6.515397733979095	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x1ed000	0x3df44	0x3e000	f57746f13828c8e589fb8aec8479a0d1	False	0.3776658581149194	zlib compressed data	5.521726575885276	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x22b000	0x197f8	0xee00	02c971657914d56b684b9f4a05fbc754	False	0.033006171218487396	data	1.3725516447749866	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x245000	0xd074	0xd200	f4727fd54c29dfe1a34a305be5c6fd19	False	0.5143043154761905	data	5.975634034334762	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.gxfg	0x253000	0x2db0	0x2e00	412a5ca059e212119521cad66552b7a7	False	0.4136379076086957	data	5.228438981291628	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.retplne	0x256000	0xa8	0x200	022887b1467ba7c3bd7ed7d98b0a888a	False	0.12890625	data	1.320312118710215
.tls	0x257000	0x231	0x400	0c9fb149289c2757d5c8b5e55c04c0da	False	0.0400390625	data	0.21252292292517	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
CPADinfo	0x258000	0x38	0x200	60d3ea61d541c9be2e845d2787fb9574	False	0.04296875	data	0.12227588125913882	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
_RDATA	0x259000	0x1f4	0x200	5e296af163f25fb2ced59330ec8c3dee	False	0.509765625	data	4.192162511063951	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
malloc_h	0x25a000	0x5ad	0x600	3f4b91644b5db14eb94bb1a3711e8ed7	False	0.6490885416666666	data	6.098643154959229	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x25b000	0x54380	0x54400	f33a5f068f1aff1da46bb37472a46cff	False	0.49783533475519287	data	6.218553769665869	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x2b0000	0x227c	0x2400	eae742c0777c5a4d37a1ea3e631b17ad	False	0.3129340277777778	GLS_BINARY_LSB_FIRST	5.391946429447065	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
GOOGLEUPDATEAPPLICATIONCOMMANDS	0x2a0b80	0x4	data	English	United States	3.0
RT_CURSOR	0x2a0fd8	0x134	data			0.4837662337662338
RT_CURSOR	0x2a1128	0x134	data			0.22402597402597402
RT_CURSOR	0x2a1278	0x134	Targa image data - RLE 64 x 65536 x 1 +32 "\001"			0.2077922077922078
RT_CURSOR	0x2a13c8	0x134	data			0.461038961038961
RT_CURSOR	0x2a1518	0x134	data			0.39935064935064934
RT_CURSOR	0x2a1650	0xcac	data			0.08446362515413071
RT_CURSOR	0x2a2328	0x134	data			0.32142857142857145
RT_CURSOR	0x2a2460	0xcac	data			0.06103575832305795
RT_CURSOR	0x2a3138	0x10ac	Targa image data 64 x 65536 x 1 +32 " "			0.03280224929709466
RT_CURSOR	0x2a4200	0x10ac	Targa image data 64 x 65536 x 1 +32 " "			0.07966260543580131
RT_CURSOR	0x2a52c8	0x10ac	Targa image data 64 x 65536 x 1 +32 " "			0.07872539831302718
RT_CURSOR	0x2a6390	0x10ac	Targa image data 64 x 65536 x 1 +32 " "			0.07591377694470477
RT_CURSOR	0x2a7458	0x10ac	Targa image data 64 x 65536 x 1 +32 " "			0.03420805998125586
RT_CURSOR	0x2a8520	0x10ac	Targa image data 64 x 65536 x 1 +32 " "			0.03655107778819119
RT_CURSOR	0x2a95e8	0x10ac	Targa image data 64 x 65536 x 1 +32 " "			0.03795688847235239
RT_CURSOR	0x2aa6b0	0x10ac	Targa image data 64 x 65536 x 1 +32 " "			0.03303655107778819
RT_CURSOR	0x2ab778	0x10ac	Targa image data 64 x 65536 x 1 +32 " "			0.036785379568884724
RT_CURSOR	0x2ac840	0x10ac	Targa image data 64 x 65536 x 1 +32 " "			0.03608247422680412
RT_CURSOR	0x2ad908	0x10ac	Targa image data 64 x 65536 x 1 +32 " "			0.042877225866916585
RT_CURSOR	0x2ae9d0	0x134	Targa image data - RGB - RLE 64 x 65536 x 1 +32 "\001"			0.23376623376623376
RT_CURSOR	0x2aeb20	0x134	Targa image data - Mono 64 x 65536 x 1 +32 "\001"			0.1590909090909091
RT_CURSOR	0x2aec70	0x134	data			0.3181818181818182
RT_CURSOR	0x2aedc0	0x134	data			0.30194805194805197
RT_ICON	0x25c610	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	English	United States	0.4913294797687861
RT_ICON	0x25cb78	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	English	United States	0.46435018050541516
RT_ICON	0x25d420	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	English	United States	0.39072494669509594
RT_ICON	0x25e2c8	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	English	United States	0.6214539007092199
RT_ICON	0x25e730	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	English	United States	0.4298780487804878
RT_ICON	0x25f7d8	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	English	United States	0.32863070539419087
RT_ICON	0x261d80	0x7cfc	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States	0.9984998124765596
RT_ICON	0x269ae8	0x38	Device independent bitmap graphic, 1 x 2 x 1, image size 0	English	United States	0.4107142857142857
RT_ICON	0x269b38	0x38	Device independent bitmap graphic, 1 x 2 x 1, image size 0	English	United States	0.4107142857142857
RT_ICON	0x269b88	0x38	Device independent bitmap graphic, 1 x 2 x 1, image size 0	English	United States	0.4107142857142857
RT_ICON	0x269bd8	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	English	United States	0.4429190751445087
RT_ICON	0x26a140	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	English	United States	0.411101083032491
RT_ICON	0x26a9e8	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	English	United States	0.35047974413646055
RT_ICON	0x26b890	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	English	United States	0.6046099290780141
RT_ICON	0x26bcf8	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	English	United States	0.40196998123827393
RT_ICON	0x26cda0	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	English	United States	0.31483402489626555
RT_ICON	0x26f348	0x7c98	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States	0.9978994231251568
RT_ICON	0x277048	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	English	United States	0.2332089552238806
RT_ICON	0x277ef0	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	English	United States	0.3564981949458484
RT_ICON	0x278798	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	English	United States	0.5173410404624278
RT_ICON	0x278d00	0x7fa	PNG image data, 256 x 256, 8-bit colormap, non-interlaced	English	United States	0.8736532810969637
RT_ICON	0x279500	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	English	United States	0.06732365145228215
RT_ICON	0x27baa8	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	English	United States	0.10694183864915573
RT_ICON	0x27cb50	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	English	United States	0.25177304964539005
RT_ICON	0x27d020	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	English	United States	0.2260127931769723
RT_ICON	0x27dec8	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	English	United States	0.3456678700361011
RT_ICON	0x27e770	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	English	United States	0.5079479768786127
RT_ICON	0x27ecd8	0x7c8	PNG image data, 256 x 256, 8-bit colormap, non-interlaced	English	United States	0.8704819277108434
RT_ICON	0x27f4a0	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	English	United States	0.06244813278008299
RT_ICON	0x281a48	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	English	United States	0.09803001876172608
RT_ICON	0x282af0	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	English	United States	0.23049645390070922
RT_ICON	0x282fc0	0x4a8	Device independent bitmap graphic, 17 x 32 x 32, image size 1088, resolution 2835 x 2835 px/m	English	United States	0.28439597315436244
RT_ICON	0x283468	0x1234	Device independent bitmap graphic, 33 x 66 x 32, image size 4356, resolution 2835 x 2835 px/m	English	United States	0.11566523605150214
RT_ICON	0x2846a0	0x2668	Device independent bitmap graphic, 49 x 96 x 32, image size 9408, resolution 2835 x 2835 px/m	English	United States	0.07811228641171684
RT_ICON	0x286d08	0x184b	PNG image data, 257 x 256, 8-bit/color RGBA, non-interlaced	English	United States	0.992603312429651
RT_ICON	0x288598	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	English	United States	0.4552023121387283
RT_ICON	0x288b00	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	English	United States	0.43772563176895307
RT_ICON	0x2893a8	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	English	United States	0.4013859275053305
RT_ICON	0x28a250	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	English	United States	0.5638297872340425
RT_ICON	0x28a6b8	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	English	United States	0.3574108818011257
RT_ICON	0x28b760	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	English	United States	0.300103734439834
RT_ICON	0x28dd08	0x6c1c	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States	0.9986631016042781
RT_ICON	0x294990	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	English	United States	0.4653179190751445
RT_ICON	0x294ef8	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	English	United States	0.4426895306859206
RT_ICON	0x2957a0	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	English	United States	0.4064498933901919
RT_ICON	0x296648	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	English	United States	0.5709219858156028
RT_ICON	0x296ab0	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	English	United States	0.3602251407129456
RT_ICON	0x297b58	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	English	United States	0.30072614107883816
RT_ICON	0x29a100	0x6a18	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States	0.9981958762886598
RT_GROUP_CURSOR	0x2a1110	0x14	Lotus unknown worksheet or configuration, revision 0x1			1.25
RT_GROUP_CURSOR	0x2a1260	0x14	Lotus unknown worksheet or configuration, revision 0x1			1.25
RT_GROUP_CURSOR	0x2a13b0	0x14	Lotus unknown worksheet or configuration, revision 0x1			1.3
RT_GROUP_CURSOR	0x2a1500	0x14	Lotus unknown worksheet or configuration, revision 0x1			1.3
RT_GROUP_CURSOR	0x2a2300	0x22	Lotus unknown worksheet or configuration, revision 0x2			1.0
RT_GROUP_CURSOR	0x2a3110	0x22	Lotus unknown worksheet or configuration, revision 0x2			1.0
RT_GROUP_CURSOR	0x2a41e8	0x14	Lotus unknown worksheet or configuration, revision 0x1			1.2
RT_GROUP_CURSOR	0x2a52b0	0x14	Lotus unknown worksheet or configuration, revision 0x1			1.2
RT_GROUP_CURSOR	0x2a6378	0x14	Lotus unknown worksheet or configuration, revision 0x1			1.2
RT_GROUP_CURSOR	0x2a7440	0x14	Lotus unknown worksheet or configuration, revision 0x1			1.2
RT_GROUP_CURSOR	0x2a8508	0x14	Lotus unknown worksheet or configuration, revision 0x1			1.2
RT_GROUP_CURSOR	0x2a95d0	0x14	Lotus unknown worksheet or configuration, revision 0x1			1.2
RT_GROUP_CURSOR	0x2aa698	0x14	Lotus unknown worksheet or configuration, revision 0x1			1.2
RT_GROUP_CURSOR	0x2ab760	0x14	Lotus unknown worksheet or configuration, revision 0x1			1.2
RT_GROUP_CURSOR	0x2ac828	0x14	Lotus unknown worksheet or configuration, revision 0x1			1.2
RT_GROUP_CURSOR	0x2ad8f0	0x14	Lotus unknown worksheet or configuration, revision 0x1			1.2
RT_GROUP_CURSOR	0x2ae9b8	0x14	Lotus unknown worksheet or configuration, revision 0x1			1.2
RT_GROUP_CURSOR	0x2aeb08	0x14	Lotus unknown worksheet or configuration, revision 0x1			1.3
RT_GROUP_CURSOR	0x2aec58	0x14	Lotus unknown worksheet or configuration, revision 0x1			1.3
RT_GROUP_CURSOR	0x2aeda8	0x14	Lotus unknown worksheet or configuration, revision 0x1			1.3
RT_GROUP_CURSOR	0x2aeef8	0x14	Lotus unknown worksheet or configuration, revision 0x1			1.3
RT_GROUP_ICON	0x269a80	0x68	data	English	United States	0.7019230769230769
RT_GROUP_ICON	0x269b20	0x14	data	English	United States	1.1
RT_GROUP_ICON	0x269b70	0x14	data	English	United States	1.1
RT_GROUP_ICON	0x269bc0	0x14	data	English	United States	1.1
RT_GROUP_ICON	0x276fe0	0x68	data	English	United States	0.6923076923076923
RT_GROUP_ICON	0x27cfb8	0x68	data	English	United States	0.6923076923076923
RT_GROUP_ICON	0x282f58	0x68	data	English	United States	0.6923076923076923
RT_GROUP_ICON	0x288558	0x3e	data	English	United States	0.8709677419354839
RT_GROUP_ICON	0x294928	0x68	data	English	United States	0.7115384615384616
RT_GROUP_ICON	0x2a0b18	0x68	data	English	United States	0.6923076923076923
RT_VERSION	0x2a0b88	0x450	data	English	United States	0.44021739130434784
RT_MANIFEST	0x2aef10	0x46c	XML 1.0 document, ASCII text, with very long lines (1018)	English	United States	0.48674911660777387

Imports

DLL	Import
chrome_elf.dll	GetInstallDetailsPayload, IsBrowserProcess, IsExtensionPointDisableSet, SignalChromeElf, SignalInitializeCrashReporting
KERNEL32.dll	AcquireSRWLockExclusive, AddVectoredExceptionHandler, CloseHandle, CompareStringW, ConnectNamedPipe, CreateDirectoryW, CreateEventW, CreateFileMappingW, CreateFileW, CreateIoCompletionPort, CreateJobObjectW, CreateMutexW, CreateNamedPipeW, CreateProcessW, CreateRemoteThread, CreateSemaphoreW, CreateThread, DebugBreak, DeleteCriticalSection, DeleteFileW, DeleteProcThreadAttributeList, DisconnectNamedPipe, DuplicateHandle, EncodePointer, EnterCriticalSection, EnumSystemLocalesEx, EnumSystemLocalesW, ExitProcess, ExpandEnvironmentStringsW, FileTimeToSystemTime, FindClose, FindFirstFileExW, FindNextFileW, FlsAlloc, FlsFree, FlsGetValue, FlsSetValue, FlushFileBuffers, FlushViewOfFile, FormatMessageA, FormatMessageW, FreeEnvironmentStringsW, FreeLibrary, GetACP, GetCPInfo, GetCommandLineA, GetCommandLineW, GetComputerNameExW, GetConsoleMode, GetConsoleOutputCP, GetCurrentDirectoryW, GetCurrentProcess, GetCurrentProcessId, GetCurrentProcessorNumber, GetCurrentThread, GetCurrentThreadId, GetDateFormatW, GetDriveTypeW, GetEnvironmentStringsW, GetEnvironmentVariableW, GetExitCodeProcess, GetFileAttributesW, GetFileInformationByHandle, GetFileInformationByHandleEx, GetFileSizeEx, GetFileTime, GetFileType, GetFullPathNameW, GetLastError, GetLocalTime, GetLocaleInfoW, GetLogicalProcessorInformation, GetLongPathNameW, GetModuleFileNameW, GetModuleHandleA, GetModuleHandleExW, GetModuleHandleW, GetNativeSystemInfo, GetOEMCP, GetProcAddress, GetProcessHandleCount, GetProcessHeap, GetProcessHeaps, GetProcessId, GetProcessMitigationPolicy, GetProcessTimes, GetProductInfo, GetQueuedCompletionStatus, GetStartupInfoW, GetStdHandle, GetStringTypeW, GetSystemDefaultLCID, GetSystemDirectoryW, GetSystemInfo, GetSystemTimeAsFileTime, GetTempPathW, GetThreadContext, GetThreadId, GetThreadLocale, GetThreadPriority, GetTickCount, GetTimeFormatW, GetTimeZoneInformation, GetUserDefaultLCID, GetUserDefaultLangID, GetUserDefaultLocaleName, GetVersionExW, GetWindowsDirectoryW, HeapDestroy, HeapSetInformation, InitOnceExecuteOnce, InitializeConditionVariable, InitializeCriticalSection, InitializeCriticalSectionAndSpinCount, InitializeProcThreadAttributeList, InitializeSListHead, IsDebuggerPresent, IsProcessorFeaturePresent, IsValidCodePage, IsValidLocale, IsWow64Process, K32GetModuleInformation, K32GetPerformanceInfo, K32GetProcessMemoryInfo, K32QueryWorkingSetEx, LCMapStringW, LeaveCriticalSection, LoadLibraryExA, LoadLibraryExW, LoadLibraryW, LocalFree, LockFileEx, MapViewOfFile, MoveFileW, MultiByteToWideChar, OpenProcess, OutputDebugStringA, PeekNamedPipe, PostQueuedCompletionStatus, PrefetchVirtualMemory, QueryInformationJobObject, QueryPerformanceCounter, QueryPerformanceFrequency, QueryThreadCycleTime, RaiseException, ReadConsoleW, ReadFile, ReadProcessMemory, RegisterWaitForSingleObject, ReleaseMutex, ReleaseSRWLockExclusive, ReleaseSemaphore, RemoveDirectoryW, RemoveVectoredExceptionHandler, ReplaceFileW, ResetEvent, ResumeThread, RtlCaptureContext, RtlCaptureStackBackTrace, RtlLookupFunctionEntry, RtlPcToFileHeader, RtlUnwind, RtlUnwindEx, RtlVirtualUnwind, SetConsoleCtrlHandler, SetCurrentDirectoryW, SetDefaultDllDirectories, SetEndOfFile, SetEnvironmentVariableW, SetEvent, SetFileAttributesW, SetFilePointerEx, SetHandleInformation, SetInformationJobObject, SetLastError, SetNamedPipeHandleState, SetProcessMitigationPolicy, SetProcessShutdownParameters, SetStdHandle, SetThreadAffinityMask, SetThreadInformation, SetThreadPriority, SetUnhandledExceptionFilter, Sleep, SleepConditionVariableSRW, SleepEx, SuspendThread, SwitchToThread, SystemTimeToTzSpecificLocalTime, TerminateJobObject, TerminateProcess, TlsAlloc, TlsFree, TlsGetValue, TlsSetValue, TransactNamedPipe, TryAcquireSRWLockExclusive, UnhandledExceptionFilter, UnlockFileEx, UnmapViewOfFile, UnregisterWaitEx, UpdateProcThreadAttribute, VerSetConditionMask, VerifyVersionInfoW, VirtualAlloc, VirtualAllocEx, VirtualFree, VirtualFreeEx, VirtualProtect, VirtualProtectEx, VirtualQuery, VirtualQueryEx, WaitForMultipleObjects, WaitForSingleObject, WaitNamedPipeW, WakeAllConditionVariable, WakeConditionVariable, WideCharToMultiByte, Wow64GetThreadContext, WriteConsoleW, WriteFile, WriteProcessMemory
VERSION.dll	GetFileVersionInfoSizeW, GetFileVersionInfoW, VerQueryValueW
ntdll.dll	RtlInitUnicodeString

Exports

Name	Ordinal	Address
GetHandleVerifier	1	0x1400691b0
GetPakFileHashes	2	0x140092e10
IsSandboxedProcess	3	0x140094540

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Target ID:	0
Start time:	20:40:30
Start date:	02/10/2024
Path:	C:\Users\user\Desktop\D8wwrB9ZCB.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\D8wwrB9ZCB.exe"
Imagebase:	0x7ff69b330000
File size:	2'762'856 bytes
MD5 hash:	22B90D638D1DA32F8E2F2FDBECF4CAD4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Function 00007FF69B40E520 Relevance: 135.5, APIs: 72, Strings: 4, Instructions: 2539COMMON

Download Yara Rule

APIs

ResetEvent.KERNEL32 ref: 00007FF69B40E591
TryAcquireSRWLockExclusive.KERNEL32 ref: 00007FF69B40E62C
ReleaseSRWLockExclusive.KERNEL32 ref: 00007FF69B40EA7D
TryAcquireSRWLockExclusive.KERNEL32 ref: 00007FF69B40EA9F
TryAcquireSRWLockExclusive.KERNEL32 ref: 00007FF69B40EAF2
ReleaseSRWLockExclusive.KERNEL32 ref: 00007FF69B40EB07
ReleaseSRWLockExclusive.KERNEL32 ref: 00007FF69B40ED2F
ReleaseSRWLockExclusive.KERNEL32 ref: 00007FF69B40EE36
TryAcquireSRWLockExclusive.KERNEL32 ref: 00007FF69B40F632
AcquireSRWLockExclusive.KERNEL32 ref: 00007FF69B40FB99
TryAcquireSRWLockExclusive.KERNEL32 ref: 00007FF69B40FC3E
WakeAllConditionVariable.KERNEL32 ref: 00007FF69B40FC4D
TryAcquireSRWLockExclusive.KERNEL32 ref: 00007FF69B40FC62
ReleaseSRWLockExclusive.KERNEL32 ref: 00007FF69B40FC97
AcquireSRWLockExclusive.KERNEL32 ref: 00007FF69B410403

Strings

..\..\base\task\thread_pool\thread_group.cc, xrefs: 00007FF69B4101AF
WorkerThreadWaitableEvent::WakeUp, xrefs: 00007FF69B410714
ScheduleAdjustMaxTasks, xrefs: 00007FF69B4101A8
WaitableEvent::Signal, xrefs: 00007FF69B410803

Memory Dump Source

Source File: 00000000.00000002.1667242761.00007FF69B331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69B330000, based on PE: true

Associated: 00000000.00000002.1667200836.00007FF69B330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667462352.00007FF69B51D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B55B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B569000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667608048.00007FF69B575000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667624939.00007FF69B589000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667639365.00007FF69B58A000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667689383.00007FF69B58B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69b330000_D8wwrB9ZCB.jbxd

Similarity

API ID: ExclusiveLock$Acquire$Release$ConditionEventResetVariableWake
String ID: ..\..\base\task\thread_pool\thread_group.cc$ScheduleAdjustMaxTasks$WaitableEvent::Signal$WorkerThreadWaitableEvent::WakeUp
API String ID: 3245000560-14249074
Opcode ID: 29f90d176356a013c6cc727a5fb816078f1226153adb54eb9fa55965102a4b2d
Instruction ID: a0ae7b884c146a32d489617c368dcbc34c22da103546ad548e5b844e666b13d5
Opcode Fuzzy Hash: 29f90d176356a013c6cc727a5fb816078f1226153adb54eb9fa55965102a4b2d
Instruction Fuzzy Hash: 41337C22A0DA8A82EB748B15D4443B96361FBA8F90F444172DA5D877F9DF3CE656E300

Function 00007FF69B46F980 Relevance: 52.6, APIs: 25, Strings: 4, Instructions: 1888COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF69B46FCB7
_invalid_parameter_noinfo.LIBCMT ref: 00007FF69B46FF1A
_invalid_parameter_noinfo.LIBCMT ref: 00007FF69B4701DD
_invalid_parameter_noinfo.LIBCMT ref: 00007FF69B47047D
memcpy_s.LIBCPMT ref: 00007FF69B47068A
memcpy_s.LIBCPMT ref: 00007FF69B470726
memcpy_s.LIBCPMT ref: 00007FF69B470BDE
memcpy_s.LIBCPMT ref: 00007FF69B470C19
memcpy_s.LIBCPMT ref: 00007FF69B470D45
memcpy_s.LIBCPMT ref: 00007FF69B470E6C
memcpy_s.LIBCPMT ref: 00007FF69B470F17
memcpy_s.LIBCPMT ref: 00007FF69B470F5F
memcpy_s.LIBCPMT ref: 00007FF69B470F89
memcpy_s.LIBCPMT ref: 00007FF69B47103A
memcpy_s.LIBCPMT ref: 00007FF69B47123A
memcpy_s.LIBCPMT ref: 00007FF69B47127F
memcpy_s.LIBCPMT ref: 00007FF69B471336
memcpy_s.LIBCPMT ref: 00007FF69B471463
memcpy_s.LIBCPMT ref: 00007FF69B470B2E

Part of subcall function 00007FF69B46EE3C: _invalid_parameter_noinfo.LIBCMT ref: 00007FF69B46EE6E

memcpy_s.LIBCPMT ref: 00007FF69B470BA9
memcpy_s.LIBCPMT ref: 00007FF69B47161D

Strings

, xrefs: 00007FF69B471510
%llu, xrefs: 00007FF69B46F986
MZx, xrefs: 00007FF69B46F9B3, 00007FF69B46FF29, 00007FF69B46FFE6, 00007FF69B47048C, 00007FF69B470792, 00007FF69B4707C9, 00007FF69B470B6F, 00007FF69B470C28, 00007FF69B470D56, 00007FF69B470DC6, 00007FF69B470DFD, 00007FF69B4711F6
, xrefs: 00007FF69B4713E3

Memory Dump Source

Source File: 00000000.00000002.1667242761.00007FF69B331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69B330000, based on PE: true

Associated: 00000000.00000002.1667200836.00007FF69B330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667462352.00007FF69B51D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B55B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B569000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667608048.00007FF69B575000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667624939.00007FF69B589000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667639365.00007FF69B58A000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667689383.00007FF69B58B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69b330000_D8wwrB9ZCB.jbxd

Similarity

API ID: memcpy_s$_invalid_parameter_noinfo
String ID: $ $%llu$MZx
API String ID: 2880407647-1073590698
Opcode ID: 637248e052e8ef2e6d9ba4b7f6ae51877e6bebd509ea9d65f71a73d935e6b33e
Instruction ID: d84ada7dae0eeaddd0500cd264c2f514a7ba81d15a860d2395946f62cadb0796
Opcode Fuzzy Hash: 637248e052e8ef2e6d9ba4b7f6ae51877e6bebd509ea9d65f71a73d935e6b33e
Instruction Fuzzy Hash: DF03C572A152C58BEB758E25D9907FE3791FB48B88F105135DA0A97B68DF78EB00DB00

Function 00007FF69B456510 Relevance: 42.7, APIs: 17, Strings: 7, Instructions: 687fileCOMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32 ref: 00007FF69B4566B4
TryAcquireSRWLockExclusive.KERNEL32 ref: 00007FF69B45670B
ReleaseSRWLockExclusive.KERNEL32 ref: 00007FF69B45675F
ReadFile.KERNEL32 ref: 00007FF69B4567F7
GetLastError.KERNEL32 ref: 00007FF69B45683A
SetLastError.KERNEL32 ref: 00007FF69B456844
TryAcquireSRWLockExclusive.KERNEL32 ref: 00007FF69B456872
ReleaseSRWLockExclusive.KERNEL32 ref: 00007FF69B4568D5
SetLastError.KERNEL32 ref: 00007FF69B4568DD
QueryPerformanceCounter.KERNEL32 ref: 00007FF69B456A27
AcquireSRWLockExclusive.KERNEL32 ref: 00007FF69B456B73

Strings

..\..\base\threading\scoped_blocking_call_internal.cc, xrefs: 00007FF69B456F99
enable-background-thread-pool, xrefs: 00007FF69B456C2F
..\..\base\files\file_win.cc, xrefs: 00007FF69B456593
ScopedBlockingCall, xrefs: 00007FF69B4570DA
<, xrefs: 00007FF69B456D7C
MonitorNextJankWindowIfNecessary, xrefs: 00007FF69B456F92
Read, xrefs: 00007FF69B45658C

Memory Dump Source

Source File: 00000000.00000002.1667242761.00007FF69B331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69B330000, based on PE: true

Associated: 00000000.00000002.1667200836.00007FF69B330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667462352.00007FF69B51D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B55B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B569000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667608048.00007FF69B575000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667624939.00007FF69B589000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667639365.00007FF69B58A000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667689383.00007FF69B58B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69b330000_D8wwrB9ZCB.jbxd

Similarity

API ID: ExclusiveLock$AcquireErrorLast$CounterPerformanceQueryRelease$FileRead
String ID: ..\..\base\files\file_win.cc$..\..\base\threading\scoped_blocking_call_internal.cc$<$MonitorNextJankWindowIfNecessary$Read$ScopedBlockingCall$enable-background-thread-pool
API String ID: 2934378686-2374966579
Opcode ID: 759a9ccdff19a17707d74460bb15fbe90bec29c4e2a4292c9c2c90152c0ac1f9
Instruction ID: f2a3e543c9c3e0a4f36e0c02bc8f0bfaf5a28cdc4f474779c23cfe06cb99b452
Opcode Fuzzy Hash: 759a9ccdff19a17707d74460bb15fbe90bec29c4e2a4292c9c2c90152c0ac1f9
Instruction Fuzzy Hash: 6062BE21A08A8A85EA709F14E4543B933A0FF4CB94F4442B1DA5ECB7B9DFBCE645D704

Function 00007FF69B3FEEB0 Relevance: 40.9, APIs: 16, Strings: 7, Instructions: 678fileCOMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32 ref: 00007FF69B3FF054
TryAcquireSRWLockExclusive.KERNEL32 ref: 00007FF69B3FF0AB
ReleaseSRWLockExclusive.KERNEL32 ref: 00007FF69B3FF0FF
WriteFile.KERNEL32 ref: 00007FF69B3FF19A
GetLastError.KERNEL32 ref: 00007FF69B3FF1D3
SetLastError.KERNEL32 ref: 00007FF69B3FF1DD
TryAcquireSRWLockExclusive.KERNEL32 ref: 00007FF69B3FF20B
ReleaseSRWLockExclusive.KERNEL32 ref: 00007FF69B3FF26E
SetLastError.KERNEL32 ref: 00007FF69B3FF276
QueryPerformanceCounter.KERNEL32 ref: 00007FF69B3FF3C0
AcquireSRWLockExclusive.KERNEL32 ref: 00007FF69B3FF50C

Strings

..\..\base\threading\scoped_blocking_call_internal.cc, xrefs: 00007FF69B3FF91C
enable-background-thread-pool, xrefs: 00007FF69B3FF5C8
..\..\base\files\file_win.cc, xrefs: 00007FF69B3FEF33
ScopedBlockingCall, xrefs: 00007FF69B3FFA55
<, xrefs: 00007FF69B3FF715
MonitorNextJankWindowIfNecessary, xrefs: 00007FF69B3FF915
Write, xrefs: 00007FF69B3FEF2C

Memory Dump Source

Source File: 00000000.00000002.1667242761.00007FF69B331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69B330000, based on PE: true

Associated: 00000000.00000002.1667200836.00007FF69B330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667462352.00007FF69B51D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B55B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B569000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667608048.00007FF69B575000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667624939.00007FF69B589000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667639365.00007FF69B58A000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667689383.00007FF69B58B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69b330000_D8wwrB9ZCB.jbxd

Similarity

API ID: ExclusiveLock$AcquireErrorLast$CounterPerformanceQueryRelease$FileWrite
String ID: ..\..\base\files\file_win.cc$..\..\base\threading\scoped_blocking_call_internal.cc$<$MonitorNextJankWindowIfNecessary$ScopedBlockingCall$Write$enable-background-thread-pool
API String ID: 2186453118-3070973183
Opcode ID: b127987efe53d97d551ec236929ccfd1cdf16dfaf844a2248a748b7a94ff2610
Instruction ID: 0a0d4899bf06278a6a5a8fb33d8f09bc4a69dd37c7a223fb22692c92edc17e52
Opcode Fuzzy Hash: b127987efe53d97d551ec236929ccfd1cdf16dfaf844a2248a748b7a94ff2610
Instruction Fuzzy Hash: 1D62AC22A0AA8A85FA30DF15E4443B93360FF48B94F4042BADE5E872B5DF7CE645D700

Function 00007FF69B3E4410 Relevance: 40.3, APIs: 11, Strings: 11, Instructions: 1765threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThread.KERNEL32 ref: 00007FF69B3E494C
QueryThreadCycleTime.KERNEL32 ref: 00007FF69B3E4960

Strings

%s (errno: %d, %s), xrefs: 00007FF69B3E5E83, 00007FF69B3E5F1B, 00007FF69B3E5F6D, 00007FF69B3E60C9
Static buffer too small (errno: %d, %s), xrefs: 00007FF69B3E5EC9
..\..\third_party\perfetto\src\protozero\static_buffer.cc, xrefs: 00007FF69B3E5EB4
..\..\third_party\perfetto\include\perfetto\tracing\track_event_interned_data_index.h, xrefs: 00007FF69B3E5EFA
PERFETTO_CHECK(perf_counter_now >= perf_counter_initial), xrefs: 00007FF69B3E5F61
`, xrefs: 00007FF69B3E4A06
PERFETTO_CHECK(cur_packet_->is_finalized()), xrefs: 00007FF69B3E5E77
..\..\third_party\perfetto\src\base\time.cc, xrefs: 00007FF69B3E5F4C, 00007FF69B3E60A8
PERFETTO_CHECK(tsc_now >= tsc_initial), xrefs: 00007FF69B3E60BD
PERFETTO_CHECK(false), xrefs: 00007FF69B3E5F0F
..\..\third_party\perfetto\src\tracing\core\trace_writer_impl.cc, xrefs: 00007FF69B3E5E62

Memory Dump Source

Source File: 00000000.00000002.1667242761.00007FF69B331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69B330000, based on PE: true

Associated: 00000000.00000002.1667200836.00007FF69B330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667462352.00007FF69B51D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B55B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B569000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667608048.00007FF69B575000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667624939.00007FF69B589000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667639365.00007FF69B58A000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667689383.00007FF69B58B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69b330000_D8wwrB9ZCB.jbxd

Similarity

API ID: Thread$CurrentCycleQueryTime
String ID: %s (errno: %d, %s)$..\..\third_party\perfetto\include\perfetto\tracing\track_event_interned_data_index.h$..\..\third_party\perfetto\src\base\time.cc$..\..\third_party\perfetto\src\protozero\static_buffer.cc$..\..\third_party\perfetto\src\tracing\core\trace_writer_impl.cc$PERFETTO_CHECK(cur_packet_->is_finalized())$PERFETTO_CHECK(false)$PERFETTO_CHECK(perf_counter_now >= perf_counter_initial)$PERFETTO_CHECK(tsc_now >= tsc_initial)$Static buffer too small (errno: %d, %s)$`
API String ID: 2290024384-790030840
Opcode ID: 851f65b077e445d3a918aeb3a101c41584f528b1484210efb9cf3dfdf93a8f13
Instruction ID: 3135bbf66f044f4d543d1f18fc4320da3d22e3152edf5584017c14d50739c041
Opcode Fuzzy Hash: 851f65b077e445d3a918aeb3a101c41584f528b1484210efb9cf3dfdf93a8f13
Instruction Fuzzy Hash: B3135D32A08B9A86E630CB15E0443BE73A4F748B84F55417ADB8D97BA5CF7CEA55C700

Function 00007FF69B417BD0 Relevance: 39.5, APIs: 21, Strings: 1, Instructions: 1011threadCOMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32 ref: 00007FF69B417D06

Part of subcall function 00007FF69B460CE8: Concurrency::cancel_current_task.LIBCPMT ref: 00007FF69B460D18

GetCurrentThreadId.KERNEL32 ref: 00007FF69B4188B3
GetCurrentThreadId.KERNEL32 ref: 00007FF69B4188E8
GetCurrentThreadId.KERNEL32 ref: 00007FF69B4188F9
GetCurrentThreadId.KERNEL32 ref: 00007FF69B41894F
GetCurrentThreadId.KERNEL32 ref: 00007FF69B418960
GetCurrentThreadId.KERNEL32 ref: 00007FF69B418971
GetCurrentThreadId.KERNEL32 ref: 00007FF69B418983
GetCurrentThreadId.KERNEL32 ref: 00007FF69B418994
GetCurrentThreadId.KERNEL32 ref: 00007FF69B4189A5
GetCurrentThreadId.KERNEL32 ref: 00007FF69B4189B6
GetCurrentThreadId.KERNEL32 ref: 00007FF69B4189C8
GetCurrentThreadId.KERNEL32 ref: 00007FF69B4189DC
GetCurrentThreadId.KERNEL32 ref: 00007FF69B4189F8

Strings

SharedMemoryTracker, xrefs: 00007FF69B418D19

Memory Dump Source

Source File: 00000000.00000002.1667242761.00007FF69B331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69B330000, based on PE: true

Associated: 00000000.00000002.1667200836.00007FF69B330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667462352.00007FF69B51D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B55B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B569000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667608048.00007FF69B575000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667624939.00007FF69B589000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667639365.00007FF69B58A000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667689383.00007FF69B58B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69b330000_D8wwrB9ZCB.jbxd

Similarity

API ID: CurrentThread$Concurrency::cancel_current_taskCounterPerformanceQuery
String ID: SharedMemoryTracker
API String ID: 3489620604-4257729663
Opcode ID: fdef64dda1fcd67317cbd4247bb45c01d8975ad124193c0502ca456a4b514fc2
Instruction ID: 1f746249027d8a906d0b418ce18411e162a249d8fedeb3d52845559026cf56dc
Opcode Fuzzy Hash: fdef64dda1fcd67317cbd4247bb45c01d8975ad124193c0502ca456a4b514fc2
Instruction Fuzzy Hash: DDA2C532E09B8981EA748B15E0443BE73A1FBA8F80F494175DA8D837A9DF3CE561D741

Function 00007FF69B415FD0 Relevance: 37.4, APIs: 16, Strings: 5, Instructions: 627synchronizationCOMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32 ref: 00007FF69B4160B3
WaitForSingleObject.KERNEL32 ref: 00007FF69B41611D
WaitForSingleObject.KERNEL32 ref: 00007FF69B416217
QueryPerformanceCounter.KERNEL32 ref: 00007FF69B416252
QueryPerformanceCounter.KERNEL32 ref: 00007FF69B4162BA
GetLastError.KERNEL32 ref: 00007FF69B4164B4
SetLastError.KERNEL32 ref: 00007FF69B4164BE
TryAcquireSRWLockExclusive.KERNEL32 ref: 00007FF69B4164EC
ReleaseSRWLockExclusive.KERNEL32 ref: 00007FF69B41654F
SetLastError.KERNEL32 ref: 00007FF69B416557
QueryPerformanceCounter.KERNEL32 ref: 00007FF69B4165FD
WaitForSingleObject.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,000F4240,00000000,?,7FFFFFFFFFFFFFFF), ref: 00007FF69B41671C

Strings

..\..\base\synchronization\waitable_event.cc, xrefs: 00007FF69B41632D
enable-background-thread-pool, xrefs: 00007FF69B416769
WaitableEvent::Wait Complete, xrefs: 00007FF69B416A08
TimedWait, xrefs: 00007FF69B416326
ScopedBlockingCallWithBaseSyncPrimitives, xrefs: 00007FF69B4169D2

Memory Dump Source

Source File: 00000000.00000002.1667242761.00007FF69B331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69B330000, based on PE: true

Associated: 00000000.00000002.1667200836.00007FF69B330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667462352.00007FF69B51D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B55B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B569000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667608048.00007FF69B575000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667624939.00007FF69B589000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667639365.00007FF69B58A000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667689383.00007FF69B58B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69b330000_D8wwrB9ZCB.jbxd

Similarity

API ID: CounterPerformanceQuery$ErrorLastObjectSingleWait$ExclusiveLock$AcquireRelease
String ID: ..\..\base\synchronization\waitable_event.cc$ScopedBlockingCallWithBaseSyncPrimitives$TimedWait$WaitableEvent::Wait Complete$enable-background-thread-pool
API String ID: 1657068186-807259769
Opcode ID: d7982352c2888bc54c9be5efa8b0b9f1fc32c6e12ef5bea9a2bd1223c5f385ae
Instruction ID: 3a588b08b354a88a7d96adb6808a9bb1ed5316e4c047c99710efb3dd986f86b8
Opcode Fuzzy Hash: d7982352c2888bc54c9be5efa8b0b9f1fc32c6e12ef5bea9a2bd1223c5f385ae
Instruction Fuzzy Hash: F652D121E0868A81EA70CF15E45037973A1FB98F94F0841B2DA5E9B7B9CF7CE656D300

Function 00007FF69B409F70 Relevance: 37.2, APIs: 24, Instructions: 1216COMMON

Download Yara Rule

APIs

TryAcquireSRWLockExclusive.KERNEL32 ref: 00007FF69B40A057
ReleaseSRWLockExclusive.KERNEL32 ref: 00007FF69B40A3F8
TryAcquireSRWLockExclusive.KERNEL32 ref: 00007FF69B40AAB1
ReleaseSRWLockExclusive.KERNEL32 ref: 00007FF69B40AB00
TryAcquireSRWLockExclusive.KERNEL32 ref: 00007FF69B40ABCD
ReleaseSRWLockExclusive.KERNEL32 ref: 00007FF69B40AC5D
WakeConditionVariable.KERNEL32 ref: 00007FF69B40ACD5
TryAcquireSRWLockExclusive.KERNEL32 ref: 00007FF69B40AD4C
WakeAllConditionVariable.KERNEL32 ref: 00007FF69B40AD5E
ReleaseSRWLockExclusive.KERNEL32 ref: 00007FF69B40AD67
TryAcquireSRWLockExclusive.KERNEL32 ref: 00007FF69B40AD70
ReleaseSRWLockExclusive.KERNEL32 ref: 00007FF69B40AD9E
AcquireSRWLockExclusive.KERNEL32 ref: 00007FF69B40ADDB
AcquireSRWLockExclusive.KERNEL32 ref: 00007FF69B40B46A
AcquireSRWLockExclusive.KERNEL32 ref: 00007FF69B40B533
AcquireSRWLockExclusive.KERNEL32 ref: 00007FF69B40B5E2

Memory Dump Source

Source File: 00000000.00000002.1667242761.00007FF69B331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69B330000, based on PE: true

Associated: 00000000.00000002.1667200836.00007FF69B330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667462352.00007FF69B51D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B55B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B569000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667608048.00007FF69B575000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667624939.00007FF69B589000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667639365.00007FF69B58A000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667689383.00007FF69B58B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69b330000_D8wwrB9ZCB.jbxd

Similarity

API ID: ExclusiveLock$Acquire$Release$ConditionVariableWake
String ID:
API String ID: 2824607059-0
Opcode ID: dd5e8f79a27922849041e621b054ae2cc7dcb88b918dd968b8917070272f8a33
Instruction ID: 57723b50ad4c089259fb3947561432dc91f6b48989b155f886482cea45cf3b7d
Opcode Fuzzy Hash: dd5e8f79a27922849041e621b054ae2cc7dcb88b918dd968b8917070272f8a33
Instruction Fuzzy Hash: AAD27F32A08AC985EB758B19D4443B973A1FFA8B84F044171DA8D877B9DF3DE686D700

Function 00007FF69B40BA60 Relevance: 35.9, APIs: 23, Instructions: 1377COMMON

Download Yara Rule

APIs

ReleaseSRWLockExclusive.KERNEL32 ref: 00007FF69B40BE50
TryAcquireSRWLockExclusive.KERNEL32 ref: 00007FF69B40BE69
TryAcquireSRWLockExclusive.KERNEL32 ref: 00007FF69B40BEBC
ReleaseSRWLockExclusive.KERNEL32 ref: 00007FF69B40BED1
TryAcquireSRWLockExclusive.KERNEL32 ref: 00007FF69B40C377
QueryPerformanceCounter.KERNEL32 ref: 00007FF69B40C3B0
ReleaseSRWLockExclusive.KERNEL32 ref: 00007FF69B40C3E8
WakeAllConditionVariable.KERNEL32 ref: 00007FF69B40C3F7

Memory Dump Source

Source File: 00000000.00000002.1667242761.00007FF69B331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69B330000, based on PE: true

Associated: 00000000.00000002.1667200836.00007FF69B330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667462352.00007FF69B51D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B55B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B569000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667608048.00007FF69B575000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667624939.00007FF69B589000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667639365.00007FF69B58A000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667689383.00007FF69B58B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69b330000_D8wwrB9ZCB.jbxd

Similarity

API ID: ExclusiveLock$AcquireRelease$ConditionCounterPerformanceQueryVariableWake
String ID:
API String ID: 1723301642-0
Opcode ID: f9309d8b8df583df926a20bb9fc367e1c28b10484d225bf619be524cb78ebc0d
Instruction ID: 95e6ae362712445315556f33c4d17eea235c01553d23e99b1d8b357151e68287
Opcode Fuzzy Hash: f9309d8b8df583df926a20bb9fc367e1c28b10484d225bf619be524cb78ebc0d
Instruction Fuzzy Hash: 2FD29E32A49A8AC2EB748B15D4403B93361FBA8F94F544172DA5D877B9DF3CE685E300

Function 00007FF69B34CCB0 Relevance: 33.5, APIs: 18, Strings: 1, Instructions: 245threadlibraryloaderCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 00007FF69B34CCF8
GetCurrentThread.KERNEL32 ref: 00007FF69B34CCFE
GetCurrentProcess.KERNEL32 ref: 00007FF69B34CD07
DuplicateHandle.KERNEL32 ref: 00007FF69B34CD28
GetCurrentThreadId.KERNEL32 ref: 00007FF69B34CD5D
TryAcquireSRWLockExclusive.KERNEL32 ref: 00007FF69B34CD6D
ReleaseSRWLockExclusive.KERNEL32 ref: 00007FF69B34CDAA
GetLastError.KERNEL32 ref: 00007FF69B34CDC6
SetLastError.KERNEL32 ref: 00007FF69B34CDE1
GetCurrentThreadId.KERNEL32 ref: 00007FF69B34CDF8
GetCurrentThreadId.KERNEL32 ref: 00007FF69B34CE5B
GetCurrentThreadId.KERNEL32 ref: 00007FF69B34CE94
TryAcquireSRWLockExclusive.KERNEL32 ref: 00007FF69B34CEA5
ReleaseSRWLockExclusive.KERNEL32 ref: 00007FF69B34CED3
GetCurrentThread.KERNEL32 ref: 00007FF69B34CED9
GetThreadPriority.KERNEL32 ref: 00007FF69B34CEE2
GetModuleHandleW.KERNEL32 ref: 00007FF69B34CFF3
GetProcAddress.KERNEL32 ref: 00007FF69B34D003

Strings

GetHandleVerifier, xrefs: 00007FF69B34CFF9

Memory Dump Source

Source File: 00000000.00000002.1667242761.00007FF69B331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69B330000, based on PE: true

Associated: 00000000.00000002.1667200836.00007FF69B330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667462352.00007FF69B51D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B55B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B569000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667608048.00007FF69B575000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667624939.00007FF69B589000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667639365.00007FF69B58A000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667689383.00007FF69B58B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69b330000_D8wwrB9ZCB.jbxd

Similarity

API ID: Current$Thread$ExclusiveLock$AcquireErrorHandleLastProcessRelease$AddressDuplicateModulePriorityProc
String ID: GetHandleVerifier
API String ID: 191159397-1090674830
Opcode ID: e490e7cd46ecf3e9b7a0f94eac6469ad72c6843e5d88b713c3644140aa5023bd
Instruction ID: 9490522035338daae3331a5fd5c2b3cd414d953a0b60a9e82887800f6ad9dc3e
Opcode Fuzzy Hash: e490e7cd46ecf3e9b7a0f94eac6469ad72c6843e5d88b713c3644140aa5023bd
Instruction Fuzzy Hash: 5BC10721E08A4A81EA70EF25A8542793362FF4DB91F4045BAD91EC36F6DF7DBA55C300

Function 00007FF69B3D0420 Relevance: 32.2, APIs: 15, Strings: 3, Instructions: 656synchronizationCOMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32 ref: 00007FF69B3D06CE
WaitForSingleObject.KERNEL32 ref: 00007FF69B3D072F
WaitForSingleObject.KERNEL32 ref: 00007FF69B3D0874
QueryPerformanceCounter.KERNEL32 ref: 00007FF69B3D08AD
QueryPerformanceCounter.KERNEL32 ref: 00007FF69B3D0915
GetLastError.KERNEL32 ref: 00007FF69B3D09A3
SetLastError.KERNEL32 ref: 00007FF69B3D09AD
TryAcquireSRWLockExclusive.KERNEL32 ref: 00007FF69B3D09DB
ReleaseSRWLockExclusive.KERNEL32 ref: 00007FF69B3D0A3E
SetLastError.KERNEL32 ref: 00007FF69B3D0A46
QueryPerformanceCounter.KERNEL32 ref: 00007FF69B3D0AEC
WaitForSingleObject.KERNEL32 ref: 00007FF69B3D0BDB

Strings

..\..\base\synchronization\waitable_event.cc, xrefs: 00007FF69B3D07C3
WaitableEvent::Wait Complete, xrefs: 00007FF69B3D0E30
TimedWait, xrefs: 00007FF69B3D07BC

Memory Dump Source

Source File: 00000000.00000002.1667242761.00007FF69B331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69B330000, based on PE: true

Associated: 00000000.00000002.1667200836.00007FF69B330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667462352.00007FF69B51D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B55B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B569000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667608048.00007FF69B575000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667624939.00007FF69B589000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667639365.00007FF69B58A000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667689383.00007FF69B58B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69b330000_D8wwrB9ZCB.jbxd

Similarity

API ID: CounterPerformanceQuery$ErrorLastObjectSingleWait$ExclusiveLock$AcquireRelease
String ID: ..\..\base\synchronization\waitable_event.cc$TimedWait$WaitableEvent::Wait Complete
API String ID: 1657068186-2192364210
Opcode ID: 47f5811ef3de54384e7c2e83d0f3c5424f1fabb8fc64ba0eb99e4319d53c114b
Instruction ID: 39bda2fd48ec5d9b6035b1953f922222cd325bdf1ef37e0fbe282e8bafc70cb6
Opcode Fuzzy Hash: 47f5811ef3de54384e7c2e83d0f3c5424f1fabb8fc64ba0eb99e4319d53c114b
Instruction Fuzzy Hash: CD52D422A0868E91EA34CB25F5603796391FB88F94F4442BADA5E877F5DF7CE245C700

Function 00007FF69B34E460 Relevance: 32.1, APIs: 11, Strings: 7, Instructions: 586COMMON

Download Yara Rule

APIs

GetInstallDetailsPayload.CHROME_ELF ref: 00007FF69B34E49A
SignalInitializeCrashReporting.CHROME_ELF ref: 00007FF69B34E4C2
IsBrowserProcess.CHROME_ELF ref: 00007FF69B34E4C7
QueryPerformanceCounter.KERNEL32 ref: 00007FF69B34E5A8
SignalChromeElf.CHROME_ELF ref: 00007FF69B34E5DC
GetModuleFileNameW.KERNEL32 ref: 00007FF69B34E786

Strings

user-data-dir, xrefs: 00007FF69B34E9A0
type, xrefs: 00007FF69B34E533, 00007FF69B34E9C9
initial-client-data, xrefs: 00007FF69B34E887
About to load main DLL., xrefs: 00007FF69B34EC57
no-periodic-tasks, xrefs: 00007FF69B34E83E
..\..\chrome\app\chrome_exe_main_win.cc, xrefs: 00007FF69B34EBCC, 00007FF69B34EC2C
RelaunchChromeBrowserWithNewCommandLineIfNeeded, xrefs: 00007FF69B34E70F

Memory Dump Source

Source File: 00000000.00000002.1667242761.00007FF69B331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69B330000, based on PE: true

Associated: 00000000.00000002.1667200836.00007FF69B330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667462352.00007FF69B51D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B55B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B569000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667608048.00007FF69B575000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667624939.00007FF69B589000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667639365.00007FF69B58A000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667689383.00007FF69B58B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69b330000_D8wwrB9ZCB.jbxd

Similarity

API ID: Signal$BrowserChromeCounterCrashDetailsFileInitializeInstallModuleNamePayloadPerformanceProcessQueryReporting
String ID: ..\..\chrome\app\chrome_exe_main_win.cc$About to load main DLL.$RelaunchChromeBrowserWithNewCommandLineIfNeeded$initial-client-data$no-periodic-tasks$type$user-data-dir
API String ID: 4021976523-3105116269
Opcode ID: f35d8bb8c1539501be0e0969e0a4cb19f425caeae6d8cbe0022e2ad722b08610
Instruction ID: f123901545eed320938432665735b4e0742ecfbbd6e54ab4ab2c02316dad0987
Opcode Fuzzy Hash: f35d8bb8c1539501be0e0969e0a4cb19f425caeae6d8cbe0022e2ad722b08610
Instruction Fuzzy Hash: A3527121B0DB9A81FA39DB11E4503BA6361FF8DB80F4441B9DA8D837A6DF7DE6458700

Function 00007FF69B36AA10 Relevance: 28.6, APIs: 4, Strings: 12, Instructions: 608libraryloaderCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 00007FF69B36ACF7
GetModuleHandleW.KERNEL32 ref: 00007FF69B36AD3D
GetProcAddress.KERNEL32 ref: 00007FF69B36AD4D

Strings

..\..\base\win\windows_version.cc, xrefs: 00007FF69B36B1BB, 00007FF69B36B47E
SOFTWARE\Microsoft\Windows NT\CurrentVersion, xrefs: 00007FF69B36AAC2
ReleaseId, xrefs: 00007FF69B36B01C
WindowsVersion-minor, xrefs: 00007FF69B36B559
DisplayVersion, xrefs: 00007FF69B36AB71
UBR, xrefs: 00007FF69B36AB36
kernel32.dll, xrefs: 00007FF69B36AD36
Unsupported version: , xrefs: 00007FF69B36B1E3
MajorMinorBuildToVersion, xrefs: 00007FF69B36B477
WindowsVersion-build, xrefs: 00007FF69B36B59B
IsWow64Process2, xrefs: 00007FF69B36AD43
WindowsVersion-major, xrefs: 00007FF69B36B517

Memory Dump Source

Source File: 00000000.00000002.1667242761.00007FF69B331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69B330000, based on PE: true

Associated: 00000000.00000002.1667200836.00007FF69B330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667462352.00007FF69B51D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B55B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B569000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667608048.00007FF69B575000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667624939.00007FF69B589000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667639365.00007FF69B58A000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667689383.00007FF69B58B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69b330000_D8wwrB9ZCB.jbxd

Similarity

API ID: AddressCurrentHandleModuleProcProcess
String ID: ..\..\base\win\windows_version.cc$DisplayVersion$IsWow64Process2$MajorMinorBuildToVersion$ReleaseId$SOFTWARE\Microsoft\Windows NT\CurrentVersion$UBR$Unsupported version: $WindowsVersion-build$WindowsVersion-major$WindowsVersion-minor$kernel32.dll
API String ID: 4190356694-1080005728
Opcode ID: 6d4a418a6addf28c38cbb52dddaeeab543ee939a45f52864de8bd11d053d7c15
Instruction ID: 4975b888da03cd1fe51af611cf54230842b7c5d2f1617a82d6287085bf023074
Opcode Fuzzy Hash: 6d4a418a6addf28c38cbb52dddaeeab543ee939a45f52864de8bd11d053d7c15
Instruction Fuzzy Hash: E2525E32A18A8EC6EA35DB15E4523BA73A0FB48744F404179DA8EC67B5EF3DE644C701

Function 00007FF69B389CE0 Relevance: 28.6, APIs: 3, Strings: 13, Instructions: 589fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 00007FF69B389E22
LockFileEx.KERNEL32 ref: 00007FF69B389E66
GetLastError.KERNEL32 ref: 00007FF69B389FDE

Part of subcall function 00007FF69B38A880: SetFilePointerEx.KERNEL32 ref: 00007FF69B38A8B9

Strings

DAPC, xrefs: 00007FF69B38A111
record size out of range, xrefs: 00007FF69B38A17E
reports, xrefs: 00007FF69B389DC2
metadata, xrefs: 00007FF69B389D37
failed to read header, xrefs: 00007FF69B38A102
unexpected header, xrefs: 00007FF69B38A1C7
failed to rewind to read, xrefs: 00007FF69B38A088
failed to read records, xrefs: 00007FF69B38A276
invalid string table index, xrefs: 00007FF69B38A443
..\..\third_party\crashpad\crashpad\client\crash_report_database_win.cc, xrefs: 00007FF69B389FE7, 00007FF69B38A05D, 00007FF69B38A0D7, 00007FF69B38A153, 00007FF69B38A19C, 00007FF69B38A24B, 00007FF69B38A385, 00007FF69B38A418
bad string table, xrefs: 00007FF69B38A3B0
attachments, xrefs: 00007FF69B389D7C
LockFileEx, xrefs: 00007FF69B38A012

Memory Dump Source

Source File: 00000000.00000002.1667242761.00007FF69B331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69B330000, based on PE: true

Associated: 00000000.00000002.1667200836.00007FF69B330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667462352.00007FF69B51D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B55B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B569000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667608048.00007FF69B575000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667624939.00007FF69B589000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667639365.00007FF69B58A000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667689383.00007FF69B58B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69b330000_D8wwrB9ZCB.jbxd

Similarity

API ID: File$CreateErrorLastLockPointer
String ID: ..\..\third_party\crashpad\crashpad\client\crash_report_database_win.cc$DAPC$LockFileEx$attachments$bad string table$failed to read header$failed to read records$failed to rewind to read$invalid string table index$metadata$record size out of range$reports$unexpected header
API String ID: 2619313830-3208056349
Opcode ID: 689ff0de220ffb94fd86c61a87793c34bf588e80c81ce97bfea336c6213a8a49
Instruction ID: e83eea1b73d08ac8f229434800ec6a713bed9eca0a4b639d27ae3d05521266de
Opcode Fuzzy Hash: 689ff0de220ffb94fd86c61a87793c34bf588e80c81ce97bfea336c6213a8a49
Instruction Fuzzy Hash: 3D528F31A1CACA81EA35DB14E4453FA6361EF89B84F404179DA8DC7BAADF3DE245C701

Function 00007FF69B3EFF00 Relevance: 26.9, APIs: 4, Strings: 11, Instructions: 606COMMON

Download Yara Rule

APIs

TryAcquireSRWLockExclusive.KERNEL32 ref: 00007FF69B3EFF6B
ReleaseSRWLockExclusive.KERNEL32 ref: 00007FF69B3F0174

Part of subcall function 00007FF69B450E10: QueryPerformanceCounter.KERNEL32 ref: 00007FF69B450E48

ReleaseSRWLockExclusive.KERNEL32 ref: 00007FF69B3F01C0
AcquireSRWLockExclusive.KERNEL32 ref: 00007FF69B3F02A6

Strings

33333333, xrefs: 00007FF69B3F00CB
33333333, xrefs: 00007FF69B3F068C
33333333, xrefs: 00007FF69B3F0707
33333333, xrefs: 00007FF69B3F0569
UUUUUUUU, xrefs: 00007FF69B3F0672
UUUUUUUU, xrefs: 00007FF69B3EFF9E
33333333, xrefs: 00007FF69B3F0399
33333333, xrefs: 00007FF69B3EFFA8
33333333, xrefs: 00007FF69B3F0748
33333333, xrefs: 00007FF69B3F0602
UUUUUUUU, xrefs: 00007FF69B3F01F7

Memory Dump Source

Source File: 00000000.00000002.1667242761.00007FF69B331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69B330000, based on PE: true

Associated: 00000000.00000002.1667200836.00007FF69B330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667462352.00007FF69B51D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B55B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B569000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667608048.00007FF69B575000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667624939.00007FF69B589000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667639365.00007FF69B58A000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667689383.00007FF69B58B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69b330000_D8wwrB9ZCB.jbxd

Similarity

API ID: ExclusiveLock$AcquireRelease$CounterPerformanceQuery
String ID: 33333333$33333333$33333333$33333333$33333333$33333333$33333333$33333333$UUUUUUUU$UUUUUUUU$UUUUUUUU
API String ID: 1190089479-3864632714
Opcode ID: c3f9262afdcfd7e8cb11ec15c3b5fab4c7fecf9c85ebfac8e64ccc0ee2a433d0
Instruction ID: 18555063c626293c5055e95c71d79b858243e1618f8cf6720bf397b461a6f47d
Opcode Fuzzy Hash: c3f9262afdcfd7e8cb11ec15c3b5fab4c7fecf9c85ebfac8e64ccc0ee2a433d0
Instruction Fuzzy Hash: 8432AC65B09B4EA1FE64CF1A94103792291FB48FD4F48857AED4E877A4DE7CE680A301

Function 00007FF69B4C79B0 Relevance: 24.9, APIs: 2, Strings: 12, Instructions: 425COMMON

Download Yara Rule

APIs

K32GetProcessMemoryInfo.KERNEL32 ref: 00007FF69B4C7CED
K32GetPerformanceInfo.KERNEL32 ref: 00007FF69B4C7D2C

Strings

cana, xrefs: 00007FF69B4C7D54
SystemCommitLimit, xrefs: 00007FF69B4C7F45
plat, xrefs: 00007FF69B4C7AE2
prod, xrefs: 00007FF69B4C7A1C
channel, xrefs: 00007FF69B4C7A9E
ProcessPeakWorkingSetSize, xrefs: 00007FF69B4C8056
ProcessPeakPagefileUsage, xrefs: 00007FF69B4C80DD
ver, xrefs: 00007FF69B4C7A5D
SystemCommitRemaining, xrefs: 00007FF69B4C7EC8
ptype, xrefs: 00007FF69B4C7B0D
Win64, xrefs: 00007FF69B4C7AF9
ProcessPrivateUsage, xrefs: 00007FF69B4C7FD2

Memory Dump Source

Source File: 00000000.00000002.1667242761.00007FF69B331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69B330000, based on PE: true

Associated: 00000000.00000002.1667200836.00007FF69B330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667462352.00007FF69B51D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B55B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B569000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667608048.00007FF69B575000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667624939.00007FF69B589000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667639365.00007FF69B58A000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667689383.00007FF69B58B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69b330000_D8wwrB9ZCB.jbxd

Similarity

API ID: Info$MemoryPerformanceProcess
String ID: ProcessPeakPagefileUsage$ProcessPeakWorkingSetSize$ProcessPrivateUsage$SystemCommitLimit$SystemCommitRemaining$Win64$cana$channel$plat$prod$ptype$ver
API String ID: 2600119024-1714930364
Opcode ID: 9d323572dd6beef3b06907ea9378f11a5bc224c5135a3d41f309ba4dc4bc3670
Instruction ID: 5c6c0c3891b59c8b24e4fc0e6deb9af83838c793598d794f895a33288cc68bb8
Opcode Fuzzy Hash: 9d323572dd6beef3b06907ea9378f11a5bc224c5135a3d41f309ba4dc4bc3670
Instruction Fuzzy Hash: ED22853290CACA92EA319B15E4413F9A360FB99F84F405175DB8D8376ADF3CE695D700

Function 00007FF69B4944A0 Relevance: 20.5, APIs: 6, Strings: 5, Instructions: 1226COMMON

Download Yara Rule

APIs

fegetenv.LIBCMT ref: 00007FF69B4944EE
_invalid_parameter_noinfo.LIBCMT ref: 00007FF69B494B5A
_invalid_parameter_noinfo.LIBCMT ref: 00007FF69B494CD0
_invalid_parameter_noinfo.LIBCMT ref: 00007FF69B494F8E
_invalid_parameter_noinfo.LIBCMT ref: 00007FF69B4951AE
_invalid_parameter_noinfo.LIBCMT ref: 00007FF69B4953EB

Strings

1#SNAN, xrefs: 00007FF69B4945FE
1#IND, xrefs: 00007FF69B4945DB
1#INF, xrefs: 00007FF69B494617
MZx, xrefs: 00007FF69B494B7B, 00007FF69B494BE0, 00007FF69B494F9E, 00007FF69B495061, 00007FF69B4950CD, 00007FF69B4953F8
1#QNAN, xrefs: 00007FF69B494607

Memory Dump Source

Source File: 00000000.00000002.1667242761.00007FF69B331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69B330000, based on PE: true

Associated: 00000000.00000002.1667200836.00007FF69B330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667462352.00007FF69B51D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B55B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B569000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667608048.00007FF69B575000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667624939.00007FF69B589000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667639365.00007FF69B58A000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667689383.00007FF69B58B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69b330000_D8wwrB9ZCB.jbxd

Similarity

API ID: _invalid_parameter_noinfo$fegetenv
String ID: 1#IND$1#INF$1#QNAN$1#SNAN$MZx
API String ID: 1709182501-2638907429
Opcode ID: 6bf69a8620b0158f708abec1bbdd47438f3f32b63040d733ca5ad321efaa562e
Instruction ID: af62ff0bb1b347c046f8f3956696fd09520629fa2bfb6ac9be503c87d663fe7d
Opcode Fuzzy Hash: 6bf69a8620b0158f708abec1bbdd47438f3f32b63040d733ca5ad321efaa562e
Instruction Fuzzy Hash: 65B2B472A1828A8BE7748E64D6407FD37A1FB58F44F505179DA0D97A9CDF38AB00DB80

Function 00007FF69B42AD80 Relevance: 20.3, APIs: 4, Strings: 7, Instructions: 1020COMMON

Download Yara Rule

APIs

TryAcquireSRWLockExclusive.KERNEL32 ref: 00007FF69B42B02C
ReleaseSRWLockExclusive.KERNEL32 ref: 00007FF69B42B128
ReleaseSRWLockExclusive.KERNEL32 ref: 00007FF69B42B39F
AcquireSRWLockExclusive.KERNEL32 ref: 00007FF69B42B876

Strings

Blink.UseCounter, xrefs: 00007FF69B42BCED
Medium, xrefs: 00007FF69B42AD89
33333333, xrefs: 00007FF69B42B084
UUUUUUUU, xrefs: 00007FF69B42B071
Histogram.TooManyBuckets.1000, xrefs: 00007FF69B42BCE1
Histogram.MismatchedConstructionArguments, xrefs: 00007FF69B42BAF5
Histogram.BadConstructionArguments, xrefs: 00007FF69B42BDDF

Memory Dump Source

Source File: 00000000.00000002.1667242761.00007FF69B331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69B330000, based on PE: true

Associated: 00000000.00000002.1667200836.00007FF69B330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667462352.00007FF69B51D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B55B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B569000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667608048.00007FF69B575000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667624939.00007FF69B589000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667639365.00007FF69B58A000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667689383.00007FF69B58B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69b330000_D8wwrB9ZCB.jbxd

Similarity

API ID: ExclusiveLock$AcquireRelease
String ID: 33333333$Blink.UseCounter$Histogram.BadConstructionArguments$Histogram.MismatchedConstructionArguments$Histogram.TooManyBuckets.1000$Medium$UUUUUUUU
API String ID: 17069307-1087885170
Opcode ID: a0983bd198cb1b79e6c6135f2946fe344777f3d519bc70cd8aba8e29a8aef70d
Instruction ID: 2c11cbabb052a48ada565e415277818e2515822f2fb448f349cca425ffe42ebf
Opcode Fuzzy Hash: a0983bd198cb1b79e6c6135f2946fe344777f3d519bc70cd8aba8e29a8aef70d
Instruction Fuzzy Hash: A2A2D032A1C78A81EA34CF15D4403B973A1EB89B90F548576DA5DC77B9DF3CE682A700

Function 00007FF69B332CC0 Relevance: 20.2, APIs: 13, Instructions: 662COMMON

Download Yara Rule

APIs

TryAcquireSRWLockExclusive.KERNEL32 ref: 00007FF69B3CAEFB
ReleaseSRWLockExclusive.KERNEL32 ref: 00007FF69B3CAF31

Memory Dump Source

Source File: 00000000.00000002.1667242761.00007FF69B331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69B330000, based on PE: true

Associated: 00000000.00000002.1667200836.00007FF69B330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667462352.00007FF69B51D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B55B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B569000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667608048.00007FF69B575000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667624939.00007FF69B589000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667639365.00007FF69B58A000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667689383.00007FF69B58B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69b330000_D8wwrB9ZCB.jbxd

Similarity

API ID: ExclusiveLock$AcquireRelease
String ID:
API String ID: 17069307-0
Opcode ID: 3ce2e10b1859971b142c60eef9d2f2805082d7d9ea8fde693ff3dd060ba514d2
Instruction ID: 0e7bd3626f9c2fafd95e57bcb70ec9e59ee9dee3c06335eb0137c73a2d86766d
Opcode Fuzzy Hash: 3ce2e10b1859971b142c60eef9d2f2805082d7d9ea8fde693ff3dd060ba514d2
Instruction Fuzzy Hash: 6752BE72B08A9A86EB24CF55E84437937A1FB48B94F448179DE5E837A5EF3CE645C300

Function 00007FF69B3C7F10 Relevance: 19.8, APIs: 10, Strings: 1, Instructions: 565COMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32 ref: 00007FF69B3C7FC3
GetLastError.KERNEL32 ref: 00007FF69B3C7FCD
TryAcquireSRWLockExclusive.KERNEL32(?,?,?,?), ref: 00007FF69B3C80DB

Strings

bitset reset argument out of range, xrefs: 00007FF69B3C896F

Memory Dump Source

Source File: 00000000.00000002.1667242761.00007FF69B331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69B330000, based on PE: true

Associated: 00000000.00000002.1667200836.00007FF69B330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667462352.00007FF69B51D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B55B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B569000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667608048.00007FF69B575000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667624939.00007FF69B589000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667639365.00007FF69B58A000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667689383.00007FF69B58B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69b330000_D8wwrB9ZCB.jbxd

Similarity

API ID: AcquireErrorExclusiveFreeLastLockVirtual
String ID: bitset reset argument out of range
API String ID: 148317752-1934458321
Opcode ID: fa20631024114872c65fc6aa9364f34a0b1088d12322897df0440481dcc21af1
Instruction ID: fa1405e7560be0c5fcca271e4f97f0e6e17411c40467e6f609d73edd51b1ee08
Opcode Fuzzy Hash: fa20631024114872c65fc6aa9364f34a0b1088d12322897df0440481dcc21af1
Instruction Fuzzy Hash: 3622DD62B08A6982EE24CF55E84437973A1FB48B90F444279DF5E877A5DF3CE696C300

Function 00007FF69B33E530 Relevance: 19.5, APIs: 8, Strings: 3, Instructions: 203filelibraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF69B417130: QueryPerformanceCounter.KERNEL32 ref: 00007FF69B417259
Part of subcall function 00007FF69B417130: TryAcquireSRWLockExclusive.KERNEL32 ref: 00007FF69B4172B9
Part of subcall function 00007FF69B417130: ReleaseSRWLockExclusive.KERNEL32 ref: 00007FF69B417309

CreateFileW.KERNEL32 ref: 00007FF69B33E6AA
GetLastError.KERNEL32 ref: 00007FF69B33E6B8
SetLastError.KERNEL32 ref: 00007FF69B33E6E6
GetLastError.KERNEL32 ref: 00007FF69B33E751
GetLastError.KERNEL32 ref: 00007FF69B33E763
GetModuleHandleW.KERNEL32 ref: 00007FF69B33E7CC
GetProcAddress.KERNEL32 ref: 00007FF69B33E7DC
SetLastError.KERNEL32 ref: 00007FF69B33E810

Strings

DoInitialize, xrefs: 00007FF69B33E57B
GetHandleVerifier, xrefs: 00007FF69B33E7D2
..\..\base\files\file_win.cc, xrefs: 00007FF69B33E582

Memory Dump Source

Source File: 00000000.00000002.1667242761.00007FF69B331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69B330000, based on PE: true

Associated: 00000000.00000002.1667200836.00007FF69B330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667462352.00007FF69B51D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B55B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B569000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667608048.00007FF69B575000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667624939.00007FF69B589000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667639365.00007FF69B58A000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667689383.00007FF69B58B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69b330000_D8wwrB9ZCB.jbxd

Similarity

API ID: ErrorLast$ExclusiveLock$AcquireAddressCounterCreateFileHandleModulePerformanceProcQueryRelease
String ID: ..\..\base\files\file_win.cc$DoInitialize$GetHandleVerifier
API String ID: 3329152108-1999724202
Opcode ID: 60e6b447f7690e45481305fca8cc5397a31d79f65ca6b3f8ffc7ce5e699dff4d
Instruction ID: 2eec2d9ad55132e0cb3509a88acf7966a0f93920accddc2974b76107b9cb0ba5
Opcode Fuzzy Hash: 60e6b447f7690e45481305fca8cc5397a31d79f65ca6b3f8ffc7ce5e699dff4d
Instruction Fuzzy Hash: 6B71E326B1865A82FB34CB15E455B7A6791EF98780F8044B8CE4E837F1DE3DE6458310

Function 00007FF69B36CEB0 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 151libraryloaderCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF69B36CF08
SetLastError.KERNEL32 ref: 00007FF69B36CF1D
GetLastError.KERNEL32 ref: 00007FF69B36CF3E
SetLastError.KERNEL32 ref: 00007FF69B36CF50
GetLastError.KERNEL32 ref: 00007FF69B36CFB2
SetLastError.KERNEL32 ref: 00007FF69B36CFCB
GetModuleHandleW.KERNEL32 ref: 00007FF69B36D069
GetProcAddress.KERNEL32 ref: 00007FF69B36D079
GetLastError.KERNEL32 ref: 00007FF69B36D0A8

Strings

GetHandleVerifier, xrefs: 00007FF69B36D06F
function_name, xrefs: 00007FF69B36CEB4

Memory Dump Source

Source File: 00000000.00000002.1667242761.00007FF69B331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69B330000, based on PE: true

Associated: 00000000.00000002.1667200836.00007FF69B330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667462352.00007FF69B51D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B55B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B569000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667608048.00007FF69B575000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667624939.00007FF69B589000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667639365.00007FF69B58A000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667689383.00007FF69B58B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69b330000_D8wwrB9ZCB.jbxd

Similarity

API ID: ErrorLast$AddressHandleModuleProc
String ID: GetHandleVerifier$function_name
API String ID: 1762409328-2060961229
Opcode ID: 7ecc85babebf26a37a430be5f77d1bb8f3425f61a7e90a257911a8206568cbf2
Instruction ID: 6e7d504251aa187c7b926b86cf6dfbbc19b08bbb15e6a0e94395cf9e09fa7f2d
Opcode Fuzzy Hash: 7ecc85babebf26a37a430be5f77d1bb8f3425f61a7e90a257911a8206568cbf2
Instruction Fuzzy Hash: CD51E021A0CA4AC2EA74CF75A8452797291EF8C7A0F4442B9CA5EC36F2DE7DE6458310

Function 00007FF69B3EE450 Relevance: 18.5, APIs: 4, Strings: 6, Instructions: 1042COMMON

Download Yara Rule

APIs

TryAcquireSRWLockExclusive.KERNEL32 ref: 00007FF69B3EE781
ReleaseSRWLockExclusive.KERNEL32 ref: 00007FF69B3EE87D
ReleaseSRWLockExclusive.KERNEL32 ref: 00007FF69B3EEAD6

Strings

Blink.UseCounter, xrefs: 00007FF69B3EF434
UUUUUUUU, xrefs: 00007FF69B3EE7C6
Histogram.TooManyBuckets.1000, xrefs: 00007FF69B3EF428
Histogram.MismatchedConstructionArguments, xrefs: 00007FF69B3EF22F
Histogram.BadConstructionArguments, xrefs: 00007FF69B3EF53B
33333333, xrefs: 00007FF69B3EE7D9

Memory Dump Source

Source File: 00000000.00000002.1667242761.00007FF69B331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69B330000, based on PE: true

Associated: 00000000.00000002.1667200836.00007FF69B330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667462352.00007FF69B51D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B55B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B569000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667608048.00007FF69B575000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667624939.00007FF69B589000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667639365.00007FF69B58A000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667689383.00007FF69B58B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69b330000_D8wwrB9ZCB.jbxd

Similarity

API ID: ExclusiveLock$Release$Acquire
String ID: 33333333$Blink.UseCounter$Histogram.BadConstructionArguments$Histogram.MismatchedConstructionArguments$Histogram.TooManyBuckets.1000$UUUUUUUU
API String ID: 1021914862-270050585
Opcode ID: c74d279164bb34017d028e66eec0887eed129692ceb8e57f1b6153f4f86c374a
Instruction ID: b14c91a57b9d3d749004d83f748ca5eefb2c6855e806fe2999f63a57e319ee89
Opcode Fuzzy Hash: c74d279164bb34017d028e66eec0887eed129692ceb8e57f1b6153f4f86c374a
Instruction Fuzzy Hash: 12A2CE22A1C68A82FB70CB15D4403BD6391EB89B84F54857BDA4D87BB5DF7CEA85C700

Function 00007FF69B3F1D80 Relevance: 16.6, APIs: 3, Strings: 6, Instructions: 826COMMON

Download Yara Rule

APIs

TryAcquireSRWLockExclusive.KERNEL32 ref: 00007FF69B3F20A0
ReleaseSRWLockExclusive.KERNEL32 ref: 00007FF69B3F222F

Strings

33333333, xrefs: 00007FF69B3F2118
33333333, xrefs: 00007FF69B3F3069
UUUUUUUU, xrefs: 00007FF69B3F3056
UUUUUUUU, xrefs: 00007FF69B3F2105
1U!S, xrefs: 00007FF69B3F23A9
1U!S, xrefs: 00007FF69B3F2325

Memory Dump Source

Source File: 00000000.00000002.1667242761.00007FF69B331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69B330000, based on PE: true

Associated: 00000000.00000002.1667200836.00007FF69B330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667462352.00007FF69B51D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B55B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B569000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667608048.00007FF69B575000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667624939.00007FF69B589000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667639365.00007FF69B58A000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667689383.00007FF69B58B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69b330000_D8wwrB9ZCB.jbxd

Similarity

API ID: ExclusiveLock$AcquireRelease
String ID: 1U!S$1U!S$33333333$33333333$UUUUUUUU$UUUUUUUU
API String ID: 17069307-4044092597
Opcode ID: c0eaf8f5ba0981f283394ac091ad41236839d72e519aa0c98b4ff46178e17c84
Instruction ID: fc5ce8c91895372fc7c3a0a07cc6b4efc662f9c78a8cbc14225459c32cfd95ba
Opcode Fuzzy Hash: c0eaf8f5ba0981f283394ac091ad41236839d72e519aa0c98b4ff46178e17c84
Instruction Fuzzy Hash: 9D72F262B09A4AC2FA34CB96D8047797391FB5CB90F948579E90DC77A4DE3CEA41E300

Function 00007FF69B381090 Relevance: 16.2, APIs: 7, Strings: 2, Instructions: 443COMMON

Download Yara Rule

APIs

TryAcquireSRWLockExclusive.KERNEL32(?,?,?,?,?,?,00000001,00000064,-5555555555555556,0000000B,?,00000000,?,?,00007FF69B33EC95), ref: 00007FF69B3810F0
ReleaseSRWLockExclusive.KERNEL32 ref: 00007FF69B381200
ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,00000001,00000064,-5555555555555556,0000000B,?,00000000,?,?,00007FF69B33EC95), ref: 00007FF69B3812B4
TryAcquireSRWLockExclusive.KERNEL32 ref: 00007FF69B381377
ReleaseSRWLockExclusive.KERNEL32 ref: 00007FF69B3813E7
AcquireSRWLockExclusive.KERNEL32(?,?,?,?,?,?,00000001,00000064,-5555555555555556,0000000B,?,00000000,?,?,00007FF69B33EC95), ref: 00007FF69B381653

Strings

UUUUUUUU, xrefs: 00007FF69B381102
33333333, xrefs: 00007FF69B38110C

Memory Dump Source

Source File: 00000000.00000002.1667242761.00007FF69B331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69B330000, based on PE: true

Associated: 00000000.00000002.1667200836.00007FF69B330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667462352.00007FF69B51D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B55B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B569000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667608048.00007FF69B575000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667624939.00007FF69B589000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667639365.00007FF69B58A000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667689383.00007FF69B58B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69b330000_D8wwrB9ZCB.jbxd

Similarity

API ID: ExclusiveLock$AcquireRelease
String ID: 33333333$UUUUUUUU
API String ID: 17069307-3483174168
Opcode ID: 600955f4c542ecb35a6e6e697ff8b92fec92d3adf721f86743092b2779c221e2
Instruction ID: 611cf162c518c2fd061f429f01fe7ef01440276f461d7b431c3e971be08bb221
Opcode Fuzzy Hash: 600955f4c542ecb35a6e6e697ff8b92fec92d3adf721f86743092b2779c221e2
Instruction Fuzzy Hash: C402A062B08A8E82EA31CB15940067A6761FF5DB80F4441BADE4DC7BB5DF7DE6858302

Function 00007FF69B33E940 Relevance: 14.5, APIs: 2, Strings: 6, Instructions: 475COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32 ref: 00007FF69B33EEAF
GetFileAttributesW.KERNEL32 ref: 00007FF69B33F12D

Strings

PathExists, xrefs: 00007FF69B33EE4F, 00007FF69B33F0CD
SystemTemp, xrefs: 00007FF69B33EDD0
ScopedBlockingCall, xrefs: 00007FF69B33F193, 00007FF69B33F1C5, 00007FF69B33F1F7
W, xrefs: 00007FF69B33E9D7
GetSecureSystemTemp, xrefs: 00007FF69B33ED5A
..\..\base\files\file_util_win.cc, xrefs: 00007FF69B33ED61, 00007FF69B33EE56, 00007FF69B33F0D4

Memory Dump Source

Source File: 00000000.00000002.1667242761.00007FF69B331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69B330000, based on PE: true

Associated: 00000000.00000002.1667200836.00007FF69B330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667462352.00007FF69B51D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B55B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B569000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667608048.00007FF69B575000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667624939.00007FF69B589000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667639365.00007FF69B58A000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667689383.00007FF69B58B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69b330000_D8wwrB9ZCB.jbxd

Similarity

API ID: AttributesFile
String ID: ..\..\base\files\file_util_win.cc$GetSecureSystemTemp$PathExists$ScopedBlockingCall$SystemTemp$W
API String ID: 3188754299-2419050072
Opcode ID: 3d3bff96aba92a4f58851c741edd0a46c26d31d5f432e483f6aa30933f3c8f35
Instruction ID: a3128c0856871198e30b4b037be1637cd2c8e8464bc92716b9e81e3882c11c30
Opcode Fuzzy Hash: 3d3bff96aba92a4f58851c741edd0a46c26d31d5f432e483f6aa30933f3c8f35
Instruction Fuzzy Hash: 3632A321A0CADA80FA31DB14E4403FAA3A0FF99784F844175EA8D877A9DF7DD685C700

Function 00007FF69B41D9B0 Relevance: 13.6, APIs: 9, Instructions: 111threadCOMMON

Download Yara Rule

APIs

GetCurrentThread.KERNEL32(?,45C78948FFFA50CD,?,?,?,?,00007FF69B338727,?,?,?,?,00007FF69B4BBBBF,00007FF69B49980A,?,?,00000000), ref: 00007FF69B41DA0C
GetThreadPriority.KERNEL32(?,?,?,?,00007FF69B4BBBBF,00007FF69B49980A,?,?,00000000,00000001,00007FF69B4BBBBF,00007FF69B4BBBBF,?,?,?,?), ref: 00007FF69B41DA11
GetCurrentThread.KERNEL32(?,?,?,?,00007FF69B4BBBBF,00007FF69B49980A,?,?,00000000,00000001,00007FF69B4BBBBF,00007FF69B4BBBBF,?,?,?,?), ref: 00007FF69B41DA19
SetThreadPriority.KERNEL32(?,?,?,?,00007FF69B4BBBBF,00007FF69B49980A,?,?,00000000,00000001,00007FF69B4BBBBF,00007FF69B4BBBBF,?,?,?,?), ref: 00007FF69B41DA23
QueryPerformanceCounter.KERNEL32(?,?,?,?,00007FF69B4BBBBF,00007FF69B49980A,?,?,00000000,00000001,00007FF69B4BBBBF,00007FF69B4BBBBF,?,?,?,?), ref: 00007FF69B41DA89
GetCurrentThread.KERNEL32(?,?,?,?,00007FF69B4BBBBF,00007FF69B49980A,?,?,00000000,00000001,00007FF69B4BBBBF,00007FF69B4BBBBF,?,?,?,?), ref: 00007FF69B41DA92
SetThreadPriority.KERNEL32(?,?,?,?,00007FF69B4BBBBF,00007FF69B49980A,?,?,00000000,00000001,00007FF69B4BBBBF,00007FF69B4BBBBF,?,?,?,?), ref: 00007FF69B41DA9D
QueryPerformanceFrequency.KERNEL32(?,?,?,?,00007FF69B4BBBBF,00007FF69B49980A,?,?,00000000,00000001,00007FF69B4BBBBF,00007FF69B4BBBBF,?,?,?,?), ref: 00007FF69B41DAAE
QueryPerformanceCounter.KERNEL32(?,?,?,?,00007FF69B4BBBBF,00007FF69B49980A,?,?,00000000,00000001,00007FF69B4BBBBF,00007FF69B4BBBBF,?,?,?,?), ref: 00007FF69B41DB7F

Memory Dump Source

Source File: 00000000.00000002.1667242761.00007FF69B331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69B330000, based on PE: true

Associated: 00000000.00000002.1667200836.00007FF69B330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667462352.00007FF69B51D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B55B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B569000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667608048.00007FF69B575000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667624939.00007FF69B589000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667639365.00007FF69B58A000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667689383.00007FF69B58B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69b330000_D8wwrB9ZCB.jbxd

Similarity

API ID: Thread$CurrentPerformancePriorityQuery$Counter$Frequency
String ID:
API String ID: 2845919953-0
Opcode ID: f37dc472bb3f123c2dbf2a5f3b8623f65838e6933734d5cf8371a54325060c00
Instruction ID: 243dc95ebdebdc6c3601272cfd7b5f2af9c3cbd82b5dd5d646aff79f28663c47
Opcode Fuzzy Hash: f37dc472bb3f123c2dbf2a5f3b8623f65838e6933734d5cf8371a54325060c00
Instruction Fuzzy Hash: 1A518D71E18A4ACAE621DF25EC552797361FF5CB90F0442B1E90E932BADF3CA651D300

Function 00007FF69B3DD9A0 Relevance: 13.5, Strings: 10, Instructions: 1040COMMON

Download Yara Rule

Strings

%s (errno: %d, %s), xrefs: 00007FF69B3DEA88
Static buffer too small (errno: %d, %s), xrefs: 00007FF69B3DEB7A
UUUUUUUU, xrefs: 00007FF69B3DDD7F
33333333, xrefs: 00007FF69B3DDD92
..\..\third_party\perfetto\src\protozero\static_buffer.cc, xrefs: 00007FF69B3DEB65
..\..\third_party\perfetto\include\perfetto\tracing\track_event_interned_data_index.h, xrefs: 00007FF69B3DEA67
UUUUUUUU, xrefs: 00007FF69B3DEC0A
33333333, xrefs: 00007FF69B3DEC1D
PERFETTO_CHECK(false), xrefs: 00007FF69B3DEA7C
*, xrefs: 00007FF69B3DD9E5

Memory Dump Source

Source File: 00000000.00000002.1667242761.00007FF69B331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69B330000, based on PE: true

Associated: 00000000.00000002.1667200836.00007FF69B330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667462352.00007FF69B51D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B55B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B569000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667608048.00007FF69B575000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667624939.00007FF69B589000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667639365.00007FF69B58A000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667689383.00007FF69B58B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69b330000_D8wwrB9ZCB.jbxd

Similarity

API ID:
String ID: %s (errno: %d, %s)$*$..\..\third_party\perfetto\include\perfetto\tracing\track_event_interned_data_index.h$..\..\third_party\perfetto\src\protozero\static_buffer.cc$33333333$33333333$PERFETTO_CHECK(false)$Static buffer too small (errno: %d, %s)$UUUUUUUU$UUUUUUUU
API String ID: 0-996806847
Opcode ID: dcda9bc1a2af3fecebce96eda3e472bd5c0e04173c17b832775c02a2d16f9a38
Instruction ID: 9fb164f5f7e920d8f200cda2a7525ca32ba17a5320230e612584ee09fdbe0747
Opcode Fuzzy Hash: dcda9bc1a2af3fecebce96eda3e472bd5c0e04173c17b832775c02a2d16f9a38
Instruction Fuzzy Hash: 7BB2AB32A09B8981EA71CB05E0447ED77A5FB88B84F55413BDA8D937A8DF7CE694C700

Function 00007FF69B401F40 Relevance: 10.9, APIs: 3, Strings: 3, Instructions: 392COMMON

Download Yara Rule

APIs

TryAcquireSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000001,7FFFFFFFFFFFFFFF,?,?), ref: 00007FF69B4020DC
ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000001,7FFFFFFFFFFFFFFF,?,?), ref: 00007FF69B4021CA

Strings

UUUUUUUU, xrefs: 00007FF69B402121
Histogram.TooManyBuckets.1000, xrefs: 00007FF69B401F47
33333333, xrefs: 00007FF69B402134

Memory Dump Source

Source File: 00000000.00000002.1667242761.00007FF69B331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69B330000, based on PE: true

Associated: 00000000.00000002.1667200836.00007FF69B330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667462352.00007FF69B51D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B55B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B569000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667608048.00007FF69B575000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667624939.00007FF69B589000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667639365.00007FF69B58A000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667689383.00007FF69B58B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69b330000_D8wwrB9ZCB.jbxd

Similarity

API ID: ExclusiveLock$AcquireRelease
String ID: 33333333$Histogram.TooManyBuckets.1000$UUUUUUUU
API String ID: 17069307-2370641061
Opcode ID: f41a34acb85f8f0872ae8c894c6ac2f450797814094be43e778c4a1635fba914
Instruction ID: ea0dba9f986dd76356e09b43e71dad086a3ebcf5a49dd66ba709b6dfd5a1bc7e
Opcode Fuzzy Hash: f41a34acb85f8f0872ae8c894c6ac2f450797814094be43e778c4a1635fba914
Instruction Fuzzy Hash: 9BF1F031E2D74E81EB708F95A0407786391EB69F94F104576DA0E877F9CE6CEA81A701

Function 00007FF69B499480 Relevance: 10.5, Strings: 8, Instructions: 523COMMON

Download Yara Rule

Strings

Scheduling.ThreadController.ActiveOnCpuVsWallTimePercentage, xrefs: 00007FF69B499B6C
ThreadController active, xrefs: 00007FF69B4998A2
Scheduling.ThreadController.ActiveVsWallTimePercentage, xrefs: 00007FF69B499B17
Scheduling.ThreadController.IdleDuration, xrefs: 00007FF69B49963B
Scheduling.ThreadController.ActiveIntervalOffCpuDuration, xrefs: 00007FF69B499735
Scheduling.ThreadController.ActiveIntervalDuration, xrefs: 00007FF69B4996FE
Scheduling.ThreadController.ActiveOffCpuVsWallTimePercentage, xrefs: 00007FF69B499BC1
Scheduling.ThreadController.ActiveIntervalOnCpuDuration, xrefs: 00007FF69B499747

Memory Dump Source

Source File: 00000000.00000002.1667242761.00007FF69B331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69B330000, based on PE: true

Associated: 00000000.00000002.1667200836.00007FF69B330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667462352.00007FF69B51D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B55B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B569000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667608048.00007FF69B575000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667624939.00007FF69B589000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667639365.00007FF69B58A000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667689383.00007FF69B58B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69b330000_D8wwrB9ZCB.jbxd

Similarity

API ID: QueryThread$CounterCurrentCyclePerformanceTime
String ID: Scheduling.ThreadController.ActiveIntervalDuration$Scheduling.ThreadController.ActiveIntervalOffCpuDuration$Scheduling.ThreadController.ActiveIntervalOnCpuDuration$Scheduling.ThreadController.ActiveOffCpuVsWallTimePercentage$Scheduling.ThreadController.ActiveOnCpuVsWallTimePercentage$Scheduling.ThreadController.ActiveVsWallTimePercentage$Scheduling.ThreadController.IdleDuration$ThreadController active
API String ID: 2211825963-3986846443
Opcode ID: e76b7a15c7e96335c9baf79d23221723174c6a05f35871447459df015d32886f
Instruction ID: abfada2474d8bbc619d2bf27efef51ebe024e5772cbdb3408a8948d27835675f
Opcode Fuzzy Hash: e76b7a15c7e96335c9baf79d23221723174c6a05f35871447459df015d32886f
Instruction Fuzzy Hash: A812F662B0860E42EE34CB21A5543B96391EB4DFE0F545676DA2F877F8EE7CE2419300

Function 00007FF69B487BDC Relevance: 9.1, APIs: 6, Instructions: 83COMMON

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00007FF69B487C55
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF69B487C6D
RtlVirtualUnwind.KERNEL32 ref: 00007FF69B487CA8
IsDebuggerPresent.KERNEL32 ref: 00007FF69B487CE1
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF69B487CEB
UnhandledExceptionFilter.KERNEL32 ref: 00007FF69B487CF6

Memory Dump Source

Source File: 00000000.00000002.1667242761.00007FF69B331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69B330000, based on PE: true

Associated: 00000000.00000002.1667200836.00007FF69B330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667462352.00007FF69B51D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B55B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B569000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667608048.00007FF69B575000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667624939.00007FF69B589000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667639365.00007FF69B58A000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667689383.00007FF69B58B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69b330000_D8wwrB9ZCB.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: ce94d56b8e352951964e5045e6e5376a542c7340cb0c8b0e8d28d89bd0810ff2
Instruction ID: 9362fccb736fd9da46646e3b2e8564a7b0b720d2b564f885fe21be7a85d01779
Opcode Fuzzy Hash: ce94d56b8e352951964e5045e6e5376a542c7340cb0c8b0e8d28d89bd0810ff2
Instruction Fuzzy Hash: 3A317432618B8586DB70DF25E8402AE73A5FB8CB54F500535EA9D83BA9DF3CC255CB00

Function 00007FF69B4BA080 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 143windowCOMMON

Download Yara Rule

APIs

FormatMessageW.KERNEL32 ref: 00007FF69B4BA0CF
LocalFree.KERNEL32 ref: 00007FF69B4BA140
GetLastError.KERNEL32 ref: 00007FF69B4BA29F

Strings

Error (0x%lX) while retrieving error. (0x%lX), xrefs: 00007FF69B4BA2A5
(0x%lX), xrefs: 00007FF69B4BA152

Memory Dump Source

Source File: 00000000.00000002.1667242761.00007FF69B331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69B330000, based on PE: true

Associated: 00000000.00000002.1667200836.00007FF69B330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667462352.00007FF69B51D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B55B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B569000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667608048.00007FF69B575000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667624939.00007FF69B589000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667639365.00007FF69B58A000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667689383.00007FF69B58B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69b330000_D8wwrB9ZCB.jbxd

Similarity

API ID: ErrorFormatFreeLastLocalMessage
String ID: (0x%lX)$Error (0x%lX) while retrieving error. (0x%lX)
API String ID: 1365068426-3206765257
Opcode ID: cc324cf320cc03e40574e1e39c299654c6ebea4a1f7aa8788e3dcb7f97fb557d
Instruction ID: 7b639c934cf9583700ab19ba2cd45887a212fef7a4fc61a233064d47dc14691a
Opcode Fuzzy Hash: cc324cf320cc03e40574e1e39c299654c6ebea4a1f7aa8788e3dcb7f97fb557d
Instruction Fuzzy Hash: CD519132A0DB9A81EA35CB15E4503AEB7A1FF88B80F444175DA8C83B69DF3DE2459700

Function 00007FF69B47BB64 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 135timeCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF69B48A470: _invalid_parameter_noinfo.LIBCMT ref: 00007FF69B48A4A3

_get_daylight.LIBCMT ref: 00007FF69B47BC12
_get_daylight.LIBCMT ref: 00007FF69B47BC23
_get_daylight.LIBCMT ref: 00007FF69B47BC34
GetTimeZoneInformation.KERNEL32(?,?,00000000,00000000,?,00007FF69B47C140), ref: 00007FF69B47BC5B

Strings

@, xrefs: 00007FF69B47BBAB

Memory Dump Source

Source File: 00000000.00000002.1667242761.00007FF69B331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69B330000, based on PE: true

Associated: 00000000.00000002.1667200836.00007FF69B330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667462352.00007FF69B51D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B55B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B569000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667608048.00007FF69B575000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667624939.00007FF69B589000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667639365.00007FF69B58A000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667689383.00007FF69B58B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69b330000_D8wwrB9ZCB.jbxd

Similarity

API ID: _get_daylight$InformationTimeZone_invalid_parameter_noinfo
String ID: @
API String ID: 3482513350-2766056989
Opcode ID: dfaf71dc35c29ad21f1da3fd620bcb1066404be3525fac2292d0d7165ae74d3b
Instruction ID: c583521c1ed585aefe68c2238a2e55943270c760f169e75a59112de472c49fb9
Opcode Fuzzy Hash: dfaf71dc35c29ad21f1da3fd620bcb1066404be3525fac2292d0d7165ae74d3b
Instruction Fuzzy Hash: 49518532A1864A86E730EF25D8905697761FB8CB84F049179EA4DC7BBADF3CE6009740

Function 00007FF69B4B8960 Relevance: 7.9, Strings: 6, Instructions: 388COMMON

Download Yara Rule

Strings

Medium, xrefs: 00007FF69B4B8A93
samples, xrefs: 00007FF69B4B8B4D
(flags = 0x%x), xrefs: 00007FF69B4B8BC6
, mean = %.1f, xrefs: 00007FF69B4B8BAE
recorded , xrefs: 00007FF69B4B8AEE
Histogram: , xrefs: 00007FF69B4B8AD0

Memory Dump Source

Source File: 00000000.00000002.1667242761.00007FF69B331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69B330000, based on PE: true

Associated: 00000000.00000002.1667200836.00007FF69B330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667462352.00007FF69B51D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B55B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B569000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667608048.00007FF69B575000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667624939.00007FF69B589000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667639365.00007FF69B58A000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667689383.00007FF69B58B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69b330000_D8wwrB9ZCB.jbxd

Similarity

API ID:
String ID: (flags = 0x%x)$ recorded $ samples$, mean = %.1f$Histogram: $Medium
API String ID: 0-1527360983
Opcode ID: 144ff4ca58c4096582257e3e97f112eba1268777a7c7fdbeb85bb094cb4cbdae
Instruction ID: 835643e06a8e0d1d581c208047b8dd71b673e41998937b799ed65fe67cd0aa20
Opcode Fuzzy Hash: 144ff4ca58c4096582257e3e97f112eba1268777a7c7fdbeb85bb094cb4cbdae
Instruction Fuzzy Hash: 16E1B322A09AAD81EE318B25E44437E77A0EB8CF84F144571DF4D837B9DE7DE642A701

Function 00007FF69B3C5960 Relevance: 7.8, APIs: 5, Instructions: 303COMMON

Download Yara Rule

APIs

TryAcquireSRWLockExclusive.KERNEL32 ref: 00007FF69B3C5990

Memory Dump Source

Source File: 00000000.00000002.1667242761.00007FF69B331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69B330000, based on PE: true

Associated: 00000000.00000002.1667200836.00007FF69B330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667462352.00007FF69B51D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B55B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B569000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667608048.00007FF69B575000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667624939.00007FF69B589000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667639365.00007FF69B58A000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667689383.00007FF69B58B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69b330000_D8wwrB9ZCB.jbxd

Similarity

API ID: AcquireExclusiveLock
String ID:
API String ID: 4021432409-0
Opcode ID: 526727bd3038c93cadf4e1f898ef6f199e1aa348dfd5c11075583e62de55b0da
Instruction ID: 1e0c4629ff0b5c798e5b110a8ba785e2806b823857d521e3b9ce8a7d7e9e8007
Opcode Fuzzy Hash: 526727bd3038c93cadf4e1f898ef6f199e1aa348dfd5c11075583e62de55b0da
Instruction Fuzzy Hash: 86E1D0329086D982FB35CB24A5053EA67A0FB99754F044679DA9C836F2DF7CE296C300

Function 00007FF69B351C20 Relevance: 7.4, APIs: 2, Strings: 2, Instructions: 431COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF69B460CE8: Concurrency::cancel_current_task.LIBCPMT ref: 00007FF69B460D18

InitializeConditionVariable.KERNEL32 ref: 00007FF69B351E15
QueryPerformanceCounter.KERNEL32 ref: 00007FF69B35225E

Strings

unknown, xrefs: 00007FF69B352364
SequenceManager, xrefs: 00007FF69B352407

Memory Dump Source

Source File: 00000000.00000002.1667242761.00007FF69B331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69B330000, based on PE: true

Associated: 00000000.00000002.1667200836.00007FF69B330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667462352.00007FF69B51D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B55B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B569000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667608048.00007FF69B575000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667624939.00007FF69B589000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667639365.00007FF69B58A000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667689383.00007FF69B58B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69b330000_D8wwrB9ZCB.jbxd

Similarity

API ID: Concurrency::cancel_current_taskConditionCounterInitializePerformanceQueryVariable
String ID: SequenceManager$unknown
API String ID: 915391916-800720279
Opcode ID: c2f2b03a66e5af28c82d6edd60c423f1d224e56d4cd7b73b47b14e0409f1cd9c
Instruction ID: b8e221ddda74996a441c495ced7ed78c96cae1f422523801951dd8b793271b7f
Opcode Fuzzy Hash: c2f2b03a66e5af28c82d6edd60c423f1d224e56d4cd7b73b47b14e0409f1cd9c
Instruction Fuzzy Hash: F622C132A08B8985E761CF21E8803B933A4FB48B48F058279DE5D873B5DF7CA295C310

Function 00007FF69B345020 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 163COMMON

Download Yara Rule

APIs

TryAcquireSRWLockExclusive.KERNEL32 ref: 00007FF69B345073

Strings

33333333, xrefs: 00007FF69B3450D4
UUUUUUUU, xrefs: 00007FF69B3450C1

Memory Dump Source

Source File: 00000000.00000002.1667242761.00007FF69B331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69B330000, based on PE: true

Associated: 00000000.00000002.1667200836.00007FF69B330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667462352.00007FF69B51D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B55B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B569000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667608048.00007FF69B575000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667624939.00007FF69B589000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667639365.00007FF69B58A000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667689383.00007FF69B58B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69b330000_D8wwrB9ZCB.jbxd

Similarity

API ID: AcquireExclusiveLock
String ID: 33333333$UUUUUUUU
API String ID: 4021432409-3483174168
Opcode ID: 890cef334cbfa6a97ea0de0501632184363289667939906d9ce95d47665e0487
Instruction ID: 75a138cf93b45ab41d624dd14d26a898f241277bff6925e62c6b9b9b29c3efa5
Opcode Fuzzy Hash: 890cef334cbfa6a97ea0de0501632184363289667939906d9ce95d47665e0487
Instruction Fuzzy Hash: B5519C71F19A0E81EE70CB01D8616782392EF49B90F4581B6DD0D83BB5CF7EE6968300

Function 00007FF69B3D2C80 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 54libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF69B460E1C: AcquireSRWLockExclusive.KERNEL32(?,?,?,00007FF69B49885B), ref: 00007FF69B460E2C

LoadLibraryW.KERNEL32(?,?,?,?,?,?,?,?,00007FF69B35AF1C,?,?,?,?,?,?,00000000), ref: 00007FF69B3D2CE8
GetProcAddress.KERNEL32(?,?,?,?,?,?,?,?,00007FF69B35AF1C,?,?,?,?,?,?,00000000), ref: 00007FF69B3D2CFD

Strings

bcryptprimitives.dll, xrefs: 00007FF69B3D2CE1
ProcessPrng, xrefs: 00007FF69B3D2CF3

Memory Dump Source

Source File: 00000000.00000002.1667242761.00007FF69B331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69B330000, based on PE: true

Associated: 00000000.00000002.1667200836.00007FF69B330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667462352.00007FF69B51D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B55B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B569000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667608048.00007FF69B575000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667624939.00007FF69B589000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667639365.00007FF69B58A000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667689383.00007FF69B58B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69b330000_D8wwrB9ZCB.jbxd

Similarity

API ID: AcquireAddressExclusiveLibraryLoadLockProc
String ID: ProcessPrng$bcryptprimitives.dll
API String ID: 1410756787-2667675608
Opcode ID: b063b3c1f306aa47b1bbb8a95269844b030160399f1b90c34262daef41aacd9b
Instruction ID: e6b062836f31d7674211968862babf3e19e81617c754fa2b275872055f24860b
Opcode Fuzzy Hash: b063b3c1f306aa47b1bbb8a95269844b030160399f1b90c34262daef41aacd9b
Instruction Fuzzy Hash: 16112524E08A4EC1FA64DF56EC481783361FF8CB80F4449B6C90D833B2DE2CAA4AC300

Function 00007FF69B3374E0 Relevance: 6.7, Strings: 5, Instructions: 469COMMON

Download Yara Rule

Strings

MessagePumpForUI DispatchMessage, xrefs: 00007FF69B337590
Chrome.MessageLoopProblem.MESSAGE_POST_ERROR, xrefs: 00007FF69B338560
MessagePumpForUI::ProcessPumpReplacementMessage PeekMessage, xrefs: 00007FF69B33851E
I, xrefs: 00007FF69B338583
Chrome.MessageLoopProblem.RECEIVED_WM_QUIT_ERROR, xrefs: 00007FF69B337AA0

Memory Dump Source

Source File: 00000000.00000002.1667242761.00007FF69B331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69B330000, based on PE: true

Associated: 00000000.00000002.1667200836.00007FF69B330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667462352.00007FF69B51D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B55B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B569000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667608048.00007FF69B575000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667624939.00007FF69B589000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667639365.00007FF69B58A000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667689383.00007FF69B58B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69b330000_D8wwrB9ZCB.jbxd

Similarity

API ID:
String ID: Chrome.MessageLoopProblem.MESSAGE_POST_ERROR$Chrome.MessageLoopProblem.RECEIVED_WM_QUIT_ERROR$I$MessagePumpForUI DispatchMessage$MessagePumpForUI::ProcessPumpReplacementMessage PeekMessage
API String ID: 0-2900724401
Opcode ID: dd8b68d5854cb4b776792863a27b2dc5941702038d19c1e5aee41563bd3ac765
Instruction ID: 49709b0c95bb1c38dca4ae680f1f2a78e59b4ccdb476a7573bbd07e1dc65101b
Opcode Fuzzy Hash: dd8b68d5854cb4b776792863a27b2dc5941702038d19c1e5aee41563bd3ac765
Instruction Fuzzy Hash: 22226066608B89C5EA71CB19E4547BA73A0FB8CB90F508176DA9D877B4EF3CD285C700

Function 00007FF69B463AD4 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF69B463B00
GetCurrentThreadId.KERNEL32 ref: 00007FF69B463B0E
GetCurrentProcessId.KERNEL32 ref: 00007FF69B463B1A
QueryPerformanceCounter.KERNEL32 ref: 00007FF69B463B2A

Memory Dump Source

Source File: 00000000.00000002.1667242761.00007FF69B331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69B330000, based on PE: true

Associated: 00000000.00000002.1667200836.00007FF69B330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667462352.00007FF69B51D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B55B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B569000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667608048.00007FF69B575000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667624939.00007FF69B589000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667639365.00007FF69B58A000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667689383.00007FF69B58B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69b330000_D8wwrB9ZCB.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 27b3e915b01bf953fe5a0b4bed507a79538fed244853b3c7fcb2ade0d4eae178
Instruction ID: 7704632a9919d9ed8487277f5a323d0b569b20253d47eee6ac9bd073eb2f4583
Opcode Fuzzy Hash: 27b3e915b01bf953fe5a0b4bed507a79538fed244853b3c7fcb2ade0d4eae178
Instruction Fuzzy Hash: F6111C22B14F098AEB10CF65E8542A933A4F71D758F440A35EA6D87BA5DF78D2648340

Function 00007FF69B430ED0 Relevance: 5.9, APIs: 1, Strings: 2, Instructions: 616COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32 ref: 00007FF69B430F2A

Strings

Static buffer too small (errno: %d, %s), xrefs: 00007FF69B43182B
..\..\third_party\perfetto\src\protozero\static_buffer.cc, xrefs: 00007FF69B431816

Memory Dump Source

Source File: 00000000.00000002.1667242761.00007FF69B331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69B330000, based on PE: true

Associated: 00000000.00000002.1667200836.00007FF69B330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667462352.00007FF69B51D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B55B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B569000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667608048.00007FF69B575000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667624939.00007FF69B589000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667639365.00007FF69B58A000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667689383.00007FF69B58B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69b330000_D8wwrB9ZCB.jbxd

Similarity

API ID: CurrentProcess
String ID: ..\..\third_party\perfetto\src\protozero\static_buffer.cc$Static buffer too small (errno: %d, %s)
API String ID: 2050909247-1723169051
Opcode ID: 4c9aa2b483676384e804e53a8d95690ef88c2d8ea964f39277e7c51c21c7f2da
Instruction ID: fffb021cb0859bce1603157ceab84e8b4dc24533a985d1de0a2ec2638da767fb
Opcode Fuzzy Hash: 4c9aa2b483676384e804e53a8d95690ef88c2d8ea964f39277e7c51c21c7f2da
Instruction Fuzzy Hash: C542F332B08B8A82EA208F15E5447BD67A5FB49F84F584071DE8D877A9DF7CE685D300

Function 00007FF69B44CDE0 Relevance: 5.5, Strings: 4, Instructions: 508COMMON

Download Yara Rule

Strings

Blink.UseCounter, xrefs: 00007FF69B44D5C2
Histogram.TooManyBuckets.1000, xrefs: 00007FF69B44D5B4
Histogram.MismatchedConstructionArguments, xrefs: 00007FF69B44D522
Histogram.BadConstructionArguments, xrefs: 00007FF69B44D663

Memory Dump Source

Source File: 00000000.00000002.1667242761.00007FF69B331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69B330000, based on PE: true

Associated: 00000000.00000002.1667200836.00007FF69B330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667462352.00007FF69B51D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B55B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B569000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667608048.00007FF69B575000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667624939.00007FF69B589000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667639365.00007FF69B58A000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667689383.00007FF69B58B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69b330000_D8wwrB9ZCB.jbxd

Similarity

API ID: ExclusiveLock$AcquireRelease
String ID: Blink.UseCounter$Histogram.BadConstructionArguments$Histogram.MismatchedConstructionArguments$Histogram.TooManyBuckets.1000
API String ID: 17069307-749166131
Opcode ID: 37ff46faa4a9a07c89ff83e69b23cd0219c9c001d6eec71ed931c22080a3226c
Instruction ID: 9c637c44054548423e3c8d006c9ba20cfa2e47c1446e356d82662fa2404c8034
Opcode Fuzzy Hash: 37ff46faa4a9a07c89ff83e69b23cd0219c9c001d6eec71ed931c22080a3226c
Instruction Fuzzy Hash: 5322C532A0968A82EB30CF15D4402BDA392FB5DB84F548176DA4D937B9DF3CEA51D700

Function 00007FF69B48E51C Relevance: 5.5, APIs: 3, Instructions: 1005COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF69B48E952
_get_daylight.LIBCMT ref: 00007FF69B48E9ED
_get_daylight.LIBCMT ref: 00007FF69B48EA06

Memory Dump Source

Source File: 00000000.00000002.1667242761.00007FF69B331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69B330000, based on PE: true

Associated: 00000000.00000002.1667200836.00007FF69B330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667462352.00007FF69B51D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B55B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B569000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667608048.00007FF69B575000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667624939.00007FF69B589000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667639365.00007FF69B58A000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667689383.00007FF69B58B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69b330000_D8wwrB9ZCB.jbxd

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo
String ID:
API String ID: 1286766494-0
Opcode ID: 6eafe1162fedc6b3b8dfcf22d7c189e3d6314775f9dfbf2903ed81c617aff341
Instruction ID: 0d064275c0f8f84beaccbfba287c025cb999b54377797b43710b5e5cd5a0ed58
Opcode Fuzzy Hash: 6eafe1162fedc6b3b8dfcf22d7c189e3d6314775f9dfbf2903ed81c617aff341
Instruction Fuzzy Hash: CA92BF32A0864A86EB748F24D55017D37A1FB49B88F5441B5EB8D87BADDF3DE610E380

Function 00007FF69B451D40 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 140COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 00007FF69B451E7E

Strings

CountResidentBytes failed. The resident size is invalid, xrefs: 00007FF69B451F10
..\..\base\trace_event\process_memory_dump.cc, xrefs: 00007FF69B451EEB

Memory Dump Source

Source File: 00000000.00000002.1667242761.00007FF69B331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69B330000, based on PE: true

Associated: 00000000.00000002.1667200836.00007FF69B330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667462352.00007FF69B51D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B55B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B569000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667608048.00007FF69B575000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667624939.00007FF69B589000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667639365.00007FF69B58A000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667689383.00007FF69B58B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69b330000_D8wwrB9ZCB.jbxd

Similarity

API ID: CurrentProcess
String ID: ..\..\base\trace_event\process_memory_dump.cc$CountResidentBytes failed. The resident size is invalid
API String ID: 2050909247-2721434564
Opcode ID: 08984782372d5a5fe8349a554e1b7a6ddf47aafd4e2e0b7f0bd7ef111927d583
Instruction ID: 54b201f1ca2da5ae0c9b2fb9dbd6d9bf92ad22bfff3651006dcf20c3d7217fe1
Opcode Fuzzy Hash: 08984782372d5a5fe8349a554e1b7a6ddf47aafd4e2e0b7f0bd7ef111927d583
Instruction Fuzzy Hash: 75416B52F1895A42FB719B16A8013BA6681FF4DFC0F444071DE4EC3BA9EEACE646D700

Function 00007FF69B341ED0 Relevance: 5.4, Strings: 4, Instructions: 365COMMON

Download Yara Rule

Strings

shared_memory/, xrefs: 00007FF69B341F68
0x?, xrefs: 00007FF69B342216
AXPlatformNode, xrefs: 00007FF69B342308
global/, xrefs: 00007FF69B341EF8

Memory Dump Source

Source File: 00000000.00000002.1667242761.00007FF69B331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69B330000, based on PE: true

Associated: 00000000.00000002.1667200836.00007FF69B330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667462352.00007FF69B51D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B55B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B569000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667608048.00007FF69B575000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667624939.00007FF69B589000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667639365.00007FF69B58A000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667689383.00007FF69B58B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69b330000_D8wwrB9ZCB.jbxd

Similarity

API ID:
String ID: 0x?$AXPlatformNode$global/$shared_memory/
API String ID: 0-2893175800
Opcode ID: dc163390b98cb86f7cf17c86ae99131ac529347b285291db903bd8fb708814d1
Instruction ID: 04906b439b36e0f61996c7d2b75c119c40522150fecae551d7a870182837ead0
Opcode Fuzzy Hash: dc163390b98cb86f7cf17c86ae99131ac529347b285291db903bd8fb708814d1
Instruction Fuzzy Hash: 98D12821B2D69A41EE70CA52D840379A7A2EF4DB84F4441B9DE8DE77B5DE2EE245C300

Function 00007FF69B42BF70 Relevance: 5.3, Strings: 4, Instructions: 348COMMON

Download Yara Rule

Strings

UUUUUUUU, xrefs: 00007FF69B42BFC2
33333333, xrefs: 00007FF69B42C405
33333333, xrefs: 00007FF69B42BFD5
UUUUUUUU, xrefs: 00007FF69B42C3F2

Memory Dump Source

Source File: 00000000.00000002.1667242761.00007FF69B331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69B330000, based on PE: true

Associated: 00000000.00000002.1667200836.00007FF69B330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667462352.00007FF69B51D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B55B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B569000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667608048.00007FF69B575000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667624939.00007FF69B589000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667639365.00007FF69B58A000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667689383.00007FF69B58B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69b330000_D8wwrB9ZCB.jbxd

Similarity

API ID:
String ID: 33333333$33333333$UUUUUUUU$UUUUUUUU
API String ID: 0-1344069251
Opcode ID: 4f300027439de4ada26d2d572a087b11f9afabaa00a9dd1ba5bb8b2f3603ee46
Instruction ID: 85cc7b12537d29861fb55d0f9a7782f15cf19392128c4808f344ad6445a7be25
Opcode Fuzzy Hash: 4f300027439de4ada26d2d572a087b11f9afabaa00a9dd1ba5bb8b2f3603ee46
Instruction Fuzzy Hash: C8C10862B5A60D85EE348A5694013786291EF5DFD0F188571DE0ED73AAEE3CF682F300

Function 00007FF69B34BBF0 Relevance: 5.3, Strings: 4, Instructions: 316COMMON

Download Yara Rule

Strings

33333333, xrefs: 00007FF69B34BE09
33333333, xrefs: 00007FF69B34C003
UUUUUUUU, xrefs: 00007FF69B34BFF0
UUUUUUUU, xrefs: 00007FF69B34BDF6

Memory Dump Source

Source File: 00000000.00000002.1667242761.00007FF69B331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69B330000, based on PE: true

Associated: 00000000.00000002.1667200836.00007FF69B330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667462352.00007FF69B51D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B55B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B569000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667608048.00007FF69B575000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667624939.00007FF69B589000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667639365.00007FF69B58A000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667689383.00007FF69B58B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69b330000_D8wwrB9ZCB.jbxd

Similarity

API ID:
String ID: 33333333$33333333$UUUUUUUU$UUUUUUUU
API String ID: 0-1344069251
Opcode ID: ec4a2c8522911c7ae5386eb986b3abb6e1c3354c9207a38d189391f5036d0f2f
Instruction ID: 634ab3ec141648110df349a8efd735d3c3d3044751357161ece723c7b08e0656
Opcode Fuzzy Hash: ec4a2c8522911c7ae5386eb986b3abb6e1c3354c9207a38d189391f5036d0f2f
Instruction Fuzzy Hash: 8FB10562B1970E82EE25CF2694413783292EF5DBD0F08857ADE0D97765FF3DE6958200

Function 00007FF69B33FCD0 Relevance: 5.3, Strings: 4, Instructions: 313COMMON

Download Yara Rule

Strings

33333333, xrefs: 00007FF69B3400CE
33333333, xrefs: 00007FF69B33FEFD
UUUUUUUU, xrefs: 00007FF69B33FEEA
UUUUUUUU, xrefs: 00007FF69B3400BB

Memory Dump Source

Source File: 00000000.00000002.1667242761.00007FF69B331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69B330000, based on PE: true

Associated: 00000000.00000002.1667200836.00007FF69B330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667462352.00007FF69B51D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B55B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B569000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667608048.00007FF69B575000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667624939.00007FF69B589000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667639365.00007FF69B58A000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667689383.00007FF69B58B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69b330000_D8wwrB9ZCB.jbxd

Similarity

API ID:
String ID: 33333333$33333333$UUUUUUUU$UUUUUUUU
API String ID: 0-1344069251
Opcode ID: 80a97ebf5a18ab2dcb522d46ed07923bd64895561001eb4ee6ba298113b972de
Instruction ID: b30d9e28cc31ffb2d58e1a19be2febf108dae90bcee8cda862d3a1cb98182167
Opcode Fuzzy Hash: 80a97ebf5a18ab2dcb522d46ed07923bd64895561001eb4ee6ba298113b972de
Instruction Fuzzy Hash: E2B15962B1A74D82EE24CB26D8152392391EF5DFD0B88857ADE0D97765EF3CF2958200

Function 00007FF69B350F90 Relevance: 5.3, Strings: 4, Instructions: 293COMMON

Download Yara Rule

Strings

type, xrefs: 00007FF69B350FDF
no-sandbox, xrefs: 00007FF69B350FAC
service-sandbox-type, xrefs: 00007FF69B351076
disable-gpu-sandbox, xrefs: 00007FF69B3511DB

Memory Dump Source

Source File: 00000000.00000002.1667242761.00007FF69B331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69B330000, based on PE: true

Associated: 00000000.00000002.1667200836.00007FF69B330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667462352.00007FF69B51D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B55B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B569000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667608048.00007FF69B575000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667624939.00007FF69B589000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667639365.00007FF69B58A000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667689383.00007FF69B58B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69b330000_D8wwrB9ZCB.jbxd

Similarity

API ID:
String ID: disable-gpu-sandbox$no-sandbox$service-sandbox-type$type
API String ID: 0-1293740873
Opcode ID: a465f3fbfe08ad8eb4cac3db9517c47d2eac3d07397079a50db58a646f4e265a
Instruction ID: b544f91293ad94a12768a01cbbc9f1d3885c7c36e7767b430c3920340ebfa355
Opcode Fuzzy Hash: a465f3fbfe08ad8eb4cac3db9517c47d2eac3d07397079a50db58a646f4e265a
Instruction Fuzzy Hash: 1AC1B332A0DA8E82FA71CB11E5116796361EF9D780F0441BADE4ED3AB5DE7CEB458700

Function 00007FF69B3C7A10 Relevance: 4.8, APIs: 3, Instructions: 303COMMON

Download Yara Rule

APIs

TryAcquireSRWLockExclusive.KERNEL32(?,?,?,?,00007FF69B3C794F,?,-00001078,00000000,00000000,00000000,?,00000000,?,?,00007FF69B3C48A2), ref: 00007FF69B3C7A37

Memory Dump Source

Source File: 00000000.00000002.1667242761.00007FF69B331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69B330000, based on PE: true

Associated: 00000000.00000002.1667200836.00007FF69B330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667462352.00007FF69B51D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B55B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B569000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667608048.00007FF69B575000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667624939.00007FF69B589000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667639365.00007FF69B58A000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667689383.00007FF69B58B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69b330000_D8wwrB9ZCB.jbxd

Similarity

API ID: AcquireExclusiveLock
String ID:
API String ID: 4021432409-0
Opcode ID: 1acd7a408167f5d22894b4ae622f5c7498d351fc4d8cbfa473376d1f6f6db594
Instruction ID: a2d5f327d355a52aeadf4a7a2fe35fb3174439fa1bc776ea8dc4ce3dedd885f2
Opcode Fuzzy Hash: 1acd7a408167f5d22894b4ae622f5c7498d351fc4d8cbfa473376d1f6f6db594
Instruction Fuzzy Hash: 1DC1E322B1565982EB38CF65D85477933A1FB48BA0F154279EE2D877E4DF3CE6528300

Function 00007FF69B33CC90 Relevance: 4.6, APIs: 3, Instructions: 76COMMON

Download Yara Rule

APIs

GetVersionExW.KERNEL32 ref: 00007FF69B33CD30
GetProductInfo.KERNEL32 ref: 00007FF69B33CD52

Part of subcall function 00007FF69B460E1C: AcquireSRWLockExclusive.KERNEL32(?,?,?,00007FF69B49885B), ref: 00007FF69B460E2C

GetNativeSystemInfo.KERNEL32 ref: 00007FF69B33CDEB

Memory Dump Source

Source File: 00000000.00000002.1667242761.00007FF69B331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69B330000, based on PE: true

Associated: 00000000.00000002.1667200836.00007FF69B330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667462352.00007FF69B51D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B55B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B569000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667608048.00007FF69B575000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667624939.00007FF69B589000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667639365.00007FF69B58A000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667689383.00007FF69B58B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69b330000_D8wwrB9ZCB.jbxd

Similarity

API ID: Info$AcquireExclusiveLockNativeProductSystemVersion
String ID:
API String ID: 2776475993-0
Opcode ID: 38bdc5e0968cf6afcf35dac1d789bf40e2852fd2b05340d315eba1e0c0776088
Instruction ID: 57e154beaf81e4f986deda1aaf6fb3584d6b71013ed48a7bb159d3bda4584d7d
Opcode Fuzzy Hash: 38bdc5e0968cf6afcf35dac1d789bf40e2852fd2b05340d315eba1e0c0776088
Instruction Fuzzy Hash: E6412935E18A4EC6E621DF25E8507B93360FB8CB50F8045B5DA0D936B6EF2CAA56C700

Function 00007FF69B404B30 Relevance: 4.2, Strings: 3, Instructions: 488COMMON

Download Yara Rule

Strings

\u2029, xrefs: 00007FF69B4051B8
\u2028, xrefs: 00007FF69B4051AC
\u%04X, xrefs: 00007FF69B4051F4

Memory Dump Source

Source File: 00000000.00000002.1667242761.00007FF69B331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69B330000, based on PE: true

Associated: 00000000.00000002.1667200836.00007FF69B330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667462352.00007FF69B51D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B55B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B569000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667608048.00007FF69B575000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667624939.00007FF69B589000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667639365.00007FF69B58A000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667689383.00007FF69B58B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69b330000_D8wwrB9ZCB.jbxd

Similarity

API ID:
String ID: \u%04X$\u2028$\u2029
API String ID: 0-2740272883
Opcode ID: 4201f840ba19b415f82c6a9c4f41c12206f9601a10c5e036753ad1026193dbfb
Instruction ID: 64978999196c9fa7b15bcffe79272f7504f3e6c9abc5b7e1d9e6d3ca3d1b5aac
Opcode Fuzzy Hash: 4201f840ba19b415f82c6a9c4f41c12206f9601a10c5e036753ad1026193dbfb
Instruction Fuzzy Hash: FD025922B0C69985EB308E15D4502B92B61FB29FD8F044679DE1E87BE9DE7DE700E340

Function 00007FF69B488494 Relevance: 3.9, Strings: 3, Instructions: 195COMMON

Download Yara Rule

Strings

gfff, xrefs: 00007FF69B48861E
e+000, xrefs: 00007FF69B4885A1
-, xrefs: 00007FF69B4886D7

Memory Dump Source

Source File: 00000000.00000002.1667242761.00007FF69B331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69B330000, based on PE: true

Associated: 00000000.00000002.1667200836.00007FF69B330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667462352.00007FF69B51D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B55B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B569000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667608048.00007FF69B575000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667624939.00007FF69B589000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667639365.00007FF69B58A000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667689383.00007FF69B58B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69b330000_D8wwrB9ZCB.jbxd

Similarity

API ID:
String ID: -$e+000$gfff
API String ID: 0-2620144452
Opcode ID: 3ece1fca43ba067d80a1f4e015c7d3604150deb9e353b3d87d38af93686c165b
Instruction ID: b430869dc74d03fb66d89c5bfb8f029a99988c43b251a3d41d3340be9ac461ba
Opcode Fuzzy Hash: 3ece1fca43ba067d80a1f4e015c7d3604150deb9e353b3d87d38af93686c165b
Instruction Fuzzy Hash: 20710232B187C986E730CF25A80076A7791F748F94F488275DBA887BA9DF3DD6418B41

Function 00007FF69B491CF8 Relevance: 3.2, APIs: 2, Instructions: 227COMMON

Download Yara Rule

APIs

_clrfp.LIBCMT ref: 00007FF69B491F47
RaiseException.KERNEL32 ref: 00007FF69B491F58

Memory Dump Source

Source File: 00000000.00000002.1667242761.00007FF69B331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69B330000, based on PE: true

Associated: 00000000.00000002.1667200836.00007FF69B330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667462352.00007FF69B51D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B55B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B569000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667608048.00007FF69B575000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667624939.00007FF69B589000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667639365.00007FF69B58A000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667689383.00007FF69B58B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69b330000_D8wwrB9ZCB.jbxd

Similarity

API ID: ExceptionRaise_clrfp
String ID:
API String ID: 15204871-0
Opcode ID: 2b099e7683637feaee7d873359f9d2918217068b3fdd28b2770b2e824c94583a
Instruction ID: 482efd98add7f9b5e04390e617f41336c40b8d6fec61e9d148eeead77265ab32
Opcode Fuzzy Hash: 2b099e7683637feaee7d873359f9d2918217068b3fdd28b2770b2e824c94583a
Instruction Fuzzy Hash: E9B14A77604B898AEB25CF29C5463683BA0F788F48F188962DA5D877B8CF39D951D700

Function 00007FF69B4514B0 Relevance: 3.2, APIs: 2, Instructions: 220COMMON

Download Yara Rule

APIs

InitOnceExecuteOnce.KERNEL32 ref: 00007FF69B4515CF
InitOnceExecuteOnce.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 00007FF69B4516AD

Part of subcall function 00007FF69B4797E4: IsProcessorFeaturePresent.KERNEL32(?,?,?,?,00007FF69B466076), ref: 00007FF69B47980A

Part of subcall function 00007FF69B45F870: InitOnceExecuteOnce.KERNEL32(?,?,?,?,00000000,00007FF69B341E02), ref: 00007FF69B45F8A8

Memory Dump Source

Source File: 00000000.00000002.1667242761.00007FF69B331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69B330000, based on PE: true

Associated: 00000000.00000002.1667200836.00007FF69B330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667462352.00007FF69B51D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B55B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B569000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667608048.00007FF69B575000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667624939.00007FF69B589000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667639365.00007FF69B58A000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667689383.00007FF69B58B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69b330000_D8wwrB9ZCB.jbxd

Similarity

API ID: Once$ExecuteInit$FeaturePresentProcessor
String ID:
API String ID: 2832737215-0
Opcode ID: fb5b7c1ef09485a06cc88413642db35aeadb677818f9fb2bbd13c9ec92304b74
Instruction ID: 67ef4c75d639319f5a2728f6e054ad507eb426e87b81a4947f772ab6572b4c39
Opcode Fuzzy Hash: fb5b7c1ef09485a06cc88413642db35aeadb677818f9fb2bbd13c9ec92304b74
Instruction Fuzzy Hash: D391D661E1CA8A86FA30CB1990447B97350FF9DB90F504575EA8DC36BADEBDE3409B04

Function 00007FF69B42EC60 Relevance: 3.2, APIs: 2, Instructions: 217COMMON

Download Yara Rule

APIs

InitOnceExecuteOnce.KERNEL32 ref: 00007FF69B42ED6C
InitOnceExecuteOnce.KERNEL32 ref: 00007FF69B42EE4A

Part of subcall function 00007FF69B4797E4: IsProcessorFeaturePresent.KERNEL32(?,?,?,?,00007FF69B466076), ref: 00007FF69B47980A

Part of subcall function 00007FF69B45F870: InitOnceExecuteOnce.KERNEL32(?,?,?,?,00000000,00007FF69B341E02), ref: 00007FF69B45F8A8

Memory Dump Source

Source File: 00000000.00000002.1667242761.00007FF69B331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69B330000, based on PE: true

Associated: 00000000.00000002.1667200836.00007FF69B330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667462352.00007FF69B51D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B55B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B569000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667608048.00007FF69B575000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667624939.00007FF69B589000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667639365.00007FF69B58A000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667689383.00007FF69B58B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69b330000_D8wwrB9ZCB.jbxd

Similarity

API ID: Once$ExecuteInit$FeaturePresentProcessor
String ID:
API String ID: 2832737215-0
Opcode ID: c03721ba7572d99834cd50c5c2626c6d3e6632a7ab51e7d7de21ff2e6234358c
Instruction ID: d5e92bb8f8a836c60d33ad174341cc68b6b2e03016800137a3c0fd34add66e9c
Opcode Fuzzy Hash: c03721ba7572d99834cd50c5c2626c6d3e6632a7ab51e7d7de21ff2e6234358c
Instruction Fuzzy Hash: A391F961E2C68A85FA30CB1590447B97351FF9DB90F404575EA4DC3ABADE7DE341AB00

Function 00007FF69B35C440 Relevance: 2.9, Strings: 2, Instructions: 430COMMON

Download Yara Rule

Strings

0, xrefs: 00007FF69B35C927
0, xrefs: 00007FF69B35C763

Memory Dump Source

Source File: 00000000.00000002.1667242761.00007FF69B331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69B330000, based on PE: true

Associated: 00000000.00000002.1667200836.00007FF69B330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667462352.00007FF69B51D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B55B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B569000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667608048.00007FF69B575000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667624939.00007FF69B589000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667639365.00007FF69B58A000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667689383.00007FF69B58B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69b330000_D8wwrB9ZCB.jbxd

Similarity

API ID:
String ID: 0$0
API String ID: 0-203156872
Opcode ID: 182f68e9f1df14107cf1238dd349f6a7165c03b5f3be182dfba1ce8f8ea704ea
Instruction ID: 33afdaf33c56d1a743a0ca494745556711abf29c4e16d25c12e965a48ab380b2
Opcode Fuzzy Hash: 182f68e9f1df14107cf1238dd349f6a7165c03b5f3be182dfba1ce8f8ea704ea
Instruction Fuzzy Hash: 7712803260878A86DB31CF28E09027AB7A0FB98744F54467AD78E87765DFBDE205C744

Function 00007FF69B48F408 Relevance: 2.9, Strings: 2, Instructions: 358COMMON

Download Yara Rule

Strings

am/pm, xrefs: 00007FF69B48F6B7
a/p, xrefs: 00007FF69B48F722

Memory Dump Source

Source File: 00000000.00000002.1667242761.00007FF69B331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69B330000, based on PE: true

Associated: 00000000.00000002.1667200836.00007FF69B330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667462352.00007FF69B51D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B55B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B569000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667608048.00007FF69B575000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667624939.00007FF69B589000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667639365.00007FF69B58A000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667689383.00007FF69B58B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69b330000_D8wwrB9ZCB.jbxd

Similarity

API ID:
String ID: a/p$am/pm
API String ID: 0-3206640213
Opcode ID: 0f2d024aa734355a90a905f7648f089a07f642c114d33e14be984e5f16d6fe09
Instruction ID: 190065590184923eb5cb2a9cbe553374e08f25aeec08e2b486f8caa1154a0b68
Opcode Fuzzy Hash: 0f2d024aa734355a90a905f7648f089a07f642c114d33e14be984e5f16d6fe09
Instruction Fuzzy Hash: 39E1A222E0824A81FB749F6591545BD23A0FF59B84F544972EA4D87ABCDF3CEB41E380

Function 00007FF69B46BB78 Relevance: 2.8, Strings: 2, Instructions: 350COMMON

Download Yara Rule

Strings

, xrefs: 00007FF69B46BF28
, xrefs: 00007FF69B46BCE6

Memory Dump Source

Source File: 00000000.00000002.1667242761.00007FF69B331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69B330000, based on PE: true

Associated: 00000000.00000002.1667200836.00007FF69B330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667462352.00007FF69B51D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B55B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B569000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667608048.00007FF69B575000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667624939.00007FF69B589000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667639365.00007FF69B58A000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667689383.00007FF69B58B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69b330000_D8wwrB9ZCB.jbxd

Similarity

API ID:
String ID: $
API String ID: 0-227171996
Opcode ID: 0eab074191acc989c3508c956463019fdea3a0faf157e90e6e3a54c125fbcc17
Instruction ID: f3eab9913a848a6e3c7bfb98c143e2c9adc4091caa640988016a549a8a58e0e5
Opcode Fuzzy Hash: 0eab074191acc989c3508c956463019fdea3a0faf157e90e6e3a54c125fbcc17
Instruction Fuzzy Hash: 56E18F32A08A4AC2EB788F25815213D33A0FF49F48F145275DA4E877B9DF39EA41E740

Function 00007FF69B34B9D0 Relevance: 2.7, Strings: 2, Instructions: 157COMMON

Download Yara Rule

Strings

33333333, xrefs: 00007FF69B34BA6B
UUUUUUUU, xrefs: 00007FF69B34BA58

Memory Dump Source

Source File: 00000000.00000002.1667242761.00007FF69B331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69B330000, based on PE: true

Associated: 00000000.00000002.1667200836.00007FF69B330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667462352.00007FF69B51D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B55B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B569000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667608048.00007FF69B575000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667624939.00007FF69B589000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667639365.00007FF69B58A000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667689383.00007FF69B58B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69b330000_D8wwrB9ZCB.jbxd

Similarity

API ID:
String ID: 33333333$UUUUUUUU
API String ID: 0-3483174168
Opcode ID: 7a648b2f87da677899298779fb45458298fe9592527f6895b57ed3e217182eee
Instruction ID: a61aae5c12e4461de73ec5b9f60e27fe57f8289b43fa1f1a865c6289719a1f36
Opcode Fuzzy Hash: 7a648b2f87da677899298779fb45458298fe9592527f6895b57ed3e217182eee
Instruction Fuzzy Hash: 7851C212B0968E40ED74CB02851463A3756EF5CBD0B4884BADE4E877A5FF7EF6548300

Function 00007FF69B3F7FA0 Relevance: 2.1, APIs: 1, Instructions: 579COMMON

Download Yara Rule

APIs

InitOnceExecuteOnce.KERNEL32 ref: 00007FF69B3F8114

Memory Dump Source

Source File: 00000000.00000002.1667242761.00007FF69B331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69B330000, based on PE: true

Associated: 00000000.00000002.1667200836.00007FF69B330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667462352.00007FF69B51D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B55B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B569000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667608048.00007FF69B575000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667624939.00007FF69B589000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667639365.00007FF69B58A000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667689383.00007FF69B58B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69b330000_D8wwrB9ZCB.jbxd

Similarity

API ID: Once$ExecuteInit
String ID:
API String ID: 689400697-0
Opcode ID: 58ace79c4f25dcab9fe812ee158c31771e2f9d3a44b472bf9c6456037ac62e2b
Instruction ID: 55117c8cfaf72b43085861eca1784bee2e1ffafcc21e71f3bd69af861ad133cb
Opcode Fuzzy Hash: 58ace79c4f25dcab9fe812ee158c31771e2f9d3a44b472bf9c6456037ac62e2b
Instruction Fuzzy Hash: D52203B272829587E735CF5AD850AAA7B61F35DBC9F016234DF0A47B55CA3EE601CB00

Function 00007FF69B347460 Relevance: 1.9, Strings: 1, Instructions: 636COMMON

Download Yara Rule

Strings

SequenceManager, xrefs: 00007FF69B347F6F

Memory Dump Source

Source File: 00000000.00000002.1667242761.00007FF69B331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69B330000, based on PE: true

Associated: 00000000.00000002.1667200836.00007FF69B330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667462352.00007FF69B51D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B55B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B569000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667608048.00007FF69B575000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667624939.00007FF69B589000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667639365.00007FF69B58A000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667689383.00007FF69B58B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69b330000_D8wwrB9ZCB.jbxd

Similarity

API ID:
String ID: SequenceManager
API String ID: 0-545251665
Opcode ID: 9da45c52086e4c16472ba8a4fc65b4654a451fb19bb6771efcf9c6224d0ff606
Instruction ID: 7018efefb2daf61657a362c17fadc3bd59228b0dacc1bbff4af463d103d99232
Opcode Fuzzy Hash: 9da45c52086e4c16472ba8a4fc65b4654a451fb19bb6771efcf9c6224d0ff606
Instruction Fuzzy Hash: 75626F32A09B89C1EA75CB25E4543B973A2FB48B94F504576DA5E833B1DF3EE685C300

Function 00007FF69B48B9E8 Relevance: 1.5, APIs: 1, Instructions: 41COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF69B4858B4: GetLastError.KERNEL32 ref: 00007FF69B4858C3
Part of subcall function 00007FF69B4858B4: FlsGetValue.KERNEL32 ref: 00007FF69B4858D8
Part of subcall function 00007FF69B4858B4: SetLastError.KERNEL32 ref: 00007FF69B485963

EnumSystemLocalesW.KERNEL32(?,?,?,00007FF69B48B48B,?,00000000,00000092,?,?,00000000,?,00007FF69B474FE1), ref: 00007FF69B48BA66

Memory Dump Source

Source File: 00000000.00000002.1667242761.00007FF69B331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69B330000, based on PE: true

Associated: 00000000.00000002.1667200836.00007FF69B330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667462352.00007FF69B51D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B55B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B569000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667608048.00007FF69B575000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667624939.00007FF69B589000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667639365.00007FF69B58A000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667689383.00007FF69B58B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69b330000_D8wwrB9ZCB.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystemValue
String ID:
API String ID: 3029459697-0
Opcode ID: 4368ee09a1e546e80413a569d9bcce9772de90140e60d654c5f5182025663f49
Instruction ID: 8e3edce19a5706b78426c06c61ca57428a7f50886e2d4e1c515f5cc673d2548e
Opcode Fuzzy Hash: 4368ee09a1e546e80413a569d9bcce9772de90140e60d654c5f5182025663f49
Instruction Fuzzy Hash: CC01F562F082898AE7304F15E4407B972E1EB48FA0F45D271C679876E8CF799681E740

Function 00007FF69B486B68 Relevance: 1.5, APIs: 1, Instructions: 32COMMON

Download Yara Rule

APIs

EnumSystemLocalesW.KERNEL32(?,?,00000000,00007FF69B486243,?,?,?,?,?,?,?,?,00000000,00007FF69B48B0F4), ref: 00007FF69B486BB7

Memory Dump Source

Source File: 00000000.00000002.1667242761.00007FF69B331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69B330000, based on PE: true

Associated: 00000000.00000002.1667200836.00007FF69B330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667462352.00007FF69B51D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B55B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B569000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667608048.00007FF69B575000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667624939.00007FF69B589000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667639365.00007FF69B58A000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667689383.00007FF69B58B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69b330000_D8wwrB9ZCB.jbxd

Similarity

API ID: EnumLocalesSystem
String ID:
API String ID: 2099609381-0
Opcode ID: 1c8c411eff62937f836fb9b45779f2fd429c42ba343e8702f00b6d3daa5735c9
Instruction ID: 7f5a9ab66eab2c9648ca0e471831a7e890db8a968be5590bd3ad7948d6295eec
Opcode Fuzzy Hash: 1c8c411eff62937f836fb9b45779f2fd429c42ba343e8702f00b6d3daa5735c9
Instruction Fuzzy Hash: F0F08C72B18B4982E720DF19E8901A93361EB8CB80F148075DA1DC737ADE3CD6608340

Function 00007FF69B441E90 Relevance: .7, Instructions: 692COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1667242761.00007FF69B331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69B330000, based on PE: true

Associated: 00000000.00000002.1667200836.00007FF69B330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667462352.00007FF69B51D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B55B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B569000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667608048.00007FF69B575000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667624939.00007FF69B589000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667639365.00007FF69B58A000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667689383.00007FF69B58B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69b330000_D8wwrB9ZCB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1909e373a9e2755b09cfffaee63304e8a9301e48df3f8c59c93165bca77e37cd
Instruction ID: 238489dad467606ff347dbe13a4ff75c800a8c340f76335eecc472031ba8e0e5
Opcode Fuzzy Hash: 1909e373a9e2755b09cfffaee63304e8a9301e48df3f8c59c93165bca77e37cd
Instruction Fuzzy Hash: 59424922B28AA986DB34CF65A4057B9A792F788FD0F454231DE5D83BA8DE3CD611D700

Function 00007FF69B43F090 Relevance: .5, Instructions: 498COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1667242761.00007FF69B331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69B330000, based on PE: true

Associated: 00000000.00000002.1667200836.00007FF69B330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667462352.00007FF69B51D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B55B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B569000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667608048.00007FF69B575000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667624939.00007FF69B589000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667639365.00007FF69B58A000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667689383.00007FF69B58B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69b330000_D8wwrB9ZCB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1ad3505c6b88f1850bfb1aeeff926e4c9e9873e60df47dd827f7cd665573d43
Instruction ID: 7348561bf301edb7e3856330b63d2b01544b44e49a690b0315143c9352b73dd0
Opcode Fuzzy Hash: e1ad3505c6b88f1850bfb1aeeff926e4c9e9873e60df47dd827f7cd665573d43
Instruction Fuzzy Hash: 37225D12A1DB9981EA368B35D5013B9A760EF59BC0F44C336EE9DA36F5DF2DE2419300

Function 00007FF69B35CAD0 Relevance: .5, Instructions: 488COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1667242761.00007FF69B331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69B330000, based on PE: true

Associated: 00000000.00000002.1667200836.00007FF69B330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667462352.00007FF69B51D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B55B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B569000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667608048.00007FF69B575000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667624939.00007FF69B589000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667639365.00007FF69B58A000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667689383.00007FF69B58B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69b330000_D8wwrB9ZCB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c3379240a0ed71cb0a3b16ec5f2cad1b1bf1c8406c3e4fe89e761dbd624f682
Instruction ID: 950c3aa042baf0cca6e63335993f52c07940a469ead73a5d50427b459b6ec767
Opcode Fuzzy Hash: 3c3379240a0ed71cb0a3b16ec5f2cad1b1bf1c8406c3e4fe89e761dbd624f682
Instruction Fuzzy Hash: 5322C57262C68A85EA30DB25D4403BAA351FBC8B84F404179DE8EC7BA9DF7DD641CB44

Function 00007FF69B4CF360 Relevance: .4, Instructions: 380COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1667242761.00007FF69B331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69B330000, based on PE: true

Associated: 00000000.00000002.1667200836.00007FF69B330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667462352.00007FF69B51D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B55B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B569000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667608048.00007FF69B575000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667624939.00007FF69B589000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667639365.00007FF69B58A000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667689383.00007FF69B58B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69b330000_D8wwrB9ZCB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1547ed902871584d95bcd20b70e16a49807f110cdac380b3c70a674a5c86470c
Instruction ID: f04f638d6e6d7fbf6c0494aab873991d2ba45f9a3235bef617aee0a8feb7a485
Opcode Fuzzy Hash: 1547ed902871584d95bcd20b70e16a49807f110cdac380b3c70a674a5c86470c
Instruction Fuzzy Hash: A4E15973615A8946EB24CB78D1917B97BA4E799F80F459226CB0AC77A5DF3CC219C300

Function 00007FF69B474E30 Relevance: .3, Instructions: 339COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1667242761.00007FF69B331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69B330000, based on PE: true

Associated: 00000000.00000002.1667200836.00007FF69B330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667462352.00007FF69B51D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B55B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B569000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667608048.00007FF69B575000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667624939.00007FF69B589000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667639365.00007FF69B58A000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667689383.00007FF69B58B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69b330000_D8wwrB9ZCB.jbxd

Similarity

API ID: ErrorLastNameTranslate$CodePageValidValue_invalid_parameter_noinfo
String ID:
API String ID: 4023145424-0
Opcode ID: c40cef7ba106f5ee40f9fc94351b6cb0374ea1b81c823abdd2ad8917df1a7b5a
Instruction ID: d31054815c2b44305b8cb857a35f79d3e7aa68894819f27287d7116863e31edf
Opcode Fuzzy Hash: c40cef7ba106f5ee40f9fc94351b6cb0374ea1b81c823abdd2ad8917df1a7b5a
Instruction Fuzzy Hash: 80D1F526B0868A45EB709B6198907BE23A0FB98F88F404075DE8DCB6EDDF7CD645D740

Function 00007FF69B4CF9A0 Relevance: .3, Instructions: 290COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1667242761.00007FF69B331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69B330000, based on PE: true

Associated: 00000000.00000002.1667200836.00007FF69B330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667462352.00007FF69B51D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B55B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B569000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667608048.00007FF69B575000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667624939.00007FF69B589000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667639365.00007FF69B58A000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667689383.00007FF69B58B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69b330000_D8wwrB9ZCB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7944232e0ee307b0ff0f2fd5a04fa59ef7244868ed2d4ad3a2c07e599d293631
Instruction ID: d0c7b6537125101652d1470474762f294d648547fab16e195eca1dd9a035fc52
Opcode Fuzzy Hash: 7944232e0ee307b0ff0f2fd5a04fa59ef7244868ed2d4ad3a2c07e599d293631
Instruction Fuzzy Hash: A3B17DB772169486DB348F6CF081E98AF16D3A4B84F45E332C64547BA5CA3E920AC740

Function 00007FF69B46F474 Relevance: .3, Instructions: 287COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1667242761.00007FF69B331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69B330000, based on PE: true

Associated: 00000000.00000002.1667200836.00007FF69B330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667462352.00007FF69B51D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B55B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B569000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667608048.00007FF69B575000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667624939.00007FF69B589000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667639365.00007FF69B58A000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667689383.00007FF69B58B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69b330000_D8wwrB9ZCB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4207f1793b8e9ea13b36b495ad5dae1524827c889cfbdecd1f6d835fcf45b2c8
Instruction ID: 07e51c8aff7688fecaf62b71a17f8736d842b72f66c3f572fca5a68eb18c5105
Opcode Fuzzy Hash: 4207f1793b8e9ea13b36b495ad5dae1524827c889cfbdecd1f6d835fcf45b2c8
Instruction Fuzzy Hash: 8A912726B1864AC6EA384E2994103BD3690EF58F54F050579DDDEC77EDDE2CEA06AB00

Function 00007FF69B3394D0 Relevance: .2, Instructions: 215COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1667242761.00007FF69B331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69B330000, based on PE: true

Associated: 00000000.00000002.1667200836.00007FF69B330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667462352.00007FF69B51D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B55B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B569000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667608048.00007FF69B575000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667624939.00007FF69B589000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667639365.00007FF69B58A000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667689383.00007FF69B58B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69b330000_D8wwrB9ZCB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f36d2b2a4803f5b27d55139644b7f56e47494c2a6c698f7d729f35bbbdf3344
Instruction ID: 61b696e3b36b9746e628cffe88292078e53d0a913eae0808249dfe98ebaf7dbd
Opcode Fuzzy Hash: 0f36d2b2a4803f5b27d55139644b7f56e47494c2a6c698f7d729f35bbbdf3344
Instruction Fuzzy Hash: 8E810326E1928A86FA34CF25914C77A2791EB4CB94FD58379D91E823F5DE3CE6818700

Function 00007FF69B480510 Relevance: .2, Instructions: 205COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1667242761.00007FF69B331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69B330000, based on PE: true

Associated: 00000000.00000002.1667200836.00007FF69B330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667462352.00007FF69B51D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B55B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B569000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667608048.00007FF69B575000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667624939.00007FF69B589000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667639365.00007FF69B58A000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667689383.00007FF69B58B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69b330000_D8wwrB9ZCB.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 33d62c48f65c978bf7b7c0d47367023051245f2c4af07c2c0134f3e2cdcc7a1b
Instruction ID: 9482931eb12e0f2b442fa53451e34e66838fdde0d2d70113972c5602fbfbce34
Opcode Fuzzy Hash: 33d62c48f65c978bf7b7c0d47367023051245f2c4af07c2c0134f3e2cdcc7a1b
Instruction Fuzzy Hash: FF81A032A14A5982EB74CE69D09137D2360FB88FE4F148676EE5E877A9CF3CD2419740

Function 00007FF69B35DAE0 Relevance: .2, Instructions: 158COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1667242761.00007FF69B331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69B330000, based on PE: true

Associated: 00000000.00000002.1667200836.00007FF69B330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667462352.00007FF69B51D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B55B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B569000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667608048.00007FF69B575000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667624939.00007FF69B589000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667639365.00007FF69B58A000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667689383.00007FF69B58B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69b330000_D8wwrB9ZCB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca656c50f35c6ea83cf7d8e6b4251de73692da53f1f7531062bcf2bfd388a026
Instruction ID: c6fb2951bb01f75bd20c0613db75acfbad513be3081aadfbc3be989fd94f43b9
Opcode Fuzzy Hash: ca656c50f35c6ea83cf7d8e6b4251de73692da53f1f7531062bcf2bfd388a026
Instruction Fuzzy Hash: C351F3A2B2815E03FB78CE159501F795582DFA8784F00917CDE5FDBBE1DDADAA408308

Function 00007FF69B3C3050 Relevance: .2, Instructions: 155COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1667242761.00007FF69B331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69B330000, based on PE: true

Associated: 00000000.00000002.1667200836.00007FF69B330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667462352.00007FF69B51D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B55B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B569000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667608048.00007FF69B575000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667624939.00007FF69B589000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667639365.00007FF69B58A000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667689383.00007FF69B58B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69b330000_D8wwrB9ZCB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4612458c1986f5f448d0e6d3523fa93740d14a4bc993b9cfc870d087807a333b
Instruction ID: a3f0d5af015add79c25ee0f140e3acc766456b1de7aa0e7ad655f53486127017
Opcode Fuzzy Hash: 4612458c1986f5f448d0e6d3523fa93740d14a4bc993b9cfc870d087807a333b
Instruction Fuzzy Hash: 54413462F191BA44FF35D99189122796A41EB0DBD0F45A579CD0FB37E0CE7DAA428340

Function 00007FF69B46DC8C Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1667242761.00007FF69B331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69B330000, based on PE: true

Associated: 00000000.00000002.1667200836.00007FF69B330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667462352.00007FF69B51D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B55B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B569000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667608048.00007FF69B575000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667624939.00007FF69B589000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667639365.00007FF69B58A000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667689383.00007FF69B58B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69b330000_D8wwrB9ZCB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 097bcd9e653a97e9ff42800b6ff2947f7e7d9555b8134d8a29c874862d53dfa5
Instruction ID: 7b0a43122f87e350ce94000918d10dbccdb2f62d73ac9ab770de1425037a264f
Opcode Fuzzy Hash: 097bcd9e653a97e9ff42800b6ff2947f7e7d9555b8134d8a29c874862d53dfa5
Instruction Fuzzy Hash: CA516076A18A59C2E7348F29D45022833A0FB59F58F245171CA4D877ACDF3AED43D740

Function 00007FF69B46DA80 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1667242761.00007FF69B331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69B330000, based on PE: true

Associated: 00000000.00000002.1667200836.00007FF69B330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667462352.00007FF69B51D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B55B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B569000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667608048.00007FF69B575000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667624939.00007FF69B589000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667639365.00007FF69B58A000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667689383.00007FF69B58B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69b330000_D8wwrB9ZCB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83905fc0cbd9dd29f134ca30cb7b50cd92a0eb3a630676c41219eaaad6937f45
Instruction ID: 034442aa214b6676811454de68f31a85c428ee39798d966416826aaff38dbd76
Opcode Fuzzy Hash: 83905fc0cbd9dd29f134ca30cb7b50cd92a0eb3a630676c41219eaaad6937f45
Instruction Fuzzy Hash: F2516D76A18659C6E7348B29C84023937A0FB4CF68F244171CA4D977BCDF7AEA42E740

Function 00007FF69B46DE98 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1667242761.00007FF69B331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69B330000, based on PE: true

Associated: 00000000.00000002.1667200836.00007FF69B330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667462352.00007FF69B51D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B55B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B569000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667608048.00007FF69B575000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667624939.00007FF69B589000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667639365.00007FF69B58A000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667689383.00007FF69B58B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69b330000_D8wwrB9ZCB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8bdaa76a08c4e62361580dfd696641c2e4baeeb036809ff83f42da98f6e53708
Instruction ID: bce83f62532db0ce07f1c9078d7492efa2d13d853b41986cd2b44a695ca74ef0
Opcode Fuzzy Hash: 8bdaa76a08c4e62361580dfd696641c2e4baeeb036809ff83f42da98f6e53708
Instruction Fuzzy Hash: 11517176A18A59C6E7388B29C44022933A0FB5DF58F244171DA4D877A8DF3AEA43D780

Function 00007FF69B469B70 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1667242761.00007FF69B331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69B330000, based on PE: true

Associated: 00000000.00000002.1667200836.00007FF69B330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667462352.00007FF69B51D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B55B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B569000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667608048.00007FF69B575000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667624939.00007FF69B589000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667639365.00007FF69B58A000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667689383.00007FF69B58B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69b330000_D8wwrB9ZCB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c5c004e2df5c3a80d7c1f81354bf5de8acbfaf03b192535d376734c3085a5735
Instruction ID: 43453d968b653ea1fc67914eca534aec2debbe92e3e0d84bd08235b552fd55b5
Opcode Fuzzy Hash: c5c004e2df5c3a80d7c1f81354bf5de8acbfaf03b192535d376734c3085a5735
Instruction Fuzzy Hash: A3518E76A18659C6EB348B29C04823C37A0EB4CF58F244171CA4D977A8DF7AEE52E740

Function 00007FF69B469F78 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1667242761.00007FF69B331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69B330000, based on PE: true

Associated: 00000000.00000002.1667200836.00007FF69B330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667462352.00007FF69B51D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B55B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B569000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667608048.00007FF69B575000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667624939.00007FF69B589000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667639365.00007FF69B58A000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667689383.00007FF69B58B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69b330000_D8wwrB9ZCB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b3b4ab688e12a359a2da555cc4a7728bdda3392c0af10d4bca13ed12d69b30e0
Instruction ID: ba5f810c3262e25320e655cf0cc6218d078c6dc26544eb0ddc0eb111ceefcfa4
Opcode Fuzzy Hash: b3b4ab688e12a359a2da555cc4a7728bdda3392c0af10d4bca13ed12d69b30e0
Instruction Fuzzy Hash: D151A176A18A5EC6EB348F29C04423937A0EB4DF58F244171DE4D877A9CF3AEA42D740

Function 00007FF69B469D74 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1667242761.00007FF69B331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69B330000, based on PE: true

Associated: 00000000.00000002.1667200836.00007FF69B330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667462352.00007FF69B51D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B55B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B569000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667608048.00007FF69B575000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667624939.00007FF69B589000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667639365.00007FF69B58A000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667689383.00007FF69B58B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69b330000_D8wwrB9ZCB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0629603974052f935769c691db8c32fb63967237dc5be3ce639e881de59d41cb
Instruction ID: 61694147ed01ba76c81fd6578ee86247abf890a4ae48e3752d46bfb4d143c4b6
Opcode Fuzzy Hash: 0629603974052f935769c691db8c32fb63967237dc5be3ce639e881de59d41cb
Instruction Fuzzy Hash: A4517076A18659C6EB348B29C04832837A1EB4DF58F244171CA4D877A8CF7AEE53D780

Function 00007FF69B46A380 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1667242761.00007FF69B331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69B330000, based on PE: true

Associated: 00000000.00000002.1667200836.00007FF69B330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667462352.00007FF69B51D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B55B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B569000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667608048.00007FF69B575000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667624939.00007FF69B589000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667639365.00007FF69B58A000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667689383.00007FF69B58B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69b330000_D8wwrB9ZCB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 51ba8060065acd672e1a2af43a9582c8118b6a9c2df94378cc1edc7104c7b15b
Instruction ID: 86a7f7f825726a5593cb30f64b5bef6d5b8d8bb270e666cacaeaebdf5a5b973c
Opcode Fuzzy Hash: 51ba8060065acd672e1a2af43a9582c8118b6a9c2df94378cc1edc7104c7b15b
Instruction Fuzzy Hash: BD517232A18A69C5E7348B29C44423D37A0EB4DF58F245171CA4C977B8CF3AEE82D740

Function 00007FF69B4CFE20 Relevance: .1, Instructions: 139COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1667242761.00007FF69B331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69B330000, based on PE: true

Associated: 00000000.00000002.1667200836.00007FF69B330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667462352.00007FF69B51D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B55B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B569000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667608048.00007FF69B575000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667624939.00007FF69B589000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667639365.00007FF69B58A000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667689383.00007FF69B58B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69b330000_D8wwrB9ZCB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0393f52c5331b356621a73994971e53b483a9fba4472f58c1e21cdab0993a5b0
Instruction ID: e8546c98c664a96d27f5714be8e0e29343fe6cc5ffa36a8cbb54e6a16969cecb
Opcode Fuzzy Hash: 0393f52c5331b356621a73994971e53b483a9fba4472f58c1e21cdab0993a5b0
Instruction Fuzzy Hash: 36412322B1959943EA398E24A4101F86351FB98F90B459136DE1E93BE9DF3CEE4ED300

Function 00007FF69B4769CC Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1667242761.00007FF69B331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69B330000, based on PE: true

Associated: 00000000.00000002.1667200836.00007FF69B330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667462352.00007FF69B51D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B55B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B569000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667608048.00007FF69B575000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667624939.00007FF69B589000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667639365.00007FF69B58A000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667689383.00007FF69B58B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69b330000_D8wwrB9ZCB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 51dad4bfd7f62f656476d3471edc331cb9377d800a69f4d9d692b700109e0bee
Instruction ID: c41b6473e9399b275a26cfb9ba8491f4fc598aac1adc67c7202438fd517cca67
Opcode Fuzzy Hash: 51dad4bfd7f62f656476d3471edc331cb9377d800a69f4d9d692b700109e0bee
Instruction Fuzzy Hash: 7841C462714A5D82EF14CF6AE954169B3A2FB4CFD0B499036DE0DD7B68EE7CD1418304

Function 00007FF69B3C43A0 Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1667242761.00007FF69B331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69B330000, based on PE: true

Associated: 00000000.00000002.1667200836.00007FF69B330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667462352.00007FF69B51D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B55B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B569000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667608048.00007FF69B575000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667624939.00007FF69B589000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667639365.00007FF69B58A000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667689383.00007FF69B58B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69b330000_D8wwrB9ZCB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 946132d726500fa8f9ed83a1eba8b2563b52f771307af75aa874ef7284f70f81
Instruction ID: eb4efd78b576da5ef98eeca24563a6cc8eed916abf94778e417884a5b118b7a5
Opcode Fuzzy Hash: 946132d726500fa8f9ed83a1eba8b2563b52f771307af75aa874ef7284f70f81
Instruction Fuzzy Hash: 0D313D10F4963E41FE799BA669642351282EF4CF91F1844BCCC1DC7BB6DE3CBA565200

Function 00007FF69B3724D0 Relevance: 57.9, APIs: 1, Strings: 32, Instructions: 149COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(?,?,?,?,?,?,?,00007FF69B45261C), ref: 00007FF69B372518

Strings

NtQueryFullAttributesFile, xrefs: 00007FF69B372623
NtProtectVirtualMemory, xrefs: 00007FF69B3725F7
_strnicmp, xrefs: 00007FF69B372783
memcpy, xrefs: 00007FF69B3727C5
NtUnmapViewOfSection, xrefs: 00007FF69B3726BD
RtlNtStatusToDosError, xrefs: 00007FF69B37276D
strlen, xrefs: 00007FF69B372799
RtlCreateHeap, xrefs: 00007FF69B37272B
RtlCompareUnicodeString, xrefs: 00007FF69B372715
wcslen, xrefs: 00007FF69B3727AF
NtQuerySection, xrefs: 00007FF69B372665
NtCreateFile, xrefs: 00007FF69B372547
NtSetInformationFile, xrefs: 00007FF69B372691
NtQueryAttributesFile, xrefs: 00007FF69B37260D
NtMapViewOfSection, xrefs: 00007FF69B3725B5
RtlFreeHeap, xrefs: 00007FF69B372757
NtAllocateVirtualMemory, xrefs: 00007FF69B372531
NtDuplicateObject, xrefs: 00007FF69B372589
NtQueryVirtualMemory, xrefs: 00007FF69B37267B
ntdll.dll, xrefs: 00007FF69B372511
NtSignalAndWaitForSingleObject, xrefs: 00007FF69B3726A7
NtCreateSection, xrefs: 00007FF69B37255D
NtQueryInformationProcess, xrefs: 00007FF69B372639
NtFreeVirtualMemory, xrefs: 00007FF69B37259F
RtlDestroyHeap, xrefs: 00007FF69B372741
NtWaitForSingleObject, xrefs: 00007FF69B3726D3
NtQueryObject, xrefs: 00007FF69B37264F
NtOpenProcessTokenEx, xrefs: 00007FF69B3725E1
RtlAllocateHeap, xrefs: 00007FF69B3726E9
NtClose, xrefs: 00007FF69B372573
RtlAnsiStringToUnicodeString, xrefs: 00007FF69B3726FF
NtOpenThread, xrefs: 00007FF69B3725CB

Memory Dump Source

Source File: 00000000.00000002.1667242761.00007FF69B331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69B330000, based on PE: true

Associated: 00000000.00000002.1667200836.00007FF69B330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667462352.00007FF69B51D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B55B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B569000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667608048.00007FF69B575000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667624939.00007FF69B589000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667639365.00007FF69B58A000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667689383.00007FF69B58B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69b330000_D8wwrB9ZCB.jbxd

Similarity

API ID: HandleModule
String ID: NtAllocateVirtualMemory$NtClose$NtCreateFile$NtCreateSection$NtDuplicateObject$NtFreeVirtualMemory$NtMapViewOfSection$NtOpenProcessTokenEx$NtOpenThread$NtProtectVirtualMemory$NtQueryAttributesFile$NtQueryFullAttributesFile$NtQueryInformationProcess$NtQueryObject$NtQuerySection$NtQueryVirtualMemory$NtSetInformationFile$NtSignalAndWaitForSingleObject$NtUnmapViewOfSection$NtWaitForSingleObject$RtlAllocateHeap$RtlAnsiStringToUnicodeString$RtlCompareUnicodeString$RtlCreateHeap$RtlDestroyHeap$RtlFreeHeap$RtlNtStatusToDosError$_strnicmp$memcpy$ntdll.dll$strlen$wcslen
API String ID: 4139908857-3460877470
Opcode ID: 9f0c4c0d378541f33f5fa136a3994349ff4f4052654a26a81cda2449c307b366
Instruction ID: 32b97e8a57c53878f3327fbb785dcd18db5807bc4551442c5a19edb047ec59d4
Opcode Fuzzy Hash: 9f0c4c0d378541f33f5fa136a3994349ff4f4052654a26a81cda2449c307b366
Instruction Fuzzy Hash: DA81D960E0DA0E82FA65EF52E8911B633D2EF4DB40F4485B5D84D87772DFACA3168344

Function 00007FF69B43BC30 Relevance: 30.2, APIs: 12, Strings: 5, Instructions: 477threadCOMMON

Download Yara Rule

APIs

TryAcquireSRWLockExclusive.KERNEL32 ref: 00007FF69B43BD9D
ReleaseSRWLockExclusive.KERNEL32 ref: 00007FF69B43BDE9
GetCurrentThreadId.KERNEL32 ref: 00007FF69B43C25A
GetCurrentThreadId.KERNEL32 ref: 00007FF69B43C26B
GetCurrentThreadId.KERNEL32 ref: 00007FF69B43C27C
GetCurrentThreadId.KERNEL32 ref: 00007FF69B43C28D
GetCurrentThreadId.KERNEL32 ref: 00007FF69B43C29E

Strings

E, xrefs: 00007FF69B43C3ED
TaskQueueImpl::UnregisterTaskQueue, xrefs: 00007FF69B43C33E
ScopedAllowBaseSyncPrimitivesOutsideBlockingScope, xrefs: 00007FF69B43C36D, 00007FF69B43C3CA
..\..\base\task\sequence_manager\task_queue_impl.cc, xrefs: 00007FF69B43BCCB
UnregisterTaskQueue, xrefs: 00007FF69B43BCC4

Memory Dump Source

Source File: 00000000.00000002.1667242761.00007FF69B331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69B330000, based on PE: true

Associated: 00000000.00000002.1667200836.00007FF69B330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667462352.00007FF69B51D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B55B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B569000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667608048.00007FF69B575000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667624939.00007FF69B589000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667639365.00007FF69B58A000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667689383.00007FF69B58B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69b330000_D8wwrB9ZCB.jbxd

Similarity

API ID: CurrentThread$ExclusiveLock$AcquireRelease
String ID: ..\..\base\task\sequence_manager\task_queue_impl.cc$E$ScopedAllowBaseSyncPrimitivesOutsideBlockingScope$TaskQueueImpl::UnregisterTaskQueue$UnregisterTaskQueue
API String ID: 203192905-385579830
Opcode ID: e146bc5b49e2b7f816828c5d34664f353374375f8c32798919a5bf1920d7d51c
Instruction ID: e730541c4b21fda1dc466e11a8f60bf4e632b2b7e176a8987865d7f48a40c1ab
Opcode Fuzzy Hash: e146bc5b49e2b7f816828c5d34664f353374375f8c32798919a5bf1920d7d51c
Instruction Fuzzy Hash: FC22AE22A08B8E82FA749B25D1403B973A0FF58F44F084575DA5E877BADF3DE645A300

Function 00007FF69B389420 Relevance: 21.5, APIs: 4, Strings: 8, Instructions: 455fileCOMMON

Download Yara Rule

APIs

UnlockFileEx.KERNEL32 ref: 00007FF69B389488
GetLastError.KERNEL32 ref: 00007FF69B389547
SetEndOfFile.KERNEL32 ref: 00007FF69B38960D

Part of subcall function 00007FF69B3868B0: WriteFile.KERNEL32(?,?,?,?,?,00000001,?,?,00007FF69B35C324), ref: 00007FF69B38691E

GetLastError.KERNEL32 ref: 00007FF69B3896EA

Strings

..\..\third_party\crashpad\crashpad\client\crash_report_database_win.cc, xrefs: 00007FF69B389550, 00007FF69B3895BF, 00007FF69B38969B, 00007FF69B3896F3, 00007FF69B389A91, 00007FF69B389B4E, 00007FF69B389BDC
failed to write records, xrefs: 00007FF69B389B79
failed to write header, xrefs: 00007FF69B3896C6
UnlockFileEx, xrefs: 00007FF69B38957B
expected to start with , xrefs: 00007FF69B389AC4
failed to truncate, xrefs: 00007FF69B38971E
failed to rewind to write, xrefs: 00007FF69B3895EA
failed to write string table, xrefs: 00007FF69B389C07

Memory Dump Source

Source File: 00000000.00000002.1667242761.00007FF69B331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69B330000, based on PE: true

Associated: 00000000.00000002.1667200836.00007FF69B330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667462352.00007FF69B51D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B55B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B569000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667608048.00007FF69B575000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667624939.00007FF69B589000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667639365.00007FF69B58A000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667689383.00007FF69B58B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69b330000_D8wwrB9ZCB.jbxd

Similarity

API ID: File$ErrorLast$UnlockWrite
String ID: expected to start with $..\..\third_party\crashpad\crashpad\client\crash_report_database_win.cc$UnlockFileEx$failed to rewind to write$failed to truncate$failed to write header$failed to write records$failed to write string table
API String ID: 2123304066-2809872178
Opcode ID: 28fef81f520ec79f864fa55a25a6b54b3d57ad16aedd9c91d79a59f548feca51
Instruction ID: a8b7f95f2ea8e16ea7c381c36a1a684718b4cb256dbdc991d589b92de84e4627
Opcode Fuzzy Hash: 28fef81f520ec79f864fa55a25a6b54b3d57ad16aedd9c91d79a59f548feca51
Instruction Fuzzy Hash: E012C361B0C69A85EA70DB15E4447BA67A1EB8DB80F005275DF4DC7BAADE3CE241C701

Function 00007FF69B349C76 Relevance: 21.3, APIs: 9, Strings: 3, Instructions: 273threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00007FF69B349CA5
SetEvent.KERNEL32 ref: 00007FF69B349CCF
TryAcquireSRWLockExclusive.KERNEL32 ref: 00007FF69B349D76
ReleaseSRWLockExclusive.KERNEL32 ref: 00007FF69B349D8B
SetEvent.KERNEL32 ref: 00007FF69B349DBC
TryAcquireSRWLockExclusive.KERNEL32 ref: 00007FF69B349E49
ReleaseSRWLockExclusive.KERNEL32 ref: 00007FF69B349E5E

Strings

..\..\base\threading\thread.cc, xrefs: 00007FF69B349E21
Run, xrefs: 00007FF69B349E1A
WaitableEvent::Signal, xrefs: 00007FF69B34A059, 00007FF69B34A098

Memory Dump Source

Source File: 00000000.00000002.1667242761.00007FF69B331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69B330000, based on PE: true

Associated: 00000000.00000002.1667200836.00007FF69B330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667462352.00007FF69B51D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B55B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B569000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667608048.00007FF69B575000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667624939.00007FF69B589000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667639365.00007FF69B58A000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667689383.00007FF69B58B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69b330000_D8wwrB9ZCB.jbxd

Similarity

API ID: ExclusiveLock$AcquireEventRelease$CurrentThread
String ID: ..\..\base\threading\thread.cc$Run$WaitableEvent::Signal
API String ID: 3602594984-1357079643
Opcode ID: 8bb99a84a76b7420c475f0f6c31fb408ee7da18f1db4cac061bc34a332ed3b91
Instruction ID: 622925b0bbe988525bf3ffe76551c18d32a4f092469ec895ddf06ecd6c51ac3b
Opcode Fuzzy Hash: 8bb99a84a76b7420c475f0f6c31fb408ee7da18f1db4cac061bc34a332ed3b91
Instruction Fuzzy Hash: B4C1A221A18A4E86FA34DB16E54437973A2FF48B80F4045B9DA4E877B6DF3EE645C300

Function 00007FF69B387D20 Relevance: 19.5, APIs: 3, Strings: 8, Instructions: 289synchronizationCOMMON

Download Yara Rule

APIs

ReleaseSemaphore.KERNEL32(?,?,?,?,?,?,?,?,7FFFFFFFFFFFFFFF,?,?,?,?,00000000,?,?), ref: 00007FF69B388055
WaitForSingleObject.KERNEL32(?,?,?,?,?,?,?,?,7FFFFFFFFFFFFFFF,?,?,?,?,00000000,?,?), ref: 00007FF69B38806C

Strings

..\..\third_party\crashpad\crashpad\util\synchronization\semaphore_win.cc, xrefs: 00007FF69B3880E5, 00007FF69B388170
Google, xrefs: 00007FF69B387D79, 00007FF69B387D9F, 00007FF69B387F1E
Join, xrefs: 00007FF69B38811C
Chrome, xrefs: 00007FF69B387E0A, 00007FF69B387E30, 00007FF69B387F68
~Semaphore, xrefs: 00007FF69B388169
Signal, xrefs: 00007FF69B3880DE
..\..\third_party\crashpad\crashpad\util\thread\thread_win.cc, xrefs: 00007FF69B388123
WaitForSingleObject, xrefs: 00007FF69B38814D

Memory Dump Source

Source File: 00000000.00000002.1667242761.00007FF69B331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69B330000, based on PE: true

Associated: 00000000.00000002.1667200836.00007FF69B330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667462352.00007FF69B51D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B55B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B569000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667608048.00007FF69B575000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667624939.00007FF69B589000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667639365.00007FF69B58A000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667689383.00007FF69B58B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69b330000_D8wwrB9ZCB.jbxd

Similarity

API ID: ObjectReleaseSemaphoreSingleWait
String ID: ..\..\third_party\crashpad\crashpad\util\synchronization\semaphore_win.cc$..\..\third_party\crashpad\crashpad\util\thread\thread_win.cc$Chrome$Google$Join$Signal$WaitForSingleObject$~Semaphore
API String ID: 772398627-1984269241
Opcode ID: 524bdc7171d225a17bdb0d864eab07fbc4c73730112a20ac1d1a16c8f229f840
Instruction ID: 9c0b39ad29464121add23cc563ea9ca26284ad69f50150646195b19c589f1593
Opcode Fuzzy Hash: 524bdc7171d225a17bdb0d864eab07fbc4c73730112a20ac1d1a16c8f229f840
Instruction Fuzzy Hash: ECB1D162A0C78A92EE31CB15E4403B96762EB48BD4F5441B6DA4ECBBB5CF3CE605C301

Function 00007FF69B421370 Relevance: 18.3, APIs: 12, Instructions: 271threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00007FF69B421695
GetCurrentThreadId.KERNEL32 ref: 00007FF69B4216AC
GetCurrentThreadId.KERNEL32 ref: 00007FF69B4216C4
GetCurrentThreadId.KERNEL32 ref: 00007FF69B4216D6
GetCurrentThreadId.KERNEL32 ref: 00007FF69B4216E7
GetCurrentThreadId.KERNEL32 ref: 00007FF69B4216F8
GetCurrentThreadId.KERNEL32 ref: 00007FF69B421709
GetCurrentThreadId.KERNEL32 ref: 00007FF69B42171A
GetCurrentThreadId.KERNEL32 ref: 00007FF69B42172C
GetCurrentThreadId.KERNEL32 ref: 00007FF69B42173E
GetCurrentThreadId.KERNEL32 ref: 00007FF69B421751
GetCurrentThreadId.KERNEL32 ref: 00007FF69B42178B

Memory Dump Source

Source File: 00000000.00000002.1667242761.00007FF69B331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69B330000, based on PE: true

Associated: 00000000.00000002.1667200836.00007FF69B330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667462352.00007FF69B51D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B55B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B569000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667608048.00007FF69B575000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667624939.00007FF69B589000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667639365.00007FF69B58A000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667689383.00007FF69B58B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69b330000_D8wwrB9ZCB.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: 9967945b0442083ffea2ed87421dce6b8e84e961f66ee10dbbfe719b6ddd96ad
Instruction ID: 82878ac72b1d92e8ad002026daaef233c5f9f14706887352053a5ccdb79e754b
Opcode Fuzzy Hash: 9967945b0442083ffea2ed87421dce6b8e84e961f66ee10dbbfe719b6ddd96ad
Instruction Fuzzy Hash: 75C17332A0868A96EF688F25D1803B977A1FB98B44F144075CB4DC3775DF78E6A6E700

Function 00007FF69B354F80 Relevance: 17.9, APIs: 5, Strings: 5, Instructions: 354threadCOMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,?,Histogram.TooManyBuckets.1000,?,-7FFFFFFFFFFFFFF8,00000000,?,00000000,00000000), ref: 00007FF69B354FB6
OpenProcess.KERNEL32(?,?,?,?,?,?,?,?,?,Histogram.TooManyBuckets.1000,?,-7FFFFFFFFFFFFFF8,00000000,?,00000000,00000000), ref: 00007FF69B354FC9
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,Histogram.TooManyBuckets.1000,?,-7FFFFFFFFFFFFFF8,00000000,?,00000000,00000000), ref: 00007FF69B354FDB
SetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,Histogram.TooManyBuckets.1000,?,-7FFFFFFFFFFFFFF8,00000000,?,00000000,00000000), ref: 00007FF69B355011
UpdateProcThreadAttribute.KERNEL32 ref: 00007FF69B355083

Strings

--thread=, xrefs: 00007FF69B355292, 00007FF69B355309
process, xrefs: 00007FF69B3551ED
exception-pointers, xrefs: 00007FF69B355168
database, xrefs: 00007FF69B3550F0
Histogram.TooManyBuckets.1000, xrefs: 00007FF69B354F8B

Memory Dump Source

Source File: 00000000.00000002.1667242761.00007FF69B331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69B330000, based on PE: true

Associated: 00000000.00000002.1667200836.00007FF69B330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667462352.00007FF69B51D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B55B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B569000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667608048.00007FF69B575000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667624939.00007FF69B589000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667639365.00007FF69B58A000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667689383.00007FF69B58B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69b330000_D8wwrB9ZCB.jbxd

Similarity

API ID: ErrorLastProcess$AttributeCurrentOpenProcThreadUpdate
String ID: --thread=$Histogram.TooManyBuckets.1000$database$exception-pointers$process
API String ID: 3486958663-3013143651
Opcode ID: a9e90415945f8d6ede7df759b93625a68d6d3af5bf004f92825d4faee3edd8a0
Instruction ID: 9615178e1e683da288479b87349d812d119af0b162d97303104b4a910b9186a4
Opcode Fuzzy Hash: a9e90415945f8d6ede7df759b93625a68d6d3af5bf004f92825d4faee3edd8a0
Instruction Fuzzy Hash: F0F1C222A08B8A82EA30CB21E4013BA73A1FB49794F554579DA9DC7BB5DF7CF255C700

Function 00007FF69B417130 Relevance: 16.1, APIs: 5, Strings: 4, Instructions: 396COMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32 ref: 00007FF69B417259
TryAcquireSRWLockExclusive.KERNEL32 ref: 00007FF69B4172B9
ReleaseSRWLockExclusive.KERNEL32 ref: 00007FF69B417309
AcquireSRWLockExclusive.KERNEL32 ref: 00007FF69B41751A

Part of subcall function 00007FF69B460E1C: AcquireSRWLockExclusive.KERNEL32(?,?,?,00007FF69B49885B), ref: 00007FF69B460E2C

ReleaseSRWLockExclusive.KERNEL32 ref: 00007FF69B4176BA

Part of subcall function 00007FF69B344320: QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,00000000,?,800000000000000F,800000000000000F,?,?,?,7FFFFFFFFFFFFFEF,00007FF69B3442E0), ref: 00007FF69B344450

Strings

..\..\base\threading\scoped_blocking_call_internal.cc, xrefs: 00007FF69B417756
enable-background-thread-pool, xrefs: 00007FF69B41754A
ScopedBlockingCall, xrefs: 00007FF69B4177E0
MonitorNextJankWindowIfNecessary, xrefs: 00007FF69B41774F

Memory Dump Source

Source File: 00000000.00000002.1667242761.00007FF69B331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69B330000, based on PE: true

Associated: 00000000.00000002.1667200836.00007FF69B330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667462352.00007FF69B51D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B55B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B569000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667608048.00007FF69B575000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667624939.00007FF69B589000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667639365.00007FF69B58A000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667689383.00007FF69B58B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69b330000_D8wwrB9ZCB.jbxd

Similarity

API ID: ExclusiveLock$Acquire$CounterPerformanceQueryRelease
String ID: ..\..\base\threading\scoped_blocking_call_internal.cc$MonitorNextJankWindowIfNecessary$ScopedBlockingCall$enable-background-thread-pool
API String ID: 743314926-2521901312
Opcode ID: 613e839fc88b523431237555039eb8608775529df040a132aa5a091302ed4d9c
Instruction ID: 5331b170b45914808d3f1d2be1a147dfb04ecc9583cdb6a2a701810ff5d99a15
Opcode Fuzzy Hash: 613e839fc88b523431237555039eb8608775529df040a132aa5a091302ed4d9c
Instruction Fuzzy Hash: D0129A61E0864A85EA70DB15E88437933A0FB5CB64F5805B1DA5EC32FADF3CE661E300

Function 00007FF69B368B90 Relevance: 16.0, APIs: 6, Strings: 3, Instructions: 212fileCOMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32 ref: 00007FF69B368CE9
GetLastError.KERNEL32 ref: 00007FF69B368CF4
DeleteFileW.KERNEL32 ref: 00007FF69B368D5A
SetLastError.KERNEL32 ref: 00007FF69B368DC3
RemoveDirectoryW.KERNEL32 ref: 00007FF69B368DE3
SetFileAttributesW.KERNEL32 ref: 00007FF69B368EAD

Strings

ScopedBlockingCall, xrefs: 00007FF69B368E78
DoDeleteFile, xrefs: 00007FF69B368BE3
..\..\base\files\file_util_win.cc, xrefs: 00007FF69B368BEA

Memory Dump Source

Source File: 00000000.00000002.1667242761.00007FF69B331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69B330000, based on PE: true

Associated: 00000000.00000002.1667200836.00007FF69B330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667462352.00007FF69B51D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B55B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B569000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667608048.00007FF69B575000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667624939.00007FF69B589000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667639365.00007FF69B58A000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667689383.00007FF69B58B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69b330000_D8wwrB9ZCB.jbxd

Similarity

API ID: File$AttributesErrorLast$DeleteDirectoryRemove
String ID: ..\..\base\files\file_util_win.cc$DoDeleteFile$ScopedBlockingCall
API String ID: 3447957730-1263771705
Opcode ID: 2e454255beb289a50a51e2ebee3c3dfd07d83c5a4b52dc6ada267a1c48249d3b
Instruction ID: 5f2d479db642bc541fa58fb9f4ca9f98ba5c4778640c6691fc0fde7917c3d404
Opcode Fuzzy Hash: 2e454255beb289a50a51e2ebee3c3dfd07d83c5a4b52dc6ada267a1c48249d3b
Instruction Fuzzy Hash: 6A81D421A0C64E81FA30DB14D4113BA7361EFADB98F0402B6DA9DC76F5DE2DEB468310

Function 00007FF69B428C40 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 196threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00007FF69B428CA2
GetCurrentThreadId.KERNEL32 ref: 00007FF69B428CE1
SetEvent.KERNEL32 ref: 00007FF69B428D91
PostQueuedCompletionStatus.KERNEL32 ref: 00007FF69B428DDD

Strings

ScheduleWorkToSelf, xrefs: 00007FF69B428E72
ScheduleWork, xrefs: 00007FF69B428EEA
I, xrefs: 00007FF69B428E30
Chrome.MessageLoopProblem.COMPLETION_POST_ERROR, xrefs: 00007FF69B428E01
WaitableEvent::Signal, xrefs: 00007FF69B428F48

Memory Dump Source

Source File: 00000000.00000002.1667242761.00007FF69B331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69B330000, based on PE: true

Associated: 00000000.00000002.1667200836.00007FF69B330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667462352.00007FF69B51D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B55B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B569000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667608048.00007FF69B575000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667624939.00007FF69B589000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667639365.00007FF69B58A000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667689383.00007FF69B58B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69b330000_D8wwrB9ZCB.jbxd

Similarity

API ID: CurrentThread$CompletionEventPostQueuedStatus
String ID: Chrome.MessageLoopProblem.COMPLETION_POST_ERROR$I$ScheduleWork$ScheduleWorkToSelf$WaitableEvent::Signal
API String ID: 3823919964-1855744827
Opcode ID: 8033355c57187744b67d46143f4ca9822c4570c9348210437327a9339787c37c
Instruction ID: 78c9f9b6eeef1ffdd9b6fdb6c2db912e8f4a46cf5149c7e388ca03033fe0bb8f
Opcode Fuzzy Hash: 8033355c57187744b67d46143f4ca9822c4570c9348210437327a9339787c37c
Instruction Fuzzy Hash: F491B321A08A8A85FA308F14E44037E77A1EF5CB84F544476CA8DC77B9DF2DE64AE711

Function 00007FF69B41E040 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 164COMMON

Download Yara Rule

APIs

CreateEventW.KERNEL32 ref: 00007FF69B41E0F1
GetLastError.KERNEL32 ref: 00007FF69B41E10C
SetLastError.KERNEL32 ref: 00007FF69B41E12A
UnregisterWaitEx.KERNEL32 ref: 00007FF69B41E14A
GetLastError.KERNEL32 ref: 00007FF69B41E256

Strings

..\..\base\win\object_watcher.cc, xrefs: 00007FF69B41E06E
StopWatching, xrefs: 00007FF69B41E067
E, xrefs: 00007FF69B41E2CA
ScopedAllowBaseSyncPrimitivesOutsideBlockingScope, xrefs: 00007FF69B41E286, 00007FF69B41E2A7

Memory Dump Source

Source File: 00000000.00000002.1667242761.00007FF69B331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69B330000, based on PE: true

Associated: 00000000.00000002.1667200836.00007FF69B330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667462352.00007FF69B51D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B55B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B569000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667608048.00007FF69B575000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667624939.00007FF69B589000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667639365.00007FF69B58A000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667689383.00007FF69B58B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69b330000_D8wwrB9ZCB.jbxd

Similarity

API ID: ErrorLast$CreateEventUnregisterWait
String ID: ..\..\base\win\object_watcher.cc$E$ScopedAllowBaseSyncPrimitivesOutsideBlockingScope$StopWatching
API String ID: 3960733346-3839475703
Opcode ID: 35671460a7329694aa042647df262fa237cba34cf4e0a56a619d8e3f891f2964
Instruction ID: f344e6b62ffc8687a585b6b191ad89abe5423be373857d7cabfa557aaa8afa62
Opcode Fuzzy Hash: 35671460a7329694aa042647df262fa237cba34cf4e0a56a619d8e3f891f2964
Instruction Fuzzy Hash: 7F719F35A09B4A82FA718B14E45037973A0FB9CB44F180275DA8E837B9DF7DE655D700

Function 00007FF69B416C40 Relevance: 15.3, APIs: 10, Instructions: 286COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF69B416C9F
SetLastError.KERNEL32 ref: 00007FF69B416CA9
SetLastError.KERNEL32 ref: 00007FF69B416CBD
TryAcquireSRWLockExclusive.KERNEL32 ref: 00007FF69B416D8C
ReleaseSRWLockExclusive.KERNEL32 ref: 00007FF69B416DEF
QueryPerformanceCounter.KERNEL32 ref: 00007FF69B416E20
AcquireSRWLockExclusive.KERNEL32 ref: 00007FF69B416E9B
TryAcquireSRWLockExclusive.KERNEL32 ref: 00007FF69B416FEC
ReleaseSRWLockExclusive.KERNEL32 ref: 00007FF69B417012

Memory Dump Source

Source File: 00000000.00000002.1667242761.00007FF69B331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69B330000, based on PE: true

Associated: 00000000.00000002.1667200836.00007FF69B330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667462352.00007FF69B51D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B55B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B569000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667608048.00007FF69B575000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667624939.00007FF69B589000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667639365.00007FF69B58A000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667689383.00007FF69B58B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69b330000_D8wwrB9ZCB.jbxd

Similarity

API ID: ExclusiveLock$AcquireErrorLast$Release$CounterPerformanceQuery
String ID:
API String ID: 593636287-0
Opcode ID: 42216084b7a6599fd51874ba35ba0220b2dc91ec518bb5ccb284a25f8c2c93ce
Instruction ID: a3f4b0f56c89f34da1c7ab027766afb5873200f586881d6e09e3edb58ce80916
Opcode Fuzzy Hash: 42216084b7a6599fd51874ba35ba0220b2dc91ec518bb5ccb284a25f8c2c93ce
Instruction Fuzzy Hash: 68C1D522E08B4E81EA359F21D5403797761EF5DF94F0842B1DA4E9B6B9DF7CE2A19300

Function 00007FF69B42FE40 Relevance: 15.2, APIs: 10, Instructions: 194COMMON

Download Yara Rule

APIs

TryAcquireSRWLockExclusive.KERNEL32 ref: 00007FF69B42FE8C
WakeAllConditionVariable.KERNEL32 ref: 00007FF69B42FE9E
ReleaseSRWLockExclusive.KERNEL32 ref: 00007FF69B42FEA7
TryAcquireSRWLockExclusive.KERNEL32 ref: 00007FF69B42FEB0
ReleaseSRWLockExclusive.KERNEL32 ref: 00007FF69B42FEDE
TryAcquireSRWLockExclusive.KERNEL32 ref: 00007FF69B42FF28
ReleaseSRWLockExclusive.KERNEL32 ref: 00007FF69B42FF4D
AcquireSRWLockExclusive.KERNEL32 ref: 00007FF69B42FF5B
AcquireSRWLockExclusive.KERNEL32 ref: 00007FF69B42FF6C
AcquireSRWLockExclusive.KERNEL32 ref: 00007FF69B43002F

Memory Dump Source

Source File: 00000000.00000002.1667242761.00007FF69B331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69B330000, based on PE: true

Associated: 00000000.00000002.1667200836.00007FF69B330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667462352.00007FF69B51D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B55B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B569000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667608048.00007FF69B575000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667624939.00007FF69B589000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667639365.00007FF69B58A000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667689383.00007FF69B58B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69b330000_D8wwrB9ZCB.jbxd

Similarity

API ID: ExclusiveLock$Acquire$Release$ConditionVariableWake
String ID:
API String ID: 2824607059-0
Opcode ID: 01186bb8804bdc6136e6aa29544d243107385bc3c512428dbbb0d23b6e55e7e5
Instruction ID: adf338a2964f0c0271545fbc15eaed8a95df6c451acdc63f1e985caec1077a4c
Opcode Fuzzy Hash: 01186bb8804bdc6136e6aa29544d243107385bc3c512428dbbb0d23b6e55e7e5
Instruction Fuzzy Hash: 9061B221B0960E86FA79DF15A8146382361EF5DF55F9906B2CD1EC63F5CE3CE686A300

Function 00007FF69B385A80 Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 194COMMON

Download Yara Rule

APIs

GetUserDefaultLangID.KERNEL32 ref: 00007FF69B385B11
GetUserDefaultLangID.KERNEL32 ref: 00007FF69B385B17
VerQueryValueW.VERSION ref: 00007FF69B385B85
VerQueryValueW.VERSION ref: 00007FF69B385C11
VerQueryValueW.VERSION ref: 00007FF69B385C9D
VerQueryValueW.VERSION ref: 00007FF69B385D2D

Strings

\StringFileInfo\%04hx%04hx\%ls, xrefs: 00007FF69B385B49, 00007FF69B385BD6, 00007FF69B385C62, 00007FF69B385CF2
\VarFileInfo\Translation, xrefs: 00007FF69B385AE3

Memory Dump Source

Source File: 00000000.00000002.1667242761.00007FF69B331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69B330000, based on PE: true

Associated: 00000000.00000002.1667200836.00007FF69B330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667462352.00007FF69B51D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B55B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B569000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667608048.00007FF69B575000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667624939.00007FF69B589000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667639365.00007FF69B58A000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667689383.00007FF69B58B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69b330000_D8wwrB9ZCB.jbxd

Similarity

API ID: QueryValue$DefaultLangUser
String ID: \StringFileInfo\%04hx%04hx\%ls$\VarFileInfo\Translation
API String ID: 2923350452-4158013653
Opcode ID: 7b0dad72db24311ce47872a68ab03c3bceddf5f321988d80fd6150b9c95274a6
Instruction ID: 07b8855290b389168d47bc25f0d02101749c50817a3cc13e22d09afcb78fe9c0
Opcode Fuzzy Hash: 7b0dad72db24311ce47872a68ab03c3bceddf5f321988d80fd6150b9c95274a6
Instruction Fuzzy Hash: 2571C67261864982EB21DF21D5543AAB7A1FB49BC0F904076EF8C87BA9DF7DD248C701

Function 00007FF69B353A70 Relevance: 14.2, APIs: 2, Strings: 6, Instructions: 178libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF69B353C86
GetProcAddress.KERNEL32 ref: 00007FF69B353C9F

Strings

type, xrefs: 00007FF69B353B5D
SetUnhandledExceptionFilter, xrefs: 00007FF69B353C95
kernel32.dll, xrefs: 00007FF69B353C7F
test-child-process, xrefs: 00007FF69B353B81
database, xrefs: 00007FF69B353BD3
fallback-handler, xrefs: 00007FF69B353B43

Memory Dump Source

Source File: 00000000.00000002.1667242761.00007FF69B331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69B330000, based on PE: true

Associated: 00000000.00000002.1667200836.00007FF69B330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667462352.00007FF69B51D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B55B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B569000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667608048.00007FF69B575000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667624939.00007FF69B589000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667639365.00007FF69B58A000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667689383.00007FF69B58B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69b330000_D8wwrB9ZCB.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: SetUnhandledExceptionFilter$database$fallback-handler$kernel32.dll$test-child-process$type
API String ID: 1646373207-2136241734
Opcode ID: 878b4494aa7021c9da59e3e033de8854484b9062c0eacf9904d7615642bb6fb0
Instruction ID: c48df43567f09a8252434f69345d34e86efde3897daa324a9486ca8c7aa766e7
Opcode Fuzzy Hash: 878b4494aa7021c9da59e3e033de8854484b9062c0eacf9904d7615642bb6fb0
Instruction Fuzzy Hash: C3916E22A1CBCA81EA31DB10E5503F973A1FB99B44F454175DA8D837AADF7CE299C700

Function 00007FF69B33DAD9 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 173threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00007FF69B33DB8F
GetCurrentThreadId.KERNEL32 ref: 00007FF69B33DBA0
GetCurrentThreadId.KERNEL32 ref: 00007FF69B33DBB1
GetCurrentThreadId.KERNEL32 ref: 00007FF69B33DBC2
GetCurrentThreadId.KERNEL32 ref: 00007FF69B33DBCF

Strings

Observers can only be added once!, xrefs: 00007FF69B33DCEA
AddObserver, xrefs: 00007FF69B33DCB1
..\..\base\observer_list.h, xrefs: 00007FF69B33DCB8

Memory Dump Source

Source File: 00000000.00000002.1667242761.00007FF69B331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69B330000, based on PE: true

Associated: 00000000.00000002.1667200836.00007FF69B330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667462352.00007FF69B51D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B55B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B569000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667608048.00007FF69B575000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667624939.00007FF69B589000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667639365.00007FF69B58A000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667689383.00007FF69B58B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69b330000_D8wwrB9ZCB.jbxd

Similarity

API ID: CurrentThread
String ID: ..\..\base\observer_list.h$AddObserver$Observers can only be added once!
API String ID: 2882836952-2846359756
Opcode ID: 31bf9603a21335449cb5701558c683eb9f87237e36ec94d4402c049ff15719d2
Instruction ID: 1c0e2e71604b2892f705339ad78772cb907ecaa6460f443a1f48898ceb455e19
Opcode Fuzzy Hash: 31bf9603a21335449cb5701558c683eb9f87237e36ec94d4402c049ff15719d2
Instruction Fuzzy Hash: 5E518162B0874E82EA34EB16E58027A7361EF5CBD0F884475DF5E87BB5DE6CE6458300

Function 00007FF69B417940 Relevance: 14.1, APIs: 2, Strings: 6, Instructions: 131libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(?,?,?,?,?,?,?,?,-00000001,?,00007FF69B457C75), ref: 00007FF69B417A78
GetProcAddress.KERNEL32(?,?,?,?,?,?,?,?,-00000001,?,00007FF69B457C75), ref: 00007FF69B417A88

Part of subcall function 00007FF69B3C4E40: WaitForSingleObject.KERNEL32(?,?,0000000F,00007FF69B417AC6,?,?,?,?,?,?,?,?,-00000001,?,00007FF69B457C75), ref: 00007FF69B3C4E4A

Strings

%s (errno: %d, %s), xrefs: 00007FF69B417B5A
..\..\third_party\perfetto\include\perfetto\tracing\track_event_category_registry.h, xrefs: 00007FF69B417B39
wakeup.flow,toplevel.flow, xrefs: 00007FF69B417A0F
GetHandleVerifier, xrefs: 00007FF69B417A7E
PERFETTO_CHECK(false && "A track event used an unknown category. Please add it to " "PERFETTO_DEFINE_CATEGORIES()."), xrefs: 00007FF69B417B4E
~WaitableEvent while Signaled, xrefs: 00007FF69B417AFA

Memory Dump Source

Source File: 00000000.00000002.1667242761.00007FF69B331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69B330000, based on PE: true

Associated: 00000000.00000002.1667200836.00007FF69B330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667462352.00007FF69B51D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B55B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B569000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667608048.00007FF69B575000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667624939.00007FF69B589000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667639365.00007FF69B58A000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667689383.00007FF69B58B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69b330000_D8wwrB9ZCB.jbxd

Similarity

API ID: AddressHandleModuleObjectProcSingleWait
String ID: %s (errno: %d, %s)$..\..\third_party\perfetto\include\perfetto\tracing\track_event_category_registry.h$GetHandleVerifier$PERFETTO_CHECK(false && "A track event used an unknown category. Please add it to " "PERFETTO_DEFINE_CATEGORIES().")$wakeup.flow,toplevel.flow$~WaitableEvent while Signaled
API String ID: 2452614001-2914896919
Opcode ID: 704b0cce4de711a09872a9cecf2793aabb1d5a6f3c80f1252d32465b48b548c9
Instruction ID: 7c6dbce5680584de78ff7db5536be7a135e08b4b9de73418b64c4782d341dca4
Opcode Fuzzy Hash: 704b0cce4de711a09872a9cecf2793aabb1d5a6f3c80f1252d32465b48b548c9
Instruction Fuzzy Hash: 0A517A61E0CA4E81FA709F15E4543B933A1EB58B84F4414B6C64EC37BADE6CEB69D300

Function 00007FF69B48696C Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 117libraryloaderCOMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,?,00000000,00007FF69B4867B0,?,?,00000000,00007FF69B489357,?,?,E0000008,00007FF69B474621), ref: 00007FF69B486AE8
GetProcAddress.KERNEL32(?,?,00000000,00007FF69B4867B0,?,?,00000000,00007FF69B489357,?,?,E0000008,00007FF69B474621), ref: 00007FF69B486AF4

Strings

ext-ms-, xrefs: 00007FF69B486A45
MZx, xrefs: 00007FF69B48698B, 00007FF69B486A71, 00007FF69B486AD1
api-ms-, xrefs: 00007FF69B486A32

Memory Dump Source

Source File: 00000000.00000002.1667242761.00007FF69B331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69B330000, based on PE: true

Associated: 00000000.00000002.1667200836.00007FF69B330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667462352.00007FF69B51D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B55B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B569000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667608048.00007FF69B575000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667624939.00007FF69B589000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667639365.00007FF69B58A000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667689383.00007FF69B58B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69b330000_D8wwrB9ZCB.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: MZx$api-ms-$ext-ms-
API String ID: 3013587201-2431898299
Opcode ID: 73f6808954297319da8cd8a2f48e6bfb67d946c25182f454695ff4d6b6a5becb
Instruction ID: b0ef6232eb3bcfaef857713103d736faefd4309f710817ff35d54a4364f54959
Opcode Fuzzy Hash: 73f6808954297319da8cd8a2f48e6bfb67d946c25182f454695ff4d6b6a5becb
Instruction Fuzzy Hash: F9411421B19B0A41FA76DF16A8006762391FF4DFA0F498176DD0DCB7A8EE3CE6459380

Function 00007FF69B4B6950 Relevance: 13.6, APIs: 9, Instructions: 67synchronizationCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?), ref: 00007FF69B4B6979
TerminateProcess.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?), ref: 00007FF69B4B6984
GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?), ref: 00007FF69B4B69A0
WaitForSingleObject.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?), ref: 00007FF69B4B69AE
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?), ref: 00007FF69B4B69D5
GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?), ref: 00007FF69B4B69E1
WaitForSingleObject.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?), ref: 00007FF69B4B69F4
GetCurrentProcess.KERNEL32 ref: 00007FF69B4B6A15
GetExitCodeProcess.KERNEL32 ref: 00007FF69B4B6A23

Memory Dump Source

Source File: 00000000.00000002.1667242761.00007FF69B331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69B330000, based on PE: true

Associated: 00000000.00000002.1667200836.00007FF69B330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667462352.00007FF69B51D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B55B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B569000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667608048.00007FF69B575000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667624939.00007FF69B589000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667639365.00007FF69B58A000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667689383.00007FF69B58B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69b330000_D8wwrB9ZCB.jbxd

Similarity

API ID: Process$Current$ObjectSingleWait$CodeErrorExitLastTerminate
String ID:
API String ID: 2432511979-0
Opcode ID: 0077a2cdbe7684b2d204571969dc92dc3abea20b9f5ab0647aca6a0bc5ef6a35
Instruction ID: 2d21d143027c3e3552ca6ccb21f2a145efb98faa09fd02a8375cdd897f57a4d7
Opcode Fuzzy Hash: 0077a2cdbe7684b2d204571969dc92dc3abea20b9f5ab0647aca6a0bc5ef6a35
Instruction Fuzzy Hash: 14213221A0C59A81F6319B15E45423DA2B1EF8DB44F1880B1CA8EC77B9DE7CE685A301

Function 00007FF69B33DD10 Relevance: 12.5, APIs: 2, Strings: 5, Instructions: 283COMMON

Download Yara Rule

APIs

GetLongPathNameW.KERNEL32 ref: 00007FF69B33E188
SetLastError.KERNEL32 ref: 00007FF69B33E28F

Strings

%08x-%04x-%04x-%04x-%012llx, xrefs: 00007FF69B33DF67
CreateAndOpenTemporaryFileInDir, xrefs: 00007FF69B33DD70
ScopedBlockingCall, xrefs: 00007FF69B33E2AF
.tmp, xrefs: 00007FF69B33E009
..\..\base\files\file_util_win.cc, xrefs: 00007FF69B33DD77

Memory Dump Source

Source File: 00000000.00000002.1667242761.00007FF69B331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69B330000, based on PE: true

Associated: 00000000.00000002.1667200836.00007FF69B330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667462352.00007FF69B51D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B55B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B569000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667608048.00007FF69B575000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667624939.00007FF69B589000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667639365.00007FF69B58A000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667689383.00007FF69B58B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69b330000_D8wwrB9ZCB.jbxd

Similarity

API ID: ErrorLastLongNamePath
String ID: %08x-%04x-%04x-%04x-%012llx$..\..\base\files\file_util_win.cc$.tmp$CreateAndOpenTemporaryFileInDir$ScopedBlockingCall
API String ID: 1903379502-383945204
Opcode ID: feb283f5add87c095c34e2cea5ebd69ab93132f92689d7f1be593ded60de68ff
Instruction ID: ae19763558a135dcf25b3cfdc848c5e99096d41baa9b9096971dd3d5ccd68397
Opcode Fuzzy Hash: feb283f5add87c095c34e2cea5ebd69ab93132f92689d7f1be593ded60de68ff
Instruction Fuzzy Hash: C3D17032A0CBC981EA369B15E4413EAB7A0FB99784F404175DACC87BA9DF3DE255D700

Function 00007FF69B36B9B0 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 276timeCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF69B4BBC3F), ref: 00007FF69B36B9DB
SetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF69B4BBC3F), ref: 00007FF69B36B9E5
GetLocalTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF69B4BBC3F), ref: 00007FF69B36BA7D
SetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF69B4BBC3F), ref: 00007FF69B36BCCA

Strings

VERBOSE, xrefs: 00007FF69B36BD9C
)] , xrefs: 00007FF69B36BC16
UNKNOWN, xrefs: 00007FF69B36BD27

Memory Dump Source

Source File: 00000000.00000002.1667242761.00007FF69B331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69B330000, based on PE: true

Associated: 00000000.00000002.1667200836.00007FF69B330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667462352.00007FF69B51D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B55B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B569000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667608048.00007FF69B575000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667624939.00007FF69B589000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667639365.00007FF69B58A000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667689383.00007FF69B58B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69b330000_D8wwrB9ZCB.jbxd

Similarity

API ID: ErrorLast$LocalTime
String ID: )] $UNKNOWN$VERBOSE
API String ID: 3586426482-3915483136
Opcode ID: 232c8e820146bc5addb430a14e7ce4beacbc2facc5dcc5f1e8d82ed63482d043
Instruction ID: 27bcc166c68502ef9f38b073bc56d82e4e93ac1f5dddb591f543972e3c16b1ee
Opcode Fuzzy Hash: 232c8e820146bc5addb430a14e7ce4beacbc2facc5dcc5f1e8d82ed63482d043
Instruction Fuzzy Hash: 41C1E321B08A8AC1EA34DF15E45227A77A1EB89F84F444075EE4E877B6EF3CE645C700

Function 00007FF69B339D50 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 109COMMON

Download Yara Rule

APIs

TryAcquireSRWLockExclusive.KERNEL32(?), ref: 00007FF69B339E40
ReleaseSRWLockExclusive.KERNEL32 ref: 00007FF69B339E65
AcquireSRWLockExclusive.KERNEL32 ref: 00007FF69B339EB3

Strings

E, xrefs: 00007FF69B339F13
WaitNoSyncWork, xrefs: 00007FF69B339DC5
..\..\base\task\sequence_manager\work_tracker.cc, xrefs: 00007FF69B339DCC
ScopedAllowBaseSyncPrimitivesOutsideBlockingScope, xrefs: 00007FF69B339EC9, 00007FF69B339EF0

Memory Dump Source

Source File: 00000000.00000002.1667242761.00007FF69B331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69B330000, based on PE: true

Associated: 00000000.00000002.1667200836.00007FF69B330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667462352.00007FF69B51D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B55B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B569000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667608048.00007FF69B575000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667624939.00007FF69B589000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667639365.00007FF69B58A000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667689383.00007FF69B58B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69b330000_D8wwrB9ZCB.jbxd

Similarity

API ID: ExclusiveLock$Acquire$Release
String ID: ..\..\base\task\sequence_manager\work_tracker.cc$E$ScopedAllowBaseSyncPrimitivesOutsideBlockingScope$WaitNoSyncWork
API String ID: 1678258262-2415033031
Opcode ID: bc56937bbbf7a170183f0a3a08f5a6c2eb265204e84b8daa15dcd227a4dd79a1
Instruction ID: 99de351029b26962ebd8308c5ce3014ed526a8e7bd6790c42fee2e46ee244e95
Opcode Fuzzy Hash: bc56937bbbf7a170183f0a3a08f5a6c2eb265204e84b8daa15dcd227a4dd79a1
Instruction Fuzzy Hash: F6513C31608B8AC1EA30DF15E4543BA73A0EB88B84F440176DA9E87775DF3DE65AC740

Function 00007FF69B366BA0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 108libraryloaderCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF69B366BD8
SetLastError.KERNEL32 ref: 00007FF69B366BFC
GetModuleHandleW.KERNEL32 ref: 00007FF69B366C90
GetProcAddress.KERNEL32 ref: 00007FF69B366CA0
GetModuleHandleW.KERNEL32 ref: 00007FF69B366CD4
GetProcAddress.KERNEL32 ref: 00007FF69B366CE4

Strings

GetHandleVerifier, xrefs: 00007FF69B366C96, 00007FF69B366CDA

Memory Dump Source

Source File: 00000000.00000002.1667242761.00007FF69B331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69B330000, based on PE: true

Associated: 00000000.00000002.1667200836.00007FF69B330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667462352.00007FF69B51D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B55B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B569000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667608048.00007FF69B575000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667624939.00007FF69B589000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667639365.00007FF69B58A000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667689383.00007FF69B58B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69b330000_D8wwrB9ZCB.jbxd

Similarity

API ID: AddressErrorHandleLastModuleProc
String ID: GetHandleVerifier
API String ID: 4275029093-1090674830
Opcode ID: 276d9ebdd24910902b7ea08e5824f3cc12be087ab4314d47b48f21ed5c8418b1
Instruction ID: 9074a2bb173d65097feaf18558bb174832cccccceaa018f6654e8b08d9ae648e
Opcode Fuzzy Hash: 276d9ebdd24910902b7ea08e5824f3cc12be087ab4314d47b48f21ed5c8418b1
Instruction Fuzzy Hash: A5411C25A09A4AC1EA34DF56E8563B93362FF4DBC0F4484B9C94EC33B1DE7DA659C210

Function 00007FF69B344B07 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 102fileCOMMON

Download Yara Rule

APIs

CreateFileMappingW.KERNEL32 ref: 00007FF69B344BA3
GetLastError.KERNEL32 ref: 00007FF69B344BB5
SetLastError.KERNEL32 ref: 00007FF69B344BE3
MapViewOfFile.KERNEL32 ref: 00007FF69B344C11

Strings

MapImageToMemory, xrefs: 00007FF69B344B1E
..\..\base\files\memory_mapped_file_win.cc, xrefs: 00007FF69B344B25
ScopedBlockingCall, xrefs: 00007FF69B344D54

Memory Dump Source

Source File: 00000000.00000002.1667242761.00007FF69B331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69B330000, based on PE: true

Associated: 00000000.00000002.1667200836.00007FF69B330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667462352.00007FF69B51D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B55B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B569000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667608048.00007FF69B575000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667624939.00007FF69B589000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667639365.00007FF69B58A000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667689383.00007FF69B58B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69b330000_D8wwrB9ZCB.jbxd

Similarity

API ID: ErrorFileLast$CreateMappingView
String ID: ..\..\base\files\memory_mapped_file_win.cc$MapImageToMemory$ScopedBlockingCall
API String ID: 2231327692-923734411
Opcode ID: fe86218d2f39bde458ac4012b9eb5f40e64a188bc8e13430b6722f3397b1bd9b
Instruction ID: 10fb440258f345d5c57bf32e0f3928de2dc7bdd576066b6ed83e8eb0553838a7
Opcode Fuzzy Hash: fe86218d2f39bde458ac4012b9eb5f40e64a188bc8e13430b6722f3397b1bd9b
Instruction Fuzzy Hash: 13416421608A8A82EB30DF54F4553BA7362FF88744F444179DA8E87A75DF7DE245C700

Function 00007FF69B492FB8 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 88libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,00000010,?,00007FF69B492EDF,?,?,00000000,00007FF69B481C3E,?,?,?,00007FF69B464E29), ref: 00007FF69B49303D
GetLastError.KERNEL32(?,00000010,?,00007FF69B492EDF,?,?,00000000,00007FF69B481C3E,?,?,?,00007FF69B464E29), ref: 00007FF69B49304B
LoadLibraryExW.KERNEL32(?,00000010,?,00007FF69B492EDF,?,?,00000000,00007FF69B481C3E,?,?,?,00007FF69B464E29), ref: 00007FF69B493075
FreeLibrary.KERNEL32(?,00000010,?,00007FF69B492EDF,?,?,00000000,00007FF69B481C3E,?,?,?,00007FF69B464E29), ref: 00007FF69B4930E3
GetProcAddress.KERNEL32(?,00000010,?,00007FF69B492EDF,?,?,00000000,00007FF69B481C3E,?,?,?,00007FF69B464E29), ref: 00007FF69B4930EF

Strings

MZx, xrefs: 00007FF69B492FD6, 00007FF69B493086, 00007FF69B4930CC
api-ms-, xrefs: 00007FF69B49305D

Memory Dump Source

Source File: 00000000.00000002.1667242761.00007FF69B331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69B330000, based on PE: true

Associated: 00000000.00000002.1667200836.00007FF69B330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667462352.00007FF69B51D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B55B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B569000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667608048.00007FF69B575000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667624939.00007FF69B589000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667639365.00007FF69B58A000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667689383.00007FF69B58B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69b330000_D8wwrB9ZCB.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: MZx$api-ms-
API String ID: 2559590344-259127448
Opcode ID: 0567214eaa759b5435dccad67280da318e288f24834ab898781dc8d2fb63fc1a
Instruction ID: 12995de4eb06736ec2e5be4513a48c4888fa75960a9d3fb543763b5dd3df3cb8
Opcode Fuzzy Hash: 0567214eaa759b5435dccad67280da318e288f24834ab898781dc8d2fb63fc1a
Instruction Fuzzy Hash: 9931BE21A1AA4A91FE329B16AA1453933D4FF5DFA0F490575DE5DC73A8DF7CE2408700

Function 00007FF69B387940 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 63fileCOMMON

Download Yara Rule

APIs

SetFilePointerEx.KERNEL32(?,?,?,?,?,00000001,?,?,00007FF69B35C324), ref: 00007FF69B387977
SetEndOfFile.KERNEL32 ref: 00007FF69B387993
GetLastError.KERNEL32(?,?,?,?,?,00000001,?,?,00007FF69B35C324), ref: 00007FF69B3879D1
GetLastError.KERNEL32 ref: 00007FF69B387A17

Strings

SetFilePointerEx, xrefs: 00007FF69B3879FF
..\..\third_party\crashpad\crashpad\util\file\file_io_win.cc, xrefs: 00007FF69B3879DA, 00007FF69B387A20
SetEndOfFile, xrefs: 00007FF69B387A45

Memory Dump Source

Source File: 00000000.00000002.1667242761.00007FF69B331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69B330000, based on PE: true

Associated: 00000000.00000002.1667200836.00007FF69B330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667462352.00007FF69B51D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B55B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B569000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667608048.00007FF69B575000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667624939.00007FF69B589000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667639365.00007FF69B58A000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667689383.00007FF69B58B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69b330000_D8wwrB9ZCB.jbxd

Similarity

API ID: ErrorFileLast$Pointer
String ID: ..\..\third_party\crashpad\crashpad\util\file\file_io_win.cc$SetEndOfFile$SetFilePointerEx
API String ID: 1697706070-1316252286
Opcode ID: 2a0843e282d71c67300d99956b24b7c698a280025d6e8ad264383c6bb95cabbb
Instruction ID: 987758d7a115604d6e2f364ee9e5c9c820407558c5c419c4c52c23c31ae8c2c2
Opcode Fuzzy Hash: 2a0843e282d71c67300d99956b24b7c698a280025d6e8ad264383c6bb95cabbb
Instruction Fuzzy Hash: C9218D31B0C65ED1FA30DB15E8113BA22A2EB8CB80F0011B5C90DC7BB6DE2DE3469B11

Function 00007FF69B4C74A0 Relevance: 12.1, APIs: 8, Instructions: 116processsynchronizationthreadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,0000000D), ref: 00007FF69B4C7541
CreateProcessW.KERNEL32 ref: 00007FF69B4C75CA
WaitForSingleObject.KERNEL32 ref: 00007FF69B4C75DE
GetLastError.KERNEL32 ref: 00007FF69B4C75F1
CloseHandle.KERNEL32 ref: 00007FF69B4C7607
CloseHandle.KERNEL32 ref: 00007FF69B4C760E

Memory Dump Source

Source File: 00000000.00000002.1667242761.00007FF69B331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69B330000, based on PE: true

Associated: 00000000.00000002.1667200836.00007FF69B330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667462352.00007FF69B51D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B55B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B569000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667608048.00007FF69B575000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667624939.00007FF69B589000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667639365.00007FF69B58A000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667689383.00007FF69B58B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69b330000_D8wwrB9ZCB.jbxd

Similarity

API ID: CloseHandle$CreateCurrentErrorLastObjectProcessSingleThreadWait
String ID:
API String ID: 2809771408-0
Opcode ID: 6f0312a0e049ff4280f56e47f6ee7f90fc2d1e454cba1e031af36f1e5dbd6e4d
Instruction ID: 97f6494704c391900f8585675f46867a752a968e1c14d357ef2ee51a39b291a6
Opcode Fuzzy Hash: 6f0312a0e049ff4280f56e47f6ee7f90fc2d1e454cba1e031af36f1e5dbd6e4d
Instruction Fuzzy Hash: 0D418521A0874986EA349F29F4443BA7361FF88B60F404271DAADC3AB9DF3CE5559700

Function 00007FF69B3C84A0 Relevance: 12.1, APIs: 8, Instructions: 76memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00001000,?,?,00001000,00007FF69B3C824F,00000003,00001000,00000000,00000000,?,?,?), ref: 00007FF69B3C84D6
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00007FF69B3CD2D5), ref: 00007FF69B3C84FD
TryAcquireSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00007FF69B3CD2D5), ref: 00007FF69B3C8519
ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00007FF69B3CD2D5), ref: 00007FF69B3C8536
VirtualAlloc.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00007FF69B3CD2D5), ref: 00007FF69B3C854A
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00007FF69B3CD2D5), ref: 00007FF69B3C8558
TryAcquireSRWLockExclusive.KERNEL32(?,?,?,?,?,00001000,?,?,00001000,00007FF69B3C824F,00000003,00001000,00000000,00000000,?,?), ref: 00007FF69B3C857B
ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,00001000,?,?,00001000,00007FF69B3C824F,00000003,00001000,00000000,00000000,?,?), ref: 00007FF69B3C8598

Memory Dump Source

Source File: 00000000.00000002.1667242761.00007FF69B331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69B330000, based on PE: true

Associated: 00000000.00000002.1667200836.00007FF69B330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667462352.00007FF69B51D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B55B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B569000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667608048.00007FF69B575000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667624939.00007FF69B589000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667639365.00007FF69B58A000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667689383.00007FF69B58B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69b330000_D8wwrB9ZCB.jbxd

Similarity

API ID: ExclusiveLock$AcquireAllocErrorLastReleaseVirtual
String ID:
API String ID: 527672694-0
Opcode ID: 3603cfa9b7df96b4aabc90dd8ef4d14d3b8c10ec7dac570bf12e0429c83771d0
Instruction ID: 57c9592b87dee8dd213f01c61981058715b0a3358b9f6d5770b298640ece4184
Opcode Fuzzy Hash: 3603cfa9b7df96b4aabc90dd8ef4d14d3b8c10ec7dac570bf12e0429c83771d0
Instruction Fuzzy Hash: 48213920A19A1BD6FA35DF52AC445746365EF6CB90F8505F9CD1D836B2EE2CAB86C300

Function 00007FF69B43B510 Relevance: 10.9, APIs: 3, Strings: 3, Instructions: 446threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00007FF69B43BB36
GetCurrentThreadId.KERNEL32 ref: 00007FF69B43BB47
GetCurrentThreadId.KERNEL32 ref: 00007FF69B43BB58

Strings

SequenceManagerImpl::UnregisterTaskQueue, xrefs: 00007FF69B43BBDD
NULL, xrefs: 00007FF69B43BBD2
queue_name, xrefs: 00007FF69B43BBF4

Memory Dump Source

Source File: 00000000.00000002.1667242761.00007FF69B331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69B330000, based on PE: true

Associated: 00000000.00000002.1667200836.00007FF69B330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667462352.00007FF69B51D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B55B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B569000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667608048.00007FF69B575000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667624939.00007FF69B589000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667639365.00007FF69B58A000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667689383.00007FF69B58B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69b330000_D8wwrB9ZCB.jbxd

Similarity

API ID: CurrentThread
String ID: NULL$SequenceManagerImpl::UnregisterTaskQueue$queue_name
API String ID: 2882836952-1240882560
Opcode ID: d385b3a65402514e5e02fc107150af5981459baf521a259c7c2784ee9d1fc0e8
Instruction ID: 66242544aa9f59fd71e79e51287fcc377007f5c6e34e33b9dfcf051925c94022
Opcode Fuzzy Hash: d385b3a65402514e5e02fc107150af5981459baf521a259c7c2784ee9d1fc0e8
Instruction Fuzzy Hash: 4B128E72A05B4982EA688F15D29477877A0FB58F90F184676EBAD837E4DF38D690D300

Function 00007FF69B393BF0 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 220COMMON

Download Yara Rule

APIs

TryAcquireSRWLockExclusive.KERNEL32 ref: 00007FF69B393C3E
ReleaseSRWLockExclusive.KERNEL32 ref: 00007FF69B393C89
AcquireSRWLockExclusive.KERNEL32 ref: 00007FF69B393D97
ReleaseSRWLockExclusive.KERNEL32 ref: 00007FF69B393EDA

Strings

..\..\base\threading\scoped_blocking_call_internal.cc, xrefs: 00007FF69B393F66
MonitorNextJankWindowIfNecessary, xrefs: 00007FF69B393F5F

Memory Dump Source

Source File: 00000000.00000002.1667242761.00007FF69B331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69B330000, based on PE: true

Associated: 00000000.00000002.1667200836.00007FF69B330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667462352.00007FF69B51D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B55B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B569000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667608048.00007FF69B575000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667624939.00007FF69B589000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667639365.00007FF69B58A000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667689383.00007FF69B58B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69b330000_D8wwrB9ZCB.jbxd

Similarity

API ID: ExclusiveLock$AcquireRelease
String ID: ..\..\base\threading\scoped_blocking_call_internal.cc$MonitorNextJankWindowIfNecessary
API String ID: 17069307-733433259
Opcode ID: a552fa26b4be54e63322d582659734f0588bac52181c2c2e2d2c3112bad9e8ca
Instruction ID: 49055a2aa1d175d475ad6115698e9a3e36897e858678693d0a0481e9679ec429
Opcode Fuzzy Hash: a552fa26b4be54e63322d582659734f0588bac52181c2c2e2d2c3112bad9e8ca
Instruction Fuzzy Hash: B8A17A71A08A4AC5EB20EF15D8583B933A1FB48BA4F4445B5C92EC76F6DF7CAA45C300

Function 00007FF69B4B9A70 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 180fileCOMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32 ref: 00007FF69B4B9AFD
CreateFileW.KERNEL32 ref: 00007FF69B4B9BCD
GetCurrentDirectoryW.KERNEL32 ref: 00007FF69B4B9C09
CreateFileW.KERNEL32 ref: 00007FF69B4B9CBA

Strings

Check failed: false. , xrefs: 00007FF69B4B9D24
debug.log, xrefs: 00007FF69B4B9B71, 00007FF69B4B9C71

Memory Dump Source

Source File: 00000000.00000002.1667242761.00007FF69B331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69B330000, based on PE: true

Associated: 00000000.00000002.1667200836.00007FF69B330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667462352.00007FF69B51D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B55B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B569000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667608048.00007FF69B575000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667624939.00007FF69B589000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667639365.00007FF69B58A000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667689383.00007FF69B58B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69b330000_D8wwrB9ZCB.jbxd

Similarity

API ID: File$Create$CurrentDirectoryModuleName
String ID: Check failed: false. $debug.log
API String ID: 4120427848-883309970
Opcode ID: de69052495d402390393d2feaf7c481c06d762cbbe5ca5dcd1fda88c2e9dde70
Instruction ID: 25d50f172637e509447e10e7d74b9723c062b11cc0ba0e4db30aeabfe1b70cd6
Opcode Fuzzy Hash: de69052495d402390393d2feaf7c481c06d762cbbe5ca5dcd1fda88c2e9dde70
Instruction Fuzzy Hash: C561EC61A18A5A81FE308F05E69837D23A1EF8CF94F0442B5CA1D877FADF2CE2459300

Function 00007FF69B35AF30 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 133libraryloaderthreadCOMMON

Download Yara Rule

APIs

GetCurrentThread.KERNEL32(?,?,?,?,00000000,?,?,00000000,00000000,00007FF69B35AE7E,?,?,?,?,?,?), ref: 00007FF69B35AF94
LocalFree.KERNEL32(?,?,?,?,00000000,?,?,00000000,00000000,00007FF69B35AE7E,?,?,?,?,?,?), ref: 00007FF69B35B07A
GetModuleHandleA.KERNEL32(?,?,?,?,00000000,?,?,00000000,00000000,00007FF69B35AE7E,?,?,?,?,?,?), ref: 00007FF69B35B0DB
GetProcAddress.KERNEL32(?,?,?,?,00000000,?,?,00000000,00000000,00007FF69B35AE7E,?,?,?,?,?,?), ref: 00007FF69B35B0EB

Strings

Kernel32.dll, xrefs: 00007FF69B35B0D4
GetThreadDescription, xrefs: 00007FF69B35B0E1

Memory Dump Source

Source File: 00000000.00000002.1667242761.00007FF69B331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69B330000, based on PE: true

Associated: 00000000.00000002.1667200836.00007FF69B330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667462352.00007FF69B51D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B55B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B569000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667608048.00007FF69B575000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667624939.00007FF69B589000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667639365.00007FF69B58A000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667689383.00007FF69B58B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69b330000_D8wwrB9ZCB.jbxd

Similarity

API ID: AddressCurrentFreeHandleLocalModuleProcThread
String ID: GetThreadDescription$Kernel32.dll
API String ID: 4205643583-415897907
Opcode ID: 59b25eca87c3073234f69e64169333dd2632e24ce029a3932e1f8a2e0ae1eb3d
Instruction ID: 8df8f1f3c215f1968ec482e737d969a44e00d5c06e86067b2bae374be553379b
Opcode Fuzzy Hash: 59b25eca87c3073234f69e64169333dd2632e24ce029a3932e1f8a2e0ae1eb3d
Instruction Fuzzy Hash: 2541AD31A08A4A82EA30DF15E99517973A1EF4CBA0F5401B5DA1EC77B6EF7CE6458310

Function 00007FF69B418EE0 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 124COMMON

Download Yara Rule

APIs

TryAcquireSRWLockExclusive.KERNEL32(?,?,?,?,?,00000000,?,?,00000000,00000001,00007FF69B418C6B), ref: 00007FF69B418F09
ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,00000000,?,?,00000000,00000001,00007FF69B418C6B), ref: 00007FF69B418FE5
AcquireSRWLockExclusive.KERNEL32(?,?,?,?,?,00000000,?,?,00000000,00000001,00007FF69B418C6B), ref: 00007FF69B419026

Strings

it != usages_.end(), xrefs: 00007FF69B419052
..\..\base\memory\shared_memory_tracker.cc, xrefs: 00007FF69B419038
DecrementMemoryUsage, xrefs: 00007FF69B419031

Memory Dump Source

Source File: 00000000.00000002.1667242761.00007FF69B331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69B330000, based on PE: true

Associated: 00000000.00000002.1667200836.00007FF69B330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667462352.00007FF69B51D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B55B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B569000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667608048.00007FF69B575000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667624939.00007FF69B589000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667639365.00007FF69B58A000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667689383.00007FF69B58B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69b330000_D8wwrB9ZCB.jbxd

Similarity

API ID: ExclusiveLock$Acquire$Release
String ID: ..\..\base\memory\shared_memory_tracker.cc$DecrementMemoryUsage$it != usages_.end()
API String ID: 1678258262-3010543142
Opcode ID: 1e7170a334d1ed2f44b5bb01fc69d09dd3ab117fa7df66dd8af72f6c08764aa5
Instruction ID: fec68f3e01768a2b7b4081a1dacee76e271792af95d1203c37f760553e55858e
Opcode Fuzzy Hash: 1e7170a334d1ed2f44b5bb01fc69d09dd3ab117fa7df66dd8af72f6c08764aa5
Instruction Fuzzy Hash: 51419F51B09A4A81EE348F1199185796762FF6CFC0F484072DE0D87769DF3CE662E300

Function 00007FF69B438CB0 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 107libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF69B438DF0
GetProcAddress.KERNEL32 ref: 00007FF69B438E00

Strings

GetHandleVerifier, xrefs: 00007FF69B438DF6
..\..\base\files\file_win.cc, xrefs: 00007FF69B438D41
ScopedBlockingCall, xrefs: 00007FF69B438E56
Close, xrefs: 00007FF69B438D3A

Memory Dump Source

Source File: 00000000.00000002.1667242761.00007FF69B331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69B330000, based on PE: true

Associated: 00000000.00000002.1667200836.00007FF69B330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667462352.00007FF69B51D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B55B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B569000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667608048.00007FF69B575000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667624939.00007FF69B589000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667639365.00007FF69B58A000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667689383.00007FF69B58B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69b330000_D8wwrB9ZCB.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: ..\..\base\files\file_win.cc$Close$GetHandleVerifier$ScopedBlockingCall
API String ID: 1646373207-3663164917
Opcode ID: 476f09423d9e45c90793e076302d8c5c474243c7ac5322815a51d780d9681744
Instruction ID: ed03e22caf2d8096a4d17507982a34582626be605d122517c2748c5c5169dc88
Opcode Fuzzy Hash: 476f09423d9e45c90793e076302d8c5c474243c7ac5322815a51d780d9681744
Instruction Fuzzy Hash: D4418231A08A8E90FA319F25E5553B96361FF98B84F484071DA8EC77B9DE3CE245D311

Function 00007FF69B3CF9A0 Relevance: 10.6, APIs: 3, Strings: 4, Instructions: 88COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32 ref: 00007FF69B3CF9BA
GetLastError.KERNEL32 ref: 00007FF69B3CF9F6
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?), ref: 00007FF69B3CFA65

Strings

Free, xrefs: 00007FF69B3CFA8D
CloseHandle, xrefs: 00007FF69B3CFA24, 00007FF69B3CFABE
..\..\third_party\crashpad\crashpad\util\file\file_io_win.cc, xrefs: 00007FF69B3CF9FF
..\..\third_party\crashpad\crashpad\util\win\scoped_handle.cc, xrefs: 00007FF69B3CFA94

Memory Dump Source

Source File: 00000000.00000002.1667242761.00007FF69B331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69B330000, based on PE: true

Associated: 00000000.00000002.1667200836.00007FF69B330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667462352.00007FF69B51D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B55B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B569000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667608048.00007FF69B575000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667624939.00007FF69B589000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667639365.00007FF69B58A000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667689383.00007FF69B58B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69b330000_D8wwrB9ZCB.jbxd

Similarity

API ID: CloseHandle$ErrorLast
String ID: ..\..\third_party\crashpad\crashpad\util\file\file_io_win.cc$..\..\third_party\crashpad\crashpad\util\win\scoped_handle.cc$CloseHandle$Free
API String ID: 1798101686-1661544796
Opcode ID: eba82d90a50ce5c60a71bf1873ef058c2f94574e38323a86cf0d9624ecd5145c
Instruction ID: ebcf71992bec1dfdcedbd4584c552c6001bb34ffd469e907cbce36183ab22cea
Opcode Fuzzy Hash: eba82d90a50ce5c60a71bf1873ef058c2f94574e38323a86cf0d9624ecd5145c
Instruction Fuzzy Hash: 4D314121A1C55E91FE309B65A9562BA3251EF4CB80F4000B5DE0DC7ABADF6CE7468B11

Function 00007FF69B4E6C90 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 82COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNEL32 ref: 00007FF69B4E6CBD
GetLastError.KERNEL32 ref: 00007FF69B4E6CCE
GetLastError.KERNEL32 ref: 00007FF69B4E6CED

Part of subcall function 00007FF69B4E6BB0: GetFileAttributesW.KERNEL32 ref: 00007FF69B4E6BDA

Strings

not a directory, xrefs: 00007FF69B4E6DB5
..\..\third_party\crashpad\crashpad\util\file\filesystem_win.cc, xrefs: 00007FF69B4E6CF6, 00007FF69B4E6D88
CreateDirectory , xrefs: 00007FF69B4E6D1B

Memory Dump Source

Source File: 00000000.00000002.1667242761.00007FF69B331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69B330000, based on PE: true

Associated: 00000000.00000002.1667200836.00007FF69B330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667462352.00007FF69B51D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B55B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B569000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667608048.00007FF69B575000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667624939.00007FF69B589000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667639365.00007FF69B58A000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667689383.00007FF69B58B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69b330000_D8wwrB9ZCB.jbxd

Similarity

API ID: ErrorLast$AttributesCreateDirectoryFile
String ID: not a directory$..\..\third_party\crashpad\crashpad\util\file\filesystem_win.cc$CreateDirectory
API String ID: 635176117-3044177479
Opcode ID: 756be62aaf80665b293f97bced187ee8aa067b794e0508aabda7e226f5b668a8
Instruction ID: 4657b66feb2f90f631ddf814fa7b4b3c2b2486809b41acae3aabed2d5f13ff63
Opcode Fuzzy Hash: 756be62aaf80665b293f97bced187ee8aa067b794e0508aabda7e226f5b668a8
Instruction Fuzzy Hash: 00319C21B0C65E51FA74EB11A5517BD2252EF8DB80F4000B5DE4D8BBBADE2DEA06A301

Function 00007FF69B34FA20 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 80COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 00007FF69B34FA44
CreateEventW.KERNEL32 ref: 00007FF69B34FACA
GetLastError.KERNEL32 ref: 00007FF69B34FAE3
SetLastError.KERNEL32 ref: 00007FF69B34FB13

Strings

ExitCodeWatcherThread, xrefs: 00007FF69B34FA5C
erThread, xrefs: 00007FF69B34FA8F

Memory Dump Source

Source File: 00000000.00000002.1667242761.00007FF69B331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69B330000, based on PE: true

Associated: 00000000.00000002.1667200836.00007FF69B330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667462352.00007FF69B51D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B55B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B569000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667608048.00007FF69B575000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667624939.00007FF69B589000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667639365.00007FF69B58A000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667689383.00007FF69B58B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69b330000_D8wwrB9ZCB.jbxd

Similarity

API ID: ErrorLast$CreateCurrentEventProcess
String ID: ExitCodeWatcherThread$erThread
API String ID: 2886518480-1722799589
Opcode ID: 7ca60a6efab855032e4dd1572dd566b7a86d59eb9685673237b950fd9360c07f
Instruction ID: 4f4eebabbc5f7073f86dd637f72f91c821558d7c1bc9a9e1821e36d6c3e0de00
Opcode Fuzzy Hash: 7ca60a6efab855032e4dd1572dd566b7a86d59eb9685673237b950fd9360c07f
Instruction Fuzzy Hash: A831E42160978A81FA70DB24F55537A63A1EB59784F088075DA8E837B6DFBDE2458300

Function 00007FF69B34DF70 Relevance: 10.6, APIs: 7, Instructions: 59threadCOMMON

Download Yara Rule

APIs

GetCurrentThread.KERNEL32(?,?,?,?,?,?,00007FF69B34DF34,?,?,?,00007FF69B403F8D), ref: 00007FF69B34DF87
SetThreadPriority.KERNEL32(?,?,?,?,?,?,00007FF69B34DF34,?,?,?,00007FF69B403F8D), ref: 00007FF69B34DFA0
SetThreadInformation.KERNEL32(?,?,?,?,?,?,00007FF69B34DF34,?,?,?,00007FF69B403F8D), ref: 00007FF69B34DFBD

Part of subcall function 00007FF69B499270: GetCurrentThread.KERNEL32(?,?,?,?,00007FF69B34DFC8,?,?,?,?,?,?,00007FF69B34DF34,?,?,?,00007FF69B403F8D), ref: 00007FF69B499274
Part of subcall function 00007FF69B499270: GetThreadPriority.KERNEL32(?,?,?,?,00007FF69B34DFC8,?,?,?,?,?,?,00007FF69B34DF34,?,?,?,00007FF69B403F8D), ref: 00007FF69B49927D

SetThreadPriority.KERNEL32(?,?,?,?,?,?,00007FF69B34DF34,?,?,?,00007FF69B403F8D), ref: 00007FF69B34DFD4
GetCurrentThread.KERNEL32(?,?,?,?,?,?,00007FF69B34DF34,?,?,?,00007FF69B403F8D), ref: 00007FF69B34DFF3
SetThreadInformation.KERNEL32(?,?,?,?,?,?,00007FF69B34DF34,?,?,?,00007FF69B403F8D), ref: 00007FF69B34E00A
SetThreadPriority.KERNEL32(?,?,?,?,?,?,00007FF69B34DF34,?,?,?,00007FF69B403F8D), ref: 00007FF69B34E033

Memory Dump Source

Source File: 00000000.00000002.1667242761.00007FF69B331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69B330000, based on PE: true

Associated: 00000000.00000002.1667200836.00007FF69B330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667462352.00007FF69B51D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B55B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B569000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667608048.00007FF69B575000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667624939.00007FF69B589000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667639365.00007FF69B58A000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667689383.00007FF69B58B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69b330000_D8wwrB9ZCB.jbxd

Similarity

API ID: Thread$Priority$Current$Information
String ID:
API String ID: 2516384554-0
Opcode ID: 7699461f617d4bedc11fc0e15b988fd7a0082f266e8609dbf9dac1419e1d6cc6
Instruction ID: 518cfc86b6db896e3e051d7ecd26b5c5efdf1c3c1cdb4de55cf941412d6c2f64
Opcode Fuzzy Hash: 7699461f617d4bedc11fc0e15b988fd7a0082f266e8609dbf9dac1419e1d6cc6
Instruction Fuzzy Hash: 3B21D431A0860A82FB709F25EA042292292EF8CB91F004175DE1E83BB5DE3DEA428700

Function 00007FF69B485A2C Relevance: 10.6, APIs: 7, Instructions: 57COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF69B485A3B
FlsGetValue.KERNEL32 ref: 00007FF69B485A50
FlsSetValue.KERNEL32 ref: 00007FF69B485A71
FlsSetValue.KERNEL32 ref: 00007FF69B485A9E
FlsSetValue.KERNEL32 ref: 00007FF69B485AAF
FlsSetValue.KERNEL32 ref: 00007FF69B485AC0
SetLastError.KERNEL32 ref: 00007FF69B485ADB

Memory Dump Source

Source File: 00000000.00000002.1667242761.00007FF69B331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69B330000, based on PE: true

Associated: 00000000.00000002.1667200836.00007FF69B330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667462352.00007FF69B51D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B55B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B569000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667608048.00007FF69B575000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667624939.00007FF69B589000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667639365.00007FF69B58A000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667689383.00007FF69B58B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69b330000_D8wwrB9ZCB.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: e7b359884eb2dc0914d210608bff3c12e65f9776b9902780600c4164ad79ab71
Instruction ID: fae4b3b30937635be5ddcc764cea3a9e79393bbdfb8dba430158bad7c7c0c70b
Opcode Fuzzy Hash: e7b359884eb2dc0914d210608bff3c12e65f9776b9902780600c4164ad79ab71
Instruction Fuzzy Hash: 35118120B0C24E41FA78AB6165D51396162DF4CBB0F1447B5D92ECA6FAEE7CE6416340

Function 00007FF69B4CB480 Relevance: 9.1, APIs: 6, Instructions: 118threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32(000000A0,?,?,?,00007FF69B42177E), ref: 00007FF69B4CB597
GetCurrentThreadId.KERNEL32(?,?,00007FF69B42177E), ref: 00007FF69B4CB5A8
GetCurrentThreadId.KERNEL32(?,?,00007FF69B42177E), ref: 00007FF69B4CB5B9
GetCurrentThreadId.KERNEL32 ref: 00007FF69B4CB5CA
GetCurrentThreadId.KERNEL32 ref: 00007FF69B4CB5DB
GetCurrentThreadId.KERNEL32(?,?,00007FF69B42177E), ref: 00007FF69B4CB604

Memory Dump Source

Source File: 00000000.00000002.1667242761.00007FF69B331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69B330000, based on PE: true

Associated: 00000000.00000002.1667200836.00007FF69B330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667462352.00007FF69B51D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B55B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B569000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667608048.00007FF69B575000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667624939.00007FF69B589000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667639365.00007FF69B58A000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667689383.00007FF69B58B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69b330000_D8wwrB9ZCB.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: e1f217c2d3c9e858e7bda86a5d6d76f0525cfd96002e7efb719e6d029f3eccfa
Instruction ID: b2b705ea4e2b36e24aade041199fc4d3e340824e7a2cb5bfe0af5797af85988c
Opcode Fuzzy Hash: e1f217c2d3c9e858e7bda86a5d6d76f0525cfd96002e7efb719e6d029f3eccfa
Instruction Fuzzy Hash: D7418462A0874E96EB749F26C5802B977A1FB5CF84F048471CB0D836B5DF68ED99D310

Function 00007FF69B345400 Relevance: 9.1, APIs: 3, Strings: 2, Instructions: 314COMMON

Download Yara Rule

APIs

TryAcquireSRWLockExclusive.KERNEL32 ref: 00007FF69B345732
ReleaseSRWLockExclusive.KERNEL32 ref: 00007FF69B345757

Part of subcall function 00007FF69B3439D0: UnmapViewOfFile.KERNEL32(00000000,?,?,00007FF69B34399D), ref: 00007FF69B3439E8

Part of subcall function 00007FF69B368B90: GetFileAttributesW.KERNEL32 ref: 00007FF69B368CE9
Part of subcall function 00007FF69B368B90: GetLastError.KERNEL32 ref: 00007FF69B368CF4

AcquireSRWLockExclusive.KERNEL32 ref: 00007FF69B34592B

Strings

(, xrefs: 00007FF69B3457A2
UMA.PersistentAllocator.EarlyHistograms., xrefs: 00007FF69B345793

Memory Dump Source

Source File: 00000000.00000002.1667242761.00007FF69B331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69B330000, based on PE: true

Associated: 00000000.00000002.1667200836.00007FF69B330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667462352.00007FF69B51D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B55B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B569000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667608048.00007FF69B575000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667624939.00007FF69B589000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667639365.00007FF69B58A000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667689383.00007FF69B58B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69b330000_D8wwrB9ZCB.jbxd

Similarity

API ID: ExclusiveLock$AcquireFile$AttributesErrorLastReleaseUnmapView
String ID: ($UMA.PersistentAllocator.EarlyHistograms.
API String ID: 2812541354-2412162110
Opcode ID: 01abff1a0b94b8186a3ffaa611a92045b9f6ebfb62d12a153cf1eddf716d7cf0
Instruction ID: d825122bb790b7d058fe1a11263277fcdcd5583d25824f1bcf6b7204d5b701e6
Opcode Fuzzy Hash: 01abff1a0b94b8186a3ffaa611a92045b9f6ebfb62d12a153cf1eddf716d7cf0
Instruction Fuzzy Hash: 27E1AF22E09A8A81FA31DB11E4413B96362FF88B84F454579DA4D87BE6DF3DE681C340

Function 00007FF69B47D084 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 299fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 00007FF69B47D103
WriteFile.KERNEL32 ref: 00007FF69B47D3CB
WriteFile.KERNEL32 ref: 00007FF69B47D411
GetLastError.KERNEL32 ref: 00007FF69B47D4C7

Strings

MZx, xrefs: 00007FF69B47D0DA, 00007FF69B47D15B, 00007FF69B47D210

Memory Dump Source

Source File: 00000000.00000002.1667242761.00007FF69B331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69B330000, based on PE: true

Associated: 00000000.00000002.1667200836.00007FF69B330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667462352.00007FF69B51D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B55B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B569000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667608048.00007FF69B575000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667624939.00007FF69B589000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667639365.00007FF69B58A000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667689383.00007FF69B58B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69b330000_D8wwrB9ZCB.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID: MZx
API String ID: 2718003287-2575928145
Opcode ID: 1f0b57139a25ae7a8d9da5687a45eff08674d6af695c8789bf5bba2c2666c3b2
Instruction ID: f5f6139576c3b389eda5618cc219f2beb4a9788f3eee7be53d325bf131445ebe
Opcode Fuzzy Hash: 1f0b57139a25ae7a8d9da5687a45eff08674d6af695c8789bf5bba2c2666c3b2
Instruction Fuzzy Hash: C2D11772B18A448AE721CF75D8806BC37B1FB48BD8B144276CE5D97BA9DE78E106D300

Function 00007FF69B48A9AC Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 167COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF69B4858B4: GetLastError.KERNEL32 ref: 00007FF69B4858C3
Part of subcall function 00007FF69B4858B4: FlsGetValue.KERNEL32 ref: 00007FF69B4858D8
Part of subcall function 00007FF69B4858B4: SetLastError.KERNEL32 ref: 00007FF69B485963

TranslateName.LIBCMT ref: 00007FF69B48AA16
TranslateName.LIBCMT ref: 00007FF69B48AA51
GetACP.KERNEL32(?,?,?,00000000,00000092,00007FF69B474FE8), ref: 00007FF69B48AA98
IsValidCodePage.KERNEL32(?,?,?,00000000,00000092,00007FF69B474FE8), ref: 00007FF69B48AAD0

Strings

utf8, xrefs: 00007FF69B48ABB4

Memory Dump Source

Source File: 00000000.00000002.1667242761.00007FF69B331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69B330000, based on PE: true

Associated: 00000000.00000002.1667200836.00007FF69B330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667462352.00007FF69B51D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B55B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B569000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667608048.00007FF69B575000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667624939.00007FF69B589000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667639365.00007FF69B58A000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667689383.00007FF69B58B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69b330000_D8wwrB9ZCB.jbxd

Similarity

API ID: ErrorLastNameTranslate$CodePageValidValue
String ID: utf8
API String ID: 1791977518-905460609
Opcode ID: cfeeee3e2bf621bf7218feec9bed533eec1b63827bce942cca85afa683253106
Instruction ID: f6304a75f8f0a8a461add1677a799786f5834b7a5c392b58e27ef94a6da0a5f9
Opcode Fuzzy Hash: cfeeee3e2bf621bf7218feec9bed533eec1b63827bce942cca85afa683253106
Instruction Fuzzy Hash: 48619221A0874E81EA749F5195502B92355EF48F80F444571CE4C87BFAEFBDE751E381

Function 00007FF69B347090 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 120threadCOMMON

Download Yara Rule

APIs

SwitchToThread.KERNEL32(?), ref: 00007FF69B347195

Strings

%s (errno: %d, %s), xrefs: 00007FF69B3471E7, 00007FF69B347235
PERFETTO_CHECK(chunk.size() == page_chunk_size), xrefs: 00007FF69B3471DB
PERFETTO_CHECK(chunk_state == expected_chunk_state), xrefs: 00007FF69B347229
..\..\third_party\perfetto\src\tracing\core\shared_memory_abi.cc, xrefs: 00007FF69B3471C6, 00007FF69B347214

Memory Dump Source

Source File: 00000000.00000002.1667242761.00007FF69B331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69B330000, based on PE: true

Associated: 00000000.00000002.1667200836.00007FF69B330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667462352.00007FF69B51D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B55B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B569000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667608048.00007FF69B575000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667624939.00007FF69B589000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667639365.00007FF69B58A000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667689383.00007FF69B58B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69b330000_D8wwrB9ZCB.jbxd

Similarity

API ID: SwitchThread
String ID: %s (errno: %d, %s)$..\..\third_party\perfetto\src\tracing\core\shared_memory_abi.cc$PERFETTO_CHECK(chunk.size() == page_chunk_size)$PERFETTO_CHECK(chunk_state == expected_chunk_state)
API String ID: 115865932-3916303389
Opcode ID: 638e6c08f567bdc93006dac18288345f1dc0e6a7f22360e44332de6a6b9f4045
Instruction ID: 770a008ae6fc7e47ec06af4a3085d54b8f1a1bfe2a53b663deda669ef3944cd6
Opcode Fuzzy Hash: 638e6c08f567bdc93006dac18288345f1dc0e6a7f22360e44332de6a6b9f4045
Instruction Fuzzy Hash: 174145A2A0810A82E734DF20E850AB83752FB98F94F005279DA1E877F5DE3CDA45C340

Function 00007FF69B379360 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 111COMMON

Download Yara Rule

APIs

GetLongPathNameW.KERNEL32 ref: 00007FF69B3793FD
GetLongPathNameW.KERNEL32 ref: 00007FF69B37943C

Strings

MakeLongFilePath, xrefs: 00007FF69B3793A4
ScopedBlockingCall, xrefs: 00007FF69B3794FE
..\..\base\files\file_util_win.cc, xrefs: 00007FF69B3793AB

Memory Dump Source

Source File: 00000000.00000002.1667242761.00007FF69B331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69B330000, based on PE: true

Associated: 00000000.00000002.1667200836.00007FF69B330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667462352.00007FF69B51D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B55B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B569000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667608048.00007FF69B575000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667624939.00007FF69B589000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667639365.00007FF69B58A000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667689383.00007FF69B58B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69b330000_D8wwrB9ZCB.jbxd

Similarity

API ID: LongNamePath
String ID: ..\..\base\files\file_util_win.cc$MakeLongFilePath$ScopedBlockingCall
API String ID: 82841172-2989128051
Opcode ID: f2363d00ff0a1719f09b8138d34a4e52e20001bca91de7ec2423e65ab96bf81c
Instruction ID: e36ed0164bc263333c982a6b6192b3ce648782e4eb02b2343870924418a071a6
Opcode Fuzzy Hash: f2363d00ff0a1719f09b8138d34a4e52e20001bca91de7ec2423e65ab96bf81c
Instruction Fuzzy Hash: EF41D421A1CB8A91FA31CF25E4947BA6360FF99744F044275EA8D83765EFBCE2958700

Function 00007FF69B47BBE4 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 106timeCOMMON

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 00007FF69B47BC12

Part of subcall function 00007FF69B465D1C: _invalid_parameter_noinfo.LIBCMT ref: 00007FF69B465D30

_get_daylight.LIBCMT ref: 00007FF69B47BC34

Part of subcall function 00007FF69B465CEC: _invalid_parameter_noinfo.LIBCMT ref: 00007FF69B465D00

GetTimeZoneInformation.KERNEL32(?,?,00000000,00000000,?,00007FF69B47C140), ref: 00007FF69B47BC5B
_get_daylight.LIBCMT ref: 00007FF69B47BC23

Part of subcall function 00007FF69B465CBC: _invalid_parameter_noinfo.LIBCMT ref: 00007FF69B465CD0

Strings

?, xrefs: 00007FF69B47BE15

Memory Dump Source

Source File: 00000000.00000002.1667242761.00007FF69B331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69B330000, based on PE: true

Associated: 00000000.00000002.1667200836.00007FF69B330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667462352.00007FF69B51D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B55B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B569000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667608048.00007FF69B575000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667624939.00007FF69B589000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667639365.00007FF69B58A000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667689383.00007FF69B58B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69b330000_D8wwrB9ZCB.jbxd

Similarity

API ID: _get_daylight_invalid_parameter_noinfo$InformationTimeZone
String ID: ?
API String ID: 2373669816-1684325040
Opcode ID: f8641ec82ff78cdd92d9424d86b3039a636cd6911cde022eab6d6244fbf69ea2
Instruction ID: c2407366fd05d36cad028090520ac0bb0bd76160c116b471d2f07c17885fbd9f
Opcode Fuzzy Hash: f8641ec82ff78cdd92d9424d86b3039a636cd6911cde022eab6d6244fbf69ea2
Instruction Fuzzy Hash: D8417F32E1824A86E730EF35D8904A97761FB8CB44B049179EA0DC3ABADF3CE600D740

Function 00007FF69B438E80 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 88libraryloaderCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,?,00007FF69B34484B), ref: 00007FF69B438EB8
SetLastError.KERNEL32(?,?,?,?,00007FF69B34484B), ref: 00007FF69B438EDC
GetModuleHandleW.KERNEL32(?,?,?,?,00007FF69B34484B), ref: 00007FF69B438F66
GetProcAddress.KERNEL32(?,?,?,?,00007FF69B34484B), ref: 00007FF69B438F76

Strings

GetHandleVerifier, xrefs: 00007FF69B438F6C

Memory Dump Source

Source File: 00000000.00000002.1667242761.00007FF69B331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69B330000, based on PE: true

Associated: 00000000.00000002.1667200836.00007FF69B330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667462352.00007FF69B51D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B55B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B569000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667608048.00007FF69B575000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667624939.00007FF69B589000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667639365.00007FF69B58A000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667689383.00007FF69B58B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69b330000_D8wwrB9ZCB.jbxd

Similarity

API ID: ErrorLast$AddressHandleModuleProc
String ID: GetHandleVerifier
API String ID: 1762409328-1090674830
Opcode ID: 55675e016d195d31ecbde28afab06f843da25d491714808addcd76d1b0f42367
Instruction ID: 791f407539c4d39e1a75e197e6e0b322be0cc903821eae536cc049b324f97c08
Opcode Fuzzy Hash: 55675e016d195d31ecbde28afab06f843da25d491714808addcd76d1b0f42367
Instruction Fuzzy Hash: C931B332A08B4A91EA349F15E5453787362FB4CB90F0884B5DA8D837B6DF3CE295D301

Function 00007FF69B439460 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 76libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00007FF69B439546
GetProcAddress.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00007FF69B439556

Strings

GetHandleVerifier, xrefs: 00007FF69B43954C
..\..\base\files\file_win.cc, xrefs: 00007FF69B4394D2
Close, xrefs: 00007FF69B4394CB

Memory Dump Source

Source File: 00000000.00000002.1667242761.00007FF69B331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69B330000, based on PE: true

Associated: 00000000.00000002.1667200836.00007FF69B330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667462352.00007FF69B51D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B55B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B569000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667608048.00007FF69B575000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667624939.00007FF69B589000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667639365.00007FF69B58A000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667689383.00007FF69B58B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69b330000_D8wwrB9ZCB.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: ..\..\base\files\file_win.cc$Close$GetHandleVerifier
API String ID: 1646373207-1682205630
Opcode ID: 5d82f1ed6f637a330997a78984531ab0b163bdbc4e542cda7aa102aaeb86ce7d
Instruction ID: 04e1f2fee19dc3825eebed123b5820d4ac7ff919c88b4da9794dfd377e2d681a
Opcode Fuzzy Hash: 5d82f1ed6f637a330997a78984531ab0b163bdbc4e542cda7aa102aaeb86ce7d
Instruction Fuzzy Hash: 2B316B21A0CA9E81FE359F25E5593B92361FF98B84F4844B1C94E837B5DE3DE286D300

Function 00007FF69B45F9B0 Relevance: 7.8, APIs: 5, Instructions: 295threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00007FF69B45FC85
GetCurrentThreadId.KERNEL32 ref: 00007FF69B45FC96
GetCurrentThreadId.KERNEL32 ref: 00007FF69B45FCA7
GetCurrentThreadId.KERNEL32 ref: 00007FF69B45FCD0
GetCurrentThreadId.KERNEL32 ref: 00007FF69B45FD14

Memory Dump Source

Source File: 00000000.00000002.1667242761.00007FF69B331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69B330000, based on PE: true

Associated: 00000000.00000002.1667200836.00007FF69B330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667462352.00007FF69B51D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B55B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B569000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667608048.00007FF69B575000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667624939.00007FF69B589000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667639365.00007FF69B58A000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667689383.00007FF69B58B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69b330000_D8wwrB9ZCB.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: a8ba2f1d1631e442cfac61755a5c9f1b9111008899f4cb3bbfb9f8c1603fc2b7
Instruction ID: 38e911da7d679664df4e4689be5ea1b49b0ba9fd43e66f167496fae39be4410a
Opcode Fuzzy Hash: a8ba2f1d1631e442cfac61755a5c9f1b9111008899f4cb3bbfb9f8c1603fc2b7
Instruction Fuzzy Hash: D5B1AF76B04B4A82EA24CF25D48017D2761FB88FA0F554672CF6E837E4DF78E9869301

Function 00007FF69B3C4950 Relevance: 7.8, APIs: 5, Instructions: 295COMMON

Download Yara Rule

APIs

ReleaseSRWLockExclusive.KERNEL32(?,?,00000180,?,?,?,00000001,00000000,?,00007FF69B3C63F5), ref: 00007FF69B3C4DF7

Part of subcall function 00007FF69B3C75C0: TryAcquireSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000180), ref: 00007FF69B3C7616

TryAcquireSRWLockExclusive.KERNEL32 ref: 00007FF69B3C4B8E
ReleaseSRWLockExclusive.KERNEL32 ref: 00007FF69B3C4C4C
TryAcquireSRWLockExclusive.KERNEL32 ref: 00007FF69B3C4C85
ReleaseSRWLockExclusive.KERNEL32 ref: 00007FF69B3C4D3C

Memory Dump Source

Source File: 00000000.00000002.1667242761.00007FF69B331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69B330000, based on PE: true

Associated: 00000000.00000002.1667200836.00007FF69B330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667462352.00007FF69B51D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B55B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B569000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667608048.00007FF69B575000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667624939.00007FF69B589000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667639365.00007FF69B58A000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667689383.00007FF69B58B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69b330000_D8wwrB9ZCB.jbxd

Similarity

API ID: ExclusiveLock$AcquireRelease
String ID:
API String ID: 17069307-0
Opcode ID: 3a9a3ad1d76ff5ac7871f2c70e08b6b17897b053d8c02a99a2412bfd901e289e
Instruction ID: adb6229e3070ec7aa328ee7e1b4cf6106fd1d80cb69eddeaae3b9e78878a0a62
Opcode Fuzzy Hash: 3a9a3ad1d76ff5ac7871f2c70e08b6b17897b053d8c02a99a2412bfd901e289e
Instruction Fuzzy Hash: DCD1CE72A08A9A86EF24CF15E84837A37A1FB48B84F444179DE5E837A5DF3DE644C300

Function 00007FF69B452A30 Relevance: 7.7, APIs: 5, Instructions: 159COMMON

Download Yara Rule

APIs

TryAcquireSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 00007FF69B452A78
QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 00007FF69B452AEF
QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 00007FF69B452BBC
ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 00007FF69B452BFE

Memory Dump Source

Source File: 00000000.00000002.1667242761.00007FF69B331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69B330000, based on PE: true

Associated: 00000000.00000002.1667200836.00007FF69B330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667462352.00007FF69B51D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B55B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B569000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667608048.00007FF69B575000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667624939.00007FF69B589000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667639365.00007FF69B58A000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667689383.00007FF69B58B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69b330000_D8wwrB9ZCB.jbxd

Similarity

API ID: CounterExclusiveLockPerformanceQuery$AcquireRelease
String ID:
API String ID: 2118801018-0
Opcode ID: 14639954d15d7e7e97bf11b873bad004af9188bda07cea6406340636840233fb
Instruction ID: 15b4ac13315d45fbe13cfad750e98623772c9c0ff7c4b0445e13299e9f2c7625
Opcode Fuzzy Hash: 14639954d15d7e7e97bf11b873bad004af9188bda07cea6406340636840233fb
Instruction Fuzzy Hash: F4617B61B09B0E82EA748F55E99023833A1FB8DB90F4044B6D90EC73FADE6CA645D704

Function 00007FF69B485988 Relevance: 7.6, APIs: 5, Instructions: 50COMMON

Download Yara Rule

APIs

FlsGetValue.KERNEL32 ref: 00007FF69B485999
FlsSetValue.KERNEL32 ref: 00007FF69B4859B8
FlsSetValue.KERNEL32 ref: 00007FF69B4859E0
FlsSetValue.KERNEL32 ref: 00007FF69B4859F1
FlsSetValue.KERNEL32 ref: 00007FF69B485A02

Memory Dump Source

Source File: 00000000.00000002.1667242761.00007FF69B331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69B330000, based on PE: true

Associated: 00000000.00000002.1667200836.00007FF69B330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667462352.00007FF69B51D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B55B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B569000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667608048.00007FF69B575000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667624939.00007FF69B589000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667639365.00007FF69B58A000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667689383.00007FF69B58B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69b330000_D8wwrB9ZCB.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 865d8deab7749f601f92cedaab0518ce9a9441c20ee9017cc020fba7ea2db61b
Instruction ID: ca7651fb76b6a93b747f97b0ce44c8d02a617d114944afa1489ac9e722a97937
Opcode Fuzzy Hash: 865d8deab7749f601f92cedaab0518ce9a9441c20ee9017cc020fba7ea2db61b
Instruction Fuzzy Hash: 0711EF10F0D20F41F978BA65649617921A1CF4CB70F1847B9D93ECD6FAED2DB6416381

Function 00007FF69B3F5400 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 298COMMON

Download Yara Rule

APIs

TryAcquireSRWLockExclusive.KERNEL32 ref: 00007FF69B3F54A1
ReleaseSRWLockExclusive.KERNEL32 ref: 00007FF69B3F5527
AcquireSRWLockExclusive.KERNEL32 ref: 00007FF69B3F578F

Strings

Histogram.MismatchedConstructionArguments, xrefs: 00007FF69B3F5864

Memory Dump Source

Source File: 00000000.00000002.1667242761.00007FF69B331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69B330000, based on PE: true

Associated: 00000000.00000002.1667200836.00007FF69B330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667462352.00007FF69B51D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B55B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B569000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667608048.00007FF69B575000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667624939.00007FF69B589000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667639365.00007FF69B58A000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667689383.00007FF69B58B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69b330000_D8wwrB9ZCB.jbxd

Similarity

API ID: ExclusiveLock$Acquire$Release
String ID: Histogram.MismatchedConstructionArguments
API String ID: 1678258262-1291613963
Opcode ID: 35470700884c68ea0156b0985f18dfad8fc39227d223dfeb83fc22e78a77b8d7
Instruction ID: 40f16b87dc8abc2911e09607603a88ab65650506b7243a8f96fa58e2c3808ea7
Opcode Fuzzy Hash: 35470700884c68ea0156b0985f18dfad8fc39227d223dfeb83fc22e78a77b8d7
Instruction Fuzzy Hash: 68C1AF22B0968A82FA34CF15E44437D63A1FB8CB84F558579DA4E87BA6DF3CE245D700

Function 00007FF69B3EBB20 Relevance: 7.3, APIs: 2, Strings: 2, Instructions: 287COMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32 ref: 00007FF69B3EBE21
ReleaseSRWLockExclusive.KERNEL32 ref: 00007FF69B3EBE85

Strings

Static buffer too small (errno: %d, %s), xrefs: 00007FF69B3EBDD9
..\..\third_party\perfetto\src\protozero\static_buffer.cc, xrefs: 00007FF69B3EBDC4

Memory Dump Source

Source File: 00000000.00000002.1667242761.00007FF69B331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69B330000, based on PE: true

Associated: 00000000.00000002.1667200836.00007FF69B330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667462352.00007FF69B51D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B55B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B569000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667608048.00007FF69B575000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667624939.00007FF69B589000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667639365.00007FF69B58A000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667689383.00007FF69B58B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69b330000_D8wwrB9ZCB.jbxd

Similarity

API ID: ExclusiveLock$AcquireRelease
String ID: ..\..\third_party\perfetto\src\protozero\static_buffer.cc$Static buffer too small (errno: %d, %s)
API String ID: 17069307-1723169051
Opcode ID: 283520930cd0902f59cdce88030da51f9a9ee87c164802017b65d66365d5e7a8
Instruction ID: 7de0ccba20d9ce6ce78f2e60bcfb5d18c0ec1cd6a798dbf261760f7a2f2c26e7
Opcode Fuzzy Hash: 283520930cd0902f59cdce88030da51f9a9ee87c164802017b65d66365d5e7a8
Instruction Fuzzy Hash: 25C19432A19A8982EB25CF19E5842BD7761FB9CB88F144176DB4D83769EF3CD685C300

Function 00007FF69B3E3360 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 228COMMON

Download Yara Rule

APIs

QueryPerformanceFrequency.KERNEL32 ref: 00007FF69B3E33BD
QueryPerformanceCounter.KERNEL32 ref: 00007FF69B3E33CD

Strings

X, xrefs: 00007FF69B3E354C
@, xrefs: 00007FF69B3E339C

Memory Dump Source

Source File: 00000000.00000002.1667242761.00007FF69B331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69B330000, based on PE: true

Associated: 00000000.00000002.1667200836.00007FF69B330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667462352.00007FF69B51D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B55B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B569000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667608048.00007FF69B575000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667624939.00007FF69B589000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667639365.00007FF69B58A000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667689383.00007FF69B58B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69b330000_D8wwrB9ZCB.jbxd

Similarity

API ID: PerformanceQuery$CounterFrequency
String ID: @$X
API String ID: 774501991-461597874
Opcode ID: 3de79cabd1794749fa65fb43f628bedab7c2c4fb7c474831e634b16addaf5b87
Instruction ID: 413b37ef2e8bec2ba3b592f948131cdcf8bf936ba85bec638353a40e0d5c6cbf
Opcode Fuzzy Hash: 3de79cabd1794749fa65fb43f628bedab7c2c4fb7c474831e634b16addaf5b87
Instruction Fuzzy Hash: A2A14932608B4986EB21CF16E44467EB7A5FB89B80F414176DA8D83BA5DF3CE695C700

Function 00007FF69B37A9E0 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 174COMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32 ref: 00007FF69B37ABE0
ReleaseSRWLockExclusive.KERNEL32 ref: 00007FF69B37ABFB

Strings

Static buffer too small (errno: %d, %s), xrefs: 00007FF69B37ABA4
..\..\third_party\perfetto\src\protozero\static_buffer.cc, xrefs: 00007FF69B37AB8F

Memory Dump Source

Source File: 00000000.00000002.1667242761.00007FF69B331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69B330000, based on PE: true

Associated: 00000000.00000002.1667200836.00007FF69B330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667462352.00007FF69B51D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B55B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B569000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667608048.00007FF69B575000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667624939.00007FF69B589000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667639365.00007FF69B58A000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667689383.00007FF69B58B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69b330000_D8wwrB9ZCB.jbxd

Similarity

API ID: ExclusiveLock$AcquireRelease
String ID: ..\..\third_party\perfetto\src\protozero\static_buffer.cc$Static buffer too small (errno: %d, %s)
API String ID: 17069307-1723169051
Opcode ID: 117615cc117f3e920f3ea54ff27d377817a2f6a27e88ce587c71fe7d771ab519
Instruction ID: fbaa0e3cf1487d7151c1e4cd7e135b4897f037216276caab95d4b6a0dd02e4bf
Opcode Fuzzy Hash: 117615cc117f3e920f3ea54ff27d377817a2f6a27e88ce587c71fe7d771ab519
Instruction Fuzzy Hash: 8C61CF22B18A8EC6EA61CF24E98426D67A1FB48F84F444475DE4D837B5DF7CE645C300

Function 00007FF69B3D0F50 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 172COMMON

Download Yara Rule

APIs

TryAcquireSRWLockExclusive.KERNEL32(Medium,?,00000000,00000004,00007FF69B451396), ref: 00007FF69B3D0F8E
ReleaseSRWLockExclusive.KERNEL32 ref: 00007FF69B3D102E
AcquireSRWLockExclusive.KERNEL32 ref: 00007FF69B3D10F3

Strings

Medium, xrefs: 00007FF69B3D0F55

Memory Dump Source

Source File: 00000000.00000002.1667242761.00007FF69B331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69B330000, based on PE: true

Associated: 00000000.00000002.1667200836.00007FF69B330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667462352.00007FF69B51D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B55B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B569000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667608048.00007FF69B575000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667624939.00007FF69B589000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667639365.00007FF69B58A000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667689383.00007FF69B58B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69b330000_D8wwrB9ZCB.jbxd

Similarity

API ID: ExclusiveLock$Acquire$Release
String ID: Medium
API String ID: 1678258262-3252633729
Opcode ID: 014d295745ec8abf6ac2415242f09b1c7e1907e077f6d2dc89e87585b1e3a278
Instruction ID: 07cc833289e5bc1f5d9aff92ccaafb44d2fdc883e464b114e292a0a01be10e22
Opcode Fuzzy Hash: 014d295745ec8abf6ac2415242f09b1c7e1907e077f6d2dc89e87585b1e3a278
Instruction Fuzzy Hash: 61614322B19A4E83EA74DB25F44127973A1FB8CB90F44057ADA5E877B5DF3CE6458300

Function 00007FF69B344090 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 138threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32(?,7FFFFFFFFFFFFFC0,-80000000000000B0,000003E8,?,?,00000000,-7FFFFFFFFFFFFF68,00007FF69B4B67F7), ref: 00007FF69B34412A
CloseHandle.KERNEL32(?,00000000,-7FFFFFFFFFFFFF68,00007FF69B4B67F7), ref: 00007FF69B344171
GetLastError.KERNEL32(?,00000000,-7FFFFFFFFFFFFF68,00007FF69B4B67F7), ref: 00007FF69B344179

Strings

create_thread_last_error, xrefs: 00007FF69B344276

Memory Dump Source

Source File: 00000000.00000002.1667242761.00007FF69B331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69B330000, based on PE: true

Associated: 00000000.00000002.1667200836.00007FF69B330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667462352.00007FF69B51D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B55B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B569000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667608048.00007FF69B575000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667624939.00007FF69B589000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667639365.00007FF69B58A000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667689383.00007FF69B58B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69b330000_D8wwrB9ZCB.jbxd

Similarity

API ID: CloseCreateErrorHandleLastThread
String ID: create_thread_last_error
API String ID: 747004058-3219933969
Opcode ID: 3796fa3c8d11c0f42857596d75d528e55db6e9c6ae225e8a75cef3cbf7b597dc
Instruction ID: 466e213d1bfdb2de06faaf05b8d67fff43e50bd0f082efe593c9cc17473a7d53
Opcode Fuzzy Hash: 3796fa3c8d11c0f42857596d75d528e55db6e9c6ae225e8a75cef3cbf7b597dc
Instruction Fuzzy Hash: D451AD21A08A4E82FA75DF12A84227A7791FF9DB90F4401B9DD4EC37B6DE3DE6418700

Function 00007FF69B387520 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 103fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 00007FF69B387581
GetLastError.KERNEL32 ref: 00007FF69B3875C1

Strings

CreateFile , xrefs: 00007FF69B3875EC
..\..\third_party\crashpad\crashpad\util\file\file_io_win.cc, xrefs: 00007FF69B3875CA

Memory Dump Source

Source File: 00000000.00000002.1667242761.00007FF69B331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69B330000, based on PE: true

Associated: 00000000.00000002.1667200836.00007FF69B330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667462352.00007FF69B51D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B55B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B569000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667608048.00007FF69B575000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667624939.00007FF69B589000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667639365.00007FF69B58A000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667689383.00007FF69B58B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69b330000_D8wwrB9ZCB.jbxd

Similarity

API ID: CreateErrorFileLast
String ID: ..\..\third_party\crashpad\crashpad\util\file\file_io_win.cc$CreateFile
API String ID: 1214770103-2987130713
Opcode ID: 9a25913b6cb2bd47473d69888e1d4f663b9c15388d3e0fa36f919d8f98036a7d
Instruction ID: 60b64eb7a47e291a7342bae575564809ec04108051a975cec6815bbc0e1af3b3
Opcode Fuzzy Hash: 9a25913b6cb2bd47473d69888e1d4f663b9c15388d3e0fa36f919d8f98036a7d
Instruction Fuzzy Hash: 8E31CF21B0868A92EB31CB15E5503BA6762EB8DBD0F040175DA9DC7BB9DF2CE2518B01

Function 00007FF69B396940 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 94COMMON

Download Yara Rule

APIs

GetCurrentDirectoryW.KERNEL32 ref: 00007FF69B3969EC

Strings

ScopedBlockingCall, xrefs: 00007FF69B396AB2
GetCurrentDirectoryW, xrefs: 00007FF69B39697C
..\..\base\files\file_util_win.cc, xrefs: 00007FF69B396983

Memory Dump Source

Source File: 00000000.00000002.1667242761.00007FF69B331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69B330000, based on PE: true

Associated: 00000000.00000002.1667200836.00007FF69B330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667462352.00007FF69B51D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B55B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B569000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667608048.00007FF69B575000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667624939.00007FF69B589000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667639365.00007FF69B58A000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667689383.00007FF69B58B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69b330000_D8wwrB9ZCB.jbxd

Similarity

API ID: CurrentDirectory
String ID: ..\..\base\files\file_util_win.cc$GetCurrentDirectoryW$ScopedBlockingCall
API String ID: 1611563598-3482229333
Opcode ID: 768ccf44396f3ad257d490a23da151d203f0a9e4f6992ef50a5ec64d7572231a
Instruction ID: ab1d8f6211311605856853c19d606bf88fd2e3b8be528c49c8dcf933b4f4bd01
Opcode Fuzzy Hash: 768ccf44396f3ad257d490a23da151d203f0a9e4f6992ef50a5ec64d7572231a
Instruction Fuzzy Hash: 31418022A08A8A91FB31DF15E4547EE7360FF99B80F445071EA8D8776ADE7CE285C700

Function 00007FF69B4E7970 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 90fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 00007FF69B4E79BF
GetLastError.KERNEL32 ref: 00007FF69B4E79DF

Strings

CreateFile , xrefs: 00007FF69B4E7A0A
..\..\third_party\crashpad\crashpad\util\file\file_io_win.cc, xrefs: 00007FF69B4E79E8

Memory Dump Source

Source File: 00000000.00000002.1667242761.00007FF69B331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69B330000, based on PE: true

Associated: 00000000.00000002.1667200836.00007FF69B330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667462352.00007FF69B51D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B55B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B569000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667608048.00007FF69B575000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667624939.00007FF69B589000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667639365.00007FF69B58A000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667689383.00007FF69B58B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69b330000_D8wwrB9ZCB.jbxd

Similarity

API ID: CreateErrorFileLast
String ID: ..\..\third_party\crashpad\crashpad\util\file\file_io_win.cc$CreateFile
API String ID: 1214770103-2987130713
Opcode ID: 5c19e8dcdcf9aa4bc2ce5a3249df9f130059630936929b3ba77f825700f5fd44
Instruction ID: 94bd440a1780f278e48c1090e3267b5ded599335f81a655ec466c5e926ee6d98
Opcode Fuzzy Hash: 5c19e8dcdcf9aa4bc2ce5a3249df9f130059630936929b3ba77f825700f5fd44
Instruction Fuzzy Hash: D231B031B0C69A52FA31CB11E55437E6761EB89BE0F040175DA9C87BBADF2CE3618700

Function 00007FF69B402D70 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 71COMMON

Download Yara Rule

APIs

SleepConditionVariableSRW.KERNEL32 ref: 00007FF69B402E3A

Strings

TimedWait, xrefs: 00007FF69B402DCF
ScopedBlockingCallWithBaseSyncPrimitives, xrefs: 00007FF69B402E9D
..\..\base\synchronization\condition_variable_win.cc, xrefs: 00007FF69B402DD6

Memory Dump Source

Source File: 00000000.00000002.1667242761.00007FF69B331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69B330000, based on PE: true

Associated: 00000000.00000002.1667200836.00007FF69B330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667462352.00007FF69B51D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B55B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B569000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667608048.00007FF69B575000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667624939.00007FF69B589000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667639365.00007FF69B58A000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667689383.00007FF69B58B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69b330000_D8wwrB9ZCB.jbxd

Similarity

API ID: ConditionSleepVariable
String ID: ..\..\base\synchronization\condition_variable_win.cc$ScopedBlockingCallWithBaseSyncPrimitives$TimedWait
API String ID: 1382704212-1641630961
Opcode ID: 7ba6b4e3ec763a46382bdfc1f89fb9ff93d0504ce39f8a96ad9a303d597b9107
Instruction ID: bc2bd969ad0434b35ff1ea2048c25a50118de8c990445c336380683482f89f5e
Opcode Fuzzy Hash: 7ba6b4e3ec763a46382bdfc1f89fb9ff93d0504ce39f8a96ad9a303d597b9107
Instruction Fuzzy Hash: F931C131A0C6CA90F7719B28E4053EA77A0FFA9744F444171DA8C826AADF2DD28AD740

Function 00007FF69B416B40 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 69fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF69B417130: QueryPerformanceCounter.KERNEL32 ref: 00007FF69B417259
Part of subcall function 00007FF69B417130: TryAcquireSRWLockExclusive.KERNEL32 ref: 00007FF69B4172B9
Part of subcall function 00007FF69B417130: ReleaseSRWLockExclusive.KERNEL32 ref: 00007FF69B417309

ReadFile.KERNEL32 ref: 00007FF69B416BD9
GetLastError.KERNEL32 ref: 00007FF69B416C2C

Strings

..\..\base\files\file_win.cc, xrefs: 00007FF69B416B8F
ReadAtCurrentPos, xrefs: 00007FF69B416B88

Memory Dump Source

Source File: 00000000.00000002.1667242761.00007FF69B331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69B330000, based on PE: true

Associated: 00000000.00000002.1667200836.00007FF69B330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667462352.00007FF69B51D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B55B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B569000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667608048.00007FF69B575000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667624939.00007FF69B589000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667639365.00007FF69B58A000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667689383.00007FF69B58B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69b330000_D8wwrB9ZCB.jbxd

Similarity

API ID: ExclusiveLock$AcquireCounterErrorFileLastPerformanceQueryReadRelease
String ID: ..\..\base\files\file_win.cc$ReadAtCurrentPos
API String ID: 4242078987-1219976487
Opcode ID: c1f4d661a99a77ab6ef8bdad3effc6bee3c5834048eca5214411c058fa50626f
Instruction ID: 910a4fa7c36c649822ad1b2211e9469bf7ed8068c43fd1f7ff3aa365bf3c04a5
Opcode Fuzzy Hash: c1f4d661a99a77ab6ef8bdad3effc6bee3c5834048eca5214411c058fa50626f
Instruction Fuzzy Hash: 7B212C32F185AE82F6318B14A851BBAA360FF9CF50F440171DD4C876B9EE3CD6569740

Function 00007FF69B345B60 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 65libraryloaderCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF69B345B74
GetModuleHandleW.KERNEL32 ref: 00007FF69B345BEA
GetProcAddress.KERNEL32 ref: 00007FF69B345BFA

Strings

GetHandleVerifier, xrefs: 00007FF69B345BF0

Memory Dump Source

Source File: 00000000.00000002.1667242761.00007FF69B331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69B330000, based on PE: true

Associated: 00000000.00000002.1667200836.00007FF69B330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667462352.00007FF69B51D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B55B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B569000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667608048.00007FF69B575000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667624939.00007FF69B589000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667639365.00007FF69B58A000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667689383.00007FF69B58B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69b330000_D8wwrB9ZCB.jbxd

Similarity

API ID: AddressErrorHandleLastModuleProc
String ID: GetHandleVerifier
API String ID: 4275029093-1090674830
Opcode ID: ee27680f0c4694e2b17a37b60d109fbb139fa5a94e240fcfbd8bee819221b975
Instruction ID: 115a72f08d312bae59d4eb1cde4c3c49e4e1e2ee406b5c0e484676c08e68a3b6
Opcode Fuzzy Hash: ee27680f0c4694e2b17a37b60d109fbb139fa5a94e240fcfbd8bee819221b975
Instruction Fuzzy Hash: F4215E21F09B0B81FA359F55A8442792352EF4CB91F4484B9D90E837F1DF7EA696C300

Function 00007FF69B3439D0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 57filelibraryloaderCOMMON

Download Yara Rule

APIs

UnmapViewOfFile.KERNEL32(00000000,?,?,00007FF69B34399D), ref: 00007FF69B3439E8
GetModuleHandleW.KERNEL32(00000000,?,?,00007FF69B34399D), ref: 00007FF69B343A50
GetProcAddress.KERNEL32(?,00007FF69B34399D), ref: 00007FF69B343A60

Strings

GetHandleVerifier, xrefs: 00007FF69B343A56

Memory Dump Source

Source File: 00000000.00000002.1667242761.00007FF69B331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69B330000, based on PE: true

Associated: 00000000.00000002.1667200836.00007FF69B330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667462352.00007FF69B51D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B55B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B569000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667608048.00007FF69B575000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667624939.00007FF69B589000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667639365.00007FF69B58A000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667689383.00007FF69B58B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69b330000_D8wwrB9ZCB.jbxd

Similarity

API ID: AddressFileHandleModuleProcUnmapView
String ID: GetHandleVerifier
API String ID: 3224599007-1090674830
Opcode ID: 02a4d4ca455527675abebf4958dd8490e44f8794cdbb51e548826e0752fafa9c
Instruction ID: af47a8203ad37e028bb5df7860ae5c161b3679617124f2794db8316327ccabb9
Opcode Fuzzy Hash: 02a4d4ca455527675abebf4958dd8490e44f8794cdbb51e548826e0752fafa9c
Instruction Fuzzy Hash: 26211221A08A0E81FB79DF66E4593792362EF48B84F1444B9D90E833B5DE7DE689C200

Function 00007FF69B4E6BB0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 56COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32 ref: 00007FF69B4E6BDA
GetLastError.KERNEL32 ref: 00007FF69B4E6C07

Strings

GetFileAttributes , xrefs: 00007FF69B4E6C35
..\..\third_party\crashpad\crashpad\util\file\filesystem_win.cc, xrefs: 00007FF69B4E6C10

Memory Dump Source

Source File: 00000000.00000002.1667242761.00007FF69B331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69B330000, based on PE: true

Associated: 00000000.00000002.1667200836.00007FF69B330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667462352.00007FF69B51D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B55B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B569000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667608048.00007FF69B575000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667624939.00007FF69B589000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667639365.00007FF69B58A000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667689383.00007FF69B58B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69b330000_D8wwrB9ZCB.jbxd

Similarity

API ID: AttributesErrorFileLast
String ID: ..\..\third_party\crashpad\crashpad\util\file\filesystem_win.cc$GetFileAttributes
API String ID: 1799206407-537131185
Opcode ID: a272a96b0d98d75806d8d63e8aaac0f67c248516a827856f3a18254967e64349
Instruction ID: f38d745bab07337a0e2b87a5ca6c07b84abda131962cdfbe95259a144d5159f1
Opcode Fuzzy Hash: a272a96b0d98d75806d8d63e8aaac0f67c248516a827856f3a18254967e64349
Instruction Fuzzy Hash: AF11D321B1C55E41FA74EB25E9563BE2252EF8CBC4F0001B5DA4DCB6FADE2DE6469300

Function 00007FF69B4E6DE0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 48COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32 ref: 00007FF69B4E6E07
GetLastError.KERNEL32 ref: 00007FF69B4E6E4C

Strings

GetFileAttributes , xrefs: 00007FF69B4E6E7A
..\..\third_party\crashpad\crashpad\util\file\filesystem_win.cc, xrefs: 00007FF69B4E6E55

Memory Dump Source

Source File: 00000000.00000002.1667242761.00007FF69B331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69B330000, based on PE: true

Associated: 00000000.00000002.1667200836.00007FF69B330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667462352.00007FF69B51D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B55B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B569000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667608048.00007FF69B575000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667624939.00007FF69B589000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667639365.00007FF69B58A000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667689383.00007FF69B58B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69b330000_D8wwrB9ZCB.jbxd

Similarity

API ID: AttributesErrorFileLast
String ID: ..\..\third_party\crashpad\crashpad\util\file\filesystem_win.cc$GetFileAttributes
API String ID: 1799206407-537131185
Opcode ID: 2caed194ba3a53d70ff654f177b560ab30f1c566fcf0ea38a9516d6c43b14277
Instruction ID: e8d292785e792238407a4e4634038297a22b93e3e9b1f06d6ac33faa12c09714
Opcode Fuzzy Hash: 2caed194ba3a53d70ff654f177b560ab30f1c566fcf0ea38a9516d6c43b14277
Instruction Fuzzy Hash: DB119D21A0C55E51FA749F29E5153BE2241EF48FC4F4001B1DA1DC7AFADE2DE742A700

Function 00007FF69B386F00 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 47fileCOMMON

Download Yara Rule

APIs

UnlockFileEx.KERNEL32 ref: 00007FF69B386F40
GetLastError.KERNEL32 ref: 00007FF69B386F7E

Strings

UnlockFileEx, xrefs: 00007FF69B386FAC
..\..\third_party\crashpad\crashpad\util\file\file_io_win.cc, xrefs: 00007FF69B386F87

Memory Dump Source

Source File: 00000000.00000002.1667242761.00007FF69B331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69B330000, based on PE: true

Associated: 00000000.00000002.1667200836.00007FF69B330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667462352.00007FF69B51D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B55B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B569000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667608048.00007FF69B575000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667624939.00007FF69B589000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667639365.00007FF69B58A000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667689383.00007FF69B58B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69b330000_D8wwrB9ZCB.jbxd

Similarity

API ID: ErrorFileLastUnlock
String ID: ..\..\third_party\crashpad\crashpad\util\file\file_io_win.cc$UnlockFileEx
API String ID: 3655728120-3540829929
Opcode ID: 7d03b49988bc278e343496ffbd523ff58797051ee493468da91f07d07d24e3f6
Instruction ID: 51c87217680f9c8024b5f88e9e688f6301500219a2c24376cc56fab779b38995
Opcode Fuzzy Hash: 7d03b49988bc278e343496ffbd523ff58797051ee493468da91f07d07d24e3f6
Instruction Fuzzy Hash: D1119332A1CA9E91F6319B15A4413BA6391EF4C790F4082B1D95C876B5EF2DD7458701

Function 00007FF69B4159E0 Relevance: 6.2, APIs: 4, Instructions: 234COMMON

Download Yara Rule

APIs

TryAcquireSRWLockExclusive.KERNEL32(?), ref: 00007FF69B415BE1
QueryPerformanceCounter.KERNEL32 ref: 00007FF69B415C15
ReleaseSRWLockExclusive.KERNEL32 ref: 00007FF69B415C48
AcquireSRWLockExclusive.KERNEL32 ref: 00007FF69B415D02

Memory Dump Source

Source File: 00000000.00000002.1667242761.00007FF69B331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69B330000, based on PE: true

Associated: 00000000.00000002.1667200836.00007FF69B330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667462352.00007FF69B51D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B55B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B569000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667608048.00007FF69B575000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667624939.00007FF69B589000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667639365.00007FF69B58A000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667689383.00007FF69B58B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69b330000_D8wwrB9ZCB.jbxd

Similarity

API ID: ExclusiveLock$Acquire$CounterPerformanceQueryRelease
String ID:
API String ID: 743314926-0
Opcode ID: d15c484800e0821e473c933d62fbd30ed0f7ff94defe446ae3d9f88ecab34ba8
Instruction ID: eb57e6a704bbb67b7679bbcdd769a255af4127cea61ac56beb3038191a027d3f
Opcode Fuzzy Hash: d15c484800e0821e473c933d62fbd30ed0f7ff94defe446ae3d9f88ecab34ba8
Instruction Fuzzy Hash: 0EA17272E09B4A81EB68CF15D45027C37A4FB68F84B1885B6CA5D877A4DF7CE6A1D300

Function 00007FF69B47CC5C Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

GetConsoleMode.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00007FF69B47D06F,?), ref: 00007FF69B47CD78
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00007FF69B47D06F,?), ref: 00007FF69B47CE03

Memory Dump Source

Source File: 00000000.00000002.1667242761.00007FF69B331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69B330000, based on PE: true

Associated: 00000000.00000002.1667200836.00007FF69B330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667462352.00007FF69B51D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B55B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B569000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667608048.00007FF69B575000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667624939.00007FF69B589000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667639365.00007FF69B58A000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667689383.00007FF69B58B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69b330000_D8wwrB9ZCB.jbxd

Similarity

API ID: ConsoleErrorLastMode
String ID:
API String ID: 953036326-0
Opcode ID: 9918bf4e7b9e67877d22b53b51b72e7e141f04ea5e20802e168ce537da1ae8c5
Instruction ID: 62b604105f8a660d34bef000122723fdfd49fe9987819677e1758d4fac49d418
Opcode Fuzzy Hash: 9918bf4e7b9e67877d22b53b51b72e7e141f04ea5e20802e168ce537da1ae8c5
Instruction Fuzzy Hash: E691E662E4865995F770DF6594C02BC3BA0FB08F88F1441B9DE0E976AADF78E691D300

Function 00007FF69B48CAD4 Relevance: 6.2, APIs: 4, Instructions: 164COMMON

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 00007FF69B48CBCC
_get_daylight.LIBCMT ref: 00007FF69B48CBDD
_get_daylight.LIBCMT ref: 00007FF69B48CBEE
_isindst.LIBCMT ref: 00007FF69B48CCB9

Memory Dump Source

Source File: 00000000.00000002.1667242761.00007FF69B331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69B330000, based on PE: true

Associated: 00000000.00000002.1667200836.00007FF69B330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667462352.00007FF69B51D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B55B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B569000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667608048.00007FF69B575000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667624939.00007FF69B589000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667639365.00007FF69B58A000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667689383.00007FF69B58B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69b330000_D8wwrB9ZCB.jbxd

Similarity

API ID: _get_daylight$_isindst
String ID:
API String ID: 4170891091-0
Opcode ID: 99780faef8a4020719926d3f5280398109b002a710dce61aa9c3186644818f20
Instruction ID: 7e35ae085c3ef7a68811a9cae5a6dfabf232504156ade5b5ec029fcc8003b4b3
Opcode Fuzzy Hash: 99780faef8a4020719926d3f5280398109b002a710dce61aa9c3186644818f20
Instruction Fuzzy Hash: F051F872F046198AFB34CF2499956BC3761EB08B58F504179EE1E93AFADF38A6019740

Function 00007FF69B365BB0 Relevance: 6.1, APIs: 4, Instructions: 149threadCOMMON

Download Yara Rule

APIs

TryAcquireSRWLockExclusive.KERNEL32 ref: 00007FF69B365BCE
GetCurrentThreadId.KERNEL32 ref: 00007FF69B365C58

Part of subcall function 00007FF69B460CE8: Concurrency::cancel_current_task.LIBCPMT ref: 00007FF69B460D18

ReleaseSRWLockExclusive.KERNEL32 ref: 00007FF69B365DB2
AcquireSRWLockExclusive.KERNEL32 ref: 00007FF69B365DDC

Memory Dump Source

Source File: 00000000.00000002.1667242761.00007FF69B331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69B330000, based on PE: true

Associated: 00000000.00000002.1667200836.00007FF69B330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667462352.00007FF69B51D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B55B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B569000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667608048.00007FF69B575000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667624939.00007FF69B589000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667639365.00007FF69B58A000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667689383.00007FF69B58B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69b330000_D8wwrB9ZCB.jbxd

Similarity

API ID: ExclusiveLock$Acquire$Concurrency::cancel_current_taskCurrentReleaseThread
String ID:
API String ID: 2289101447-0
Opcode ID: f9d67d2333a2f417d12fa1f129e72a1ee27a5b7b112aa4f99865d20971e6c196
Instruction ID: b84ab757344ba72f26200b26ebc6f7de065a0115609eff0c0945d3772ec04374
Opcode Fuzzy Hash: f9d67d2333a2f417d12fa1f129e72a1ee27a5b7b112aa4f99865d20971e6c196
Instruction Fuzzy Hash: 03517C32604B09C2EA60DF11E85927837A4FB4CBA0F514279DE6D837E5DF38E649C300

Function 00007FF69B368ED0 Relevance: 6.1, APIs: 4, Instructions: 149fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF69B3696F0: FindNextFileW.KERNEL32 ref: 00007FF69B369803
Part of subcall function 00007FF69B3696F0: GetLastError.KERNEL32 ref: 00007FF69B369811

DeleteFileW.KERNEL32 ref: 00007FF69B368FC0
GetLastError.KERNEL32 ref: 00007FF69B368FCB
RemoveDirectoryW.KERNEL32 ref: 00007FF69B3690B0
SetFileAttributesW.KERNEL32 ref: 00007FF69B3690F2

Memory Dump Source

Source File: 00000000.00000002.1667242761.00007FF69B331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69B330000, based on PE: true

Associated: 00000000.00000002.1667200836.00007FF69B330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667462352.00007FF69B51D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B55B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B569000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667608048.00007FF69B575000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667624939.00007FF69B589000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667639365.00007FF69B58A000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667689383.00007FF69B58B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69b330000_D8wwrB9ZCB.jbxd

Similarity

API ID: File$ErrorLast$AttributesDeleteDirectoryFindNextRemove
String ID:
API String ID: 2174510925-0
Opcode ID: 711f23b6cc69983e8d431da02445e6064b73f82a504618e43f09168ee6cabfd8
Instruction ID: 7bd7a7c1e2deacc209e0ef16df8a1a8f8896e92f9ce99cec2a8e153c2a4bb564
Opcode Fuzzy Hash: 711f23b6cc69983e8d431da02445e6064b73f82a504618e43f09168ee6cabfd8
Instruction Fuzzy Hash: BA51C221A0C64A85FB21CB21A85637A7790EF8CB94F0001B5EE8DC7BA5EE7CE245C700

Function 00007FF69B3330D0 Relevance: 6.1, APIs: 4, Instructions: 128COMMON

Download Yara Rule

APIs

TryAcquireSRWLockExclusive.KERNEL32(?,?,?,?,00007FF69B361382), ref: 00007FF69B3330FE
AcquireSRWLockExclusive.KERNEL32(?,?,?,00007FF69B361382), ref: 00007FF69B333241
TryAcquireSRWLockExclusive.KERNEL32(?,?,?,00007FF69B361382), ref: 00007FF69B333267
ReleaseSRWLockExclusive.KERNEL32(?,?,?,00007FF69B361382), ref: 00007FF69B333286

Memory Dump Source

Source File: 00000000.00000002.1667242761.00007FF69B331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69B330000, based on PE: true

Associated: 00000000.00000002.1667200836.00007FF69B330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667462352.00007FF69B51D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B55B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B569000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667608048.00007FF69B575000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667624939.00007FF69B589000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667639365.00007FF69B58A000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667689383.00007FF69B58B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69b330000_D8wwrB9ZCB.jbxd

Similarity

API ID: ExclusiveLock$Acquire$Release
String ID:
API String ID: 1678258262-0
Opcode ID: 50fca6fdd0e850e2ed36327cba54d47898d009f1524a10dc08f17ce88a853e19
Instruction ID: 509bdec4a08ef776a739c050a60a29aea5a1dc7f24a113a08d7e2e804f59e4c2
Opcode Fuzzy Hash: 50fca6fdd0e850e2ed36327cba54d47898d009f1524a10dc08f17ce88a853e19
Instruction Fuzzy Hash: 3E41F412F0A58B51FF75DB11944427A6751EB8AB90F88C2B9CE4D873A1CF3CA696C301

Function 00007FF69B363500 Relevance: 6.1, APIs: 4, Instructions: 62COMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32(?,?,?,-00000080,00000018,00000000,?,?,?,?,-00000080,?), ref: 00007FF69B363529
ReleaseSRWLockExclusive.KERNEL32(?,?,?,-00000080,00000018,00000000,?,?,?,?,-00000080,?), ref: 00007FF69B363564
AcquireSRWLockExclusive.KERNEL32(?,?,?,-00000080,00000018,00000000,?,?,?,?,-00000080,?), ref: 00007FF69B363580
ReleaseSRWLockExclusive.KERNEL32(?,?,?,-00000080,00000018,00000000,?,?,?,?,-00000080,?), ref: 00007FF69B363590

Memory Dump Source

Source File: 00000000.00000002.1667242761.00007FF69B331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69B330000, based on PE: true

Associated: 00000000.00000002.1667200836.00007FF69B330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667462352.00007FF69B51D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B55B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B569000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667608048.00007FF69B575000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667624939.00007FF69B589000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667639365.00007FF69B58A000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667689383.00007FF69B58B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69b330000_D8wwrB9ZCB.jbxd

Similarity

API ID: ExclusiveLock$AcquireRelease
String ID:
API String ID: 17069307-0
Opcode ID: 9ccd5c4f9039133ddca666a552167234bca13d71d280e9e9de234760ce1f0a18
Instruction ID: a7053097ee896b765d39614420b3b674fe2dfccd5a81a141bb37a77cf7260129
Opcode Fuzzy Hash: 9ccd5c4f9039133ddca666a552167234bca13d71d280e9e9de234760ce1f0a18
Instruction Fuzzy Hash: 6D212832A09A4ED0EA218F09A95517833A1FB487B4F4042B5DE6D832B1DF3CA28AC700

Function 00007FF69B354C20 Relevance: 6.1, APIs: 4, Instructions: 56COMMON

Download Yara Rule

APIs

WaitForMultipleObjects.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF69B354BBA), ref: 00007FF69B354C69
GetExitCodeProcess.KERNEL32 ref: 00007FF69B354C89
GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF69B354BBA), ref: 00007FF69B354CCB
GetCurrentProcess.KERNEL32 ref: 00007FF69B354CD6

Memory Dump Source

Source File: 00000000.00000002.1667242761.00007FF69B331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69B330000, based on PE: true

Associated: 00000000.00000002.1667200836.00007FF69B330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667462352.00007FF69B51D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B55B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B569000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667608048.00007FF69B575000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667624939.00007FF69B589000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667639365.00007FF69B58A000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667689383.00007FF69B58B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69b330000_D8wwrB9ZCB.jbxd

Similarity

API ID: Process$Current$CodeExitMultipleObjectsWait
String ID:
API String ID: 3026435989-0
Opcode ID: 9a11607a27844470fa7d8a315d8b865e65d88f009e0309cdcc70f8150a9483a0
Instruction ID: a1e5709c6d8b79a235d2a5e695df5cac232111b9919256e2ba1bc8f0e8a3b5b1
Opcode Fuzzy Hash: 9a11607a27844470fa7d8a315d8b865e65d88f009e0309cdcc70f8150a9483a0
Instruction Fuzzy Hash: 3011A132A0CA4A91F7788F26E45423923A0EF8CB84F148179CA5DC37B8DE6CE695C704

Function 00007FF69B485AF4 Relevance: 6.1, APIs: 4, Instructions: 54COMMON

Download Yara Rule

APIs

FlsSetValue.KERNEL32(?,?,?,00007FF69B487E53,?,?,00000000,00007FF69B487D6A), ref: 00007FF69B485B32
FlsSetValue.KERNEL32(?,?,?,00007FF69B487E53,?,?,00000000,00007FF69B487D6A), ref: 00007FF69B485B5A
FlsSetValue.KERNEL32(?,?,?,00007FF69B487E53,?,?,00000000,00007FF69B487D6A), ref: 00007FF69B485B6B
FlsSetValue.KERNEL32(?,?,?,00007FF69B487E53,?,?,00000000,00007FF69B487D6A), ref: 00007FF69B485B7C

Memory Dump Source

Source File: 00000000.00000002.1667242761.00007FF69B331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69B330000, based on PE: true

Associated: 00000000.00000002.1667200836.00007FF69B330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667462352.00007FF69B51D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B55B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B569000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667608048.00007FF69B575000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667624939.00007FF69B589000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667639365.00007FF69B58A000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667689383.00007FF69B58B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69b330000_D8wwrB9ZCB.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 64f31047c4056736064169fd8c9023f6cbac204cb9a3c25ed371520df382101f
Instruction ID: 34cb268c9b442775f606ce3dc9544d468f8745984cf9931f051288a5c3c49afa
Opcode Fuzzy Hash: 64f31047c4056736064169fd8c9023f6cbac204cb9a3c25ed371520df382101f
Instruction Fuzzy Hash: 36114F10F0D24E41FA79AB61694217962A1DF5CBB0F1847B8E93DCA6FAEE2CF6015341

Function 00007FF69B389C30 Relevance: 6.0, APIs: 2, Strings: 2, Instructions: 40COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32 ref: 00007FF69B389C4A
GetLastError.KERNEL32 ref: 00007FF69B389C8B

Strings

CloseHandle, xrefs: 00007FF69B389CB9
..\..\third_party\crashpad\crashpad\util\file\file_io_win.cc, xrefs: 00007FF69B389C94

Memory Dump Source

Source File: 00000000.00000002.1667242761.00007FF69B331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69B330000, based on PE: true

Associated: 00000000.00000002.1667200836.00007FF69B330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667462352.00007FF69B51D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B55B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B569000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667608048.00007FF69B575000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667624939.00007FF69B589000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667639365.00007FF69B58A000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667689383.00007FF69B58B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69b330000_D8wwrB9ZCB.jbxd

Similarity

API ID: CloseErrorHandleLast
String ID: ..\..\third_party\crashpad\crashpad\util\file\file_io_win.cc$CloseHandle
API String ID: 918212764-1830217499
Opcode ID: 5e55876514701451442fe0fe0fb9644a5c17449d41d564e33697f6f8bdcf1799
Instruction ID: e1b8aa00ae070a5e0ea74932b8b0da0d28a8fdb221b41d83ef1aec89dc05564a
Opcode Fuzzy Hash: 5e55876514701451442fe0fe0fb9644a5c17449d41d564e33697f6f8bdcf1799
Instruction Fuzzy Hash: 39016131B1C55E92FA359B21A4563BA32A0EF8CB40F0011B9CA4EC76B6DE2DE7429751

Function 00007FF69B45FE70 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 120threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF69B42177E), ref: 00007FF69B45FE96

Strings

SequenceManager PostTask, xrefs: 00007FF69B45FFD1

Memory Dump Source

Source File: 00000000.00000002.1667242761.00007FF69B331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69B330000, based on PE: true

Associated: 00000000.00000002.1667200836.00007FF69B330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667462352.00007FF69B51D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B55B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B569000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667608048.00007FF69B575000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667624939.00007FF69B589000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667639365.00007FF69B58A000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667689383.00007FF69B58B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69b330000_D8wwrB9ZCB.jbxd

Similarity

API ID: CurrentThread
String ID: SequenceManager PostTask
API String ID: 2882836952-689118878
Opcode ID: 166b7a66d12b521753e736e67b8b5f712a2ea6d0c1c536c72ba3eb6a50d98364
Instruction ID: 5842cef9d2e6b718e8799c0ccc19e80899e552467ba3ec79b662939a1130ac11
Opcode Fuzzy Hash: 166b7a66d12b521753e736e67b8b5f712a2ea6d0c1c536c72ba3eb6a50d98364
Instruction Fuzzy Hash: 37417232A08B4986EB658B19E88037937A1EB9CB90F154076DB9DC3775DE3CEA81D701

Function 00007FF69B37BFA0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 86libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF69B37C085
GetProcAddress.KERNEL32 ref: 00007FF69B37C095

Strings

GetHandleVerifier, xrefs: 00007FF69B37C08B

Memory Dump Source

Source File: 00000000.00000002.1667242761.00007FF69B331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69B330000, based on PE: true

Associated: 00000000.00000002.1667200836.00007FF69B330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667462352.00007FF69B51D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B55B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B569000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667608048.00007FF69B575000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667624939.00007FF69B589000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667639365.00007FF69B58A000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667689383.00007FF69B58B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69b330000_D8wwrB9ZCB.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: GetHandleVerifier
API String ID: 1646373207-1090674830
Opcode ID: 770db972acd40cdd63e7ac81d1fed1b0d9a372bd8d621b6143e50bd87d8e06ab
Instruction ID: 4ba9892abf35416acd095a8e53affbfd90ea62d9bdeb2cc2983dd9b57cb7d424
Opcode Fuzzy Hash: 770db972acd40cdd63e7ac81d1fed1b0d9a372bd8d621b6143e50bd87d8e06ab
Instruction Fuzzy Hash: 91315E21A09A0AC5FE75DF26E4943793361EF48B44F5444BACA0E837B1DF7DE6459380

Function 00007FF69B4B7520 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 58COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF69B417130: QueryPerformanceCounter.KERNEL32 ref: 00007FF69B417259
Part of subcall function 00007FF69B417130: TryAcquireSRWLockExclusive.KERNEL32 ref: 00007FF69B4172B9
Part of subcall function 00007FF69B417130: ReleaseSRWLockExclusive.KERNEL32 ref: 00007FF69B417309

SetFilePointerEx.KERNEL32 ref: 00007FF69B4B75B6

Part of subcall function 00007FF69B416C40: GetLastError.KERNEL32 ref: 00007FF69B416C9F
Part of subcall function 00007FF69B416C40: SetLastError.KERNEL32 ref: 00007FF69B416CA9
Part of subcall function 00007FF69B416C40: SetLastError.KERNEL32 ref: 00007FF69B416CBD

Strings

..\..\base\files\file_win.cc, xrefs: 00007FF69B4B756C
Seek, xrefs: 00007FF69B4B7565

Memory Dump Source

Source File: 00000000.00000002.1667242761.00007FF69B331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69B330000, based on PE: true

Associated: 00000000.00000002.1667200836.00007FF69B330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667462352.00007FF69B51D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B55B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B569000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667608048.00007FF69B575000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667624939.00007FF69B589000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667639365.00007FF69B58A000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667689383.00007FF69B58B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69b330000_D8wwrB9ZCB.jbxd

Similarity

API ID: ErrorLast$ExclusiveLock$AcquireCounterFilePerformancePointerQueryRelease
String ID: ..\..\base\files\file_win.cc$Seek
API String ID: 1419458111-3266232722
Opcode ID: 599bd1838224786a4bc9055febdf6476b87c55b68bf1e29d6540b7170bc418b5
Instruction ID: fa7d5f1e841e52c9d183fffc23dd61bd1a6aaf2724d0cd49f25c28c5a159cdaf
Opcode Fuzzy Hash: 599bd1838224786a4bc9055febdf6476b87c55b68bf1e29d6540b7170bc418b5
Instruction Fuzzy Hash: DC11E43271899A91FA329F16A805BF963A0FF88B84F404031DE9C93765EE3DD247C300

Function 00007FF69B344D80 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF69B417130: QueryPerformanceCounter.KERNEL32 ref: 00007FF69B417259
Part of subcall function 00007FF69B417130: TryAcquireSRWLockExclusive.KERNEL32 ref: 00007FF69B4172B9
Part of subcall function 00007FF69B417130: ReleaseSRWLockExclusive.KERNEL32 ref: 00007FF69B417309

GetFileSizeEx.KERNEL32 ref: 00007FF69B344E05

Part of subcall function 00007FF69B416C40: GetLastError.KERNEL32 ref: 00007FF69B416C9F
Part of subcall function 00007FF69B416C40: SetLastError.KERNEL32 ref: 00007FF69B416CA9
Part of subcall function 00007FF69B416C40: SetLastError.KERNEL32 ref: 00007FF69B416CBD

Strings

..\..\base\files\file_win.cc, xrefs: 00007FF69B344DC3
GetLength, xrefs: 00007FF69B344DBC

Memory Dump Source

Source File: 00000000.00000002.1667242761.00007FF69B331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69B330000, based on PE: true

Associated: 00000000.00000002.1667200836.00007FF69B330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667462352.00007FF69B51D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B55B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B569000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667608048.00007FF69B575000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667624939.00007FF69B589000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667639365.00007FF69B58A000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667689383.00007FF69B58B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69b330000_D8wwrB9ZCB.jbxd

Similarity

API ID: ErrorLast$ExclusiveLock$AcquireCounterFilePerformanceQueryReleaseSize
String ID: ..\..\base\files\file_win.cc$GetLength
API String ID: 1511923460-1822068241
Opcode ID: b2e80671bd28f08f8118fafff31c50d22d021878e5d9bf3d6877978ba48e616b
Instruction ID: 31b3630916aeeda8fe95378e5c42b36542fd16d7620f38bc0d0973396ec304b7
Opcode Fuzzy Hash: b2e80671bd28f08f8118fafff31c50d22d021878e5d9bf3d6877978ba48e616b
Instruction Fuzzy Hash: 81118E31B0898E91FA359B29A9557F963A0FF98B84F405031DE8D83B29EE3DD2578700

Function 00007FF69B463C5C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

RtlPcToFileHeader.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF69B462E27), ref: 00007FF69B463CAC
RaiseException.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF69B462E27), ref: 00007FF69B463CED

Strings

csm, xrefs: 00007FF69B463CDA

Memory Dump Source

Source File: 00000000.00000002.1667242761.00007FF69B331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69B330000, based on PE: true

Associated: 00000000.00000002.1667200836.00007FF69B330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667462352.00007FF69B51D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B55B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B569000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667608048.00007FF69B575000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667624939.00007FF69B589000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667639365.00007FF69B58A000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667689383.00007FF69B58B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69b330000_D8wwrB9ZCB.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: 7753bb324e962436b8a6eb334fb6808d8e652d7df97d637cb83d86c97c5b0319
Instruction ID: 0155593546355062ee2ff42ac8cf180fed1107930ab9761a0148ea8e89a06b6b
Opcode Fuzzy Hash: 7753bb324e962436b8a6eb334fb6808d8e652d7df97d637cb83d86c97c5b0319
Instruction Fuzzy Hash: 8E116D32608B8982EB618F19F50026977E1FB8CF94F584270EE8C47769EF3CC6618B00

Function 00007FF69B366B00 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF69B366B4F
GetProcAddress.KERNEL32 ref: 00007FF69B366B5F

Strings

GetHandleVerifier, xrefs: 00007FF69B366B55

Memory Dump Source

Source File: 00000000.00000002.1667242761.00007FF69B331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69B330000, based on PE: true

Associated: 00000000.00000002.1667200836.00007FF69B330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667462352.00007FF69B51D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B55B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B569000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667608048.00007FF69B575000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667624939.00007FF69B589000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667639365.00007FF69B58A000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667689383.00007FF69B58B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69b330000_D8wwrB9ZCB.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: GetHandleVerifier
API String ID: 1646373207-1090674830
Opcode ID: b1d771c64790a72c074ac489b8aedd9a1d566ae1ea8a5d3c04aaf63b56321202
Instruction ID: 5dd02065066f771665d03132a6ec741c838e30c686d990e0ae9492d61081f909
Opcode Fuzzy Hash: b1d771c64790a72c074ac489b8aedd9a1d566ae1ea8a5d3c04aaf63b56321202
Instruction Fuzzy Hash: EA015E24B08A0EC1EA34DFA6E4553783362EF4DBC0F1484B9C90E833B1CE3CA2458300

Function 00007FF69B4B84F0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 39COMMON

Download Yara Rule

APIs

TryAcquireSRWLockExclusive.KERNEL32 ref: 00007FF69B4B850D
AcquireSRWLockExclusive.KERNEL32 ref: 00007FF69B4B8543

Strings

Histogram.TooManyBuckets.1000, xrefs: 00007FF69B4B84F4

Memory Dump Source

Source File: 00000000.00000002.1667242761.00007FF69B331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69B330000, based on PE: true

Associated: 00000000.00000002.1667200836.00007FF69B330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667462352.00007FF69B51D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B55B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B569000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667608048.00007FF69B575000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667624939.00007FF69B589000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667639365.00007FF69B58A000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667689383.00007FF69B58B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69b330000_D8wwrB9ZCB.jbxd

Similarity

API ID: AcquireExclusiveLock
String ID: Histogram.TooManyBuckets.1000
API String ID: 4021432409-786474106
Opcode ID: d35529867956c7e56669029016a480a49fda9abcbdc5815354a48f4b6409493e
Instruction ID: 8c72916295c946d88033c7bfb4102e90a4dda922527f672ffbf99e015400a067
Opcode Fuzzy Hash: d35529867956c7e56669029016a480a49fda9abcbdc5815354a48f4b6409493e
Instruction Fuzzy Hash: D5F06216B49A2981EA369F1EA84086C5311EF8DFB1B5980B1CE0D83775DD38D9D7D701

Function 00007FF69B49D390 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 37COMMON

Download Yara Rule

APIs

__std_exception_destroy.LIBVCRUNTIME ref: 00007FF69B49D3D9

Strings

bad_variant_access.cc, xrefs: 00007FF69B49D394
Bad variant access, xrefs: 00007FF69B49D39B

Memory Dump Source

Source File: 00000000.00000002.1667242761.00007FF69B331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69B330000, based on PE: true

Associated: 00000000.00000002.1667200836.00007FF69B330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667462352.00007FF69B51D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B55B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B569000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667608048.00007FF69B575000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667624939.00007FF69B589000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667639365.00007FF69B58A000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667689383.00007FF69B58B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69b330000_D8wwrB9ZCB.jbxd

Similarity

API ID: __std_exception_destroy
String ID: Bad variant access$bad_variant_access.cc
API String ID: 2453523683-4004146108
Opcode ID: c833e2eec1534c8d1242b21f64c4fc9191c5d1d8031e1ebabc85726212758c7a
Instruction ID: d3412a19808e8e5523641c90f9a93ab89cb5b3a95f37c5ec065f68cda762d723
Opcode Fuzzy Hash: c833e2eec1534c8d1242b21f64c4fc9191c5d1d8031e1ebabc85726212758c7a
Instruction Fuzzy Hash: 8BE09325F0555DC2FA25AF59BD512A81151CF8CF90F544071DD0C87779DD2C6743C301

Function 00007FF69B48FC3C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF69B48FC6C
GetDriveTypeW.KERNEL32 ref: 00007FF69B48FCAC

Strings

:, xrefs: 00007FF69B48FC95

Memory Dump Source

Source File: 00000000.00000002.1667242761.00007FF69B331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69B330000, based on PE: true

Associated: 00000000.00000002.1667200836.00007FF69B330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667462352.00007FF69B51D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B55B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B569000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667608048.00007FF69B575000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667624939.00007FF69B589000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667639365.00007FF69B58A000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667689383.00007FF69B58B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69b330000_D8wwrB9ZCB.jbxd

Similarity

API ID: DriveType_invalid_parameter_noinfo
String ID: :
API String ID: 2595371189-336475711
Opcode ID: f420f76babe1c8cd3e18d08baff18084927ffebfbc03bc61ec1df683aaa89dc0
Instruction ID: ee21204e5a1b17863393b95a356273353a2fd27ff236f4a97168274a36fd8bae
Opcode Fuzzy Hash: f420f76babe1c8cd3e18d08baff18084927ffebfbc03bc61ec1df683aaa89dc0
Instruction Fuzzy Hash: F8018F61A1860A86F730AF64946127E33A0FF4CB08F801575DA4DC66B9EF2CE704EB58

Function 00007FF69B43CBE0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 33libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF69B43CC13
GetProcAddress.KERNEL32 ref: 00007FF69B43CC23

Strings

GetHandleVerifier, xrefs: 00007FF69B43CC19

Memory Dump Source

Source File: 00000000.00000002.1667242761.00007FF69B331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69B330000, based on PE: true

Associated: 00000000.00000002.1667200836.00007FF69B330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667462352.00007FF69B51D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B55B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667539997.00007FF69B569000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667608048.00007FF69B575000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667624939.00007FF69B589000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667639365.00007FF69B58A000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667689383.00007FF69B58B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff69b330000_D8wwrB9ZCB.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: GetHandleVerifier
API String ID: 1646373207-1090674830
Opcode ID: d30b80ed800426612b5ec4219d20783b58fdfd00d3ebbd04b910ce3b6157bda2
Instruction ID: 997050cdc5986562895cfff49aeb197498ccf3475494a52fa2bae7b4e153bd45
Opcode Fuzzy Hash: d30b80ed800426612b5ec4219d20783b58fdfd00d3ebbd04b910ce3b6157bda2
Instruction Fuzzy Hash: 83011D34F4DB0E81FA799B5AA5542752352EF4CF84F1884B9C80EC33BADE6DA245D300

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report D8wwrB9ZCB.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

General Information

Errors

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Authenticode Signature

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Exports

Possible Origin

Network Behavior

Statistics

CPU Usage

Memory Usage

System Behavior

Analysis Process: D8wwrB9ZCB.exePID: 6336, Parent PID: 2580

General

Chronological Activities

Disassembly

Analysis Process: D8wwrB9ZCB.exePID: 6336, Parent PID: 2580COMMON

Non-executed Functions

Function 00007FF69B40E520 Relevance: 135.5, APIs: 72, Strings: 4, Instructions: 2539COMMON

Function 00007FF69B46F980 Relevance: 52.6, APIs: 25, Strings: 4, Instructions: 1888COMMON

Function 00007FF69B456510 Relevance: 42.7, APIs: 17, Strings: 7, Instructions: 687fileCOMMON

Windows Analysis Report
D8wwrB9ZCB.exe