Edit tour

Windows Analysis Report
0urFbKxdvL.exe

Overview

General Information

Sample name:	0urFbKxdvL.exe renamed because original name is a hash value
Original sample name:	328eea4110a4b59778225e2efef7b9cfd07adfb8d189d9fa2d2e450de274659c.exe
Analysis ID:	1527620
MD5:	0ae609594fbd4bb27287bd63bc9e9529
SHA1:	a506ec04296bd6fe7450c59578bd55a94f17aa65
SHA256:	328eea4110a4b59778225e2efef7b9cfd07adfb8d189d9fa2d2e450de274659c
Tags:	exeSliverFoxuser-bloated7731
Infos:

Detection

Score:	60
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

AI detected suspicious sample

Contains functionality to detect hardware virtualization (CPUID execution measurement)

Tries to detect virtualization through RDTSC time measurements

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to query CPU information (cpuid)

Contains functionality to read device registry values (via SetupAPI)

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected potential crypto function

Extensive use of GetProcAddress (often used to hide API calls)

Found large amount of non-executed APIs

PE file contains an invalid checksum

Program does not show much activity (idle)

Queries device information via Setup API

Sample file is different than original file name gathered from version info

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

0urFbKxdvL.exe (PID: 6868 cmdline: "C:\Users\user\Desktop\0urFbKxdvL.exe" MD5: 0AE609594FBD4BB27287BD63BC9E9529)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: 0urFbKxdvL.exe	Virustotal: Detection: 18%			Perma Link
Source: 0urFbKxdvL.exe	ReversingLabs: Detection: 32%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 91.2% probability

Source: C:\Users\user\Desktop\0urFbKxdvL.exe

Code function: 0_2_00000001400043D0 GetWindowsDirectoryW,FindFirstFileW,FindNextFileW,FindClose,

0_2_00000001400043D0

Source: 0urFbKxdvL.exe	String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningCAEVR36.crl0
Source: 0urFbKxdvL.exe	String found in binary or memory: http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t
Source: 0urFbKxdvL.exe	String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningCAEVR36.crt0#
Source: 0urFbKxdvL.exe	String found in binary or memory: http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#
Source: 0urFbKxdvL.exe	String found in binary or memory: http://ocsp.sectigo.com0
Source: 0urFbKxdvL.exe	String found in binary or memory: https://sectigo.com/CPS0

Source: C:\Users\user\Desktop\0urFbKxdvL.exe

Code function: 0_2_0000000140004570: IIDFromString,CreateFileW,GetLastError,lstrlenW,wsprintfW,DeviceIoControl,CloseHandle,

0_2_0000000140004570

Source: C:\Users\user\Desktop\0urFbKxdvL.exe	Code function: 0_2_000000014000CA3C	0_2_000000014000CA3C
Source: C:\Users\user\Desktop\0urFbKxdvL.exe	Code function: 0_2_000000014000D684	0_2_000000014000D684
Source: C:\Users\user\Desktop\0urFbKxdvL.exe	Code function: 0_2_0000000140009CA0	0_2_0000000140009CA0
Source: C:\Users\user\Desktop\0urFbKxdvL.exe	Code function: 0_2_00000001400126C4	0_2_00000001400126C4
Source: C:\Users\user\Desktop\0urFbKxdvL.exe	Code function: 0_2_0000000140007320	0_2_0000000140007320
Source: C:\Users\user\Desktop\0urFbKxdvL.exe	Code function: 0_2_000000014000CD28	0_2_000000014000CD28
Source: C:\Users\user\Desktop\0urFbKxdvL.exe	Code function: 0_2_0000000140003990	0_2_0000000140003990
Source: C:\Users\user\Desktop\0urFbKxdvL.exe	Code function: 0_2_00000001400049C0	0_2_00000001400049C0
Source: C:\Users\user\Desktop\0urFbKxdvL.exe	Code function: 0_2_000000014000E9D4	0_2_000000014000E9D4
Source: C:\Users\user\Desktop\0urFbKxdvL.exe	Code function: 0_2_001E0000	0_2_001E0000
Source: C:\Users\user\Desktop\0urFbKxdvL.exe	Code function: 0_2_001E6947	0_2_001E6947

Source: 0urFbKxdvL.exe	Binary or memory string: OriginalFilename vs 0urFbKxdvL.exe
Source: 0urFbKxdvL.exe, 00000000.00000002.1830203802.0000000140031000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamedeviceinstaller.exe vs 0urFbKxdvL.exe
Source: 0urFbKxdvL.exe	Binary or memory string: OriginalFilenamedeviceinstaller.exe vs 0urFbKxdvL.exe

Source: classification engine

Classification label: mal60.evad.winEXE@1/0@0/0

Source: C:\Users\user\Desktop\0urFbKxdvL.exe

Code function: 0_2_0000000140007EB0 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,CloseHandle,InitiateSystemShutdownExW,

0_2_0000000140007EB0

Source: C:\Users\user\Desktop\0urFbKxdvL.exe

Mutant created: \Sessions\1\BaseNamedObjects\e3a596ac-25f6-43e4-910a-e6a0c89ca722

Source: 0urFbKxdvL.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\0urFbKxdvL.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 0urFbKxdvL.exe	Virustotal: Detection: 18%
Source: 0urFbKxdvL.exe	ReversingLabs: Detection: 32%

Source: 0urFbKxdvL.exe	String found in binary or memory: positioned on the newly-added filter. ! Deletes the next occurrence of the specified filter. When the subcommand
Source: 0urFbKxdvL.exe	String found in binary or memory: ng of the list. When the subcommand completes, the cursor is positioned on the newly-added filter. + Add after
Source: 0urFbKxdvL.exe	String found in binary or memory: cursor is positioned on the newly-added filter.
Source: 0urFbKxdvL.exe	String found in binary or memory: cursor is positioned on the newly-added filter.

Source: C:\Users\user\Desktop\0urFbKxdvL.exe	Section loaded: apphelp.dll			Jump to behavior
Source: C:\Users\user\Desktop\0urFbKxdvL.exe	Section loaded: amsi.dll			Jump to behavior

Source: 0urFbKxdvL.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: 0urFbKxdvL.exe

Static file information: File size 4338576 > 1048576

Source: 0urFbKxdvL.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: 0urFbKxdvL.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: 0urFbKxdvL.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: 0urFbKxdvL.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: 0urFbKxdvL.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\0urFbKxdvL.exe

Code function: 0_2_0000000140004230 GetFullPathNameW,LoadLibraryW,GetProcAddress,GetLastError,FreeLibrary,GetLastError,FreeLibrary,FreeLibrary,FreeLibrary,

0_2_0000000140004230

Source: 0urFbKxdvL.exe

Static PE information: real checksum: 0x4716e should be: 0x426362

Source: C:\Users\user\Desktop\0urFbKxdvL.exe	Code function: 0_2_001E8C37 push edi; ret	0_2_001E8C4B
Source: C:\Users\user\Desktop\0urFbKxdvL.exe	Code function: 0_2_001E8C5E push ecx; ret	0_2_001E8C63
Source: C:\Users\user\Desktop\0urFbKxdvL.exe	Code function: 0_2_001E8C7C push ecx; ret	0_2_001E8C82
Source: C:\Users\user\Desktop\0urFbKxdvL.exe	Code function: 0_2_001E8C70 push edi; ret	0_2_001E8C7A

Source: C:\Users\user\Desktop\0urFbKxdvL.exe

Code function: 0_2_000000014000CA3C EncodePointer,GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_000000014000CA3C

Malware Analysis System Evasion

Contains functionality to detect hardware virtualization (CPUID execution measurement)

Source: C:\Users\user\Desktop\0urFbKxdvL.exe

Code function: 0_2_000000014000112B

0_2_000000014000112B

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\0urFbKxdvL.exe	RDTSC instruction interceptor: First address: 140001142 second address: 140001152 instructions: 0x00000000 rdtsc 0x00000002 dec eax 0x00000003 shl edx, 20h 0x00000006 dec eax 0x00000007 or eax, edx 0x00000009 dec eax 0x0000000a mov ecx, eax 0x0000000c fldpi 0x0000000e frndint 0x00000010 rdtsc
Source: C:\Users\user\Desktop\0urFbKxdvL.exe	RDTSC instruction interceptor: First address: 140001152 second address: 140001152 instructions: 0x00000000 rdtsc 0x00000002 dec eax 0x00000003 shl edx, 20h 0x00000006 dec eax 0x00000007 or eax, edx 0x00000009 dec eax 0x0000000a sub eax, ecx 0x0000000c dec ecx 0x0000000d cmp eax, ecx 0x0000000f jc 00007F9A810F7DADh 0x00000011 fldpi 0x00000013 frndint 0x00000015 rdtsc

Source: C:\Users\user\Desktop\0urFbKxdvL.exe

Code function: 0_2_000000014000112B rdtsc

0_2_000000014000112B

Source: C:\Users\user\Desktop\0urFbKxdvL.exe

Code function: 0_2_0000000140009CA0 SetupDiGetDeviceInstallParamsW,SetupDiSetDeviceInstallParamsW,SetupDiBuildDriverInfoList,SetupDiEnumDriverInfoW,SetupDiOpenDevRegKey,RegCloseKey,RegQueryValueExW,RegQueryValueExW,RegQueryValueExW,RegQueryValueExW,RegCloseKey,SetupDiGetDeviceRegistryPropertyW,SetupDiSetDeviceInstallParamsW,SetupDiBuildDriverInfoList,SetupDiEnumDriverInfoW,SetupDiGetDriverInfoDetailW,GetLastError,SetupDiEnumDriverInfoW,SetupDiDestroyDriverInfoList,RegCloseKey,

0_2_0000000140009CA0

Source: C:\Users\user\Desktop\0urFbKxdvL.exe

API coverage: 2.1 %

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\0urFbKxdvL.exe

Code function: 0_2_00000001400043D0 GetWindowsDirectoryW,FindFirstFileW,FindNextFileW,FindClose,

0_2_00000001400043D0

Source: C:\Users\user\Desktop\0urFbKxdvL.exe

Code function: 0_2_001E2917 GetSystemInfo,

0_2_001E2917

Source: C:\Users\user\Desktop\0urFbKxdvL.exe

Code function: 0_2_000000014000112B rdtsc

0_2_000000014000112B

Source: C:\Users\user\Desktop\0urFbKxdvL.exe

Code function: 0_2_000000014000B608 __crtCaptureCurrentContext,IsDebuggerPresent,__crtUnhandledException,

0_2_000000014000B608

Source: C:\Users\user\Desktop\0urFbKxdvL.exe

Code function: 0_2_00000001400121B8 EncodePointer,__crtIsPackagedApp,LoadLibraryExW,GetLastError,LoadLibraryW,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,IsDebuggerPresent,OutputDebugStringW,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,

0_2_00000001400121B8

Source: C:\Users\user\Desktop\0urFbKxdvL.exe

Code function: 0_2_0000000140004230 GetFullPathNameW,LoadLibraryW,GetProcAddress,GetLastError,FreeLibrary,GetLastError,FreeLibrary,FreeLibrary,FreeLibrary,

0_2_0000000140004230

Source: C:\Users\user\Desktop\0urFbKxdvL.exe

Code function: 0_2_000000014000C8BC GetProcessHeap,

0_2_000000014000C8BC

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\0urFbKxdvL.exe

Code function: 0_2_0000000140010850 SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_0000000140010850

Source: C:\Users\user\Desktop\0urFbKxdvL.exe

Code function: 0_2_000000014000F644 cpuid

0_2_000000014000F644

Source: C:\Users\user\Desktop\0urFbKxdvL.exe

0_2_0000000140009CA0

Source: C:\Users\user\Desktop\0urFbKxdvL.exe

Code function: 0_2_0000000140010018 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_0000000140010018

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	1 Access Token Manipulation	1 Access Token Manipulation	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 DLL Side-Loading	LSASS Memory	1 Query Registry	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Obfuscated Files or Information	Security Account Manager	24 Security Software Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	1 File and Directory Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	Software Packing	LSA Secrets	223 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
0urFbKxdvL.exe	19%	Virustotal		Browse
0urFbKxdvL.exe	32%	ReversingLabs	Win64.Trojan.Generic

Source	Detection	Scanner	Label	Link
http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t	0%	URL Reputation	safe
https://sectigo.com/CPS0	0%	URL Reputation	safe
http://ocsp.sectigo.com0	0%	URL Reputation	safe
http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#	0%	URL Reputation	safe
http://crl.sectigo.com/SectigoPublicCodeSigningCAEVR36.crl0	0%	Virustotal		Browse
http://crt.sectigo.com/SectigoPublicCodeSigningCAEVR36.crt0#	0%	Virustotal		Browse

Name	Source	Malicious	Antivirus Detection	Reputation
http://crl.sectigo.com/SectigoPublicCodeSigningCAEVR36.crl0	0urFbKxdvL.exe	false	0%, Virustotal, Browse	unknown
http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t	0urFbKxdvL.exe	false	URL Reputation: safe	unknown
https://sectigo.com/CPS0	0urFbKxdvL.exe	false	URL Reputation: safe	unknown
http://ocsp.sectigo.com0	0urFbKxdvL.exe	false	URL Reputation: safe	unknown
http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#	0urFbKxdvL.exe	false	URL Reputation: safe	unknown
http://crt.sectigo.com/SectigoPublicCodeSigningCAEVR36.crt0#	0urFbKxdvL.exe	false	0%, Virustotal, Browse	unknown

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1527620
Start date and time:	2024-10-07 06:50:12 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 2m 10s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	1
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	0urFbKxdvL.exe renamed because original name is a hash value
Original Sample Name:	328eea4110a4b59778225e2efef7b9cfd07adfb8d189d9fa2d2e450de274659c.exe
Detection:	MAL
Classification:	mal60.evad.winEXE@1/0@0/0
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 9 Number of non-executed functions: 43
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Simulations

Behavior and APIs

Time	Type	Description
00:51:19	API Interceptor	1x Sleep call for process: 0urFbKxdvL.exe modified

File type:	PE32+ executable (GUI) x86-64, for MS Windows
Entropy (8bit):	0.539544912633656
TrID:	Win64 Executable GUI (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	0urFbKxdvL.exe
File size:	4'338'576 bytes
MD5:	0ae609594fbd4bb27287bd63bc9e9529
SHA1:	a506ec04296bd6fe7450c59578bd55a94f17aa65
SHA256:	328eea4110a4b59778225e2efef7b9cfd07adfb8d189d9fa2d2e450de274659c
SHA512:	d8499aea7c7678fd73516908fc6b67620f6adb226229966b346e723ca08bdbddc42bfc37babdcdfc7c4e87ff8529beb930940eaa3302bb6e1e2731347da4abd1
SSDEEP:	3072:gQX30XiK1yhTwS8XjJ3T/yub0kouJidkIQhujeZw0WMTwTKVrSf5RWRtS:zH0bXllTK60kojwo0TCKVrSf5y
TLSH:	3E16D50363E96199F5F3AB3499B552219B737CA19E38C74E0258811DCFB3E809D39B63
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........S._.2...2...2..X.&..2..X.'..2..X.$..2...Jz..2...2..22....&..2.... ..2...2~..2....%..2..Rich.2..................PE..d......^...

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x14000b32c
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x140000000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, TERMINAL_SERVER_AWARE
Time Stamp:	0x5EBBC909 [Wed May 13 10:16:41 2020 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	2
File Version Major:	5
File Version Minor:	2
Subsystem Version Major:	5
Subsystem Version Minor:	2
Import Hash:	09e13ccaecfac7723baa55f4b7663729

Authenticode Signature

Signature Valid:
Signature Issuer:
Signature Validation Error:
Error Number:
Not Before, Not After
Subject Chain
Version:
Thumbprint MD5:
Thumbprint SHA-1:
Thumbprint SHA-256:
Serial:

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
call 00007F9A80B75418h
dec eax
add esp, 28h
jmp 00007F9A80B664E5h
int3
int3
dec eax
lea eax, dword ptr [00009961h]
dec eax
mov dword ptr [ecx], eax
dec eax
mov eax, dword ptr [edx]
mov byte ptr [ecx+10h], 00000000h
dec eax
mov dword ptr [ecx+08h], eax
dec eax
mov eax, ecx
ret
int3
int3
int3
inc eax
push ebx
dec eax
sub esp, 20h
dec eax
and dword ptr [ecx+08h], 00000000h
dec eax
lea eax, dword ptr [0000993Ah]
dec eax
mov ebx, ecx
dec eax
mov dword ptr [ecx], eax
mov byte ptr [ecx+10h], 00000000h
call 00007F9A80B70750h
dec eax
mov eax, ebx
dec eax
add esp, 20h
pop ebx
ret
int3
int3
dec eax
lea eax, dword ptr [00009919h]
dec eax
mov dword ptr [ecx], eax
jmp 00007F9A80B70812h
int3
dec eax
mov dword ptr [esp+08h], ebx
push edi
dec eax
sub esp, 20h
dec eax
mov edi, edx
dec eax
mov ebx, ecx
dec eax
cmp ecx, edx
je 00007F9A80B70753h
call 00007F9A80B707F7h
cmp byte ptr [edi+10h], 00000000h
je 00007F9A80B70740h
dec eax
mov edx, dword ptr [edi+08h]
dec eax
mov ecx, ebx
call 00007F9A80B70789h
jmp 00007F9A80B7073Ah
dec eax
mov eax, dword ptr [edi+08h]
dec eax
mov dword ptr [ebx+08h], eax
dec eax
mov eax, ebx
dec eax
mov ebx, dword ptr [esp+30h]
dec eax
add esp, 20h
pop edi
ret
dec eax
mov dword ptr [esp+08h], ebx
push edi
dec eax
sub esp, 20h
dec eax
lea eax, dword ptr [000098BBh]
mov ebx, edx
dec eax
mov edi, ecx
dec eax

Rich Headers

Programming Language:

[IMP] VS2008 SP1 build 30729
[RES] VS2012 UPD4 build 61030
[LNK] VS2012 UPD4 build 61030

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x1bcac	0x78	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x33000	0xafec	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x31000	0x10f8	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x38a00	0x1b90	.rsrc
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x3e000	0x67c	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x1a6f0	0x70	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x14000	0x4a8	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x12f91	0x13000	1e594382c3f5e8c63dafbf83a47224d4	False	0.5647743626644737	data	6.31237259360314	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x14000	0x8e36	0x9000	748978ae9cc91681b00dd08b7b1c4a29	False	0.3344184027777778	data	4.318170867822159	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x1d000	0x13b00	0x10800	bbf99811d946b9122af7b8914d8d5dbe	False	0.4825846354166667	data	5.627074879820151	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x31000	0x10f8	0x1200	5fca5de5e4fdf02465922bba040d5120	False	0.4516059027777778	data	4.842198122273491	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x33000	0xafec	0xb000	ebcc72a1b2a02881e5b0bdf5fceb886d	False	0.13108132102272727	data	3.4487274625670556	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x3e000	0x90c	0xa00	f6324ad470840bca9e3b60544f950905	False	0.4171875	data	4.283178652006133	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_STRING	0x33118	0xea	Matlab v4 mat-file (little endian) n, numeric, rows 0, columns 0	English	United States	0.43162393162393164
RT_STRING	0x33204	0xaa	data	English	United States	0.4823529411764706
RT_MESSAGETABLE	0x332b0	0xa944	Matlab v4 mat-file (little endian) \306\352, rows 60000, columns 60002, imaginary	English	United States	0.1238576571586818
RT_VERSION	0x3dbf4	0x3f8	data	English	United States	0.41437007874015747

Imports

DLL	Import
KERNEL32.dll	FindFirstFileW, FindNextFileW, LocalFree, GetCurrentProcess, FormatMessageW, FileTimeToSystemTime, GetFileAttributesW, SetFilePointerEx, SetStdHandle, HeapSize, HeapReAlloc, GetConsoleMode, CreateFileW, GetFullPathNameW, GetWindowsDirectoryW, LoadLibraryW, lstrlenW, CloseHandle, FindClose, DeviceIoControl, GetLastError, GetProcAddress, GetDateFormatW, FreeLibrary, GetConsoleCP, FlushFileBuffers, OutputDebugStringW, LoadLibraryExW, LCMapStringW, WideCharToMultiByte, GetModuleHandleW, TlsFree, TlsSetValue, TlsGetValue, TlsAlloc, TerminateProcess, SetUnhandledExceptionFilter, UnhandledExceptionFilter, RtlVirtualUnwind, RtlLookupFunctionEntry, RtlCaptureContext, FreeEnvironmentStringsW, GetEnvironmentStringsW, GetSystemTimeAsFileTime, GetCurrentProcessId, QueryPerformanceCounter, GetStringTypeW, GetStartupInfoW, GetFileType, RtlUnwindEx, Sleep, InitializeCriticalSectionAndSpinCount, DeleteCriticalSection, GetModuleFileNameW, WriteFile, GetStdHandle, GetModuleHandleExW, WriteConsoleW, ExitProcess, GetProcessHeap, MultiByteToWideChar, GetCurrentThreadId, SetLastError, GetCPInfo, GetOEMCP, GetACP, HeapFree, HeapAlloc, EnterCriticalSection, LeaveCriticalSection, GetCommandLineW, EncodePointer, DecodePointer, RtlPcToFileHeader, RaiseException, IsDebuggerPresent, IsProcessorFeaturePresent, VirtualAlloc
USER32.dll	wsprintfW, LoadStringW, CharPrevW, CharNextW
ADVAPI32.dll	RegQueryValueExW, LookupPrivilegeValueW, AdjustTokenPrivileges, OpenProcessToken, OpenServiceW, OpenSCManagerW, CloseServiceHandle, RegSetValueExW, RegDeleteValueW, RegCloseKey, InitiateSystemShutdownExW
ole32.dll	CLSIDFromString, IIDFromString
SETUPAPI.dll	CM_Get_Next_Res_Des_Ex, CM_Get_Res_Des_Data_Size_Ex, CM_Get_Res_Des_Data_Ex, CM_Get_First_Log_Conf_Ex, CM_Free_Res_Des_Handle, CM_Free_Log_Conf_Handle, SetupDiGetDriverInstallParamsW, SetupDiSetDeviceInstallParamsW, SetupDiDestroyDriverInfoList, SetupDiGetDriverInfoDetailW, SetupDiSetSelectedDriverW, SetupDiEnumDriverInfoW, SetupDiBuildDriverInfoList, SetupScanFileQueueW, SetupCloseFileQueue, SetupOpenFileQueue, SetupGetStringFieldW, SetupFindFirstLineW, SetupCloseInfFile, SetupOpenInfFileW, SetupDiGetDeviceRegistryPropertyW, SetupDiOpenDeviceInfoW, SetupDiCreateDeviceInfoListExW, CM_Reenumerate_DevNode_Ex, CM_Locate_DevNode_ExW, CM_Get_Device_Interface_List_SizeW, CM_Get_Device_Interface_ListW, CM_Get_DevNode_Status_Ex, CM_Get_Device_ID_ExW, CM_Disconnect_Machine, CM_Connect_MachineW, SetupDiClassGuidsFromNameExW, SetupDiClassNameFromGuidExW, SetupDiSetClassInstallParamsW, SetupDiGetDeviceInstallParamsW, SetupDiSetDeviceRegistryPropertyW, SetupDiOpenClassRegKeyExW, SetupDiCallClassInstaller, SetupDiGetClassDescriptionExW, SetupDiBuildClassInfoListExW, SetupDiGetINFClassW, SetupDiGetClassDevsExW, SetupDiDestroyDeviceInfoList, SetupDiEnumDeviceInfo, SetupDiCreateDeviceInfoW, SetupDiGetDeviceInfoListDetailW, SetupDiCreateDeviceInfoList, SetupCopyOEMInfW, SetupDiOpenDevRegKey

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Target ID:	0
Start time:	00:51:15
Start date:	07/10/2024
Path:	C:\Users\user\Desktop\0urFbKxdvL.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\0urFbKxdvL.exe"
Imagebase:	0x140000000
File size:	4'338'576 bytes
MD5 hash:	0AE609594FBD4BB27287BD63BC9E9529
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	2.3%
Dynamic/Decrypted Code Coverage:	99.2%
Signature Coverage:	35.7%
Total number of Nodes:	392
Total number of Limit Nodes:	7

Executed Functions

Function 001E2917 Relevance: 45.5, APIs: 1, Strings: 25, Instructions: 49
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 001E0E57: LoadLibraryA.KERNELBASE ref: 001E0EC4

GetSystemInfo.KERNELBASE ref: 001E29C2

Strings

t, xrefs: 001E296D
k, xrefs: 001E2922
s, xrefs: 001E297C
e, xrefs: 001E2927
m, xrefs: 001E298B
G, xrefs: 001E2963
d, xrefs: 001E294F
o, xrefs: 001E299F
l, xrefs: 001E2954
y, xrefs: 001E2977
l, xrefs: 001E2959
r, xrefs: 001E292C
t, xrefs: 001E2981
l, xrefs: 001E293B
3, xrefs: 001E2940
n, xrefs: 001E2995
f, xrefs: 001E299A
I, xrefs: 001E2990
e, xrefs: 001E2986
n, xrefs: 001E2931
e, xrefs: 001E2968
2, xrefs: 001E2945
., xrefs: 001E294A
S, xrefs: 001E2972
e, xrefs: 001E2936

Memory Dump Source

Source File: 00000000.00000002.1829954835.00000000001E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 001E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_0urFbKxdvL.jbxd

Similarity

API ID: InfoLibraryLoadSystem
String ID: .$2$3$G$I$S$d$e$e$e$e$f$k$l$l$l$m$n$n$o$r$s$t$t$y
API String ID: 2528439753-3724200337
Opcode ID: 0fc8c04ef61f41a6e734b9a01e1b2a0ac8531192857d5d2a5c7d68ec73663fa1
Instruction ID: 6b362cf44f12e077093de3ab036843ab9f696ecefad6c7b416dbd138b25c46d6
Opcode Fuzzy Hash: 0fc8c04ef61f41a6e734b9a01e1b2a0ac8531192857d5d2a5c7d68ec73663fa1
Instruction Fuzzy Hash: D421B72040C7C0D9E352D628C08875FBED16BA674CF88599DF1C95A292C7BF8658C76B

Function 001E8517 Relevance: 85.8, APIs: 2, Strings: 47, Instructions: 100
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 001E0E57: LoadLibraryA.KERNELBASE ref: 001E0EC4

VirtualProtect.KERNELBASE ref: 001E866E
VirtualProtect.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,001E88FB), ref: 001E869D

Strings

r, xrefs: 001E85B9
e, xrefs: 001E8564
t, xrefs: 001E8523
e, xrefs: 001E85C8
t, xrefs: 001E85E1
l, xrefs: 001E8569
l, xrefs: 001E8541
i, xrefs: 001E8596
n, xrefs: 001E860E
o, xrefs: 001E85BE
l, xrefs: 001E8532
a, xrefs: 001E85AA
d, xrefs: 001E857D
e, xrefs: 001E85FA
t, xrefs: 001E85D2
t, xrefs: 001E85C3
a, xrefs: 001E85F0
t, xrefs: 001E8613
l, xrefs: 001E8546
l, xrefs: 001E85AF
u, xrefs: 001E85A5
l, xrefs: 001E8582
v, xrefs: 001E8604
l, xrefs: 001E8587
e, xrefs: 001E8609
d, xrefs: 001E853C
r, xrefs: 001E859B
d, xrefs: 001E8528
n, xrefs: 001E851E
V, xrefs: 001E8591
c, xrefs: 001E85CD
T, xrefs: 001E85E6
N, xrefs: 001E85DC
3, xrefs: 001E856E
2, xrefs: 001E8573
k, xrefs: 001E8550
n, xrefs: 001E855F
r, xrefs: 001E855A
P, xrefs: 001E85B4
., xrefs: 001E8578
t, xrefs: 001E85A0
e, xrefs: 001E8555
l, xrefs: 001E852D
E, xrefs: 001E85FF
., xrefs: 001E8537
c, xrefs: 001E85F5
r, xrefs: 001E85EB

Memory Dump Source

Source File: 00000000.00000002.1829954835.00000000001E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 001E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_0urFbKxdvL.jbxd

Similarity

API ID: ProtectVirtual$LibraryLoad
String ID: .$.$2$3$E$N$P$T$V$a$a$c$c$d$d$d$e$e$e$e$e$i$k$l$l$l$l$l$l$l$l$n$n$n$o$r$r$r$r$t$t$t$t$t$t$u$v
API String ID: 895956442-1938279493
Opcode ID: ed663ba51057405492db862212b8c8051be87ab1ea5d60a9a3613037d2cb4a83
Instruction ID: 98f3f78f390053dd27d3e82d5d17511d1080963eb83177ceb75fed1409a66346
Opcode Fuzzy Hash: ed663ba51057405492db862212b8c8051be87ab1ea5d60a9a3613037d2cb4a83
Instruction Fuzzy Hash: 8951702040C7C0CAE312D728C44875FFFE26BA6748F48498CB1C54A2A2C7FB9568C767

Function 001E86B7 Relevance: 84.1, APIs: 2, Strings: 46, Instructions: 101
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 001E0E57: LoadLibraryA.KERNELBASE ref: 001E0EC4

VirtualProtect.KERNELBASE ref: 001E8813
VirtualProtect.KERNELBASE ref: 001E8842

Strings

c, xrefs: 001E8745
n, xrefs: 001E86CD
VeB, xrefs: 001E87EB
m, xrefs: 001E8704
P, xrefs: 001E879A
m, xrefs: 001E8731
A, xrefs: 001E872C
r, xrefs: 001E86C8
l, xrefs: 001E8722
e, xrefs: 001E86C3
s, xrefs: 001E8709
n, xrefs: 001E874F
l, xrefs: 001E871D
k, xrefs: 001E86BE
o, xrefs: 001E87A4
e, xrefs: 001E86D2
t, xrefs: 001E87A9
c, xrefs: 001E87B3
2, xrefs: 001E86E1
d, xrefs: 001E86EB
u, xrefs: 001E8759
i, xrefs: 001E873B
l, xrefs: 001E86F0
S, xrefs: 001E8740
l, xrefs: 001E86F5
., xrefs: 001E8713
t, xrefs: 001E87B8
t, xrefs: 001E8786
l, xrefs: 001E86D7
d, xrefs: 001E8718
e, xrefs: 001E8768
i, xrefs: 001E870E
a, xrefs: 001E86FF
3, xrefs: 001E86DC
r, xrefs: 001E879F
f, xrefs: 001E8763
f, xrefs: 001E875E
l, xrefs: 001E8795
a, xrefs: 001E8790
r, xrefs: 001E876D
B, xrefs: 001E8754
e, xrefs: 001E87AE
u, xrefs: 001E878B
., xrefs: 001E86E6
a, xrefs: 001E874A
s, xrefs: 001E8736

Memory Dump Source

Source File: 00000000.00000002.1829954835.00000000001E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 001E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_0urFbKxdvL.jbxd

Similarity

API ID: ProtectVirtual$LibraryLoad
String ID: .$.$2$3$A$B$P$S$VeB$a$a$a$c$c$d$d$e$e$e$e$f$f$i$i$k$l$l$l$l$l$l$m$m$n$n$o$r$r$r$s$s$t$t$t$u$u
API String ID: 895956442-770127954
Opcode ID: a27508a6293d6f97c6c402cb9fb694186acae8492344363b8b6fcf1741269bed
Instruction ID: cac2c556508ed36d665c28282d806a2cda75891cce5795edabcebf95a71cf58e
Opcode Fuzzy Hash: a27508a6293d6f97c6c402cb9fb694186acae8492344363b8b6fcf1741269bed
Instruction Fuzzy Hash: 4551912050C7C0CAE312D728C45875FFFD26BA6748F48499CB1D54A2A2C7FB9668C767

Function 001E2467 Relevance: 31.6, APIs: 1, Strings: 17, Instructions: 73
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 001E0E57: LoadLibraryA.KERNELBASE ref: 001E0EC4

SleepEx.KERNELBASE ref: 001E250E

Strings

d, xrefs: 001E2498
2, xrefs: 001E248E
l, xrefs: 001E2484
l, xrefs: 001E24B1
n, xrefs: 001E247A
e, xrefs: 001E24BB
S, xrefs: 001E24AC
e, xrefs: 001E2470
l, xrefs: 001E249D
3, xrefs: 001E2489
k, xrefs: 001E246B
e, xrefs: 001E247F
e, xrefs: 001E24B6
l, xrefs: 001E24A2
., xrefs: 001E2493
r, xrefs: 001E2475
p, xrefs: 001E24C0

Memory Dump Source

Source File: 00000000.00000002.1829954835.00000000001E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 001E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_0urFbKxdvL.jbxd

Similarity

API ID: LibraryLoadSleep
String ID: .$2$3$S$d$e$e$e$e$k$l$l$l$l$n$p$r
API String ID: 2118945035-1151806120
Opcode ID: 3cb603b51f7702b711465f8eee98a85c1f75f823072d7b7383f082aa6f8f4f25
Instruction ID: 399c514fb745afbb94ed2f0f68f1bec5567fef2971778998ceb648f0a3c49c15
Opcode Fuzzy Hash: 3cb603b51f7702b711465f8eee98a85c1f75f823072d7b7383f082aa6f8f4f25
Instruction Fuzzy Hash: 5B21F52010CBC4CEE342D668845875BFFD2ABAA709F440A5DF0C996292C7FAC598C727

Function 001E0E57 Relevance: 1.6, APIs: 1, Instructions: 54
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE ref: 001E0EC4

Memory Dump Source

Source File: 00000000.00000002.1829954835.00000000001E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 001E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_0urFbKxdvL.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 235e72a7c4a46574d56536a75a93859d3b0f1fc4ed960766b8425097f384a9d1
Instruction ID: 5bd7adb82a24445d6cb924a63fd42b2dd6f4c651f59e9fa04c343e8bf2393fa2
Opcode Fuzzy Hash: 235e72a7c4a46574d56536a75a93859d3b0f1fc4ed960766b8425097f384a9d1
Instruction Fuzzy Hash: 89119A70528B889FD689EF69C05871E7AE1FB9C345F940A2DF489D3290D7B889C4CB46

Function 00000001400012B0 Relevance: 1.4, APIs: 1, Instructions: 160
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE ref: 0000000140003610

Memory Dump Source

Source File: 00000000.00000002.1830110169.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1830094398.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1830134247.0000000140014000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1830150505.000000014001D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1830164046.000000014001E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1830164046.0000000140024000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1830203802.0000000140031000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_0urFbKxdvL.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: e4b512b6c16b9208ec479ad47c4ac0c5910a558e0788372609c665a1a03fa5f5
Instruction ID: 704af476db65c0eeef5f6891e4cc0caf001e4bac9f341313fc9b85eee6c6d204
Opcode Fuzzy Hash: e4b512b6c16b9208ec479ad47c4ac0c5910a558e0788372609c665a1a03fa5f5
Instruction Fuzzy Hash: 5961E4B2611A8192EB1ACF1BE1903EC6760F7CCBC5F549225EB4A07BB1DB38C1A5C700

Function 0000000140003320 Relevance: 1.3, APIs: 1, Instructions: 67
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE ref: 0000000140003610

Memory Dump Source

Source File: 00000000.00000002.1830110169.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1830094398.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1830134247.0000000140014000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1830150505.000000014001D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1830164046.000000014001E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1830164046.0000000140024000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1830203802.0000000140031000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_0urFbKxdvL.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 33e563ba038323b2d255fb3bb1d5b113feda57c36ee0ed1f73719c6469e121ab
Instruction ID: 97dfca1c15d198223b395158cb937e2404b45c9ed2e5e2b82091fa29808ce56d
Opcode Fuzzy Hash: 33e563ba038323b2d255fb3bb1d5b113feda57c36ee0ed1f73719c6469e121ab
Instruction Fuzzy Hash: DF310F72608B8186E722CF56F88078AB7E4F38CB94F544129EB8947B78DF79C555CB00

Function 00000001400010B0 Relevance: 1.3, APIs: 1, Instructions: 64
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE ref: 0000000140003610

Memory Dump Source

Source File: 00000000.00000002.1830110169.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1830094398.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1830134247.0000000140014000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1830150505.000000014001D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1830164046.000000014001E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1830164046.0000000140024000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1830203802.0000000140031000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_0urFbKxdvL.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 1b6f53348a68bdd5065bf2f7113c7e9456c11f8837988c6a52245199bcdd0d90
Instruction ID: c8a0adb227e65bfff738e68f8c8946a12ff7ea2864567f7c2243dcec2aca9257
Opcode Fuzzy Hash: 1b6f53348a68bdd5065bf2f7113c7e9456c11f8837988c6a52245199bcdd0d90
Instruction Fuzzy Hash: 1C11907261964090EA27DF77B8407E962A4B78DFC5F988025FF4D4B3A1CE79C892C711

Function 00000001400035ED Relevance: 1.3, APIs: 1, Instructions: 12
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE ref: 0000000140003610

Memory Dump Source

Source File: 00000000.00000002.1830110169.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1830094398.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1830134247.0000000140014000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1830150505.000000014001D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1830164046.000000014001E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1830164046.0000000140024000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1830203802.0000000140031000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_0urFbKxdvL.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 30a1d343fb9a970dba098e6885d91e60a03fd8333c3af810e1cc3c19700e9722
Instruction ID: 1ed30be74b7ba8a770c6a65b02b4c7fd82dd013a14b652b9f4c44187bbcdb5f7
Opcode Fuzzy Hash: 30a1d343fb9a970dba098e6885d91e60a03fd8333c3af810e1cc3c19700e9722
Instruction Fuzzy Hash: D5D052B061264082EB02DF33E0407C822A0A70EFC1F4A8024FA080B3A0DE3A80808B80

Non-executed Functions

Function 001E6947 Relevance: 299.8, Strings: 239, Instructions: 1050
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

c, xrefs: 001E6A5E
e, xrefs: 001E72D2
j, xrefs: 001E7860
j, xrefs: 001E7581
f, xrefs: 001E69BE
., xrefs: 001E7820
z, xrefs: 001E75B9
0, xrefs: 001E7559
t, xrefs: 001E730F
c, xrefs: 001E7830
x, xrefs: 001E6A46
o, xrefs: 001E73D9
j, xrefs: 001E69E6
., xrefs: 001E7659
e, xrefs: 001E7377
p, xrefs: 001E7840
s, xrefs: 001E6A16
e, xrefs: 001E6C30
e, xrefs: 001E7490
r, xrefs: 001E79C9
e, xrefs: 001E744C
z, xrefs: 001E6A66
-, xrefs: 001E6A0E
3, xrefs: 001E6C3F
P, xrefs: 001E79C1
t, xrefs: 001E7347
e, xrefs: 001E73E9
u, xrefs: 001E7661
c, xrefs: 001E73E1
d, xrefs: 001E6CA2
., xrefs: 001E7898
g, xrefs: 001E7758
g, xrefs: 001E7519
f, xrefs: 001E7639
l, xrefs: 001E6C58
v, xrefs: 001E75B1
a, xrefs: 001E7800
e, xrefs: 001E79E1
r, xrefs: 001E6A56
t, xrefs: 001E736F
s, xrefs: 001E75A9
a, xrefs: 001E79B1
3, xrefs: 001E72DC
., xrefs: 001E75E1
z, xrefs: 001E75C9
j, xrefs: 001E77C0
e, xrefs: 001E6CAA
/, xrefs: 001E6AB6
x, xrefs: 001E75D9
a, xrefs: 001E6A2E
., xrefs: 001E77A8
l, xrefs: 001E6C9A
e, xrefs: 001E72C3
r, xrefs: 001E6CB2
r, xrefs: 001E734F
l, xrefs: 001E72F0
z, xrefs: 001E6ABE
t, xrefs: 001E7619
j, xrefs: 001E7521
z, xrefs: 001E6A26
t, xrefs: 001E6A9E
t, xrefs: 001E7631
r, xrefs: 001E75E9
j, xrefs: 001E698E
d, xrefs: 001E6C4E
V, xrefs: 001E7989
F, xrefs: 001E7317
l, xrefs: 001E6C3A
F, xrefs: 001E743D
z, xrefs: 001E75F9
e, xrefs: 001E6A7E
r, xrefs: 001E72C8
e, xrefs: 001E7810
k, xrefs: 001E697E
S, xrefs: 001E7481
4, xrefs: 001E7549
i, xrefs: 001E731F
a, xrefs: 001E75C1
e, xrefs: 001E7447
r, xrefs: 001E6AD6
/, xrefs: 001E7539
2, xrefs: 001E72E1
r, xrefs: 001E7669
l, xrefs: 001E72F5
j, xrefs: 001E7561
e, xrefs: 001E6A3E
y, xrefs: 001E7740
l, xrefs: 001E6C53
P, xrefs: 001E6CBA
l, xrefs: 001E7486
k, xrefs: 001E7509
0, xrefs: 001E69AE
o, xrefs: 001E79D1
y, xrefs: 001E7501
l, xrefs: 001E7848
z, xrefs: 001E77F8
., xrefs: 001E6C49
P, xrefs: 001E73C9
a, xrefs: 001E7433
e, xrefs: 001E7850
e, xrefs: 001E742E
i, xrefs: 001E7357
e, xrefs: 001E7409
., xrefs: 001E72E6
j, xrefs: 001E77B8
k, xrefs: 001E7748
:, xrefs: 001E7529
k, xrefs: 001E7511
0, xrefs: 001E7798
l, xrefs: 001E7609
z, xrefs: 001E6A36
t, xrefs: 001E6CCA
d, xrefs: 001E6AAE
4, xrefs: 001E7788
v, xrefs: 001E6A1E
4, xrefs: 001E69B6
f, xrefs: 001E77B0
/, xrefs: 001E69A6
0, xrefs: 001E69C6
/, xrefs: 001E7778
e, xrefs: 001E77D8
f, xrefs: 001E6AA6
e, xrefs: 001E6C7A
A, xrefs: 001E6CDA
f, xrefs: 001E7790
/, xrefs: 001E7888
x, xrefs: 001E78B0
0, xrefs: 001E7780
e, xrefs: 001E7307
-, xrefs: 001E75A1
k, xrefs: 001E7750
o, xrefs: 001E6C92
S, xrefs: 001E6C62
t, xrefs: 001E7870
F, xrefs: 001E6C8A
n, xrefs: 001E72CD
r, xrefs: 001E7442
., xrefs: 001E69D6
t, xrefs: 001E79A1
:, xrefs: 001E6996
e, xrefs: 001E6A06
j, xrefs: 001E7890
f, xrefs: 001E7551
H, xrefs: 001E6C6A
-, xrefs: 001E7589
r, xrefs: 001E73D1
r, xrefs: 001E7828
t, xrefs: 001E69FE
l, xrefs: 001E7327
t, xrefs: 001E6A86
., xrefs: 001E7569
d, xrefs: 001E7880
t, xrefs: 001E73C1
j, xrefs: 001E7621
G, xrefs: 001E73B1
e, xrefs: 001E7599
t, xrefs: 001E7858
t, xrefs: 001E77D0
a, xrefs: 001E7411
., xrefs: 001E7868
x, xrefs: 001E7818
G, xrefs: 001E72FF
-, xrefs: 001E77E0
d, xrefs: 001E72EB
l, xrefs: 001E6C35
l, xrefs: 001E72D7
t, xrefs: 001E733F
A, xrefs: 001E7387
/, xrefs: 001E7770
t, xrefs: 001E6C82
H, xrefs: 001E7429
c, xrefs: 001E75F1
g, xrefs: 001E78A8
e, xrefs: 001E7611
a, xrefs: 001E78A0
j, xrefs: 001E7760
u, xrefs: 001E6ACE
e, xrefs: 001E73B9
f, xrefs: 001E7571
/, xrefs: 001E699E
s, xrefs: 001E73F9
t, xrefs: 001E79D9
z, xrefs: 001E7838
g, xrefs: 001E6986
j, xrefs: 001E69CE
v, xrefs: 001E77F0
b, xrefs: 001E735F
k, xrefs: 001E7671
j, xrefs: 001E77A0
., xrefs: 001E6A4E
s, xrefs: 001E77E8
., xrefs: 001E6AC6
e, xrefs: 001E748B
H, xrefs: 001E7401
f, xrefs: 001E69DE
2, xrefs: 001E6C44
s, xrefs: 001E73F1
t, xrefs: 001E79F1
s, xrefs: 001E737F
i, xrefs: 001E7991
j, xrefs: 001E7579
t, xrefs: 001E7591
G, xrefs: 001E6C72
., xrefs: 001E7629
h, xrefs: 001E6CD2
/, xrefs: 001E7649
/, xrefs: 001E7531
a, xrefs: 001E6CC2
p, xrefs: 001E7438
j, xrefs: 001E7651
l, xrefs: 001E6A76
l, xrefs: 001E79B9
r, xrefs: 001E7999
p, xrefs: 001E7419
y, xrefs: 001E696E
e, xrefs: 001E732F
u, xrefs: 001E79A9
p, xrefs: 001E7601
p, xrefs: 001E7495
j, xrefs: 001E69EE
h, xrefs: 001E6C2B
c, xrefs: 001E79E9
., xrefs: 001E6A96
u, xrefs: 001E7367
A, xrefs: 001E7337
d, xrefs: 001E7641
k, xrefs: 001E6976
e, xrefs: 001E75D1
p, xrefs: 001E6A6E
:, xrefs: 001E7768
f, xrefs: 001E7878
z, xrefs: 001E7808
-, xrefs: 001E77C8
-, xrefs: 001E69F6
j, xrefs: 001E6A8E
k, xrefs: 001E72BE
k, xrefs: 001E6ADE
S, xrefs: 001E6C26
0, xrefs: 001E7541

Memory Dump Source

Source File: 00000000.00000002.1829954835.00000000001E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 001E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_0urFbKxdvL.jbxd

Similarity

API ID: LibraryLoad
String ID: -$-$-$-$-$-$.$.$.$.$.$.$.$.$.$.$.$.$.$.$/$/$/$/$/$/$/$/$/$0$0$0$0$0$0$2$2$3$3$4$4$4$:$:$:$A$A$A$F$F$F$G$G$G$H$H$H$P$P$P$S$S$S$V$a$a$a$a$a$a$a$a$b$c$c$c$c$c$d$d$d$d$d$d$e$e$e$e$e$e$e$e$e$e$e$e$e$e$e$e$e$e$e$e$e$e$e$e$e$e$f$f$f$f$f$f$f$f$f$g$g$g$g$h$h$i$i$i$j$j$j$j$j$j$j$j$j$j$j$j$j$j$j$j$j$k$k$k$k$k$k$k$k$k$l$l$l$l$l$l$l$l$l$l$l$l$l$l$n$o$o$o$p$p$p$p$p$p$r$r$r$r$r$r$r$r$r$r$r$r$s$s$s$s$s$s$t$t$t$t$t$t$t$t$t$t$t$t$t$t$t$t$t$t$t$u$u$u$u$v$v$v$x$x$x$x$y$y$y$z$z$z$z$z$z$z$z$z$z
API String ID: 1029625771-3190796625
Opcode ID: c8d79dde74befa2575d9765322aa16e196879dcb8d4840348170a8b8e9b5a32a
Instruction ID: a03fc4faadf2aa054ca0613f8f1ac1e15456e016eda1f6c386cf9095bd2f54ca
Opcode Fuzzy Hash: c8d79dde74befa2575d9765322aa16e196879dcb8d4840348170a8b8e9b5a32a
Instruction Fuzzy Hash: 4DB2173021CBC48AE376DB28C458BDFBBD2ABE6304F44495D90CD87292DBBA5558C763

Function 001E0000 Relevance: 259.4, APIs: 1, Strings: 147, Instructions: 405
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

i, xrefs: 001E05E5
l, xrefs: 001E0360
n, xrefs: 001E033D
e, xrefs: 001E03E7
x, xrefs: 001E040F
s, xrefs: 001E06B4
t, xrefs: 001E0725
i, xrefs: 001E04AC
t, xrefs: 001E08F7
2, xrefs: 001E0351
e, xrefs: 001E042D
r, xrefs: 001E0AA4
o, xrefs: 001E0568
r, xrefs: 001E0917
e, xrefs: 001E0342
x, xrefs: 001E0A84
s, xrefs: 001E0755
a, xrefs: 001E08EF
i, xrefs: 001E0548
r, xrefs: 001E085D
r, xrefs: 001E0560
o, xrefs: 001E0605
o, xrefs: 001E069C
W, xrefs: 001E0414
d, xrefs: 001E0392
t, xrefs: 001E084D
u, xrefs: 001E036F
r, xrefs: 001E05FD
E, xrefs: 001E079E
r, xrefs: 001E08DF
MpS, xrefs: 001E043D
s, xrefs: 001E0588
x, xrefs: 001E05DD
e, xrefs: 001E0333
l, xrefs: 001E0397
i, xrefs: 001E067C
t, xrefs: 001E07B6
x, xrefs: 001E0540
x, xrefs: 001E04A4
c, xrefs: 001E086D
T, xrefs: 001E0907
o, xrefs: 001E073D
c, xrefs: 001E07D6
s, xrefs: 001E0AC4
o, xrefs: 001E040A
P, xrefs: 001E05F5
s, xrefs: 001E087D
e, xrefs: 001E074D
l, xrefs: 001E0423
o, xrefs: 001E0865
r, xrefs: 001E0338
o, xrefs: 001E03CE
P, xrefs: 001E04BC
l, xrefs: 001E039C
r, xrefs: 001E037E
c, xrefs: 001E0745
p, xrefs: 001E0432
e, xrefs: 001E0615
o, xrefs: 001E0AAC
e, xrefs: 001E0875
e, xrefs: 001E0379
s, xrefs: 001E0374
P, xrefs: 001E068C
B, xrefs: 001E0405
t, xrefs: 001E0550
t, xrefs: 001E0A94
P, xrefs: 001E0A9C
C, xrefs: 001E08D7
E, xrefs: 001E066C
s, xrefs: 001E0885
d, xrefs: 001E035B
3, xrefs: 001E0383
s, xrefs: 001E0580
s, xrefs: 001E04E4
a, xrefs: 001E0927
l, xrefs: 001E0347
t, xrefs: 001E04B4
E, xrefs: 001E0835
A, xrefs: 001E03D8
o, xrefs: 001E04CC
P, xrefs: 001E07BE
., xrefs: 001E038D
g, xrefs: 001E03BF
E, xrefs: 001E049C
o, xrefs: 001E07CE
r, xrefs: 001E07C6
P, xrefs: 001E0558
t, xrefs: 001E0684
e, xrefs: 001E0428
r, xrefs: 001E04C4
e, xrefs: 001E0ABC
i, xrefs: 001E0A8C
s, xrefs: 001E075D
S, xrefs: 001E041E
c, xrefs: 001E0570
i, xrefs: 001E0845
s, xrefs: 001E06BC
x, xrefs: 001E03D3
s, xrefs: 001E03B5
x, xrefs: 001E0674
r, xrefs: 001E0735
E, xrefs: 001E05D5
E, xrefs: 001E0A7C
s, xrefs: 001E03EC
k, xrefs: 001E032E
i, xrefs: 001E07AE
s, xrefs: 001E04EC
s, xrefs: 001E07E6
i, xrefs: 001E071D
., xrefs: 001E0356
e, xrefs: 001E04DC
x, xrefs: 001E083D
s, xrefs: 001E0ACC
e, xrefs: 001E08FF
s, xrefs: 001E061D
3, xrefs: 001E034C
c, xrefs: 001E04D4
e, xrefs: 001E091F
d, xrefs: 001E092F
E, xrefs: 001E0538
2, xrefs: 001E0388
e, xrefs: 001E07DE
e, xrefs: 001E0578
s, xrefs: 001E07EE
c, xrefs: 001E060D
e, xrefs: 001E08E7
e, xrefs: 001E0400
h, xrefs: 001E090F
B, xrefs: 001E03C9
s, xrefs: 001E03F1
P, xrefs: 001E072D
E, xrefs: 001E070D
M, xrefs: 001E03E2
e, xrefs: 001E03C4
a, xrefs: 001E03BA
a, xrefs: 001E03F6
c, xrefs: 001E06A4
P, xrefs: 001E0855
t, xrefs: 001E05ED
s, xrefs: 001E0625
r, xrefs: 001E0694
c, xrefs: 001E0AB4
x, xrefs: 001E0715
g, xrefs: 001E03FB
e, xrefs: 001E06AC
x, xrefs: 001E07A6
l, xrefs: 001E0365

Memory Dump Source

Source File: 00000000.00000002.1829954835.00000000001E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 001E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e0000_0urFbKxdvL.jbxd

Similarity

API ID:
String ID: .$.$2$2$3$3$A$B$B$C$E$E$E$E$E$E$E$E$M$MpS$P$P$P$P$P$P$P$P$S$T$W$a$a$a$a$c$c$c$c$c$c$c$c$d$d$d$e$e$e$e$e$e$e$e$e$e$e$e$e$e$e$e$e$e$e$g$g$h$i$i$i$i$i$i$i$i$k$l$l$l$l$l$l$n$o$o$o$o$o$o$o$o$o$o$p$r$r$r$r$r$r$r$r$r$r$r$r$s$s$s$s$s$s$s$s$s$s$s$s$s$s$s$s$s$s$s$s$t$t$t$t$t$t$t$t$t$u$x$x$x$x$x$x$x$x$x$x
API String ID: 0-1894514983
Opcode ID: d5e70fa943472593a328994ccd66b51891a2297826b3c5827c6605f78d733cd1
Instruction ID: 0e41bf4517aa08289c9e207e3b9920b6b3dc731a8d376133e1dc102908a8e07e
Opcode Fuzzy Hash: d5e70fa943472593a328994ccd66b51891a2297826b3c5827c6605f78d733cd1
Instruction Fuzzy Hash: 4322F42050CBC0C9E332D72884597DFBED2ABA6708F484D9DD1CD8A292DBFA4158C763

Function 00000001400126C4 Relevance: 42.5, APIs: 23, Strings: 1, Instructions: 460COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 0000000140012721
_invalid_parameter_noinfo.LIBCMT ref: 000000014001272C

Strings

U, xrefs: 0000000140012C8E

Memory Dump Source

Source File: 00000000.00000002.1830110169.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1830094398.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1830134247.0000000140014000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1830150505.000000014001D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1830164046.000000014001E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1830164046.0000000140024000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1830203802.0000000140031000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_0urFbKxdvL.jbxd

Similarity

API ID: _errno_invalid_parameter_noinfo
String ID: U
API String ID: 2959964966-4171548499
Opcode ID: af4138025e285e9986c36e09b8c060183f9860ae73059bae6ccddf27b3ebd38c
Instruction ID: 1f4b0a45a299a05b7f9b4a85ca433d9c60d4af80b6a1c5da4c5d7ceea22fd39f
Opcode Fuzzy Hash: af4138025e285e9986c36e09b8c060183f9860ae73059bae6ccddf27b3ebd38c
Instruction Fuzzy Hash: C512D47221468186EB22CF2AE4843DEB7A1F78DBC4F544116FB894B6B8DB3EC555CB10

Function 0000000140009CA0 Relevance: 42.3, APIs: 20, Strings: 4, Instructions: 260registryCOMMON

Download Yara Rule

APIs

SetupDiGetDeviceInstallParamsW.SETUPAPI ref: 0000000140009D00
SetupDiSetDeviceInstallParamsW.SETUPAPI ref: 0000000140009D24
SetupDiBuildDriverInfoList.SETUPAPI ref: 0000000140009D3A
SetupDiEnumDriverInfoW.SETUPAPI ref: 0000000140009D56
RegCloseKey.ADVAPI32 ref: 000000014000A0EF

Strings

DriverDesc, xrefs: 0000000140009E8E
ProviderName, xrefs: 0000000140009DFC
InfSection, xrefs: 0000000140009E45
InfPath, xrefs: 0000000140009DB6

Memory Dump Source

Source File: 00000000.00000002.1830110169.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1830094398.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1830134247.0000000140014000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1830150505.000000014001D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1830164046.000000014001E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1830164046.0000000140024000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1830203802.0000000140031000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_0urFbKxdvL.jbxd

Similarity

API ID: Setup$DeviceDriverInfoInstallParams$BuildCloseEnumList
String ID: DriverDesc$InfPath$InfSection$ProviderName
API String ID: 2620718138-109328823
Opcode ID: 004d6d2ef626f72d505bd0cfe8ca2f3722ce6cdb573c0bfad9fad846d2bd928a
Instruction ID: eaa9f11f46baee65e037cb275f94c5b721857eada26dcd83acea46d2b9e4ae60
Opcode Fuzzy Hash: 004d6d2ef626f72d505bd0cfe8ca2f3722ce6cdb573c0bfad9fad846d2bd928a
Instruction Fuzzy Hash: FCB16FB221478586EB61CF62B9443EA73E4F789BC8F404116EB8947A78EF7DC649D700

Function 000000014000E9D4 Relevance: 37.4, APIs: 19, Strings: 2, Instructions: 687COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 000000014000EA35

Part of subcall function 000000014000A1E0: _getptd.LIBCMT ref: 000000014000A1F6
Part of subcall function 000000014000A1E0: __updatetlocinfo.LIBCMT ref: 000000014000A22B
Part of subcall function 000000014000A1E0: __updatetmbcinfo.LIBCMT ref: 000000014000A252

_errno.LIBCMT ref: 000000014000EA3A

Part of subcall function 000000014000C804: _getptd_noexit.LIBCMT ref: 000000014000C808

_fileno.LIBCMT ref: 000000014000EA67

Part of subcall function 000000014000E42C: _errno.LIBCMT ref: 000000014000E435
Part of subcall function 000000014000E42C: _invalid_parameter_noinfo.LIBCMT ref: 000000014000E440

write_multi_char.LIBCMT ref: 000000014000F097
write_string.LIBCMT ref: 000000014000F0B4
write_multi_char.LIBCMT ref: 000000014000F0D1
write_string.LIBCMT ref: 000000014000F130
write_string.LIBCMT ref: 000000014000F167
write_multi_char.LIBCMT ref: 000000014000F189
free.LIBCMT ref: 000000014000F19D
_isleadbyte_l.LIBCMT ref: 000000014000F26E
write_char.LIBCMT ref: 000000014000F284
write_char.LIBCMT ref: 000000014000F2A5
_errno.LIBCMT ref: 000000014000F39F
_invalid_parameter_noinfo.LIBCMT ref: 000000014000F3AA

Strings

@, xrefs: 000000014000EA53
, xrefs: 000000014000F06B

Memory Dump Source

Source File: 00000000.00000002.1830110169.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1830094398.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1830134247.0000000140014000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1830150505.000000014001D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1830164046.000000014001E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1830164046.0000000140024000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1830203802.0000000140031000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_0urFbKxdvL.jbxd

Similarity

API ID: _errnowrite_multi_charwrite_string$Locale_invalid_parameter_noinfowrite_char$UpdateUpdate::___updatetlocinfo__updatetmbcinfo_fileno_getptd_getptd_noexit_isleadbyte_lfree
String ID: $@
API String ID: 3318157856-1077428164
Opcode ID: 45b5c7fedf1a9eefa98bdd1f63e44a8914cbe8fbf7a41632d7cb2cf6d8010d5f
Instruction ID: 7d32200c846e971a268c8d936c1203293af3f5361ec9625ac4ec6ccc3facf91c
Opcode Fuzzy Hash: 45b5c7fedf1a9eefa98bdd1f63e44a8914cbe8fbf7a41632d7cb2cf6d8010d5f
Instruction Fuzzy Hash: 3C52E0B26086C486FB66CB16F4443FE6BA1B7497C4F148016FF4667AF5DB79C940AB00

Function 000000014000D684 Relevance: 26.2, APIs: 17, Instructions: 711COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 000000014000D6EE

Part of subcall function 000000014000A1E0: _getptd.LIBCMT ref: 000000014000A1F6
Part of subcall function 000000014000A1E0: __updatetlocinfo.LIBCMT ref: 000000014000A22B
Part of subcall function 000000014000A1E0: __updatetmbcinfo.LIBCMT ref: 000000014000A252

_errno.LIBCMT ref: 000000014000D6F3

Part of subcall function 000000014000C804: _getptd_noexit.LIBCMT ref: 000000014000C808

_errno.LIBCMT ref: 000000014000D704
_invalid_parameter_noinfo.LIBCMT ref: 000000014000D70F
_isleadbyte_l.LIBCMT ref: 000000014000D918
_malloc_crt.LIBCMT ref: 000000014000DC81
DecodePointer.KERNEL32 ref: 000000014000DCC1
DecodePointer.KERNEL32 ref: 000000014000DD02
DecodePointer.KERNEL32 ref: 000000014000DD27
write_multi_char.LIBCMT ref: 000000014000DDB9
write_string.LIBCMT ref: 000000014000DDD6
write_multi_char.LIBCMT ref: 000000014000DDFC
write_char.LIBCMT ref: 000000014000DE4B
write_string.LIBCMT ref: 000000014000DE90
write_multi_char.LIBCMT ref: 000000014000DEB6
free.LIBCMT ref: 000000014000DED4
write_char.LIBCMT ref: 000000014000E000

Memory Dump Source

Source File: 00000000.00000002.1830110169.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1830094398.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1830134247.0000000140014000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1830150505.000000014001D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1830164046.000000014001E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1830164046.0000000140024000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1830203802.0000000140031000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_0urFbKxdvL.jbxd

Similarity

API ID: DecodePointerwrite_multi_char$Locale_errnowrite_charwrite_string$UpdateUpdate::___updatetlocinfo__updatetmbcinfo_getptd_getptd_noexit_invalid_parameter_noinfo_isleadbyte_l_malloc_crtfree
String ID:
API String ID: 3710470324-0
Opcode ID: bdae5667f47aff7fbbf16576b180cd02ddf0167a7946a581b5586dad3fd4bd6c
Instruction ID: 43a8f8d452061ae399d37bafcbd321ed0e944e01b442aff3bca34f360b4d0701
Opcode Fuzzy Hash: bdae5667f47aff7fbbf16576b180cd02ddf0167a7946a581b5586dad3fd4bd6c
Instruction Fuzzy Hash: 5452B2B260868186FB66CB16F4443EE7BA1F7897D4F25011BFB465BAF4DB39C8418B10

Function 00000001400049C0 Relevance: 23.0, APIs: 12, Strings: 1, Instructions: 285COMMON

Download Yara Rule

APIs

SetupDiClassGuidsFromNameExW.SETUPAPI ref: 0000000140004A8B
GetLastError.KERNEL32 ref: 0000000140004A97
SetupDiClassGuidsFromNameExW.SETUPAPI ref: 0000000140004AEB
SetupDiDestroyDeviceInfoList.SETUPAPI ref: 0000000140004DCA

Strings

, xrefs: 0000000140004B82

Memory Dump Source

Source File: 00000000.00000002.1830110169.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1830094398.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1830134247.0000000140014000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1830150505.000000014001D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1830164046.000000014001E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1830164046.0000000140024000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1830203802.0000000140031000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_0urFbKxdvL.jbxd

Similarity

API ID: Setup$ClassFromGuidsName$DestroyDeviceErrorInfoLastList
String ID:
API String ID: 1066883911-3916222277
Opcode ID: acf5cf9db57d546e807f12668150204679d19d9348a34b666ff6445cb47e287d
Instruction ID: 6cb68a191280f32e8ac8d9007d9eb735b98d7561379cab9c10be5878a5506a9f
Opcode Fuzzy Hash: acf5cf9db57d546e807f12668150204679d19d9348a34b666ff6445cb47e287d
Instruction Fuzzy Hash: B2C18EB270464182EB66CF66B8407EA77A0F78DBE8F504226EF6947BE5DB38C505C704

Function 0000000140007320 Relevance: 19.9, APIs: 13, Instructions: 363COMMON

Download Yara Rule

APIs

SetupDiClassGuidsFromNameExW.SETUPAPI ref: 000000014000741D
GetLastError.KERNEL32 ref: 0000000140007427
SetupDiDestroyDeviceInfoList.SETUPAPI ref: 0000000140007455
CharNextW.USER32 ref: 0000000140007509
CharNextW.USER32 ref: 000000014000751B
wcschr.LIBCMT ref: 000000014000752B
SetupDiCreateDeviceInfoListExW.SETUPAPI ref: 000000014000759D
SetupDiGetClassDevsExW.SETUPAPI ref: 00000001400075E6
SetupDiOpenDeviceInfoW.SETUPAPI ref: 000000014000763A
SetupDiGetDeviceInfoListDetailW.SETUPAPI ref: 0000000140007657
SetupDiEnumDeviceInfo.SETUPAPI ref: 000000014000768F
CM_Get_Device_ID_ExW.SETUPAPI ref: 00000001400076F9
SetupDiEnumDeviceInfo.SETUPAPI ref: 0000000140007893

Part of subcall function 00000001400079A0: SetupDiGetDeviceRegistryPropertyW.SETUPAPI ref: 0000000140007A15
Part of subcall function 00000001400079A0: GetLastError.KERNEL32 ref: 0000000140007A20
Part of subcall function 00000001400079A0: SetupDiGetDeviceRegistryPropertyW.SETUPAPI ref: 0000000140007A92

Part of subcall function 00000001400081E0: CharNextW.USER32 ref: 0000000140008289
Part of subcall function 00000001400081E0: lstrlenW.KERNEL32 ref: 0000000140008395
Part of subcall function 00000001400081E0: lstrlenW.KERNEL32 ref: 00000001400083A1

Part of subcall function 00000001400081E0: wcschr.LIBCMT ref: 000000014000829C
Part of subcall function 00000001400081E0: CharNextW.USER32 ref: 00000001400082F0

Memory Dump Source

Source File: 00000000.00000002.1830110169.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1830094398.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1830134247.0000000140014000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1830150505.000000014001D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1830164046.000000014001E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1830164046.0000000140024000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1830203802.0000000140031000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_0urFbKxdvL.jbxd

Similarity

API ID: Setup$Device$Info$CharNext$List$ClassEnumErrorLastPropertyRegistrylstrlenwcschr$CreateDestroyDetailDevice_DevsFromGet_GuidsNameOpen
String ID:
API String ID: 540770659-0
Opcode ID: 46bf24fb9aa7e4b08b5476fc35f18a3a98618df8899f880df90351b03a45de3b
Instruction ID: 9bb0a2ba3187f6af023c882bec9f8781603e524fe668e13baff9208c86da8899
Opcode Fuzzy Hash: 46bf24fb9aa7e4b08b5476fc35f18a3a98618df8899f880df90351b03a45de3b
Instruction Fuzzy Hash: B2F18CB2B04A8086EB62CF26F444BDA67A4F789BD8F504115EF5D47BA8EB7DC541C700

Function 0000000140004230 Relevance: 19.3, APIs: 9, Strings: 2, Instructions: 90libraryloaderCOMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32 ref: 000000014000428F
LoadLibraryW.KERNEL32 ref: 00000001400042B0
GetProcAddress.KERNEL32 ref: 00000001400042CC
GetLastError.KERNEL32 ref: 00000001400042EE
FreeLibrary.KERNEL32 ref: 0000000140004311

Strings

setupapi.dll, xrefs: 00000001400042A9
SetupUninstallOEMInfW, xrefs: 00000001400042C2

Memory Dump Source

Source File: 00000000.00000002.1830110169.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1830094398.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1830134247.0000000140014000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1830150505.000000014001D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1830164046.000000014001E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1830164046.0000000140024000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1830203802.0000000140031000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_0urFbKxdvL.jbxd

Similarity

API ID: Library$AddressErrorFreeFullLastLoadNamePathProc
String ID: SetupUninstallOEMInfW$setupapi.dll
API String ID: 3805412813-3713901415
Opcode ID: 2b8d2a49c2dfd8286926f9f007ff0edf5a921fcb8e2036fdb8d59eade46a02c3
Instruction ID: c5f5208e2f038bcab60d9a25ef7d8eaa9f3ccf9720b0f20c03119a1375561dbd
Opcode Fuzzy Hash: 2b8d2a49c2dfd8286926f9f007ff0edf5a921fcb8e2036fdb8d59eade46a02c3
Instruction Fuzzy Hash: 4F4125B1614A8092EB62EB63F8453DA6360FB98BC1F455025FB4E476B6DF3CCA44C744

Function 0000000140004570 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 89filestringCOMMON

Download Yara Rule

APIs

IIDFromString.OLE32 ref: 00000001400068C0
CreateFileW.KERNEL32 ref: 0000000140006901
GetLastError.KERNEL32 ref: 000000014000690A
lstrlenW.KERNEL32 ref: 0000000140006917
wsprintfW.USER32 ref: 0000000140006933
DeviceIoControl.KERNEL32 ref: 0000000140006973
CloseHandle.KERNEL32 ref: 000000014000697C

Strings

{b5ffd75f-da40-4353-8ff8-b6daf6f1d8ca} Error %X , xrefs: 000000014000692C
{b5ffd75f-da40-4353-8ff8-b6daf6f1d8ca}, xrefs: 00000001400068B9

Memory Dump Source

Source File: 00000000.00000002.1830110169.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1830094398.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1830134247.0000000140014000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1830150505.000000014001D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1830164046.000000014001E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1830164046.0000000140024000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1830203802.0000000140031000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_0urFbKxdvL.jbxd

Similarity

API ID: CloseControlCreateDeviceErrorFileFromHandleLastStringlstrlenwsprintf
String ID: {b5ffd75f-da40-4353-8ff8-b6daf6f1d8ca}${b5ffd75f-da40-4353-8ff8-b6daf6f1d8ca} Error %X
API String ID: 784259077-3618227390
Opcode ID: 9371f016894103a274dc2e27b9aaaef3ece1dfa444d2834018c35b0830c51904
Instruction ID: 8fe4f8c763be507cc92c7229caa7988853e25a059c82c6f96ecf7034f115f44b
Opcode Fuzzy Hash: 9371f016894103a274dc2e27b9aaaef3ece1dfa444d2834018c35b0830c51904
Instruction Fuzzy Hash: ED418C72304A4582EB21CF12F44439A7361F7897D4F814215EB8E4BAB8DF3DC649CB40

Function 0000000140007EB0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 43shutdownCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,0000000140005A7B), ref: 0000000140007EC3
OpenProcessToken.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,0000000140005A7B), ref: 0000000140007ED6
LookupPrivilegeValueW.ADVAPI32 ref: 0000000140007EEE
AdjustTokenPrivileges.ADVAPI32 ref: 0000000140007F2D
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,0000000140005A7B), ref: 0000000140007F38
InitiateSystemShutdownExW.ADVAPI32 ref: 0000000140007F58

Strings

SeShutdownPrivilege, xrefs: 0000000140007EE5

Memory Dump Source

Source File: 00000000.00000002.1830110169.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1830094398.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1830134247.0000000140014000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1830150505.000000014001D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1830164046.000000014001E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1830164046.0000000140024000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1830203802.0000000140031000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_0urFbKxdvL.jbxd

Similarity

API ID: ProcessToken$AdjustCloseCurrentHandleInitiateLookupOpenPrivilegePrivilegesShutdownSystemValue
String ID: SeShutdownPrivilege
API String ID: 2036077386-3733053543
Opcode ID: 4673438f657a7952c90e644b3e93f6ab33e7a1c3d9f2fcf07acf090e17b56650
Instruction ID: 2832a6990ff05d64aafd5fc68365cc9371dba05f77b21c8a77f32dbdad30392f
Opcode Fuzzy Hash: 4673438f657a7952c90e644b3e93f6ab33e7a1c3d9f2fcf07acf090e17b56650
Instruction Fuzzy Hash: 84110DB2614A8182EB21CF62F41579A77A1F78DB88F915015F78E4BA78DF7EC149CB00

Function 00000001400043D0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 98COMMON

Download Yara Rule

APIs

GetWindowsDirectoryW.KERNEL32 ref: 0000000140004414

Strings

\INF\OEM*.INF, xrefs: 000000014000447A

Memory Dump Source

Source File: 00000000.00000002.1830110169.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1830094398.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1830134247.0000000140014000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1830150505.000000014001D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1830164046.000000014001E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1830164046.0000000140024000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1830203802.0000000140031000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_0urFbKxdvL.jbxd

Similarity

API ID: DirectoryWindows
String ID: \INF\OEM*.INF
API String ID: 3619848164-2728984289
Opcode ID: fb27b99ad530845d268da5181d45462764bbd52525ee148a1f1191a07e3b520d
Instruction ID: 87ee9946e775dd7b4886b2606f1aab007d27cae620c4916618a5fa30faee4b9c
Opcode Fuzzy Hash: fb27b99ad530845d268da5181d45462764bbd52525ee148a1f1191a07e3b520d
Instruction Fuzzy Hash: 69416DF2314A8082EB22DB22F8543E962A5FB9D7D4F944121A75A076F6DF3CC509C714

Function 0000000140003990 Relevance: 3.5, APIs: 2, Instructions: 524COMMON

Download Yara Rule

APIs

SetupCopyOEMInfW.SETUPAPI ref: 00000001400041CE

Memory Dump Source

Source File: 00000000.00000002.1830110169.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1830094398.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1830134247.0000000140014000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1830150505.000000014001D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1830164046.000000014001E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1830164046.0000000140024000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1830203802.0000000140031000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_0urFbKxdvL.jbxd

Similarity

API ID: CopySetup
String ID:
API String ID: 3932593008-0
Opcode ID: 004d69855c0444492032f3d8e4616cb30d8b0d7fbfa510f7f01e5b8619986469
Instruction ID: a60eb4f6eed8400f18e6139215ba9445b2455d60217eaa01b938a98619c129b0
Opcode Fuzzy Hash: 004d69855c0444492032f3d8e4616cb30d8b0d7fbfa510f7f01e5b8619986469
Instruction Fuzzy Hash: D73269B2604A8486FB66CF27F8943E9B7A4F78DB94F044226EB59477F5DB38C4858700

Function 000000014000112B Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1830110169.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1830094398.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1830134247.0000000140014000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1830150505.000000014001D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1830164046.000000014001E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1830164046.0000000140024000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1830203802.0000000140031000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_0urFbKxdvL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c2d1427acba216a55333da4bf10ffa46f58bb07106e4e162916ce79798d8ef1
Instruction ID: cea7d347219e52cdfa1c14992018c1d0d95a95b0b8ead74e5fe2d925432d012c
Opcode Fuzzy Hash: 9c2d1427acba216a55333da4bf10ffa46f58bb07106e4e162916ce79798d8ef1
Instruction Fuzzy Hash: F6F065B4B3531D09FE998BB72915BE15056475ABE4E44E630AE1CA73D0E43CA8920155

Function 0000000140009920 Relevance: 40.4, APIs: 17, Strings: 6, Instructions: 197libraryfileloaderCOMMON

Download Yara Rule

APIs

SetupOpenInfFileW.SETUPAPI(?,?,?,00000000,?,0000000140004526), ref: 0000000140009961
GetLastError.KERNEL32(?,?,?,00000000,?,0000000140004526), ref: 0000000140009970
SetupFindFirstLineW.SETUPAPI(?,?,?,00000000,?,0000000140004526), ref: 000000014000999C
SetupGetStringFieldW.SETUPAPI(?,?,?,00000000,?,0000000140004526), ref: 00000001400099C2
SetupFindFirstLineW.SETUPAPI(?,?,?,00000000,?,0000000140004526), ref: 0000000140009A11
SetupGetStringFieldW.SETUPAPI(?,?,?,00000000,?,0000000140004526), ref: 0000000140009A3B
CLSIDFromString.OLE32(?,?,?,00000000,?,0000000140004526), ref: 0000000140009A51
SetupDiGetClassDescriptionExW.SETUPAPI(?,?,?,00000000,?,0000000140004526), ref: 0000000140009A7A
LoadLibraryW.KERNEL32(?,?,?,00000000,?,0000000140004526), ref: 0000000140009ABA
GetProcAddress.KERNEL32(?,?,?,00000000,?,0000000140004526), ref: 0000000140009ADE
GetLastError.KERNEL32 ref: 0000000140009B1B
GetLastError.KERNEL32 ref: 0000000140009B28
SetupFindFirstLineW.SETUPAPI ref: 0000000140009B7A

Strings

Version, xrefs: 000000014000998A, 0000000140009A07, 0000000140009B70
setupapi.dll, xrefs: 0000000140009AB3
ClassGUID, xrefs: 0000000140009A00
SetupVerifyInfFile, xrefs: 0000000140009ACC
DriverVer, xrefs: 0000000140009B69
Provider, xrefs: 0000000140009983

Memory Dump Source

Source File: 00000000.00000002.1830110169.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1830094398.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1830134247.0000000140014000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1830150505.000000014001D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1830164046.000000014001E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1830164046.0000000140024000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1830203802.0000000140031000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_0urFbKxdvL.jbxd

Similarity

API ID: Setup$ErrorFindFirstLastLineString$Field$AddressClassDescriptionFileFromLibraryLoadOpenProc
String ID: ClassGUID$DriverVer$Provider$SetupVerifyInfFile$Version$setupapi.dll
API String ID: 2815445529-1638047923
Opcode ID: 61f6f44b7b042b4ad544f7a4d956d310c75e07ef06f78c2f06c14e127002d5cc
Instruction ID: 9356a1399b0e8ba1a1b8bd6b2e6dae40fe7e2ac72bd30a580a453a6ae19e76ec
Opcode Fuzzy Hash: 61f6f44b7b042b4ad544f7a4d956d310c75e07ef06f78c2f06c14e127002d5cc
Instruction Fuzzy Hash: 539126B2210A8592E762EF63F8047DA23A0FB8DBC5F804016BB4A576B5DF39C649C750

Function 00000001400061A0 Relevance: 26.6, APIs: 11, Strings: 4, Instructions: 359registryservicestringCOMMON

Download Yara Rule

APIs

SetupDiClassGuidsFromNameExW.SETUPAPI ref: 000000014000621C
GetLastError.KERNEL32 ref: 0000000140006226

Part of subcall function 000000014000A288: _errno.LIBCMT ref: 000000014000A2A3
Part of subcall function 000000014000A288: _invalid_parameter_noinfo.LIBCMT ref: 000000014000A2AE

SetupDiOpenClassRegKeyExW.SETUPAPI ref: 00000001400062AE
OpenSCManagerW.ADVAPI32 ref: 00000001400063D7
OpenServiceW.ADVAPI32 ref: 00000001400063F5
CloseServiceHandle.ADVAPI32 ref: 0000000140006406
CloseServiceHandle.ADVAPI32 ref: 000000014000640F

Part of subcall function 00000001400071D0: lstrlenW.KERNEL32(?,00000000,?,000000014000656E), ref: 0000000140007203

lstrlenW.KERNEL32 ref: 00000001400065D8
RegSetValueExW.ADVAPI32 ref: 0000000140006626
RegDeleteValueW.ADVAPI32 ref: 0000000140006669

Part of subcall function 00000001400078C0: FormatMessageW.KERNEL32 ref: 0000000140007908
Part of subcall function 00000001400078C0: CharPrevW.USER32 ref: 0000000140007936
Part of subcall function 00000001400078C0: fputws.LIBCMT ref: 0000000140007980
Part of subcall function 00000001400078C0: LocalFree.KERNEL32 ref: 000000014000798A

RegCloseKey.ADVAPI32 ref: 00000001400066CB

Strings

LowerFilters, xrefs: 000000014000627C
upper, xrefs: 0000000140006243
lower, xrefs: 0000000140006268
UpperFilters, xrefs: 000000014000625B

Memory Dump Source

Source File: 00000000.00000002.1830110169.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1830094398.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1830134247.0000000140014000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1830150505.000000014001D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1830164046.000000014001E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1830164046.0000000140024000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1830203802.0000000140031000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_0urFbKxdvL.jbxd

Similarity

API ID: CloseOpenService$ClassHandleSetupValuelstrlen$CharDeleteErrorFormatFreeFromGuidsLastLocalManagerMessageNamePrev_errno_invalid_parameter_noinfofputws
String ID: LowerFilters$UpperFilters$lower$upper
API String ID: 2301954639-3449112408
Opcode ID: c8de1b8fa281c8ef1b4355dd1fa80e33725943819413b2979065e279466e257b
Instruction ID: 7abbcb659f324e3ac446997519a3390d0430b15f0da958f3f74bd2875e4fc4e8
Opcode Fuzzy Hash: c8de1b8fa281c8ef1b4355dd1fa80e33725943819413b2979065e279466e257b
Instruction Fuzzy Hash: 01E1DFB1600A4082EA26DB27F9503EA63A2F74DBE4F444225FF5A677F5EF3AC5458340

Function 0000000140006AA0 Relevance: 26.3, APIs: 9, Strings: 6, Instructions: 92COMMON

Download Yara Rule

APIs

CM_Get_Device_Interface_List_SizeW.SETUPAPI(?,?,?,?,00000000,00000001400068DB), ref: 0000000140006AD8
wprintf.LIBCMT ref: 0000000140006AED

Part of subcall function 000000014000A8C0: _errno.LIBCMT ref: 000000014000A8E5
Part of subcall function 000000014000A8C0: _invalid_parameter_noinfo.LIBCMT ref: 000000014000A8F0

wprintf.LIBCMT ref: 0000000140006B07

Strings

Error: No active device interfaces found. Is the sample driver loaded?, xrefs: 0000000140006B00
Error 0x%x retrieving device interface list size., xrefs: 0000000140006AE4
Error allocating memory for device interface list., xrefs: 0000000140006B29
Error 0x%x retrieving device interface list., xrefs: 0000000140006B69
Warning: More than one device interface instance found. Selecting first matching device., xrefs: 0000000140006B94
Error: StringCchCopy failed with HRESULT 0x%x, xrefs: 0000000140006BB5

Memory Dump Source

Source File: 00000000.00000002.1830110169.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1830094398.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1830134247.0000000140014000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1830150505.000000014001D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1830164046.000000014001E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1830164046.0000000140024000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1830203802.0000000140031000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_0urFbKxdvL.jbxd

Similarity

API ID: wprintf$Device_Get_Interface_List_Size_errno_invalid_parameter_noinfo
String ID: Error 0x%x retrieving device interface list size.$Error 0x%x retrieving device interface list.$Error allocating memory for device interface list.$Error: No active device interfaces found. Is the sample driver loaded?$Error: StringCchCopy failed with HRESULT 0x%x$Warning: More than one device interface instance found. Selecting first matching device.
API String ID: 4215907127-1653569444
Opcode ID: df84e69d78d16755a989156a712fd83446a12bd72892cdade269fbaae3384414
Instruction ID: 65ff07ec2dedabcc05e19b096baed55693e3b94b1f706183af876b608bded32b
Opcode Fuzzy Hash: df84e69d78d16755a989156a712fd83446a12bd72892cdade269fbaae3384414
Instruction Fuzzy Hash: C33190B160460081FB16EF27B8413EA76E1BB8DBE0F948121BF19977F1EF39C5868600

Function 0000000140009210 Relevance: 22.9, APIs: 9, Strings: 4, Instructions: 116COMMON

Download Yara Rule

APIs

CM_Get_Next_Res_Des_Ex.SETUPAPI ref: 0000000140009253
wprintf.LIBCMT ref: 000000014000931E

Part of subcall function 000000014000A6D0: _errno.LIBCMT ref: 000000014000A6F5
Part of subcall function 000000014000A6D0: _invalid_parameter_noinfo.LIBCMT ref: 000000014000A700

CM_Free_Res_Des_Handle.SETUPAPI ref: 000000014000926E

Part of subcall function 0000000140007E70: fputs.LIBCMT ref: 0000000140007E90

CM_Get_Res_Des_Data_Size_Ex.SETUPAPI ref: 000000014000928A
CM_Get_Res_Des_Data_Ex.SETUPAPI ref: 00000001400092C8
wprintf.LIBCMT ref: 0000000140009303
CM_Get_Next_Res_Des_Ex.SETUPAPI ref: 000000014000939A
CM_Free_Res_Des_Handle.SETUPAPI ref: 00000001400093B5

Strings

MEM : %08I64x-%08I64x, xrefs: 000000014000935C
DMA : %u, xrefs: 0000000140009317
IO : %04I64x-%04I64x, xrefs: 000000014000933C
IRQ : %u, xrefs: 00000001400092FC

Memory Dump Source

Source File: 00000000.00000002.1830110169.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1830094398.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1830134247.0000000140014000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1830150505.000000014001D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1830164046.000000014001E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1830164046.0000000140024000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1830203802.0000000140031000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_0urFbKxdvL.jbxd

Similarity

API ID: Des_Res_$Get_$Data_Free_HandleNext_wprintf$Size__errno_invalid_parameter_noinfofputs
String ID: DMA : %u$IO : %04I64x-%04I64x$IRQ : %u$MEM : %08I64x-%08I64x
API String ID: 1897267696-3427375868
Opcode ID: f86508c705e05d63a160b50b61966e16536725a36a75a4889040542636781cc1
Instruction ID: ddb3a1eb6b80c44e9e95771c1fcad6983c7a0eaa5175376a50ed0be315e634a4
Opcode Fuzzy Hash: f86508c705e05d63a160b50b61966e16536725a36a75a4889040542636781cc1
Instruction Fuzzy Hash: 8D414AB1208A8082EB66DF57F544BEAB3A5F789BC4F494015BB4A4B7B5DF38C945CB00

Function 0000000140008AA0 Relevance: 21.3, APIs: 11, Strings: 1, Instructions: 256timeCOMMON

Download Yara Rule

APIs

SetupDiGetDeviceInstallParamsW.SETUPAPI ref: 0000000140008B18
SetupDiSetDeviceInstallParamsW.SETUPAPI ref: 0000000140008B3C
SetupDiBuildDriverInfoList.SETUPAPI ref: 0000000140008B52
SetupDiEnumDriverInfoW.SETUPAPI ref: 0000000140008B84
SetupDiGetDriverInfoDetailW.SETUPAPI ref: 0000000140008BF7
GetLastError.KERNEL32 ref: 0000000140008C01
FileTimeToSystemTime.KERNEL32 ref: 0000000140008CCC
GetDateFormatW.KERNEL32 ref: 0000000140008CFB

Strings

, xrefs: 0000000140008D85

Memory Dump Source

Source File: 00000000.00000002.1830110169.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1830094398.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1830134247.0000000140014000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1830150505.000000014001D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1830164046.000000014001E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1830164046.0000000140024000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1830203802.0000000140031000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_0urFbKxdvL.jbxd

Similarity

API ID: Setup$DriverInfo$DeviceInstallParamsTime$BuildDateDetailEnumErrorFileFormatLastListSystem
String ID:
API String ID: 618623176-3916222277
Opcode ID: 9cd4087c554e4eac253ba68a21dbc4d99d34ddc71f2c87828bcc5fac513abc1b
Instruction ID: ec5508ad97f21095b8260fe81413e34f856c590f93263b3ed450f44e94f4a250
Opcode Fuzzy Hash: 9cd4087c554e4eac253ba68a21dbc4d99d34ddc71f2c87828bcc5fac513abc1b
Instruction Fuzzy Hash: 8BC15BB161468086F726EB62E805BDA77A1F78CBC4F404415FB8957AEACF3DC644CB60

Function 0000000140006D30 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 260stringCOMMON

Download Yara Rule

APIs

SetupDiGetDeviceInfoListDetailW.SETUPAPI ref: 0000000140006D78
CM_Get_Device_ID_ExW.SETUPAPI ref: 0000000140006DA7
CM_Get_DevNode_Status_Ex.SETUPAPI ref: 0000000140006DCF
wprintf.LIBCMT ref: 0000000140006DEF

Part of subcall function 000000014000A6D0: _errno.LIBCMT ref: 000000014000A6F5
Part of subcall function 000000014000A6D0: _invalid_parameter_noinfo.LIBCMT ref: 000000014000A700

Part of subcall function 00000001400078C0: FormatMessageW.KERNEL32 ref: 0000000140007908
Part of subcall function 00000001400078C0: CharPrevW.USER32 ref: 0000000140007936
Part of subcall function 00000001400078C0: fputws.LIBCMT ref: 0000000140007980
Part of subcall function 00000001400078C0: LocalFree.KERNEL32 ref: 000000014000798A

lstrlenW.KERNEL32 ref: 0000000140007023
SetupDiSetDeviceRegistryPropertyW.SETUPAPI ref: 0000000140007063
wprintf.LIBCMT ref: 00000001400070E3
wprintf.LIBCMT ref: 00000001400070FC
wprintf.LIBCMT ref: 000000014000710B
wprintf.LIBCMT ref: 0000000140007124

Strings

%-60s: , xrefs: 0000000140006DE8, 00000001400070D9

Memory Dump Source

Source File: 00000000.00000002.1830110169.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1830094398.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1830134247.0000000140014000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1830150505.000000014001D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1830164046.000000014001E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1830164046.0000000140024000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1830203802.0000000140031000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_0urFbKxdvL.jbxd

Similarity

API ID: wprintf$DeviceGet_Setup$CharDetailDevice_FormatFreeInfoListLocalMessageNode_PrevPropertyRegistryStatus__errno_invalid_parameter_noinfofputwslstrlen
String ID: %-60s:
API String ID: 367777426-769737362
Opcode ID: f032e8fae677de0da69d302c5c80f20a4f91eef62ad1fc40ac2ef5aea2a327ab
Instruction ID: e9abfa25a142b5ff92d8e0d505dbabf69afb4d540efb7fde84babaf60d48a2db
Opcode Fuzzy Hash: f032e8fae677de0da69d302c5c80f20a4f91eef62ad1fc40ac2ef5aea2a327ab
Instruction Fuzzy Hash: 78B1ADB2610A8582EB62CF26F4407EAA7A5F788BD8F445224FB9A577B5DF3CC451C700

Function 0000000140008800 Relevance: 16.6, APIs: 11, Instructions: 147COMMON

Download Yara Rule

APIs

Part of subcall function 0000000140009CA0: SetupDiGetDeviceInstallParamsW.SETUPAPI ref: 0000000140009D00

SetupDiGetDriverInfoDetailW.SETUPAPI ref: 00000001400088B6
GetLastError.KERNEL32 ref: 00000001400088C0
SetupDiSetSelectedDriverW.SETUPAPI ref: 00000001400088F8
SetupOpenFileQueue.SETUPAPI ref: 0000000140008906
SetupDiGetDeviceInstallParamsW.SETUPAPI ref: 000000014000893E
SetupDiSetDeviceInstallParamsW.SETUPAPI ref: 0000000140008961
SetupDiCallClassInstaller.SETUPAPI ref: 000000014000897A
SetupScanFileQueueW.SETUPAPI ref: 00000001400089BF
SetupScanFileQueueW.SETUPAPI ref: 0000000140008A23
SetupDiDestroyDriverInfoList.SETUPAPI ref: 0000000140008A43
SetupCloseFileQueue.SETUPAPI ref: 0000000140008A52

Part of subcall function 0000000140007E70: fputs.LIBCMT ref: 0000000140007E90

Part of subcall function 00000001400078C0: FormatMessageW.KERNEL32 ref: 0000000140007908
Part of subcall function 00000001400078C0: CharPrevW.USER32 ref: 0000000140007936
Part of subcall function 00000001400078C0: fputws.LIBCMT ref: 0000000140007980
Part of subcall function 00000001400078C0: LocalFree.KERNEL32 ref: 000000014000798A

Memory Dump Source

Source File: 00000000.00000002.1830110169.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1830094398.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1830134247.0000000140014000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1830150505.000000014001D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1830164046.000000014001E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1830164046.0000000140024000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1830203802.0000000140031000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_0urFbKxdvL.jbxd

Similarity

API ID: Setup$FileQueue$DeviceDriverInstallParams$InfoScan$CallCharClassCloseDestroyDetailErrorFormatFreeInstallerLastListLocalMessageOpenPrevSelectedfputsfputws
String ID:
API String ID: 3517419612-0
Opcode ID: ac74428aa5dd5c35b4bc2e0249f9db39bb6b66f70a776efa6525b73bcb8564c1
Instruction ID: d063ca9a16e41564c09959666ef8371de515dc05b799c50b288e8d1683b31fe8
Opcode Fuzzy Hash: ac74428aa5dd5c35b4bc2e0249f9db39bb6b66f70a776efa6525b73bcb8564c1
Instruction Fuzzy Hash: 0E614CB1214A8086F722DF22E8547DA73A5FB89BD4F404626FB6907AF5DF39C609C740

Function 0000000140005C10 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 134COMMON

Download Yara Rule

Strings

, xrefs: 0000000140005D8C

Memory Dump Source

Source File: 00000000.00000002.1830110169.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1830094398.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1830134247.0000000140014000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1830150505.000000014001D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1830164046.000000014001E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1830164046.0000000140024000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1830203802.0000000140031000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_0urFbKxdvL.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: a90501a58383f8471fb478657ccf385f7d3b3128c39c7fbd9fdbb16fd87cd59c
Instruction ID: 8939e11e4d63b3d66664be8960c86d4ff965cd3e2d8b9b64c70fef0255db7796
Opcode Fuzzy Hash: a90501a58383f8471fb478657ccf385f7d3b3128c39c7fbd9fdbb16fd87cd59c
Instruction Fuzzy Hash: 28516E72304AC082EB25DF12F4047DB63A5F789BD5F944116AB8947AA8EF7DC545CB00

Function 0000000140004710 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 164COMMON

Download Yara Rule

APIs

Part of subcall function 000000014000A130: malloc.LIBCMT ref: 000000014000A14A

SetupDiBuildClassInfoListExW.SETUPAPI ref: 000000014000478C
GetLastError.KERNEL32 ref: 0000000140004796

Part of subcall function 000000014000A130: _callnewh.LIBCMT ref: 000000014000A13E
Part of subcall function 000000014000A130: _CxxThrowException.LIBCMT ref: 000000014000A193

SetupDiBuildClassInfoListExW.SETUPAPI ref: 00000001400047E8
SetupDiClassNameFromGuidExW.SETUPAPI ref: 0000000140004852
SetupDiGetClassDescriptionExW.SETUPAPI ref: 00000001400048DC
wprintf.LIBCMT ref: 000000014000495E

Strings

%-20s: %s, xrefs: 0000000140004957

Memory Dump Source

Source File: 00000000.00000002.1830110169.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1830094398.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1830134247.0000000140014000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1830150505.000000014001D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1830164046.000000014001E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1830164046.0000000140024000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1830203802.0000000140031000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_0urFbKxdvL.jbxd

Similarity

API ID: ClassSetup$BuildInfoList$DescriptionErrorExceptionFromGuidLastNameThrow_callnewhmallocwprintf
String ID: %-20s: %s
API String ID: 3398164692-1251934994
Opcode ID: d6051411c387a46dfcc46221ce026d307689f9695689710c9e8ce05c24461f66
Instruction ID: b8fcd1a316e30d656eea867874f6d3a68273eafe061fbe9abbbe1891a3b094d0
Opcode Fuzzy Hash: d6051411c387a46dfcc46221ce026d307689f9695689710c9e8ce05c24461f66
Instruction Fuzzy Hash: 62618CB232568182EB62CF12B4407DA63A0FB8DBC4F844525FB8A47BA5EF3CC505C744

Function 00000001400093D0 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 150registryCOMMON

Download Yara Rule

APIs

SetupDiGetDeviceInfoListDetailW.SETUPAPI ref: 00000001400093FF
SetupDiOpenClassRegKeyExW.SETUPAPI ref: 000000014000943F
wprintf.LIBCMT ref: 000000014000953E
RegCloseKey.ADVAPI32 ref: 00000001400095C7

Part of subcall function 0000000140007E70: fputs.LIBCMT ref: 0000000140007E90

Part of subcall function 00000001400078C0: FormatMessageW.KERNEL32 ref: 0000000140007908
Part of subcall function 00000001400078C0: CharPrevW.USER32 ref: 0000000140007936
Part of subcall function 00000001400078C0: fputws.LIBCMT ref: 0000000140007980
Part of subcall function 00000001400078C0: LocalFree.KERNEL32 ref: 000000014000798A

Part of subcall function 0000000140008620: wprintf.LIBCMT ref: 0000000140008651

Strings

LowerFilters, xrefs: 0000000140009575
%s, xrefs: 0000000140009534
UpperFilters, xrefs: 000000014000944E

Memory Dump Source

Source File: 00000000.00000002.1830110169.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1830094398.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1830134247.0000000140014000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1830150505.000000014001D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1830164046.000000014001E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1830164046.0000000140024000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1830203802.0000000140031000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_0urFbKxdvL.jbxd

Similarity

API ID: Setupwprintf$CharClassCloseDetailDeviceFormatFreeInfoListLocalMessageOpenPrevfputsfputws
String ID: %s$LowerFilters$UpperFilters
API String ID: 205352705-1836264166
Opcode ID: 0be0182f719dfb9952726e0c0785eb2e390ae01cca8e94e282cd98b64d68face
Instruction ID: 529cbf2e193ed732394b1f7d828ec3daeef0bdc298c3290cedfbf51475d62f3e
Opcode Fuzzy Hash: 0be0182f719dfb9952726e0c0785eb2e390ae01cca8e94e282cd98b64d68face
Instruction Fuzzy Hash: 9C5169B1614A8042FA17EB23F8197EA6291AB8DBC0F484125BB5D4B3E7DF7DC8418351

Function 0000000140005A90 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 81COMMON

Download Yara Rule

Strings

newdev.dll, xrefs: 0000000140005B2D
UpdateDriverForPlugAndPlayDevicesW, xrefs: 0000000140005B4E

Memory Dump Source

Source File: 00000000.00000002.1830110169.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1830094398.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1830134247.0000000140014000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1830150505.000000014001D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1830164046.000000014001E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1830164046.0000000140024000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1830203802.0000000140031000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_0urFbKxdvL.jbxd

Similarity

API ID:
String ID: UpdateDriverForPlugAndPlayDevicesW$newdev.dll
API String ID: 0-3767700378
Opcode ID: 8806c71b56bc765eddcbc7946bf0cabb6b8bc9be3bac1c222922800c6063ff69
Instruction ID: 6bd2540d958761b39ee3454196263a72dfaf786d20ea5a31e2b33f33bc23979a
Opcode Fuzzy Hash: 8806c71b56bc765eddcbc7946bf0cabb6b8bc9be3bac1c222922800c6063ff69
Instruction Fuzzy Hash: D13159B1208A8082EB62EB62F4883DA63A4F78DBC1F444126EB4947BA5DF39D4858700

Function 0000000140006BF0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 69COMMON

Download Yara Rule

APIs

SetupDiGetDeviceInfoListDetailW.SETUPAPI ref: 0000000140006C23
CM_Get_Device_ID_ExW.SETUPAPI ref: 0000000140006C4F
SetupDiSetClassInstallParamsW.SETUPAPI ref: 0000000140006C91
SetupDiCallClassInstaller.SETUPAPI ref: 0000000140006CA6
SetupDiGetDeviceInstallParamsW.SETUPAPI ref: 0000000140006CC9
wprintf.LIBCMT ref: 0000000140006D0A

Strings

%-60s: %s, xrefs: 0000000140006D03

Memory Dump Source

Source File: 00000000.00000002.1830110169.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1830094398.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1830134247.0000000140014000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1830150505.000000014001D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1830164046.000000014001E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1830164046.0000000140024000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1830203802.0000000140031000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_0urFbKxdvL.jbxd

Similarity

API ID: Setup$ClassDeviceInstallParams$CallDetailDevice_Get_InfoInstallerListwprintf
String ID: %-60s: %s
API String ID: 1061212145-3470069224
Opcode ID: 39421e0781a6c62ba2f951787ac893adc36cd0b67526da7e01083c921b7177f6
Instruction ID: 0dec86af3c577e712a98a7b3109412ecac0a40933844ac8a87a4e6dfd11fb277
Opcode Fuzzy Hash: 39421e0781a6c62ba2f951787ac893adc36cd0b67526da7e01083c921b7177f6
Instruction Fuzzy Hash: 393121B1214AC182F7618F22F8587DA77A2F789BC8F404116EF89576A8DF3DC515CB40

Function 000000014001250C Relevance: 12.1, APIs: 8, Instructions: 63COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 0000000140012525

Part of subcall function 000000014000C804: _getptd_noexit.LIBCMT ref: 000000014000C808

__lock_fhandle.LIBCMT ref: 000000014001256D
FlushFileBuffers.KERNEL32(00000001,00000000,00000000,000000014000D07E,?,?,00000001,000000014000D1A9,?,?,?,?,?,000000014000A595), ref: 0000000140012588
GetLastError.KERNEL32(?,?,00000001,000000014000D1A9,?,?,?,?,?,000000014000A595), ref: 0000000140012592
_errno.LIBCMT ref: 00000001400125A9
_unlock_fhandle.LIBCMT ref: 00000001400125B9

Memory Dump Source

Source File: 00000000.00000002.1830110169.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1830094398.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1830134247.0000000140014000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1830150505.000000014001D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1830164046.000000014001E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1830164046.0000000140024000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1830203802.0000000140031000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_0urFbKxdvL.jbxd

Similarity

API ID: _errno$BuffersErrorFileFlushLast__lock_fhandle_getptd_noexit_unlock_fhandle
String ID:
API String ID: 211752500-0
Opcode ID: aafe2b3a985552675c15153066ba911b6788134598c82b6409c44e7c12b7c723
Instruction ID: 6f9d9d2e137c53e7689b88ca5d0af2c8b064bf5e67caee8433d539d6654ada62
Opcode Fuzzy Hash: aafe2b3a985552675c15153066ba911b6788134598c82b6409c44e7c12b7c723
Instruction Fuzzy Hash: D321E771310A8045FB17AF67A4E13ED2652AB9C7E0F194118FB564F3F2DE79C8918314

Function 00000001400081E0 Relevance: 10.6, APIs: 7, Instructions: 140stringCOMMON

Download Yara Rule

APIs

CharNextW.USER32 ref: 0000000140008289
wcschr.LIBCMT ref: 000000014000829C
CharNextW.USER32 ref: 00000001400082F0
CharNextW.USER32 ref: 0000000140008331
lstrlenW.KERNEL32 ref: 0000000140008395
lstrlenW.KERNEL32 ref: 00000001400083A1

Part of subcall function 000000014000AEBC: _errno.LIBCMT ref: 000000014000AEDC
Part of subcall function 000000014000AEBC: _invalid_parameter_noinfo.LIBCMT ref: 000000014000AEE7

Memory Dump Source

Source File: 00000000.00000002.1830110169.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1830094398.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1830134247.0000000140014000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1830150505.000000014001D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1830164046.000000014001E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1830164046.0000000140024000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1830203802.0000000140031000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_0urFbKxdvL.jbxd

Similarity

API ID: CharNext$lstrlen$_errno_invalid_parameter_noinfowcschr
String ID:
API String ID: 2821222958-0
Opcode ID: bef95d78009c089aeea2a6ce3f18c19c5432a3c65cf1d8999f49be06cb53108e
Instruction ID: 32f5eaf999c97275e364a4c63c52a64c0c23b4bcc29fa5b9fc78720e62347257
Opcode Fuzzy Hash: bef95d78009c089aeea2a6ce3f18c19c5432a3c65cf1d8999f49be06cb53108e
Instruction Fuzzy Hash: 1C518DB5601A5181EE76DB63B5143FE62A0BB8DFC0F488426FF8657BA5EF38C6518310

Function 0000000140008010 Relevance: 10.6, APIs: 7, Instructions: 135COMMON

Download Yara Rule

APIs

Part of subcall function 000000014000AEBC: _errno.LIBCMT ref: 000000014000AEDC
Part of subcall function 000000014000AEBC: _invalid_parameter_noinfo.LIBCMT ref: 000000014000AEE7

CharNextW.USER32 ref: 00000001400080AD

Memory Dump Source

Source File: 00000000.00000002.1830110169.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1830094398.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1830134247.0000000140014000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1830150505.000000014001D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1830164046.000000014001E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1830164046.0000000140024000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1830203802.0000000140031000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_0urFbKxdvL.jbxd

Similarity

API ID: CharNext_errno_invalid_parameter_noinfo
String ID:
API String ID: 1929449741-0
Opcode ID: 57fd3ba7d0dc3bba04662302b7b662dfb0eaba2940cf9eae605d080abce027b2
Instruction ID: e5514d4ebe63c75b25eea472a4b9a7b07c126955c5f8705adc0d784fca488e60
Opcode Fuzzy Hash: 57fd3ba7d0dc3bba04662302b7b662dfb0eaba2940cf9eae605d080abce027b2
Instruction Fuzzy Hash: 094180B571565181EB66DB27B9103FA62A4FB4DBC0F484025FF8A57BE5EF38C4A28310

Function 0000000140013A9C Relevance: 10.6, APIs: 7, Instructions: 67COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 0000000140013AC7

Part of subcall function 000000014000C804: _getptd_noexit.LIBCMT ref: 000000014000C808

__lock_fhandle.LIBCMT ref: 0000000140013B0B
_lseeki64_nolock.LIBCMT ref: 0000000140013B24
_unlock_fhandle.LIBCMT ref: 0000000140013B47

Part of subcall function 000000014000C794: _getptd_noexit.LIBCMT ref: 000000014000C798

Memory Dump Source

Source File: 00000000.00000002.1830110169.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1830094398.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1830134247.0000000140014000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1830150505.000000014001D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1830164046.000000014001E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1830164046.0000000140024000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1830203802.0000000140031000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_0urFbKxdvL.jbxd

Similarity

API ID: _getptd_noexit$__lock_fhandle_errno_lseeki64_nolock_unlock_fhandle
String ID:
API String ID: 75911684-0
Opcode ID: 1715129e0919a1850b4a4de5b21ed77b4c1e29a5ba07b43396ca8edd0cf17bed
Instruction ID: b10b0c6338cf677d8ed1d5406abb4dfef6a591b96a03ab56529a241025bd8f4e
Opcode Fuzzy Hash: 1715129e0919a1850b4a4de5b21ed77b4c1e29a5ba07b43396ca8edd0cf17bed
Instruction Fuzzy Hash: C721F3B261558045FA07AF27A8827ED6650AB88BF1F594718FF790F3F2DB398441C714

Function 0000000140009810 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 66COMMON

Download Yara Rule

APIs

SetupDiGetDeviceInfoListDetailW.SETUPAPI ref: 0000000140009849
CM_Get_Device_ID_ExW.SETUPAPI ref: 0000000140009873
wprintf.LIBCMT ref: 00000001400098E8
wprintf.LIBCMT ref: 00000001400098F6

Strings

%s, xrefs: 00000001400098EF
%-60s: %s, xrefs: 00000001400098DE

Memory Dump Source

Source File: 00000000.00000002.1830110169.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1830094398.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1830134247.0000000140014000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1830150505.000000014001D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1830164046.000000014001E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1830164046.0000000140024000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1830203802.0000000140031000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_0urFbKxdvL.jbxd

Similarity

API ID: wprintf$DetailDeviceDevice_Get_InfoListSetup
String ID: %-60s: %s$%s
API String ID: 500149863-1339393084
Opcode ID: 58420ff71981e70f0b088cf18948d52def29ba61bff1789f6497cbc26443b0c8
Instruction ID: d815fc9da303b41ef93b9c6d4678b871f195b329186b52154e75255d3b88d213
Opcode Fuzzy Hash: 58420ff71981e70f0b088cf18948d52def29ba61bff1789f6497cbc26443b0c8
Instruction Fuzzy Hash: F22171B171868581FB62DF16F4947EA63A0FB8ABC4F448125EB4D0B7A4DF39C505C700

Function 0000000140005E60 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 66libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32 ref: 0000000140005E87
GetProcAddress.KERNEL32 ref: 0000000140005EC4
FreeLibrary.KERNEL32 ref: 0000000140005ED5

Strings

setupapi.dll, xrefs: 0000000140005E77
SetupSetNonInteractiveMode, xrefs: 0000000140005EB5

Memory Dump Source

Source File: 00000000.00000002.1830110169.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1830094398.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1830134247.0000000140014000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1830150505.000000014001D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1830164046.000000014001E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1830164046.0000000140024000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1830203802.0000000140031000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_0urFbKxdvL.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: SetupSetNonInteractiveMode$setupapi.dll
API String ID: 145871493-1268865691
Opcode ID: 94f97624f5dac09af30f832d77a35dc926adfb2c0542bc15ea753e67248f1de5
Instruction ID: 84aa0ad4c05f19595f6f0cb0327785312e08ad5f4029f5bf74cd787ca5e35ae0
Opcode Fuzzy Hash: 94f97624f5dac09af30f832d77a35dc926adfb2c0542bc15ea753e67248f1de5
Instruction Fuzzy Hash: 63213976708B9082EB12AF57B8447AAA390B78EFD4F440525BF8917B34DF3CC1418B04

Function 0000000140013700 Relevance: 10.6, APIs: 7, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 0000000140013721

Part of subcall function 000000014000C804: _getptd_noexit.LIBCMT ref: 000000014000C808

__lock_fhandle.LIBCMT ref: 0000000140013765
_close_nolock.LIBCMT ref: 0000000140013778
_unlock_fhandle.LIBCMT ref: 0000000140013791

Part of subcall function 000000014000C794: _getptd_noexit.LIBCMT ref: 000000014000C798

Memory Dump Source

Source File: 00000000.00000002.1830110169.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1830094398.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1830134247.0000000140014000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1830150505.000000014001D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1830164046.000000014001E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1830164046.0000000140024000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1830203802.0000000140031000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_0urFbKxdvL.jbxd

Similarity

API ID: _getptd_noexit$__lock_fhandle_close_nolock_errno_unlock_fhandle
String ID:
API String ID: 1789918242-0
Opcode ID: cd0c5e2885a051529e2b8990a08f8e249855bcd391e8febec261e9a7fea12117
Instruction ID: 527fc7903de6d94cafebed338d17db3d73ae6ebbf5563fcfae0adc79fb118e46
Opcode Fuzzy Hash: cd0c5e2885a051529e2b8990a08f8e249855bcd391e8febec261e9a7fea12117
Instruction Fuzzy Hash: 641104F261928045F627EF27A8853EC6650A7887F1F654628FB5A0F3F7CA79C8418710

Function 0000000140009080 Relevance: 9.1, APIs: 6, Instructions: 90COMMON

Download Yara Rule

APIs

SetupDiGetDeviceInfoListDetailW.SETUPAPI ref: 00000001400090BA
CM_Get_DevNode_Status_Ex.SETUPAPI ref: 00000001400090E3
CM_Get_First_Log_Conf_Ex.SETUPAPI ref: 0000000140009114
CM_Get_First_Log_Conf_Ex.SETUPAPI ref: 0000000140009135
CM_Get_First_Log_Conf_Ex.SETUPAPI ref: 0000000140009163
CM_Free_Log_Conf_Handle.SETUPAPI ref: 00000001400091FE

Memory Dump Source

Source File: 00000000.00000002.1830110169.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1830094398.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1830134247.0000000140014000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1830150505.000000014001D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1830164046.000000014001E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1830164046.0000000140024000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1830203802.0000000140031000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_0urFbKxdvL.jbxd

Similarity

API ID: Conf_Get_Log_$First_$DetailDeviceFree_HandleInfoListNode_SetupStatus_
String ID:
API String ID: 950201049-0
Opcode ID: a2e0bd01e5d5aa480d3cc991309868edf8cbe1ceb55d54a243f334fb4bcb990a
Instruction ID: 6af4d3e925e2d7f0f9bc8d1bcdc9ddc98766f1539d03e36d6a6539f7e7af98da
Opcode Fuzzy Hash: a2e0bd01e5d5aa480d3cc991309868edf8cbe1ceb55d54a243f334fb4bcb990a
Instruction Fuzzy Hash: 03415B7232468286EB91DF62F4847DA73A0F788BC4F405015FB8A47AA9DF3CD459CB50

Function 00000001400125E4 Relevance: 9.1, APIs: 6, Instructions: 67COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 000000014001260F

Part of subcall function 000000014000C804: _getptd_noexit.LIBCMT ref: 000000014000C808

__lock_fhandle.LIBCMT ref: 0000000140012653
_unlock_fhandle.LIBCMT ref: 000000014001268D

Part of subcall function 000000014000C794: _getptd_noexit.LIBCMT ref: 000000014000C798

Memory Dump Source

Source File: 00000000.00000002.1830110169.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1830094398.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1830134247.0000000140014000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1830150505.000000014001D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1830164046.000000014001E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1830164046.0000000140024000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1830203802.0000000140031000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_0urFbKxdvL.jbxd

Similarity

API ID: _getptd_noexit$__lock_fhandle_errno_unlock_fhandle
String ID:
API String ID: 1756211493-0
Opcode ID: f21935d3972bad399e818c089660db3031781d0e2c4ccb26f942fd882b222533
Instruction ID: 647ed5fa019ca88172cc81a66e8da66ecb732046a6aefd4dead0957879e25fe8
Opcode Fuzzy Hash: f21935d3972bad399e818c089660db3031781d0e2c4ccb26f942fd882b222533
Instruction Fuzzy Hash: BD21E4727206804AFB07AF67A8417ED7A50AB88BE1F594514FB190F3F2CF798891CB10

Function 000000014000AEBC Relevance: 7.6, APIs: 5, Instructions: 122COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 000000014000AEE7
_errno.LIBCMT ref: 000000014000AEDC

Part of subcall function 000000014000C804: _getptd_noexit.LIBCMT ref: 000000014000C808

_errno.LIBCMT ref: 000000014000AF8A
_invalid_parameter_noinfo.LIBCMT ref: 000000014000AF95

Memory Dump Source

Source File: 00000000.00000002.1830110169.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1830094398.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1830134247.0000000140014000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1830150505.000000014001D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1830164046.000000014001E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1830164046.0000000140024000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1830203802.0000000140031000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_0urFbKxdvL.jbxd

Similarity

API ID: _errno_invalid_parameter_noinfo$_getptd_noexit
String ID:
API String ID: 1573762532-0
Opcode ID: e92b10341d8fdd7dfca5fe718ddef3a7398a5a471f3b54b454817d12f8827c49
Instruction ID: 6609a30aa4cf3393d92ddf3bb2956f3420ba20a1f9d389a3212d390fe0e2dc09
Opcode Fuzzy Hash: e92b10341d8fdd7dfca5fe718ddef3a7398a5a471f3b54b454817d12f8827c49
Instruction Fuzzy Hash: FC4125F2A1129686FF66EB23B1403FA72E0E759BD4F944126FB99476E5D73CC9818300

Function 000000014000A288 Relevance: 7.6, APIs: 5, Instructions: 107COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 000000014000A2AE
_errno.LIBCMT ref: 000000014000A2A3

Part of subcall function 000000014000C804: _getptd_noexit.LIBCMT ref: 000000014000C808

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 000000014000A32D
_errno.LIBCMT ref: 000000014000A33E
_invalid_parameter_noinfo.LIBCMT ref: 000000014000A349

Memory Dump Source

Source File: 00000000.00000002.1830110169.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1830094398.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1830134247.0000000140014000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1830150505.000000014001D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1830164046.000000014001E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1830164046.0000000140024000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1830203802.0000000140031000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_0urFbKxdvL.jbxd

Similarity

API ID: Locale_errno_invalid_parameter_noinfo$UpdateUpdate::__getptd_noexit
String ID:
API String ID: 781512312-0
Opcode ID: 97ceef5abbfc478cb36941b4f4966c8d6de80c2938c1c831e00e3e21b6c0c3dd
Instruction ID: 8fac1346d1b894dbe6228735086dc04d5ee8932f7cf276c59b5d6265866b3863
Opcode Fuzzy Hash: 97ceef5abbfc478cb36941b4f4966c8d6de80c2938c1c831e00e3e21b6c0c3dd
Instruction Fuzzy Hash: 1E41FEF2A142A082EB66EB17A5503FD33E0E759BE4F948126BB94076E4DB3CCA51C700

Function 0000000140012FD0 Relevance: 7.6, APIs: 5, Instructions: 93COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 0000000140013032
_isleadbyte_l.LIBCMT ref: 0000000140013062
MultiByteToWideChar.KERNEL32(?,?,?,?,?,?,?,?,00000000,000000014000DE32), ref: 00000001400130A1
MultiByteToWideChar.KERNEL32(?,?,?,?,?,?,?,?,00000000,000000014000DE32), ref: 00000001400130EF
_errno.LIBCMT ref: 00000001400130F9

Memory Dump Source

Source File: 00000000.00000002.1830110169.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1830094398.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1830134247.0000000140014000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1830150505.000000014001D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1830164046.000000014001E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1830164046.0000000140024000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1830203802.0000000140031000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_0urFbKxdvL.jbxd

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::__errno_isleadbyte_l
String ID:
API String ID: 2998201375-0
Opcode ID: 741d118cd70e220190e4bb691a5021469b15d54b4cde05510503b4749c4145a7
Instruction ID: be0636770cc254fb24b2b61a7092ef18000d969c6bf9c0bb47e9775d6fb6f0d8
Opcode Fuzzy Hash: 741d118cd70e220190e4bb691a5021469b15d54b4cde05510503b4749c4145a7
Instruction Fuzzy Hash: EA41937221478086E7628F16E5507A9BBE5F78DBC4F184125FBC95BBB5CB3AC4818700

Function 0000000140006720 Relevance: 7.6, APIs: 5, Instructions: 83COMMON

Download Yara Rule

APIs

SetupDiSetClassInstallParamsW.SETUPAPI ref: 0000000140006785
SetupDiCallClassInstaller.SETUPAPI ref: 000000014000679A
SetupDiSetClassInstallParamsW.SETUPAPI ref: 00000001400067D1
SetupDiCallClassInstaller.SETUPAPI ref: 00000001400067E6
SetupDiGetDeviceInstallParamsW.SETUPAPI ref: 0000000140006803

Part of subcall function 0000000140009810: SetupDiGetDeviceInfoListDetailW.SETUPAPI ref: 0000000140009849
Part of subcall function 0000000140009810: CM_Get_Device_ID_ExW.SETUPAPI ref: 0000000140009873
Part of subcall function 0000000140009810: wprintf.LIBCMT ref: 00000001400098E8

Memory Dump Source

Source File: 00000000.00000002.1830110169.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1830094398.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1830134247.0000000140014000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1830150505.000000014001D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1830164046.000000014001E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1830164046.0000000140024000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1830203802.0000000140031000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_0urFbKxdvL.jbxd

Similarity

API ID: Setup$Class$InstallParams$CallDeviceInstaller$DetailDevice_Get_InfoListwprintf
String ID:
API String ID: 1966150667-0
Opcode ID: 9e948d31ab438f15699dcec5241440013ac89f9c856d05fa3685d17348867dfd
Instruction ID: e77259fa737ca3a44b1553b610878a15bf1f23e6ef38c20c59c9e02be9d66c37
Opcode Fuzzy Hash: 9e948d31ab438f15699dcec5241440013ac89f9c856d05fa3685d17348867dfd
Instruction Fuzzy Hash: 28311CB120468486F725CF62F9483EAB6A5F789FC8F40811AAF495BBA5CF3CC505CB00

Function 0000000140007D40 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 85registryCOMMON

Download Yara Rule

APIs

Part of subcall function 000000014000A130: malloc.LIBCMT ref: 000000014000A14A

RegQueryValueExW.ADVAPI32 ref: 0000000140007DB3
GetLastError.KERNEL32 ref: 0000000140007DC0
RegQueryValueExW.ADVAPI32 ref: 0000000140007E22

Strings

LowerFilters, xrefs: 0000000140007D46

Memory Dump Source

Source File: 00000000.00000002.1830110169.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1830094398.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1830134247.0000000140014000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1830150505.000000014001D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1830164046.000000014001E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1830164046.0000000140024000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1830203802.0000000140031000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_0urFbKxdvL.jbxd

Similarity

API ID: QueryValue$ErrorLastmalloc
String ID: LowerFilters
API String ID: 1675453543-1260524392
Opcode ID: b646b932c804e92da479334267234a5eade005bc3186fd2fd4d52ffbfb171c98
Instruction ID: b148fc0544ec94f13facd909defaf699cef75644d0b323d5e7628174600a6393
Opcode Fuzzy Hash: b646b932c804e92da479334267234a5eade005bc3186fd2fd4d52ffbfb171c98
Instruction Fuzzy Hash: B1318F72205A8082EA11DB12F9107AAA391FB8DBE0F440124FB9C47BF5EF3CD4428700

Function 000000014000A130 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47COMMON

Download Yara Rule

APIs

_callnewh.LIBCMT ref: 000000014000A13E
malloc.LIBCMT ref: 000000014000A14A

Part of subcall function 000000014000A43C: _FF_MSGBANNER.LIBCMT ref: 000000014000A46C
Part of subcall function 000000014000A43C: _NMSG_WRITE.LIBCMT ref: 000000014000A476
Part of subcall function 000000014000A43C: HeapAlloc.KERNEL32(?,?,00000000,000000014000D4AC,?,?,?,000000014000D320,?,?,?,000000014000D21F), ref: 000000014000A491
Part of subcall function 000000014000A43C: _callnewh.LIBCMT ref: 000000014000A4AA
Part of subcall function 000000014000A43C: _errno.LIBCMT ref: 000000014000A4B5
Part of subcall function 000000014000A43C: _errno.LIBCMT ref: 000000014000A4C0

_CxxThrowException.LIBCMT ref: 000000014000A193

Part of subcall function 000000014000B4EC: RtlPcToFileHeader.KERNEL32(?,?,BFFFFC18,000000014000A198), ref: 000000014000B57B
Part of subcall function 000000014000B4EC: RaiseException.KERNEL32(?,?,BFFFFC18,000000014000A198), ref: 000000014000B5BA

Strings

bad allocation, xrefs: 000000014000A15A

Memory Dump Source

Source File: 00000000.00000002.1830110169.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1830094398.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1830134247.0000000140014000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1830150505.000000014001D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1830164046.000000014001E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1830164046.0000000140024000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1830203802.0000000140031000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_0urFbKxdvL.jbxd

Similarity

API ID: Exception_callnewh_errno$AllocFileHeaderHeapRaiseThrowmalloc
String ID: bad allocation
API String ID: 1214304046-2104205924
Opcode ID: fddd8a609d162bc89f9e8555dba05befc6ca794d4df5c22690dcb180c715d3fa
Instruction ID: 00394f6e29a52a294704bd01fcc06cfe4e28e17ddc6fc69541490e775216bdc4
Opcode Fuzzy Hash: fddd8a609d162bc89f9e8555dba05befc6ca794d4df5c22690dcb180c715d3fa
Instruction Fuzzy Hash: 59016DB1705B4A80EE26DB57F4413E963A4EB8D3C4F584020BB4D0BBB6EE7CC2558B00

Function 00000001400078C0 Relevance: 6.1, APIs: 4, Instructions: 64windowCOMMON

Download Yara Rule

APIs

FormatMessageW.KERNEL32 ref: 0000000140007908
CharPrevW.USER32 ref: 0000000140007936
fputws.LIBCMT ref: 0000000140007980
LocalFree.KERNEL32 ref: 000000014000798A

Memory Dump Source

Source File: 00000000.00000002.1830110169.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1830094398.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1830134247.0000000140014000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1830150505.000000014001D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1830164046.000000014001E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1830164046.0000000140024000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1830203802.0000000140031000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_0urFbKxdvL.jbxd

Similarity

API ID: CharFormatFreeLocalMessagePrevfputws
String ID:
API String ID: 578739846-0
Opcode ID: dd6f502a9c501a50b8c5893e1ccc19445fd9336d712e31972eb5573a7e85d718
Instruction ID: 0317abda768b4f82498e3985b6f84318e84164464ede2f8f6a7c7405a7638442
Opcode Fuzzy Hash: dd6f502a9c501a50b8c5893e1ccc19445fd9336d712e31972eb5573a7e85d718
Instruction Fuzzy Hash: CA215772714B4082E712CF1AE4947ADB3A5FB99B80F654229EB9D47774EF3AC851C700

Function 00000001400060E0 Relevance: 6.0, APIs: 4, Instructions: 50COMMON

Download Yara Rule

APIs

CM_Connect_MachineW.SETUPAPI ref: 0000000140006107
CM_Locate_DevNode_ExW.SETUPAPI ref: 0000000140006120
CM_Reenumerate_DevNode_Ex.SETUPAPI ref: 0000000140006156
CM_Disconnect_Machine.SETUPAPI ref: 0000000140006184

Memory Dump Source

Source File: 00000000.00000002.1830110169.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1830094398.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1830134247.0000000140014000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1830150505.000000014001D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1830164046.000000014001E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1830164046.0000000140024000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1830203802.0000000140031000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_0urFbKxdvL.jbxd

Similarity

API ID: MachineNode_$Connect_Disconnect_Locate_Reenumerate_
String ID:
API String ID: 218754429-0
Opcode ID: 103f8b5516ebc72930eefc0d42e045731fdfda955b2280b4edec869cd7c41709
Instruction ID: a978d63058804bec8c228a9804c1d47a874a525bd408d6d7e3fa542ccfbe5fae
Opcode Fuzzy Hash: 103f8b5516ebc72930eefc0d42e045731fdfda955b2280b4edec869cd7c41709
Instruction Fuzzy Hash: 50114C71614A4182EB15DB62F84079AA3B1FB98BC8F458521FB8857A79DF38C5018B00

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 0urFbKxdvL.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Spreading

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Authenticode Signature

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Statistics

CPU Usage

Memory Usage

System Behavior

Analysis Process: 0urFbKxdvL.exePID: 6868, Parent PID: 2580

General

Chronological Activities

Disassembly

Analysis Process: 0urFbKxdvL.exePID: 6868, Parent PID: 2580COMMON

Execution Graph

Graph

Executed Functions

Function 001E2917 Relevance: 45.5, APIs: 1, Strings: 25, Instructions: 49COMMON

Control-flow Graph

Windows Analysis Report
0urFbKxdvL.exe

Function 001E2917 Relevance: 45.5, APIs: 1, Strings: 25, Instructions: 49
COMMON

Function 001E8517 Relevance: 85.8, APIs: 2, Strings: 47, Instructions: 100
memoryCOMMON

Function 001E86B7 Relevance: 84.1, APIs: 2, Strings: 46, Instructions: 101
memoryCOMMON

Function 001E2467 Relevance: 31.6, APIs: 1, Strings: 17, Instructions: 73
COMMON

Function 001E0E57 Relevance: 1.6, APIs: 1, Instructions: 54
libraryCOMMON

Function 00000001400012B0 Relevance: 1.4, APIs: 1, Instructions: 160
memoryCOMMON

Function 0000000140003320 Relevance: 1.3, APIs: 1, Instructions: 67
memoryCOMMON

Function 00000001400010B0 Relevance: 1.3, APIs: 1, Instructions: 64
memoryCOMMON

Function 00000001400035ED Relevance: 1.3, APIs: 1, Instructions: 12
memoryCOMMON

Function 001E6947 Relevance: 299.8, Strings: 239, Instructions: 1050
COMMON

Function 001E0000 Relevance: 259.4, APIs: 1, Strings: 147, Instructions: 405
COMMON