Edit tour

Windows Analysis Report
jlK7Q70gbN.exe

Overview

General Information

Sample name:	jlK7Q70gbN.exe renamed because original name is a hash value
Original sample name:	39e87c245f3df670592eac79160e0de43421742c0e0ab1cfb1452790f07747c9.exe
Analysis ID:	1528470
MD5:	fa7b382660c277341e573e54ea81ac1f
SHA1:	b84161e5c80dadd9efd6a8307e5d6cdd607b8bc8
SHA256:	39e87c245f3df670592eac79160e0de43421742c0e0ab1cfb1452790f07747c9
Infos:

Detection

Score:	8
Range:	0 - 100
Whitelisted:	false
Confidence:	20%

Signatures

Allocates memory with a write watch (potentially for evading sandboxes)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Drops PE files

Drops PE files to the windows directory (C:\Windows)

Found dropped PE file which has not been started or loaded

Found evaded block containing many API calls

Found evasive API chain checking for process token information

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

May sleep (evasive loops) to hinder dynamic analysis

PE file contains sections with non-standard names

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Uses the system / local time for branch decision (may execute only at specific dates)

Classification

Process Tree

System is w10x64

jlK7Q70gbN.exe (PID: 6972 cmdline: "C:\Users\user\Desktop\jlK7Q70gbN.exe" MD5: FA7B382660C277341E573E54EA81AC1F)

jlK7Q70gbN.exe (PID: 6180 cmdline: "C:\Windows\Temp\{562041EC-09A3-44AA-87AE-CC1700EABB21}\.cr\jlK7Q70gbN.exe" -burn.clean.room="C:\Users\user\Desktop\jlK7Q70gbN.exe" -burn.filehandle.attached=528 -burn.filehandle.self=540 MD5: F51103F1E13618AE83B88837789FE62C)

EMA3D.exe (PID: 4564 cmdline: "C:\Windows\Temp\{FFE22A89-11FD-4A47-9FF0-982DA2A5AD2F}\.be\EMA3D.exe" -q -burn.elevated BurnPipe.{01823A2F-6092-4017-B70C-7D2B2DE988B6} {636B081A-FA87-43E7-BB2F-5B923C0323C7} 6180 MD5: F51103F1E13618AE83B88837789FE62C)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: C:\Users\user\Desktop\jlK7Q70gbN.exe	Code function: 0_2_006E9FA4 DecryptFileW,	0_2_006E9FA4
Source: C:\Users\user\Desktop\jlK7Q70gbN.exe	Code function: 0_2_006E9D87 DecryptFileW,DecryptFileW,	0_2_006E9D87
Source: C:\Users\user\Desktop\jlK7Q70gbN.exe	Code function: 0_2_0070FD8F CryptAcquireContextW,GetLastError,CryptCreateHash,GetLastError,CryptHashData,ReadFile,GetLastError,CryptDestroyHash,CryptReleaseContext,GetLastError,CryptGetHashParam,GetLastError,SetFilePointerEx,GetLastError,	0_2_0070FD8F
Source: C:\Windows\Temp\{FFE22A89-11FD-4A47-9FF0-982DA2A5AD2F}\.be\EMA3D.exe	Code function: 3_2_00A29D87 DecryptFileW,DecryptFileW,	3_2_00A29D87
Source: C:\Windows\Temp\{FFE22A89-11FD-4A47-9FF0-982DA2A5AD2F}\.be\EMA3D.exe	Code function: 3_2_00A4FD8F CryptAcquireContextW,GetLastError,CryptCreateHash,GetLastError,CryptHashData,ReadFile,GetLastError,CryptDestroyHash,CryptReleaseContext,GetLastError,CryptGetHashParam,GetLastError,SetFilePointerEx,GetLastError,	3_2_00A4FD8F
Source: C:\Windows\Temp\{FFE22A89-11FD-4A47-9FF0-982DA2A5AD2F}\.be\EMA3D.exe	Code function: 3_2_00A29FA4 DecryptFileW,	3_2_00A29FA4

Source: jlK7Q70gbN.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE, REMOVABLE_RUN_FROM_SWAP, NET_RUN_FROM_SWAP

Source: jlK7Q70gbN.exe

Static PE information: certificate valid

Source: jlK7Q70gbN.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: C:\agent\_work\79\s\build\obj\ship\x86\WindowsInstaller\Microsoft.Deployment.WindowsInstaller.pdb source: Microsoft.Deployment.WindowsInstaller.dll.2.dr
Source:	Binary string: C:\agent\_work\79\s\build\ship\x86\burn.pdb/ source: jlK7Q70gbN.exe, EMA3D.exe.2.dr, jlK7Q70gbN.exe.0.dr
Source:	Binary string: C:\agent\_work\79\s\build\obj\ship\x86\core\BootstrapperCore.pdb source: BootstrapperCore.dll.2.dr
Source:	Binary string: C:\agent\_work\79\s\build\ship\x86\mbahost.pdb source: mbahost.dll.2.dr
Source:	Binary string: ./Installer/UI/obj/Release/ema3d.UI.Boot.pdb8 source: ema3d.UI.Boot.dll.2.dr
Source:	Binary string: C:\agent\_work\79\s\build\obj\ship\x86\WindowsInstaller\Microsoft.Deployment.WindowsInstaller.pdbP source: Microsoft.Deployment.WindowsInstaller.dll.2.dr
Source:	Binary string: C:\agent\_work\79\s\build\ship\x86\WixStdBA.pdb source: mbapreq.dll.2.dr
Source:	Binary string: ./Installer/UI/obj/Release/ema3d.UI.Boot.pdb source: ema3d.UI.Boot.dll.2.dr
Source:	Binary string: C:\agent\_work\79\s\build\ship\x86\burn.pdb source: jlK7Q70gbN.exe, EMA3D.exe.2.dr, jlK7Q70gbN.exe.0.dr

Source: C:\Users\user\Desktop\jlK7Q70gbN.exe	Code function: 0_2_007146C4 FindFirstFileW,FindClose,	0_2_007146C4
Source: C:\Users\user\Desktop\jlK7Q70gbN.exe	Code function: 0_2_00707767 FindFirstFileExW,	0_2_00707767
Source: C:\Users\user\Desktop\jlK7Q70gbN.exe	Code function: 0_2_006E9A30 FindFirstFileW,lstrlenW,FindNextFileW,FindClose,	0_2_006E9A30
Source: C:\Users\user\Desktop\jlK7Q70gbN.exe	Code function: 0_2_006D3D4E GetFileAttributesW,GetLastError,GetLastError,SetFileAttributesW,GetLastError,GetTempPathW,GetLastError,FindFirstFileW,GetLastError,SetFileAttributesW,DeleteFileW,GetTempFileNameW,MoveFileExW,MoveFileExW,MoveFileExW,FindNextFileW,GetLastError,GetLastError,GetLastError,GetLastError,RemoveDirectoryW,GetLastError,MoveFileExW,GetLastError,FindClose,	0_2_006D3D4E
Source: C:\Windows\Temp\{FFE22A89-11FD-4A47-9FF0-982DA2A5AD2F}\.be\EMA3D.exe	Code function: 3_2_00A546C4 FindFirstFileW,FindClose,	3_2_00A546C4
Source: C:\Windows\Temp\{FFE22A89-11FD-4A47-9FF0-982DA2A5AD2F}\.be\EMA3D.exe	Code function: 3_2_00A47767 FindFirstFileExW,	3_2_00A47767
Source: C:\Windows\Temp\{FFE22A89-11FD-4A47-9FF0-982DA2A5AD2F}\.be\EMA3D.exe	Code function: 3_2_00A29A30 FindFirstFileW,lstrlenW,FindNextFileW,FindClose,	3_2_00A29A30
Source: C:\Windows\Temp\{FFE22A89-11FD-4A47-9FF0-982DA2A5AD2F}\.be\EMA3D.exe	Code function: 3_2_00A13D4E GetFileAttributesW,GetLastError,GetLastError,SetFileAttributesW,GetLastError,GetTempPathW,GetLastError,FindFirstFileW,GetLastError,SetFileAttributesW,DeleteFileW,GetTempFileNameW,MoveFileExW,MoveFileExW,MoveFileExW,FindNextFileW,GetLastError,GetLastError,GetLastError,GetLastError,RemoveDirectoryW,GetLastError,MoveFileExW,GetLastError,FindClose,	3_2_00A13D4E

Source: jlK7Q70gbN.exe, EMA3D.exe	String found in binary or memory: http://appsyndication.org/2006/appsyn
Source: jlK7Q70gbN.exe, EMA3D.exe.2.dr, jlK7Q70gbN.exe.0.dr	String found in binary or memory: http://appsyndication.org/2006/appsynapplicationc:
Source: BootstrapperCore.dll.2.dr, mbahost.dll.2.dr, Microsoft.Deployment.WindowsInstaller.dll.2.dr, mbapreq.dll.2.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: BootstrapperCore.dll.2.dr, mbahost.dll.2.dr, Microsoft.Deployment.WindowsInstaller.dll.2.dr, mbapreq.dll.2.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
Source: BootstrapperCore.dll.2.dr, mbahost.dll.2.dr, Microsoft.Deployment.WindowsInstaller.dll.2.dr, mbapreq.dll.2.dr	String found in binary or memory: http://cacerts.digicert.com/NETFoundationProjectsCodeSigningCA.crt0
Source: jlK7Q70gbN.exe, EMA3D.exe.2.dr, jlK7Q70gbN.exe.0.dr, ema3d.UI.Boot.dll.2.dr	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl04
Source: jlK7Q70gbN.exe, EMA3D.exe.2.dr, jlK7Q70gbN.exe.0.dr, ema3d.UI.Boot.dll.2.dr	String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningCAR36.crl0y
Source: jlK7Q70gbN.exe, EMA3D.exe.2.dr, jlK7Q70gbN.exe.0.dr, ema3d.UI.Boot.dll.2.dr	String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0
Source: jlK7Q70gbN.exe, EMA3D.exe.2.dr, jlK7Q70gbN.exe.0.dr, ema3d.UI.Boot.dll.2.dr	String found in binary or memory: http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t
Source: BootstrapperCore.dll.2.dr, mbahost.dll.2.dr, Microsoft.Deployment.WindowsInstaller.dll.2.dr, mbapreq.dll.2.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
Source: BootstrapperCore.dll.2.dr, mbahost.dll.2.dr, Microsoft.Deployment.WindowsInstaller.dll.2.dr, mbapreq.dll.2.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertHighAssuranceEVRootCA.crl0=
Source: BootstrapperCore.dll.2.dr, mbahost.dll.2.dr, Microsoft.Deployment.WindowsInstaller.dll.2.dr, mbapreq.dll.2.dr	String found in binary or memory: http://crl3.digicert.com/NETFoundationProjectsCodeSigningCA.crl0E
Source: BootstrapperCore.dll.2.dr, mbahost.dll.2.dr, Microsoft.Deployment.WindowsInstaller.dll.2.dr, mbapreq.dll.2.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
Source: BootstrapperCore.dll.2.dr, mbahost.dll.2.dr, Microsoft.Deployment.WindowsInstaller.dll.2.dr, mbapreq.dll.2.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: BootstrapperCore.dll.2.dr, mbahost.dll.2.dr, Microsoft.Deployment.WindowsInstaller.dll.2.dr, mbapreq.dll.2.dr	String found in binary or memory: http://crl4.digicert.com/NETFoundationProjectsCodeSigningCA.crl0L
Source: BootstrapperCore.dll.2.dr, mbahost.dll.2.dr, Microsoft.Deployment.WindowsInstaller.dll.2.dr, mbapreq.dll.2.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
Source: jlK7Q70gbN.exe, EMA3D.exe.2.dr, jlK7Q70gbN.exe.0.dr, ema3d.UI.Boot.dll.2.dr	String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningCAR36.crt0#
Source: jlK7Q70gbN.exe, EMA3D.exe.2.dr, jlK7Q70gbN.exe.0.dr, ema3d.UI.Boot.dll.2.dr	String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#
Source: jlK7Q70gbN.exe, EMA3D.exe.2.dr, jlK7Q70gbN.exe.0.dr, ema3d.UI.Boot.dll.2.dr	String found in binary or memory: http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#
Source: jlK7Q70gbN.exe, 00000000.00000003.2042647450.0000000002E0A000.00000004.00000800.00020000.00000000.sdmp, jlK7Q70gbN.exe, 00000000.00000003.2043591191.0000000002E3B000.00000004.00000800.00020000.00000000.sdmp, jlK7Q70gbN.exe, 00000000.00000003.2042973845.0000000002E1A000.00000004.00000800.00020000.00000000.sdmp, jlK7Q70gbN.exe, 00000000.00000003.2043286088.0000000002E2B000.00000004.00000800.00020000.00000000.sdmp, jlK7Q70gbN.exe, 00000000.00000003.2042310528.0000000002DEB000.00000004.00000800.00020000.00000000.sdmp, jlK7Q70gbN.exe, 00000000.00000002.3297850430.0000000000C3A000.00000004.00000020.00020000.00000000.sdmp, jlK7Q70gbN.exe, 00000000.00000003.2044058097.0000000002E4D000.00000004.00000800.00020000.00000000.sdmp, jlK7Q70gbN.exe, 00000000.00000003.2042377711.0000000002DFC000.00000004.00000800.00020000.00000000.sdmp, jlK7Q70gbN.exe, 00000000.00000003.2044698951.0000000000C3E000.00000004.00000020.00020000.00000000.sdmp, jlK7Q70gbN.exe, 00000000.00000003.2044580204.0000000002E60000.00000004.00000800.00020000.00000000.sdmp, jlK7Q70gbN.exe, 00000000.00000003.2041684832.0000000000C3E000.00000004.00000020.00020000.00000000.sdmp, jlK7Q70gbN.exe, 00000000.00000002.3299565162.0000000002E61000.00000004.00000800.00020000.00000000.sdmp, jlK7Q70gbN.exe, 00000000.00000003.2045538277.0000000000C3A000.00000004.00000020.00020000.00000000.sdmp, jlK7Q70gbN.exe, 00000002.00000003.2048888766.000000000376B000.00000004.00000800.00020000.00000000.sdmp, jlK7Q70gbN.exe, 00000002.00000003.2046899780.000000000371B000.00000004.00000800.00020000.00000000.sdmp, jlK7Q70gbN.exe, 00000002.00000003.2047556826.000000000373A000.00000004.00000800.00020000.00000000.sdmp, jlK7Q70gbN.exe, 00000002.00000003.2049646636.0000000003790000.00000004.00000800.00020000.00000000.sdmp, jlK7Q70gbN.exe, 00000002.00000003.2049229983.000000000377D000.00000004.00000800.00020000.00000000.sdmp, jlK7Q70gbN.exe, 00000002.00000003.2048511892.000000000375B000.00000004.00000800.00020000.00000000.sdmp, jlK7Q70gbN.exe, 00000002.00000003.2048235598.000000000374A000.00000004.00000800.00020000.00000000.sdmp, jlK7Q70gbN.exe, 00000002.00000003.2046950182.000000000372C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ema3d.com
Source: jlK7Q70gbN.exe, 00000002.00000003.2052420419.000000000131F000.00000004.00000020.00020000.00000000.sdmp, jlK7Q70gbN.exe, 00000002.00000003.2052117809.000000000131F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ema3d.com$E
Source: jlK7Q70gbN.exe, EMA3D.exe.2.dr, jlK7Q70gbN.exe.0.dr, ema3d.UI.Boot.dll.2.dr	String found in binary or memory: http://ocsp.comodoca.com0
Source: BootstrapperCore.dll.2.dr, mbahost.dll.2.dr, Microsoft.Deployment.WindowsInstaller.dll.2.dr, mbapreq.dll.2.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: BootstrapperCore.dll.2.dr, mbahost.dll.2.dr, Microsoft.Deployment.WindowsInstaller.dll.2.dr, mbapreq.dll.2.dr	String found in binary or memory: http://ocsp.digicert.com0K
Source: BootstrapperCore.dll.2.dr, mbahost.dll.2.dr, Microsoft.Deployment.WindowsInstaller.dll.2.dr, mbapreq.dll.2.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: BootstrapperCore.dll.2.dr, mbahost.dll.2.dr, Microsoft.Deployment.WindowsInstaller.dll.2.dr, mbapreq.dll.2.dr	String found in binary or memory: http://ocsp.digicert.com0O
Source: jlK7Q70gbN.exe, EMA3D.exe.2.dr, jlK7Q70gbN.exe.0.dr, ema3d.UI.Boot.dll.2.dr	String found in binary or memory: http://ocsp.sectigo.com0
Source: EMA3D.exe, 00000003.00000002.3298190467.0000000000B38000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.microsoft.ce6
Source: BootstrapperCore.dll.2.dr, mbahost.dll.2.dr, Microsoft.Deployment.WindowsInstaller.dll.2.dr, mbapreq.dll.2.dr	String found in binary or memory: http://wixtoolset.org
Source: BootstrapperCore.dll.2.dr, Microsoft.Deployment.WindowsInstaller.dll.2.dr	String found in binary or memory: http://wixtoolset.org/Whttp://wixtoolset.org/telemetry/v
Source: BootstrapperCore.dll.2.dr, Microsoft.Deployment.WindowsInstaller.dll.2.dr	String found in binary or memory: http://wixtoolset.org/news/
Source: Microsoft.Deployment.WindowsInstaller.dll.2.dr	String found in binary or memory: http://wixtoolset.org/releases/
Source: BootstrapperCore.dll.2.dr	String found in binary or memory: http://wixtoolset.org/releases/SCreating
Source: mbapreq.thm.2.dr	String found in binary or memory: http://wixtoolset.org/schemas/thmutil/2010
Source: ema3d.UI.Boot.dll.2.dr	String found in binary or memory: http://www.ansys.com/privacy
Source: jlK7Q70gbN.exe, 00000000.00000002.3297556859.000000000085B000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: https://sectigo.com/CPS
Source: jlK7Q70gbN.exe, EMA3D.exe.2.dr, jlK7Q70gbN.exe.0.dr, ema3d.UI.Boot.dll.2.dr	String found in binary or memory: https://sectigo.com/CPS0
Source: jlK7Q70gbN.exe, 00000002.00000003.2079705659.0000000008E31000.00000004.00000020.00020000.00000000.sdmp, ema3d.UI.Boot.dll.2.dr	String found in binary or memory: https://www.ansys.com.mcas.ms/legal/terms-and
Source: ema3d.UI.Boot.dll.2.dr	String found in binary or memory: https://www.ansys.com.mcas.ms/legal/terms-and-conditions/ansys-hybrid-compute-environment-security
Source: BootstrapperCore.dll.2.dr, mbahost.dll.2.dr, Microsoft.Deployment.WindowsInstaller.dll.2.dr, mbapreq.dll.2.dr	String found in binary or memory: https://www.digicert.com/CPS0

Source: C:\Users\user\Desktop\jlK7Q70gbN.exe	Code function: 0_2_006FC041	0_2_006FC041
Source: C:\Users\user\Desktop\jlK7Q70gbN.exe	Code function: 0_2_007001C6	0_2_007001C6
Source: C:\Users\user\Desktop\jlK7Q70gbN.exe	Code function: 0_2_0070F1B2	0_2_0070F1B2
Source: C:\Users\user\Desktop\jlK7Q70gbN.exe	Code function: 0_2_006D62CC	0_2_006D62CC
Source: C:\Users\user\Desktop\jlK7Q70gbN.exe	Code function: 0_2_00700481	0_2_00700481
Source: C:\Users\user\Desktop\jlK7Q70gbN.exe	Code function: 0_2_0070A510	0_2_0070A510
Source: C:\Users\user\Desktop\jlK7Q70gbN.exe	Code function: 0_2_007025E1	0_2_007025E1
Source: C:\Users\user\Desktop\jlK7Q70gbN.exe	Code function: 0_2_00702815	0_2_00702815
Source: C:\Users\user\Desktop\jlK7Q70gbN.exe	Code function: 0_2_006FF8E3	0_2_006FF8E3
Source: C:\Users\user\Desktop\jlK7Q70gbN.exe	Code function: 0_2_0070A9A8	0_2_0070A9A8
Source: C:\Users\user\Desktop\jlK7Q70gbN.exe	Code function: 0_2_0070DB2E	0_2_0070DB2E
Source: C:\Users\user\Desktop\jlK7Q70gbN.exe	Code function: 0_2_0070DC52	0_2_0070DC52
Source: C:\Users\user\Desktop\jlK7Q70gbN.exe	Code function: 0_2_006FFC55	0_2_006FFC55
Source: C:\Users\user\Desktop\jlK7Q70gbN.exe	Code function: 0_2_006FFEFF	0_2_006FFEFF
Source: C:\Users\user\Desktop\jlK7Q70gbN.exe	Code function: 0_2_006F3F96	0_2_006F3F96
Source: C:\Windows\Temp\{FFE22A89-11FD-4A47-9FF0-982DA2A5AD2F}\.be\EMA3D.exe	Code function: 3_2_00A3C041	3_2_00A3C041
Source: C:\Windows\Temp\{FFE22A89-11FD-4A47-9FF0-982DA2A5AD2F}\.be\EMA3D.exe	Code function: 3_2_00A4F1B2	3_2_00A4F1B2
Source: C:\Windows\Temp\{FFE22A89-11FD-4A47-9FF0-982DA2A5AD2F}\.be\EMA3D.exe	Code function: 3_2_00A401C6	3_2_00A401C6
Source: C:\Windows\Temp\{FFE22A89-11FD-4A47-9FF0-982DA2A5AD2F}\.be\EMA3D.exe	Code function: 3_2_00A162CC	3_2_00A162CC
Source: C:\Windows\Temp\{FFE22A89-11FD-4A47-9FF0-982DA2A5AD2F}\.be\EMA3D.exe	Code function: 3_2_00A40481	3_2_00A40481
Source: C:\Windows\Temp\{FFE22A89-11FD-4A47-9FF0-982DA2A5AD2F}\.be\EMA3D.exe	Code function: 3_2_00A425E1	3_2_00A425E1
Source: C:\Windows\Temp\{FFE22A89-11FD-4A47-9FF0-982DA2A5AD2F}\.be\EMA3D.exe	Code function: 3_2_00A4A510	3_2_00A4A510
Source: C:\Windows\Temp\{FFE22A89-11FD-4A47-9FF0-982DA2A5AD2F}\.be\EMA3D.exe	Code function: 3_2_00A3F8E3	3_2_00A3F8E3
Source: C:\Windows\Temp\{FFE22A89-11FD-4A47-9FF0-982DA2A5AD2F}\.be\EMA3D.exe	Code function: 3_2_00A42815	3_2_00A42815
Source: C:\Windows\Temp\{FFE22A89-11FD-4A47-9FF0-982DA2A5AD2F}\.be\EMA3D.exe	Code function: 3_2_00A4A9A8	3_2_00A4A9A8
Source: C:\Windows\Temp\{FFE22A89-11FD-4A47-9FF0-982DA2A5AD2F}\.be\EMA3D.exe	Code function: 3_2_00A4DB2E	3_2_00A4DB2E
Source: C:\Windows\Temp\{FFE22A89-11FD-4A47-9FF0-982DA2A5AD2F}\.be\EMA3D.exe	Code function: 3_2_00A4DC52	3_2_00A4DC52
Source: C:\Windows\Temp\{FFE22A89-11FD-4A47-9FF0-982DA2A5AD2F}\.be\EMA3D.exe	Code function: 3_2_00A3FC55	3_2_00A3FC55
Source: C:\Windows\Temp\{FFE22A89-11FD-4A47-9FF0-982DA2A5AD2F}\.be\EMA3D.exe	Code function: 3_2_00A3FEFF	3_2_00A3FEFF
Source: C:\Windows\Temp\{FFE22A89-11FD-4A47-9FF0-982DA2A5AD2F}\.be\EMA3D.exe	Code function: 3_2_00A33F96	3_2_00A33F96

Source: C:\Windows\Temp\{FFE22A89-11FD-4A47-9FF0-982DA2A5AD2F}\.be\EMA3D.exe	Code function: String function: 00A12022 appears 53 times
Source: C:\Windows\Temp\{FFE22A89-11FD-4A47-9FF0-982DA2A5AD2F}\.be\EMA3D.exe	Code function: String function: 00A138BA appears 500 times
Source: C:\Windows\Temp\{FFE22A89-11FD-4A47-9FF0-982DA2A5AD2F}\.be\EMA3D.exe	Code function: String function: 00A5055B appears 681 times
Source: C:\Windows\Temp\{FFE22A89-11FD-4A47-9FF0-982DA2A5AD2F}\.be\EMA3D.exe	Code function: String function: 00A50A42 appears 34 times
Source: C:\Windows\Temp\{FFE22A89-11FD-4A47-9FF0-982DA2A5AD2F}\.be\EMA3D.exe	Code function: String function: 00A535AF appears 79 times
Source: C:\Users\user\Desktop\jlK7Q70gbN.exe	Code function: String function: 00710A42 appears 34 times
Source: C:\Users\user\Desktop\jlK7Q70gbN.exe	Code function: String function: 006D38BA appears 499 times
Source: C:\Users\user\Desktop\jlK7Q70gbN.exe	Code function: String function: 0071055B appears 681 times
Source: C:\Users\user\Desktop\jlK7Q70gbN.exe	Code function: String function: 006D2022 appears 53 times
Source: C:\Users\user\Desktop\jlK7Q70gbN.exe	Code function: String function: 007135AF appears 81 times

Source: jlK7Q70gbN.exe, 00000000.00000000.2041163595.000000000073E000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameEMA3D.exe< vs jlK7Q70gbN.exe
Source: jlK7Q70gbN.exe, 00000002.00000000.2045485722.000000000083E000.00000002.00000001.01000000.00000005.sdmp	Binary or memory string: OriginalFilenameEMA3D.exe< vs jlK7Q70gbN.exe
Source: jlK7Q70gbN.exe	Binary or memory string: OriginalFilenameEMA3D.exe< vs jlK7Q70gbN.exe
Source: jlK7Q70gbN.exe.0.dr	Binary or memory string: OriginalFilenameEMA3D.exe< vs jlK7Q70gbN.exe

Source: jlK7Q70gbN.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE, REMOVABLE_RUN_FROM_SWAP, NET_RUN_FROM_SWAP

Source: classification engine

Classification label: clean8.evad.winEXE@5/36@0/0

Source: C:\Users\user\Desktop\jlK7Q70gbN.exe

Code function: 0_2_006D2078 FormatMessageW,GetLastError,LocalFree,

0_2_006D2078

Source: C:\Users\user\Desktop\jlK7Q70gbN.exe	Code function: 0_2_006D4639 GetCurrentProcess,OpenProcessToken,GetLastError,LookupPrivilegeValueW,GetLastError,AdjustTokenPrivileges,GetLastError,Sleep,InitiateSystemShutdownExW,GetLastError,CloseHandle,		0_2_006D4639
Source: C:\Windows\Temp\{FFE22A89-11FD-4A47-9FF0-982DA2A5AD2F}\.be\EMA3D.exe	Code function: 3_2_00A14639 GetCurrentProcess,OpenProcessToken,GetLastError,LookupPrivilegeValueW,GetLastError,AdjustTokenPrivileges,GetLastError,Sleep,InitiateSystemShutdownExW,GetLastError,CloseHandle,		3_2_00A14639

Source: C:\Users\user\Desktop\jlK7Q70gbN.exe

Code function: 0_2_0071330F GetModuleHandleA,GetLastError,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,CoCreateInstance,ExitProcess,

0_2_0071330F

Source: C:\Users\user\Desktop\jlK7Q70gbN.exe

Code function: 0_2_006F6913 ChangeServiceConfigW,GetLastError,

0_2_006F6913

Source: C:\Windows\Temp\{562041EC-09A3-44AA-87AE-CC1700EABB21}\.cr\jlK7Q70gbN.exe

Mutant created: NULL

Source: C:\Users\user\Desktop\jlK7Q70gbN.exe

File created: C:\Windows\Temp\{562041EC-09A3-44AA-87AE-CC1700EABB21}\

Jump to behavior

Source: C:\Users\user\Desktop\jlK7Q70gbN.exe	Command line argument: cabinet.dll	0_2_006D1070
Source: C:\Users\user\Desktop\jlK7Q70gbN.exe	Command line argument: msi.dll	0_2_006D1070
Source: C:\Users\user\Desktop\jlK7Q70gbN.exe	Command line argument: version.dll	0_2_006D1070
Source: C:\Users\user\Desktop\jlK7Q70gbN.exe	Command line argument: wininet.dll	0_2_006D1070
Source: C:\Users\user\Desktop\jlK7Q70gbN.exe	Command line argument: clbcatq.dll	0_2_006D1070
Source: C:\Users\user\Desktop\jlK7Q70gbN.exe	Command line argument: msasn1.dll	0_2_006D1070
Source: C:\Users\user\Desktop\jlK7Q70gbN.exe	Command line argument: crypt32.dll	0_2_006D1070
Source: C:\Users\user\Desktop\jlK7Q70gbN.exe	Command line argument: feclient.dll	0_2_006D1070
Source: C:\Users\user\Desktop\jlK7Q70gbN.exe	Command line argument: cabinet.dll	0_2_006D1070
Source: C:\Windows\Temp\{FFE22A89-11FD-4A47-9FF0-982DA2A5AD2F}\.be\EMA3D.exe	Command line argument: _`AB	3_2_00A11070
Source: C:\Windows\Temp\{FFE22A89-11FD-4A47-9FF0-982DA2A5AD2F}\.be\EMA3D.exe	Command line argument: cabinet.dll	3_2_00A11070
Source: C:\Windows\Temp\{FFE22A89-11FD-4A47-9FF0-982DA2A5AD2F}\.be\EMA3D.exe	Command line argument: msi.dll	3_2_00A11070
Source: C:\Windows\Temp\{FFE22A89-11FD-4A47-9FF0-982DA2A5AD2F}\.be\EMA3D.exe	Command line argument: version.dll	3_2_00A11070
Source: C:\Windows\Temp\{FFE22A89-11FD-4A47-9FF0-982DA2A5AD2F}\.be\EMA3D.exe	Command line argument: wininet.dll	3_2_00A11070
Source: C:\Windows\Temp\{FFE22A89-11FD-4A47-9FF0-982DA2A5AD2F}\.be\EMA3D.exe	Command line argument: comres.dll	3_2_00A11070
Source: C:\Windows\Temp\{FFE22A89-11FD-4A47-9FF0-982DA2A5AD2F}\.be\EMA3D.exe	Command line argument: clbcatq.dll	3_2_00A11070
Source: C:\Windows\Temp\{FFE22A89-11FD-4A47-9FF0-982DA2A5AD2F}\.be\EMA3D.exe	Command line argument: msasn1.dll	3_2_00A11070
Source: C:\Windows\Temp\{FFE22A89-11FD-4A47-9FF0-982DA2A5AD2F}\.be\EMA3D.exe	Command line argument: crypt32.dll	3_2_00A11070
Source: C:\Windows\Temp\{FFE22A89-11FD-4A47-9FF0-982DA2A5AD2F}\.be\EMA3D.exe	Command line argument: feclient.dll	3_2_00A11070
Source: C:\Windows\Temp\{FFE22A89-11FD-4A47-9FF0-982DA2A5AD2F}\.be\EMA3D.exe	Command line argument: cabinet.dll	3_2_00A11070

Source: jlK7Q70gbN.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\Temp\{562041EC-09A3-44AA-87AE-CC1700EABB21}\.cr\jlK7Q70gbN.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\jlK7Q70gbN.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: jlK7Q70gbN.exe	String found in binary or memory: Failed to re-launch bundle process after RunOnce: %ls
Source: EMA3D.exe	String found in binary or memory: Failed to re-launch bundle process after RunOnce: %ls
Source: jlK7Q70gbN.exe	String found in binary or memory: Failed to re-launch bundle process after RunOnce: %ls

Source: C:\Users\user\Desktop\jlK7Q70gbN.exe

File read: C:\Users\user\Desktop\jlK7Q70gbN.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\jlK7Q70gbN.exe "C:\Users\user\Desktop\jlK7Q70gbN.exe"
Source: C:\Users\user\Desktop\jlK7Q70gbN.exe	Process created: C:\Windows\Temp\{562041EC-09A3-44AA-87AE-CC1700EABB21}\.cr\jlK7Q70gbN.exe "C:\Windows\Temp\{562041EC-09A3-44AA-87AE-CC1700EABB21}\.cr\jlK7Q70gbN.exe" -burn.clean.room="C:\Users\user\Desktop\jlK7Q70gbN.exe" -burn.filehandle.attached=528 -burn.filehandle.self=540
Source: C:\Windows\Temp\{562041EC-09A3-44AA-87AE-CC1700EABB21}\.cr\jlK7Q70gbN.exe	Process created: C:\Windows\Temp\{FFE22A89-11FD-4A47-9FF0-982DA2A5AD2F}\.be\EMA3D.exe "C:\Windows\Temp\{FFE22A89-11FD-4A47-9FF0-982DA2A5AD2F}\.be\EMA3D.exe" -q -burn.elevated BurnPipe.{01823A2F-6092-4017-B70C-7D2B2DE988B6} {636B081A-FA87-43E7-BB2F-5B923C0323C7} 6180
Source: C:\Users\user\Desktop\jlK7Q70gbN.exe	Process created: C:\Windows\Temp\{562041EC-09A3-44AA-87AE-CC1700EABB21}\.cr\jlK7Q70gbN.exe "C:\Windows\Temp\{562041EC-09A3-44AA-87AE-CC1700EABB21}\.cr\jlK7Q70gbN.exe" -burn.clean.room="C:\Users\user\Desktop\jlK7Q70gbN.exe" -burn.filehandle.attached=528 -burn.filehandle.self=540	Jump to behavior
Source: C:\Windows\Temp\{562041EC-09A3-44AA-87AE-CC1700EABB21}\.cr\jlK7Q70gbN.exe	Process created: C:\Windows\Temp\{FFE22A89-11FD-4A47-9FF0-982DA2A5AD2F}\.be\EMA3D.exe "C:\Windows\Temp\{FFE22A89-11FD-4A47-9FF0-982DA2A5AD2F}\.be\EMA3D.exe" -q -burn.elevated BurnPipe.{01823A2F-6092-4017-B70C-7D2B2DE988B6} {636B081A-FA87-43E7-BB2F-5B923C0323C7} 6180	Jump to behavior

Source: C:\Users\user\Desktop\jlK7Q70gbN.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlK7Q70gbN.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlK7Q70gbN.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlK7Q70gbN.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlK7Q70gbN.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlK7Q70gbN.exe	Section loaded: msxml3.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlK7Q70gbN.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlK7Q70gbN.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlK7Q70gbN.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlK7Q70gbN.exe	Section loaded: feclient.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlK7Q70gbN.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\jlK7Q70gbN.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\Temp\{562041EC-09A3-44AA-87AE-CC1700EABB21}\.cr\jlK7Q70gbN.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Temp\{562041EC-09A3-44AA-87AE-CC1700EABB21}\.cr\jlK7Q70gbN.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Temp\{562041EC-09A3-44AA-87AE-CC1700EABB21}\.cr\jlK7Q70gbN.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\Temp\{562041EC-09A3-44AA-87AE-CC1700EABB21}\.cr\jlK7Q70gbN.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Temp\{562041EC-09A3-44AA-87AE-CC1700EABB21}\.cr\jlK7Q70gbN.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\Temp\{562041EC-09A3-44AA-87AE-CC1700EABB21}\.cr\jlK7Q70gbN.exe	Section loaded: msxml3.dll	Jump to behavior
Source: C:\Windows\Temp\{562041EC-09A3-44AA-87AE-CC1700EABB21}\.cr\jlK7Q70gbN.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Temp\{562041EC-09A3-44AA-87AE-CC1700EABB21}\.cr\jlK7Q70gbN.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Temp\{562041EC-09A3-44AA-87AE-CC1700EABB21}\.cr\jlK7Q70gbN.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Temp\{562041EC-09A3-44AA-87AE-CC1700EABB21}\.cr\jlK7Q70gbN.exe	Section loaded: feclient.dll	Jump to behavior
Source: C:\Windows\Temp\{562041EC-09A3-44AA-87AE-CC1700EABB21}\.cr\jlK7Q70gbN.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\Temp\{562041EC-09A3-44AA-87AE-CC1700EABB21}\.cr\jlK7Q70gbN.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Temp\{562041EC-09A3-44AA-87AE-CC1700EABB21}\.cr\jlK7Q70gbN.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Windows\Temp\{562041EC-09A3-44AA-87AE-CC1700EABB21}\.cr\jlK7Q70gbN.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\Temp\{562041EC-09A3-44AA-87AE-CC1700EABB21}\.cr\jlK7Q70gbN.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\Temp\{562041EC-09A3-44AA-87AE-CC1700EABB21}\.cr\jlK7Q70gbN.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\Temp\{562041EC-09A3-44AA-87AE-CC1700EABB21}\.cr\jlK7Q70gbN.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\Temp\{562041EC-09A3-44AA-87AE-CC1700EABB21}\.cr\jlK7Q70gbN.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\Temp\{562041EC-09A3-44AA-87AE-CC1700EABB21}\.cr\jlK7Q70gbN.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\Temp\{562041EC-09A3-44AA-87AE-CC1700EABB21}\.cr\jlK7Q70gbN.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Temp\{562041EC-09A3-44AA-87AE-CC1700EABB21}\.cr\jlK7Q70gbN.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Temp\{562041EC-09A3-44AA-87AE-CC1700EABB21}\.cr\jlK7Q70gbN.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Temp\{562041EC-09A3-44AA-87AE-CC1700EABB21}\.cr\jlK7Q70gbN.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Temp\{562041EC-09A3-44AA-87AE-CC1700EABB21}\.cr\jlK7Q70gbN.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Temp\{562041EC-09A3-44AA-87AE-CC1700EABB21}\.cr\jlK7Q70gbN.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Windows\Temp\{562041EC-09A3-44AA-87AE-CC1700EABB21}\.cr\jlK7Q70gbN.exe	Section loaded: msvcp140_clr0400.dll	Jump to behavior
Source: C:\Windows\Temp\{562041EC-09A3-44AA-87AE-CC1700EABB21}\.cr\jlK7Q70gbN.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\Temp\{562041EC-09A3-44AA-87AE-CC1700EABB21}\.cr\jlK7Q70gbN.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\Temp\{562041EC-09A3-44AA-87AE-CC1700EABB21}\.cr\jlK7Q70gbN.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\Temp\{562041EC-09A3-44AA-87AE-CC1700EABB21}\.cr\jlK7Q70gbN.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\Temp\{562041EC-09A3-44AA-87AE-CC1700EABB21}\.cr\jlK7Q70gbN.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\Temp\{562041EC-09A3-44AA-87AE-CC1700EABB21}\.cr\jlK7Q70gbN.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\Temp\{562041EC-09A3-44AA-87AE-CC1700EABB21}\.cr\jlK7Q70gbN.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Temp\{562041EC-09A3-44AA-87AE-CC1700EABB21}\.cr\jlK7Q70gbN.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\Temp\{562041EC-09A3-44AA-87AE-CC1700EABB21}\.cr\jlK7Q70gbN.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\Temp\{562041EC-09A3-44AA-87AE-CC1700EABB21}\.cr\jlK7Q70gbN.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\Temp\{562041EC-09A3-44AA-87AE-CC1700EABB21}\.cr\jlK7Q70gbN.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Temp\{562041EC-09A3-44AA-87AE-CC1700EABB21}\.cr\jlK7Q70gbN.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\Temp\{562041EC-09A3-44AA-87AE-CC1700EABB21}\.cr\jlK7Q70gbN.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\Temp\{562041EC-09A3-44AA-87AE-CC1700EABB21}\.cr\jlK7Q70gbN.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\Temp\{562041EC-09A3-44AA-87AE-CC1700EABB21}\.cr\jlK7Q70gbN.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\Temp\{562041EC-09A3-44AA-87AE-CC1700EABB21}\.cr\jlK7Q70gbN.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Windows\Temp\{562041EC-09A3-44AA-87AE-CC1700EABB21}\.cr\jlK7Q70gbN.exe	Section loaded: d3d9.dll	Jump to behavior
Source: C:\Windows\Temp\{562041EC-09A3-44AA-87AE-CC1700EABB21}\.cr\jlK7Q70gbN.exe	Section loaded: d3d10warp.dll	Jump to behavior
Source: C:\Windows\Temp\{562041EC-09A3-44AA-87AE-CC1700EABB21}\.cr\jlK7Q70gbN.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Windows\Temp\{562041EC-09A3-44AA-87AE-CC1700EABB21}\.cr\jlK7Q70gbN.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\Temp\{562041EC-09A3-44AA-87AE-CC1700EABB21}\.cr\jlK7Q70gbN.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\Temp\{562041EC-09A3-44AA-87AE-CC1700EABB21}\.cr\jlK7Q70gbN.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\Temp\{562041EC-09A3-44AA-87AE-CC1700EABB21}\.cr\jlK7Q70gbN.exe	Section loaded: dataexchange.dll	Jump to behavior
Source: C:\Windows\Temp\{562041EC-09A3-44AA-87AE-CC1700EABB21}\.cr\jlK7Q70gbN.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\Windows\Temp\{562041EC-09A3-44AA-87AE-CC1700EABB21}\.cr\jlK7Q70gbN.exe	Section loaded: dcomp.dll	Jump to behavior
Source: C:\Windows\Temp\{562041EC-09A3-44AA-87AE-CC1700EABB21}\.cr\jlK7Q70gbN.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Windows\Temp\{562041EC-09A3-44AA-87AE-CC1700EABB21}\.cr\jlK7Q70gbN.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\Temp\{562041EC-09A3-44AA-87AE-CC1700EABB21}\.cr\jlK7Q70gbN.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Windows\Temp\{562041EC-09A3-44AA-87AE-CC1700EABB21}\.cr\jlK7Q70gbN.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Windows\Temp\{562041EC-09A3-44AA-87AE-CC1700EABB21}\.cr\jlK7Q70gbN.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\Temp\{562041EC-09A3-44AA-87AE-CC1700EABB21}\.cr\jlK7Q70gbN.exe	Section loaded: dxcore.dll	Jump to behavior
Source: C:\Windows\Temp\{562041EC-09A3-44AA-87AE-CC1700EABB21}\.cr\jlK7Q70gbN.exe	Section loaded: msctfui.dll	Jump to behavior
Source: C:\Windows\Temp\{562041EC-09A3-44AA-87AE-CC1700EABB21}\.cr\jlK7Q70gbN.exe	Section loaded: uiautomationcore.dll	Jump to behavior
Source: C:\Windows\Temp\{562041EC-09A3-44AA-87AE-CC1700EABB21}\.cr\jlK7Q70gbN.exe	Section loaded: d3dcompiler_47.dll	Jump to behavior
Source: C:\Windows\Temp\{FFE22A89-11FD-4A47-9FF0-982DA2A5AD2F}\.be\EMA3D.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Temp\{FFE22A89-11FD-4A47-9FF0-982DA2A5AD2F}\.be\EMA3D.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Temp\{FFE22A89-11FD-4A47-9FF0-982DA2A5AD2F}\.be\EMA3D.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\Temp\{FFE22A89-11FD-4A47-9FF0-982DA2A5AD2F}\.be\EMA3D.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Temp\{FFE22A89-11FD-4A47-9FF0-982DA2A5AD2F}\.be\EMA3D.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\Temp\{FFE22A89-11FD-4A47-9FF0-982DA2A5AD2F}\.be\EMA3D.exe	Section loaded: msxml3.dll	Jump to behavior
Source: C:\Windows\Temp\{FFE22A89-11FD-4A47-9FF0-982DA2A5AD2F}\.be\EMA3D.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Temp\{FFE22A89-11FD-4A47-9FF0-982DA2A5AD2F}\.be\EMA3D.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Temp\{FFE22A89-11FD-4A47-9FF0-982DA2A5AD2F}\.be\EMA3D.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Temp\{FFE22A89-11FD-4A47-9FF0-982DA2A5AD2F}\.be\EMA3D.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Temp\{FFE22A89-11FD-4A47-9FF0-982DA2A5AD2F}\.be\EMA3D.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Windows\Temp\{FFE22A89-11FD-4A47-9FF0-982DA2A5AD2F}\.be\EMA3D.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\Temp\{FFE22A89-11FD-4A47-9FF0-982DA2A5AD2F}\.be\EMA3D.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\Temp\{FFE22A89-11FD-4A47-9FF0-982DA2A5AD2F}\.be\EMA3D.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\Temp\{FFE22A89-11FD-4A47-9FF0-982DA2A5AD2F}\.be\EMA3D.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\Temp\{FFE22A89-11FD-4A47-9FF0-982DA2A5AD2F}\.be\EMA3D.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\Temp\{FFE22A89-11FD-4A47-9FF0-982DA2A5AD2F}\.be\EMA3D.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\Temp\{FFE22A89-11FD-4A47-9FF0-982DA2A5AD2F}\.be\EMA3D.exe	Section loaded: srclient.dll	Jump to behavior
Source: C:\Windows\Temp\{FFE22A89-11FD-4A47-9FF0-982DA2A5AD2F}\.be\EMA3D.exe	Section loaded: spp.dll	Jump to behavior
Source: C:\Windows\Temp\{FFE22A89-11FD-4A47-9FF0-982DA2A5AD2F}\.be\EMA3D.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\Temp\{FFE22A89-11FD-4A47-9FF0-982DA2A5AD2F}\.be\EMA3D.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\Temp\{FFE22A89-11FD-4A47-9FF0-982DA2A5AD2F}\.be\EMA3D.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\Temp\{FFE22A89-11FD-4A47-9FF0-982DA2A5AD2F}\.be\EMA3D.exe	Section loaded: umpdc.dll	Jump to behavior

Source: C:\Users\user\Desktop\jlK7Q70gbN.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F6D90F11-9C73-11D3-B32E-00C04F990BB4}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\Temp\{562041EC-09A3-44AA-87AE-CC1700EABB21}\.cr\jlK7Q70gbN.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: jlK7Q70gbN.exe

Static PE information: certificate valid

Source: jlK7Q70gbN.exe

Static file information: File size 1204392 > 1048576

Source: jlK7Q70gbN.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: jlK7Q70gbN.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: jlK7Q70gbN.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: jlK7Q70gbN.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: jlK7Q70gbN.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: jlK7Q70gbN.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: jlK7Q70gbN.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: jlK7Q70gbN.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: C:\agent\_work\79\s\build\obj\ship\x86\WindowsInstaller\Microsoft.Deployment.WindowsInstaller.pdb source: Microsoft.Deployment.WindowsInstaller.dll.2.dr
Source:	Binary string: C:\agent\_work\79\s\build\ship\x86\burn.pdb/ source: jlK7Q70gbN.exe, EMA3D.exe.2.dr, jlK7Q70gbN.exe.0.dr
Source:	Binary string: C:\agent\_work\79\s\build\obj\ship\x86\core\BootstrapperCore.pdb source: BootstrapperCore.dll.2.dr
Source:	Binary string: C:\agent\_work\79\s\build\ship\x86\mbahost.pdb source: mbahost.dll.2.dr
Source:	Binary string: ./Installer/UI/obj/Release/ema3d.UI.Boot.pdb8 source: ema3d.UI.Boot.dll.2.dr
Source:	Binary string: C:\agent\_work\79\s\build\obj\ship\x86\WindowsInstaller\Microsoft.Deployment.WindowsInstaller.pdbP source: Microsoft.Deployment.WindowsInstaller.dll.2.dr
Source:	Binary string: C:\agent\_work\79\s\build\ship\x86\WixStdBA.pdb source: mbapreq.dll.2.dr
Source:	Binary string: ./Installer/UI/obj/Release/ema3d.UI.Boot.pdb source: ema3d.UI.Boot.dll.2.dr
Source:	Binary string: C:\agent\_work\79\s\build\ship\x86\burn.pdb source: jlK7Q70gbN.exe, EMA3D.exe.2.dr, jlK7Q70gbN.exe.0.dr

Source: jlK7Q70gbN.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: jlK7Q70gbN.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: jlK7Q70gbN.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: jlK7Q70gbN.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: jlK7Q70gbN.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: jlK7Q70gbN.exe	Static PE information: section name: .wixburn
Source: jlK7Q70gbN.exe.0.dr	Static PE information: section name: .wixburn
Source: EMA3D.exe.2.dr	Static PE information: section name: .wixburn

Source: C:\Users\user\Desktop\jlK7Q70gbN.exe	Code function: 0_2_006FE826 push ecx; ret		0_2_006FE839
Source: C:\Windows\Temp\{FFE22A89-11FD-4A47-9FF0-982DA2A5AD2F}\.be\EMA3D.exe	Code function: 3_2_00A3E826 push ecx; ret		3_2_00A3E839

Source: C:\Windows\Temp\{562041EC-09A3-44AA-87AE-CC1700EABB21}\.cr\jlK7Q70gbN.exe	File created: C:\Windows\Temp\{FFE22A89-11FD-4A47-9FF0-982DA2A5AD2F}\.ba\Microsoft.Deployment.WindowsInstaller.dll	Jump to dropped file
Source: C:\Windows\Temp\{562041EC-09A3-44AA-87AE-CC1700EABB21}\.cr\jlK7Q70gbN.exe	File created: C:\Windows\Temp\{FFE22A89-11FD-4A47-9FF0-982DA2A5AD2F}\.be\EMA3D.exe	Jump to dropped file
Source: C:\Windows\Temp\{562041EC-09A3-44AA-87AE-CC1700EABB21}\.cr\jlK7Q70gbN.exe	File created: C:\Windows\Temp\{FFE22A89-11FD-4A47-9FF0-982DA2A5AD2F}\.ba\mbahost.dll	Jump to dropped file
Source: C:\Users\user\Desktop\jlK7Q70gbN.exe	File created: C:\Windows\Temp\{562041EC-09A3-44AA-87AE-CC1700EABB21}\.cr\jlK7Q70gbN.exe	Jump to dropped file
Source: C:\Windows\Temp\{562041EC-09A3-44AA-87AE-CC1700EABB21}\.cr\jlK7Q70gbN.exe	File created: C:\Windows\Temp\{FFE22A89-11FD-4A47-9FF0-982DA2A5AD2F}\.ba\BootstrapperCore.dll	Jump to dropped file
Source: C:\Windows\Temp\{562041EC-09A3-44AA-87AE-CC1700EABB21}\.cr\jlK7Q70gbN.exe	File created: C:\Windows\Temp\{FFE22A89-11FD-4A47-9FF0-982DA2A5AD2F}\.ba\mbapreq.dll	Jump to dropped file
Source: C:\Windows\Temp\{562041EC-09A3-44AA-87AE-CC1700EABB21}\.cr\jlK7Q70gbN.exe	File created: C:\Windows\Temp\{FFE22A89-11FD-4A47-9FF0-982DA2A5AD2F}\.ba\ema3d.UI.Boot.dll	Jump to dropped file

Source: C:\Windows\Temp\{562041EC-09A3-44AA-87AE-CC1700EABB21}\.cr\jlK7Q70gbN.exe	File created: C:\Windows\Temp\{FFE22A89-11FD-4A47-9FF0-982DA2A5AD2F}\.ba\Microsoft.Deployment.WindowsInstaller.dll	Jump to dropped file
Source: C:\Windows\Temp\{562041EC-09A3-44AA-87AE-CC1700EABB21}\.cr\jlK7Q70gbN.exe	File created: C:\Windows\Temp\{FFE22A89-11FD-4A47-9FF0-982DA2A5AD2F}\.be\EMA3D.exe	Jump to dropped file
Source: C:\Windows\Temp\{562041EC-09A3-44AA-87AE-CC1700EABB21}\.cr\jlK7Q70gbN.exe	File created: C:\Windows\Temp\{FFE22A89-11FD-4A47-9FF0-982DA2A5AD2F}\.ba\mbahost.dll	Jump to dropped file
Source: C:\Users\user\Desktop\jlK7Q70gbN.exe	File created: C:\Windows\Temp\{562041EC-09A3-44AA-87AE-CC1700EABB21}\.cr\jlK7Q70gbN.exe	Jump to dropped file
Source: C:\Windows\Temp\{562041EC-09A3-44AA-87AE-CC1700EABB21}\.cr\jlK7Q70gbN.exe	File created: C:\Windows\Temp\{FFE22A89-11FD-4A47-9FF0-982DA2A5AD2F}\.ba\BootstrapperCore.dll	Jump to dropped file
Source: C:\Windows\Temp\{562041EC-09A3-44AA-87AE-CC1700EABB21}\.cr\jlK7Q70gbN.exe	File created: C:\Windows\Temp\{FFE22A89-11FD-4A47-9FF0-982DA2A5AD2F}\.ba\mbapreq.dll	Jump to dropped file
Source: C:\Windows\Temp\{562041EC-09A3-44AA-87AE-CC1700EABB21}\.cr\jlK7Q70gbN.exe	File created: C:\Windows\Temp\{FFE22A89-11FD-4A47-9FF0-982DA2A5AD2F}\.ba\ema3d.UI.Boot.dll	Jump to dropped file

Source: C:\Windows\Temp\{562041EC-09A3-44AA-87AE-CC1700EABB21}\.cr\jlK7Q70gbN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{562041EC-09A3-44AA-87AE-CC1700EABB21}\.cr\jlK7Q70gbN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{562041EC-09A3-44AA-87AE-CC1700EABB21}\.cr\jlK7Q70gbN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{562041EC-09A3-44AA-87AE-CC1700EABB21}\.cr\jlK7Q70gbN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{562041EC-09A3-44AA-87AE-CC1700EABB21}\.cr\jlK7Q70gbN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{562041EC-09A3-44AA-87AE-CC1700EABB21}\.cr\jlK7Q70gbN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{562041EC-09A3-44AA-87AE-CC1700EABB21}\.cr\jlK7Q70gbN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{562041EC-09A3-44AA-87AE-CC1700EABB21}\.cr\jlK7Q70gbN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{562041EC-09A3-44AA-87AE-CC1700EABB21}\.cr\jlK7Q70gbN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{562041EC-09A3-44AA-87AE-CC1700EABB21}\.cr\jlK7Q70gbN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{562041EC-09A3-44AA-87AE-CC1700EABB21}\.cr\jlK7Q70gbN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{562041EC-09A3-44AA-87AE-CC1700EABB21}\.cr\jlK7Q70gbN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{562041EC-09A3-44AA-87AE-CC1700EABB21}\.cr\jlK7Q70gbN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{562041EC-09A3-44AA-87AE-CC1700EABB21}\.cr\jlK7Q70gbN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{562041EC-09A3-44AA-87AE-CC1700EABB21}\.cr\jlK7Q70gbN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{562041EC-09A3-44AA-87AE-CC1700EABB21}\.cr\jlK7Q70gbN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{562041EC-09A3-44AA-87AE-CC1700EABB21}\.cr\jlK7Q70gbN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{562041EC-09A3-44AA-87AE-CC1700EABB21}\.cr\jlK7Q70gbN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{562041EC-09A3-44AA-87AE-CC1700EABB21}\.cr\jlK7Q70gbN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{562041EC-09A3-44AA-87AE-CC1700EABB21}\.cr\jlK7Q70gbN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{562041EC-09A3-44AA-87AE-CC1700EABB21}\.cr\jlK7Q70gbN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{562041EC-09A3-44AA-87AE-CC1700EABB21}\.cr\jlK7Q70gbN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{562041EC-09A3-44AA-87AE-CC1700EABB21}\.cr\jlK7Q70gbN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{562041EC-09A3-44AA-87AE-CC1700EABB21}\.cr\jlK7Q70gbN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{562041EC-09A3-44AA-87AE-CC1700EABB21}\.cr\jlK7Q70gbN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{562041EC-09A3-44AA-87AE-CC1700EABB21}\.cr\jlK7Q70gbN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{562041EC-09A3-44AA-87AE-CC1700EABB21}\.cr\jlK7Q70gbN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{562041EC-09A3-44AA-87AE-CC1700EABB21}\.cr\jlK7Q70gbN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{562041EC-09A3-44AA-87AE-CC1700EABB21}\.cr\jlK7Q70gbN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{562041EC-09A3-44AA-87AE-CC1700EABB21}\.cr\jlK7Q70gbN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{562041EC-09A3-44AA-87AE-CC1700EABB21}\.cr\jlK7Q70gbN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{562041EC-09A3-44AA-87AE-CC1700EABB21}\.cr\jlK7Q70gbN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{562041EC-09A3-44AA-87AE-CC1700EABB21}\.cr\jlK7Q70gbN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{562041EC-09A3-44AA-87AE-CC1700EABB21}\.cr\jlK7Q70gbN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{562041EC-09A3-44AA-87AE-CC1700EABB21}\.cr\jlK7Q70gbN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{562041EC-09A3-44AA-87AE-CC1700EABB21}\.cr\jlK7Q70gbN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{562041EC-09A3-44AA-87AE-CC1700EABB21}\.cr\jlK7Q70gbN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{562041EC-09A3-44AA-87AE-CC1700EABB21}\.cr\jlK7Q70gbN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{562041EC-09A3-44AA-87AE-CC1700EABB21}\.cr\jlK7Q70gbN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{562041EC-09A3-44AA-87AE-CC1700EABB21}\.cr\jlK7Q70gbN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{562041EC-09A3-44AA-87AE-CC1700EABB21}\.cr\jlK7Q70gbN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{562041EC-09A3-44AA-87AE-CC1700EABB21}\.cr\jlK7Q70gbN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{562041EC-09A3-44AA-87AE-CC1700EABB21}\.cr\jlK7Q70gbN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{562041EC-09A3-44AA-87AE-CC1700EABB21}\.cr\jlK7Q70gbN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{562041EC-09A3-44AA-87AE-CC1700EABB21}\.cr\jlK7Q70gbN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{562041EC-09A3-44AA-87AE-CC1700EABB21}\.cr\jlK7Q70gbN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{562041EC-09A3-44AA-87AE-CC1700EABB21}\.cr\jlK7Q70gbN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{562041EC-09A3-44AA-87AE-CC1700EABB21}\.cr\jlK7Q70gbN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{562041EC-09A3-44AA-87AE-CC1700EABB21}\.cr\jlK7Q70gbN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{562041EC-09A3-44AA-87AE-CC1700EABB21}\.cr\jlK7Q70gbN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{562041EC-09A3-44AA-87AE-CC1700EABB21}\.cr\jlK7Q70gbN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{562041EC-09A3-44AA-87AE-CC1700EABB21}\.cr\jlK7Q70gbN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{562041EC-09A3-44AA-87AE-CC1700EABB21}\.cr\jlK7Q70gbN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{562041EC-09A3-44AA-87AE-CC1700EABB21}\.cr\jlK7Q70gbN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{562041EC-09A3-44AA-87AE-CC1700EABB21}\.cr\jlK7Q70gbN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{562041EC-09A3-44AA-87AE-CC1700EABB21}\.cr\jlK7Q70gbN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{562041EC-09A3-44AA-87AE-CC1700EABB21}\.cr\jlK7Q70gbN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{562041EC-09A3-44AA-87AE-CC1700EABB21}\.cr\jlK7Q70gbN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{562041EC-09A3-44AA-87AE-CC1700EABB21}\.cr\jlK7Q70gbN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{562041EC-09A3-44AA-87AE-CC1700EABB21}\.cr\jlK7Q70gbN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{562041EC-09A3-44AA-87AE-CC1700EABB21}\.cr\jlK7Q70gbN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{562041EC-09A3-44AA-87AE-CC1700EABB21}\.cr\jlK7Q70gbN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{562041EC-09A3-44AA-87AE-CC1700EABB21}\.cr\jlK7Q70gbN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{562041EC-09A3-44AA-87AE-CC1700EABB21}\.cr\jlK7Q70gbN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{562041EC-09A3-44AA-87AE-CC1700EABB21}\.cr\jlK7Q70gbN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{562041EC-09A3-44AA-87AE-CC1700EABB21}\.cr\jlK7Q70gbN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{562041EC-09A3-44AA-87AE-CC1700EABB21}\.cr\jlK7Q70gbN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{562041EC-09A3-44AA-87AE-CC1700EABB21}\.cr\jlK7Q70gbN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{562041EC-09A3-44AA-87AE-CC1700EABB21}\.cr\jlK7Q70gbN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{562041EC-09A3-44AA-87AE-CC1700EABB21}\.cr\jlK7Q70gbN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{562041EC-09A3-44AA-87AE-CC1700EABB21}\.cr\jlK7Q70gbN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{562041EC-09A3-44AA-87AE-CC1700EABB21}\.cr\jlK7Q70gbN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{562041EC-09A3-44AA-87AE-CC1700EABB21}\.cr\jlK7Q70gbN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{562041EC-09A3-44AA-87AE-CC1700EABB21}\.cr\jlK7Q70gbN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{562041EC-09A3-44AA-87AE-CC1700EABB21}\.cr\jlK7Q70gbN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{562041EC-09A3-44AA-87AE-CC1700EABB21}\.cr\jlK7Q70gbN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{562041EC-09A3-44AA-87AE-CC1700EABB21}\.cr\jlK7Q70gbN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{562041EC-09A3-44AA-87AE-CC1700EABB21}\.cr\jlK7Q70gbN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{562041EC-09A3-44AA-87AE-CC1700EABB21}\.cr\jlK7Q70gbN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{562041EC-09A3-44AA-87AE-CC1700EABB21}\.cr\jlK7Q70gbN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\Temp\{562041EC-09A3-44AA-87AE-CC1700EABB21}\.cr\jlK7Q70gbN.exe	Memory allocated: 33F0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Temp\{562041EC-09A3-44AA-87AE-CC1700EABB21}\.cr\jlK7Q70gbN.exe	Memory allocated: 4770000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Temp\{562041EC-09A3-44AA-87AE-CC1700EABB21}\.cr\jlK7Q70gbN.exe	Memory allocated: 6770000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Windows\Temp\{562041EC-09A3-44AA-87AE-CC1700EABB21}\.cr\jlK7Q70gbN.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\Temp\{562041EC-09A3-44AA-87AE-CC1700EABB21}\.cr\jlK7Q70gbN.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\Temp\{562041EC-09A3-44AA-87AE-CC1700EABB21}\.cr\jlK7Q70gbN.exe	Dropped PE file which has not been started: C:\Windows\Temp\{FFE22A89-11FD-4A47-9FF0-982DA2A5AD2F}\.ba\Microsoft.Deployment.WindowsInstaller.dll	Jump to dropped file
Source: C:\Windows\Temp\{562041EC-09A3-44AA-87AE-CC1700EABB21}\.cr\jlK7Q70gbN.exe	Dropped PE file which has not been started: C:\Windows\Temp\{FFE22A89-11FD-4A47-9FF0-982DA2A5AD2F}\.ba\mbahost.dll	Jump to dropped file
Source: C:\Windows\Temp\{562041EC-09A3-44AA-87AE-CC1700EABB21}\.cr\jlK7Q70gbN.exe	Dropped PE file which has not been started: C:\Windows\Temp\{FFE22A89-11FD-4A47-9FF0-982DA2A5AD2F}\.ba\mbapreq.dll	Jump to dropped file
Source: C:\Windows\Temp\{562041EC-09A3-44AA-87AE-CC1700EABB21}\.cr\jlK7Q70gbN.exe	Dropped PE file which has not been started: C:\Windows\Temp\{FFE22A89-11FD-4A47-9FF0-982DA2A5AD2F}\.ba\ema3d.UI.Boot.dll	Jump to dropped file
Source: C:\Windows\Temp\{562041EC-09A3-44AA-87AE-CC1700EABB21}\.cr\jlK7Q70gbN.exe	Dropped PE file which has not been started: C:\Windows\Temp\{FFE22A89-11FD-4A47-9FF0-982DA2A5AD2F}\.ba\BootstrapperCore.dll	Jump to dropped file

Source: C:\Windows\Temp\{FFE22A89-11FD-4A47-9FF0-982DA2A5AD2F}\.be\EMA3D.exe

Evaded block: after key decision

Source: C:\Windows\Temp\{FFE22A89-11FD-4A47-9FF0-982DA2A5AD2F}\.be\EMA3D.exe	Check user administrative privileges: GetTokenInformation,DecisionNodes
Source: C:\Users\user\Desktop\jlK7Q70gbN.exe	Check user administrative privileges: GetTokenInformation,DecisionNodes

Source: C:\Users\user\Desktop\jlK7Q70gbN.exe

API coverage: 9.5 %

Source: C:\Windows\Temp\{562041EC-09A3-44AA-87AE-CC1700EABB21}\.cr\jlK7Q70gbN.exe TID: 5448	Thread sleep time: -922337203685477s >= -30000s			Jump to behavior
Source: C:\Windows\Temp\{562041EC-09A3-44AA-87AE-CC1700EABB21}\.cr\jlK7Q70gbN.exe TID: 5448	Thread sleep time: -922337203685477s >= -30000s			Jump to behavior

Source: C:\Users\user\Desktop\jlK7Q70gbN.exe	Code function: 0_2_007101F0 GetLocalTime followed by cmp: cmp dword ptr [ebp+08h], 05h and CTI: je 0071028Bh	0_2_007101F0
Source: C:\Users\user\Desktop\jlK7Q70gbN.exe	Code function: 0_2_007101F0 GetLocalTime followed by cmp: cmp dword ptr [ebp+08h], 01h and CTI: je 00710284h	0_2_007101F0
Source: C:\Windows\Temp\{FFE22A89-11FD-4A47-9FF0-982DA2A5AD2F}\.be\EMA3D.exe	Code function: 3_2_00A501F0 GetLocalTime followed by cmp: cmp dword ptr [ebp+08h], 05h and CTI: je 00A5028Bh	3_2_00A501F0
Source: C:\Windows\Temp\{FFE22A89-11FD-4A47-9FF0-982DA2A5AD2F}\.be\EMA3D.exe	Code function: 3_2_00A501F0 GetLocalTime followed by cmp: cmp dword ptr [ebp+08h], 01h and CTI: je 00A50284h	3_2_00A501F0

Source: C:\Users\user\Desktop\jlK7Q70gbN.exe	Code function: 0_2_007146C4 FindFirstFileW,FindClose,	0_2_007146C4
Source: C:\Users\user\Desktop\jlK7Q70gbN.exe	Code function: 0_2_00707767 FindFirstFileExW,	0_2_00707767
Source: C:\Users\user\Desktop\jlK7Q70gbN.exe	Code function: 0_2_006E9A30 FindFirstFileW,lstrlenW,FindNextFileW,FindClose,	0_2_006E9A30
Source: C:\Users\user\Desktop\jlK7Q70gbN.exe	Code function: 0_2_006D3D4E GetFileAttributesW,GetLastError,GetLastError,SetFileAttributesW,GetLastError,GetTempPathW,GetLastError,FindFirstFileW,GetLastError,SetFileAttributesW,DeleteFileW,GetTempFileNameW,MoveFileExW,MoveFileExW,MoveFileExW,FindNextFileW,GetLastError,GetLastError,GetLastError,GetLastError,RemoveDirectoryW,GetLastError,MoveFileExW,GetLastError,FindClose,	0_2_006D3D4E
Source: C:\Windows\Temp\{FFE22A89-11FD-4A47-9FF0-982DA2A5AD2F}\.be\EMA3D.exe	Code function: 3_2_00A546C4 FindFirstFileW,FindClose,	3_2_00A546C4
Source: C:\Windows\Temp\{FFE22A89-11FD-4A47-9FF0-982DA2A5AD2F}\.be\EMA3D.exe	Code function: 3_2_00A47767 FindFirstFileExW,	3_2_00A47767
Source: C:\Windows\Temp\{FFE22A89-11FD-4A47-9FF0-982DA2A5AD2F}\.be\EMA3D.exe	Code function: 3_2_00A29A30 FindFirstFileW,lstrlenW,FindNextFileW,FindClose,	3_2_00A29A30
Source: C:\Windows\Temp\{FFE22A89-11FD-4A47-9FF0-982DA2A5AD2F}\.be\EMA3D.exe	Code function: 3_2_00A13D4E GetFileAttributesW,GetLastError,GetLastError,SetFileAttributesW,GetLastError,GetTempPathW,GetLastError,FindFirstFileW,GetLastError,SetFileAttributesW,DeleteFileW,GetTempFileNameW,MoveFileExW,MoveFileExW,MoveFileExW,FindNextFileW,GetLastError,GetLastError,GetLastError,GetLastError,RemoveDirectoryW,GetLastError,MoveFileExW,GetLastError,FindClose,	3_2_00A13D4E

Source: C:\Users\user\Desktop\jlK7Q70gbN.exe

Code function: 0_2_0071994A VirtualQuery,GetSystemInfo,

0_2_0071994A

Source: C:\Windows\Temp\{562041EC-09A3-44AA-87AE-CC1700EABB21}\.cr\jlK7Q70gbN.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\Temp\{562041EC-09A3-44AA-87AE-CC1700EABB21}\.cr\jlK7Q70gbN.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Users\user\Desktop\jlK7Q70gbN.exe	API call chain: ExitProcess graph end node
Source: C:\Windows\Temp\{FFE22A89-11FD-4A47-9FF0-982DA2A5AD2F}\.be\EMA3D.exe	API call chain: ExitProcess graph end node

Source: C:\Users\user\Desktop\jlK7Q70gbN.exe

Code function: 0_2_006FE594 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_006FE594

Source: C:\Users\user\Desktop\jlK7Q70gbN.exe	Code function: 0_2_00704413 mov eax, dword ptr fs:[00000030h]	0_2_00704413
Source: C:\Users\user\Desktop\jlK7Q70gbN.exe	Code function: 0_2_00708491 mov eax, dword ptr fs:[00000030h]	0_2_00708491
Source: C:\Windows\Temp\{FFE22A89-11FD-4A47-9FF0-982DA2A5AD2F}\.be\EMA3D.exe	Code function: 3_2_00A48491 mov eax, dword ptr fs:[00000030h]	3_2_00A48491
Source: C:\Windows\Temp\{FFE22A89-11FD-4A47-9FF0-982DA2A5AD2F}\.be\EMA3D.exe	Code function: 3_2_00A44413 mov eax, dword ptr fs:[00000030h]	3_2_00A44413

Source: C:\Users\user\Desktop\jlK7Q70gbN.exe

Code function: 0_2_006D39DF GetProcessHeap,RtlAllocateHeap,

0_2_006D39DF

Source: C:\Users\user\Desktop\jlK7Q70gbN.exe	Code function: 0_2_006FE0C8 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_006FE0C8
Source: C:\Users\user\Desktop\jlK7Q70gbN.exe	Code function: 0_2_006FE594 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_006FE594
Source: C:\Users\user\Desktop\jlK7Q70gbN.exe	Code function: 0_2_006FE727 SetUnhandledExceptionFilter,	0_2_006FE727
Source: C:\Users\user\Desktop\jlK7Q70gbN.exe	Code function: 0_2_007037AA IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_007037AA
Source: C:\Windows\Temp\{FFE22A89-11FD-4A47-9FF0-982DA2A5AD2F}\.be\EMA3D.exe	Code function: 3_2_00A3E0C8 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	3_2_00A3E0C8
Source: C:\Windows\Temp\{FFE22A89-11FD-4A47-9FF0-982DA2A5AD2F}\.be\EMA3D.exe	Code function: 3_2_00A3E594 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_00A3E594
Source: C:\Windows\Temp\{FFE22A89-11FD-4A47-9FF0-982DA2A5AD2F}\.be\EMA3D.exe	Code function: 3_2_00A437AA IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_00A437AA
Source: C:\Windows\Temp\{FFE22A89-11FD-4A47-9FF0-982DA2A5AD2F}\.be\EMA3D.exe	Code function: 3_2_00A3E727 SetUnhandledExceptionFilter,	3_2_00A3E727

Source: C:\Windows\Temp\{562041EC-09A3-44AA-87AE-CC1700EABB21}\.cr\jlK7Q70gbN.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\jlK7Q70gbN.exe	Process created: C:\Windows\Temp\{562041EC-09A3-44AA-87AE-CC1700EABB21}\.cr\jlK7Q70gbN.exe "C:\Windows\Temp\{562041EC-09A3-44AA-87AE-CC1700EABB21}\.cr\jlK7Q70gbN.exe" -burn.clean.room="C:\Users\user\Desktop\jlK7Q70gbN.exe" -burn.filehandle.attached=528 -burn.filehandle.self=540			Jump to behavior
Source: C:\Windows\Temp\{562041EC-09A3-44AA-87AE-CC1700EABB21}\.cr\jlK7Q70gbN.exe	Process created: C:\Windows\Temp\{FFE22A89-11FD-4A47-9FF0-982DA2A5AD2F}\.be\EMA3D.exe "C:\Windows\Temp\{FFE22A89-11FD-4A47-9FF0-982DA2A5AD2F}\.be\EMA3D.exe" -q -burn.elevated BurnPipe.{01823A2F-6092-4017-B70C-7D2B2DE988B6} {636B081A-FA87-43E7-BB2F-5B923C0323C7} 6180			Jump to behavior

Source: C:\Users\user\Desktop\jlK7Q70gbN.exe

Code function: 0_2_007119F8 InitializeSecurityDescriptor,GetLastError,CreateWellKnownSid,CreateWellKnownSid,GetLastError,CreateWellKnownSid,GetLastError,CreateWellKnownSid,GetLastError,CreateWellKnownSid,GetLastError,CreateWellKnownSid,GetLastError,SetEntriesInAclA,SetSecurityDescriptorOwner,GetLastError,SetSecurityDescriptorGroup,GetLastError,SetSecurityDescriptorDacl,GetLastError,CoInitializeSecurity,LocalFree,

0_2_007119F8

Source: C:\Users\user\Desktop\jlK7Q70gbN.exe

Code function: 0_2_00713D0B AllocateAndInitializeSid,CheckTokenMembership,

0_2_00713D0B

Source: C:\Users\user\Desktop\jlK7Q70gbN.exe

Code function: 0_2_006FE957 cpuid

0_2_006FE957

Source: C:\Windows\Temp\{562041EC-09A3-44AA-87AE-CC1700EABB21}\.cr\jlK7Q70gbN.exe	Queries volume information: C:\Windows\Temp\{FFE22A89-11FD-4A47-9FF0-982DA2A5AD2F}\.ba\BootstrapperCore.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Temp\{562041EC-09A3-44AA-87AE-CC1700EABB21}\.cr\jlK7Q70gbN.exe	Queries volume information: C:\Windows\Temp\{FFE22A89-11FD-4A47-9FF0-982DA2A5AD2F}\.ba\ema3d.UI.Boot.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Temp\{562041EC-09A3-44AA-87AE-CC1700EABB21}\.cr\jlK7Q70gbN.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Temp\{562041EC-09A3-44AA-87AE-CC1700EABB21}\.cr\jlK7Q70gbN.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Temp\{562041EC-09A3-44AA-87AE-CC1700EABB21}\.cr\jlK7Q70gbN.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\PresentationFramework-SystemXml\v4.0_4.0.0.0__b77a5c561934e089\PresentationFramework-SystemXml.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Temp\{562041EC-09A3-44AA-87AE-CC1700EABB21}\.cr\jlK7Q70gbN.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Temp\{562041EC-09A3-44AA-87AE-CC1700EABB21}\.cr\jlK7Q70gbN.exe	Queries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Temp\{562041EC-09A3-44AA-87AE-CC1700EABB21}\.cr\jlK7Q70gbN.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\UIAutomationTypes\v4.0_4.0.0.0__31bf3856ad364e35\UIAutomationTypes.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Temp\{562041EC-09A3-44AA-87AE-CC1700EABB21}\.cr\jlK7Q70gbN.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\UIAutomationProvider\v4.0_4.0.0.0__31bf3856ad364e35\UIAutomationProvider.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Temp\{562041EC-09A3-44AA-87AE-CC1700EABB21}\.cr\jlK7Q70gbN.exe	Queries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Temp\{562041EC-09A3-44AA-87AE-CC1700EABB21}\.cr\jlK7Q70gbN.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Temp\{562041EC-09A3-44AA-87AE-CC1700EABB21}\.cr\jlK7Q70gbN.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Temp\{562041EC-09A3-44AA-87AE-CC1700EABB21}\.cr\jlK7Q70gbN.exe	Queries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Temp\{562041EC-09A3-44AA-87AE-CC1700EABB21}\.cr\jlK7Q70gbN.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\jlK7Q70gbN.exe

Code function: 0_2_006E4E67 ConvertStringSecurityDescriptorToSecurityDescriptorW,GetLastError,CreateNamedPipeW,GetLastError,CreateNamedPipeW,GetLastError,CloseHandle,LocalFree,

0_2_006E4E67

Source: C:\Users\user\Desktop\jlK7Q70gbN.exe

Code function: 0_2_006D605F GetSystemTime,GetDateFormatW,GetLastError,GetLastError,GetDateFormatW,GetLastError,

0_2_006D605F

Source: C:\Users\user\Desktop\jlK7Q70gbN.exe

Code function: 0_2_006D6203 GetUserNameW,GetLastError,

0_2_006D6203

Source: C:\Users\user\Desktop\jlK7Q70gbN.exe

Code function: 0_2_00718A8F GetTimeZoneInformation,SystemTimeToTzSpecificLocalTime,

0_2_00718A8F

Source: C:\Users\user\Desktop\jlK7Q70gbN.exe

Code function: 0_2_006D51D2 GetModuleHandleW,CoInitializeEx,GetVersionExW,GetLastError,CoUninitialize,

0_2_006D51D2

Source: C:\Windows\Temp\{562041EC-09A3-44AA-87AE-CC1700EABB21}\.cr\jlK7Q70gbN.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	3 Command and Scripting Interpreter	1 Windows Service	1 Access Token Manipulation	1 Masquerading	OS Credential Dumping	12 System Time Discovery	Remote Services	1 Archive Collected Data	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Service Execution	1 DLL Side-Loading	1 Windows Service	1 Disable or Modify Tools	LSASS Memory	2 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 Native API	Logon Script (Windows)	12 Process Injection	32 Virtualization/Sandbox Evasion	Security Account Manager	32 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 DLL Side-Loading	1 Access Token Manipulation	NTDS	1 Account Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	12 Process Injection	LSA Secrets	1 System Owner/User Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Deobfuscate/Decode Files or Information	Cached Domain Credentials	2 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	2 Obfuscated Files or Information	DCSync	25 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner
C:\Windows\Temp\{FFE22A89-11FD-4A47-9FF0-982DA2A5AD2F}\.ba\BootstrapperCore.dll	0%	ReversingLabs
C:\Windows\Temp\{FFE22A89-11FD-4A47-9FF0-982DA2A5AD2F}\.ba\Microsoft.Deployment.WindowsInstaller.dll	0%	ReversingLabs
C:\Windows\Temp\{FFE22A89-11FD-4A47-9FF0-982DA2A5AD2F}\.ba\mbahost.dll	0%	ReversingLabs
C:\Windows\Temp\{FFE22A89-11FD-4A47-9FF0-982DA2A5AD2F}\.ba\mbapreq.dll	0%	ReversingLabs

Source	Detection	Scanner	Label
http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t	0%	URL Reputation	safe
https://sectigo.com/CPS0	0%	URL Reputation	safe
http://crl.sectigo.com/SectigoPublicCodeSigningCAR36.crl0y	0%	URL Reputation	safe
http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0	0%	URL Reputation	safe
http://ocsp.sectigo.com0	0%	URL Reputation	safe
http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#	0%	URL Reputation	safe
http://crt.sectigo.com/SectigoPublicCodeSigningCAR36.crt0#	0%	URL Reputation	safe
http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#	0%	URL Reputation	safe

Name	Source	Malicious	Antivirus Detection	Reputation
http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t	jlK7Q70gbN.exe, EMA3D.exe.2.dr, jlK7Q70gbN.exe.0.dr, ema3d.UI.Boot.dll.2.dr	false	URL Reputation: safe	unknown
https://sectigo.com/CPS	jlK7Q70gbN.exe, 00000000.00000002.3297556859.000000000085B000.00000004.00000010.00020000.00000000.sdmp	false		unknown
http://wixtoolset.org/releases/	Microsoft.Deployment.WindowsInstaller.dll.2.dr	false		unknown
https://sectigo.com/CPS0	jlK7Q70gbN.exe, EMA3D.exe.2.dr, jlK7Q70gbN.exe.0.dr, ema3d.UI.Boot.dll.2.dr	false	URL Reputation: safe	unknown
http://appsyndication.org/2006/appsynapplicationc:	jlK7Q70gbN.exe, EMA3D.exe.2.dr, jlK7Q70gbN.exe.0.dr	false		unknown
http://crl.sectigo.com/SectigoPublicCodeSigningCAR36.crl0y	jlK7Q70gbN.exe, EMA3D.exe.2.dr, jlK7Q70gbN.exe.0.dr, ema3d.UI.Boot.dll.2.dr	false	URL Reputation: safe	unknown
http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0	jlK7Q70gbN.exe, EMA3D.exe.2.dr, jlK7Q70gbN.exe.0.dr, ema3d.UI.Boot.dll.2.dr	false	URL Reputation: safe	unknown
http://ocsp.sectigo.com0	jlK7Q70gbN.exe, EMA3D.exe.2.dr, jlK7Q70gbN.exe.0.dr, ema3d.UI.Boot.dll.2.dr	false	URL Reputation: safe	unknown
http://wixtoolset.org	BootstrapperCore.dll.2.dr, mbahost.dll.2.dr, Microsoft.Deployment.WindowsInstaller.dll.2.dr, mbapreq.dll.2.dr	false		unknown
http://wixtoolset.org/schemas/thmutil/2010	mbapreq.thm.2.dr	false		unknown
https://www.ansys.com.mcas.ms/legal/terms-and	jlK7Q70gbN.exe, 00000002.00000003.2079705659.0000000008E31000.00000004.00000020.00020000.00000000.sdmp, ema3d.UI.Boot.dll.2.dr	false		unknown
http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#	jlK7Q70gbN.exe, EMA3D.exe.2.dr, jlK7Q70gbN.exe.0.dr, ema3d.UI.Boot.dll.2.dr	false	URL Reputation: safe	unknown
http://wixtoolset.org/Whttp://wixtoolset.org/telemetry/v	BootstrapperCore.dll.2.dr, Microsoft.Deployment.WindowsInstaller.dll.2.dr	false		unknown
http://crt.sectigo.com/SectigoPublicCodeSigningCAR36.crt0#	jlK7Q70gbN.exe, EMA3D.exe.2.dr, jlK7Q70gbN.exe.0.dr, ema3d.UI.Boot.dll.2.dr	false	URL Reputation: safe	unknown
http://ema3d.com$E	jlK7Q70gbN.exe, 00000002.00000003.2052420419.000000000131F000.00000004.00000020.00020000.00000000.sdmp, jlK7Q70gbN.exe, 00000002.00000003.2052117809.000000000131F000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://schemas.microsoft.ce6	EMA3D.exe, 00000003.00000002.3298190467.0000000000B38000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#	jlK7Q70gbN.exe, EMA3D.exe.2.dr, jlK7Q70gbN.exe.0.dr, ema3d.UI.Boot.dll.2.dr	false	URL Reputation: safe	unknown
http://wixtoolset.org/news/	BootstrapperCore.dll.2.dr, Microsoft.Deployment.WindowsInstaller.dll.2.dr	false		unknown
http://ema3d.com	jlK7Q70gbN.exe, 00000000.00000003.2042647450.0000000002E0A000.00000004.00000800.00020000.00000000.sdmp, jlK7Q70gbN.exe, 00000000.00000003.2043591191.0000000002E3B000.00000004.00000800.00020000.00000000.sdmp, jlK7Q70gbN.exe, 00000000.00000003.2042973845.0000000002E1A000.00000004.00000800.00020000.00000000.sdmp, jlK7Q70gbN.exe, 00000000.00000003.2043286088.0000000002E2B000.00000004.00000800.00020000.00000000.sdmp, jlK7Q70gbN.exe, 00000000.00000003.2042310528.0000000002DEB000.00000004.00000800.00020000.00000000.sdmp, jlK7Q70gbN.exe, 00000000.00000002.3297850430.0000000000C3A000.00000004.00000020.00020000.00000000.sdmp, jlK7Q70gbN.exe, 00000000.00000003.2044058097.0000000002E4D000.00000004.00000800.00020000.00000000.sdmp, jlK7Q70gbN.exe, 00000000.00000003.2042377711.0000000002DFC000.00000004.00000800.00020000.00000000.sdmp, jlK7Q70gbN.exe, 00000000.00000003.2044698951.0000000000C3E000.00000004.00000020.00020000.00000000.sdmp, jlK7Q70gbN.exe, 00000000.00000003.2044580204.0000000002E60000.00000004.00000800.00020000.00000000.sdmp, jlK7Q70gbN.exe, 00000000.00000003.2041684832.0000000000C3E000.00000004.00000020.00020000.00000000.sdmp, jlK7Q70gbN.exe, 00000000.00000002.3299565162.0000000002E61000.00000004.00000800.00020000.00000000.sdmp, jlK7Q70gbN.exe, 00000000.00000003.2045538277.0000000000C3A000.00000004.00000020.00020000.00000000.sdmp, jlK7Q70gbN.exe, 00000002.00000003.2048888766.000000000376B000.00000004.00000800.00020000.00000000.sdmp, jlK7Q70gbN.exe, 00000002.00000003.2046899780.000000000371B000.00000004.00000800.00020000.00000000.sdmp, jlK7Q70gbN.exe, 00000002.00000003.2047556826.000000000373A000.00000004.00000800.00020000.00000000.sdmp, jlK7Q70gbN.exe, 00000002.00000003.2049646636.0000000003790000.00000004.00000800.00020000.00000000.sdmp, jlK7Q70gbN.exe, 00000002.00000003.2049229983.000000000377D000.00000004.00000800.00020000.00000000.sdmp, jlK7Q70gbN.exe, 00000002.00000003.2048511892.000000000375B000.00000004.00000800.00020000.00000000.sdmp, jlK7Q70gbN.exe, 00000002.00000003.2048235598.000000000374A000.00000004.00000800.00020000.00000000.sdmp, jlK7Q70gbN.exe, 00000002.00000003.2046950182.000000000372C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://wixtoolset.org/releases/SCreating	BootstrapperCore.dll.2.dr	false		unknown
http://www.ansys.com/privacy	ema3d.UI.Boot.dll.2.dr	false		unknown
http://appsyndication.org/2006/appsyn	jlK7Q70gbN.exe, EMA3D.exe	false		unknown
https://www.ansys.com.mcas.ms/legal/terms-and-conditions/ansys-hybrid-compute-environment-security	ema3d.UI.Boot.dll.2.dr	false		unknown

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1528470
Start date and time:	2024-10-07 23:29:22 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 38s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	7
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	jlK7Q70gbN.exe renamed because original name is a hash value
Original Sample Name:	39e87c245f3df670592eac79160e0de43421742c0e0ab1cfb1452790f07747c9.exe
Detection:	CLEAN
Classification:	clean8.evad.winEXE@5/36@0/0
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 102 Number of non-executed functions: 294
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded domains from analysis (whitelisted): fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: jlK7Q70gbN.exe

Process:	C:\Windows\Temp\{562041EC-09A3-44AA-87AE-CC1700EABB21}\.cr\jlK7Q70gbN.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4632
Entropy (8bit):	5.180810347850249
Encrypted:	false
SSDEEP:	48:HFYZRM8NtnN/nNAt+NttNadN4t4N3N6nNMESc+VbCs/R2iwlsAliAlkzykykykyw:GZTNN6/DodU9dW3On
MD5:	58656A479C02A5087CB9BE077572A888
SHA1:	739E4950D8E9645858306E5F15B374A71ABE4977
SHA-256:	1F51C8292D2B3C0CDC98A4F09C42E37544C2B32059AB5720635A85F2722B2519
SHA-512:	896F5A4F13AEEC3589E24A3F46A53F59A452CF8A6CB4D361626F05A2ACB0F94722038CCED48D9A305EE38E32C213E2D48D5ECBEAC97A6FF8F846056D0877B9E9
Malicious:	false
Reputation:	low
Preview:	[1824:10E4][2024-10-07T17:30:12]i001: Burn v3.14.0.3910, Windows v10.0 (Build 19045: Service Pack 0), path: C:\Windows\Temp\{562041EC-09A3-44AA-87AE-CC1700EABB21}\.cr\jlK7Q70gbN.exe..[1824:10E4][2024-10-07T17:30:12]i000: Initializing numeric variable 'InstallMpi' to value '0'..[1824:10E4][2024-10-07T17:30:12]i000: Initializing numeric variable 'InstallDISCO' to value '0'..[1824:10E4][2024-10-07T17:30:12]i000: Initializing string variable 'InstallFolder' to value '[ProgramFiles64Folder]EMA'..[1824:10E4][2024-10-07T17:30:12]i000: Initializing string variable 'DiscoFolder' to value '[ProgramFiles64Folder]Ansys Inc'..[1824:10E4][2024-10-07T17:30:12]i000: Initializing string variable 'STKDirectory' to value '[ProgramFiles64Folder]'..[1824:10E4][2024-10-07T17:30:12]i000: Initializing string variable 'License' to value '[ProgramFiles64Folder]EMA\Shared\License\'..[1824:10E4][2024-10-07T17:30:12]i000: Initializing numeric variable 'CreateShortcut' to value '1'..[1824:10E4][2024-10-07T17:30:12]

C:\Windows\Temp\{562041EC-09A3-44AA-87AE-CC1700EABB21}\.cr\jlK7Q70gbN.exe

Download File

Process:	C:\Users\user\Desktop\jlK7Q70gbN.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1048328
Entropy (8bit):	7.595028138776364
Encrypted:	false
SSDEEP:	24576:5VnVr6ecc38BetTec6cXC6v8WlYKeuIsPUSy+4NY0yk7b7z:p67KTec/yclYK1rf4NxRX
MD5:	F51103F1E13618AE83B88837789FE62C
SHA1:	D5F2AF880AEB85B3B8933F8969D2A886A4B32574
SHA-256:	893CDA166AF5049C8C8A9C116BE2D75FA6122B6E90A13B8DF8F84FC355CE9A8D
SHA-512:	2B8B3FB4EF655BB9E7256716022E032BB8EA495198F8C125E4CFA2E1CEBD4398D2826FF6ACA57A032F2C8627E6D70C11E47746696F6F5ABD8FE12357E4EB0B7B
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B...#..#..#...E..#...E...#...K..#...K..#...K..#...E..#...E..#...E..#..#..."...J...#...JQ.#..#9.#...J..#..Rich.#..........PE..L...A.g^.....................T....................@..........................@.......h....@.................................t.......................(....&.......=...z..T....................{.......z..@...........................................text............................... ..`.rdata..............................@..@.data...............................@....wixburn8...........................@..@.rsrc...............................@..@.reloc...=.......>..................@..B........................................................................................................................................................................................................................................................

C:\Windows\Temp\{FFE22A89-11FD-4A47-9FF0-982DA2A5AD2F}\.ba\1028\mbapreq.wxl

Download File

Process:	C:\Windows\Temp\{562041EC-09A3-44AA-87AE-CC1700EABB21}\.cr\jlK7Q70gbN.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	2025
Entropy (8bit):	6.231406644010833
Encrypted:	false
SSDEEP:	48:cxX7DTAT8tMBCus9T3FVWmHdniarRFeOrw8Nhv2VyfN3mKNWFP44SBWWW1GyfiPq:8L4T2RJhfHP8+VYuTmQUc2mE
MD5:	1D4B831F77EFEC96FFBC70BC4B59B8B5
SHA1:	1B3ED82655AEC8A52DAEC60F8674BC7E07F8CFEB
SHA-256:	1B93556F07C35AC0564D57E0743CCBA231950962C6506C8D4A74A31CD66FD04C
SHA-512:	C6CCB188281F161DEBF02DCDDE24B77D8D14943DEED8852E77E5AFB18F3F62683AB1AE06DCEB1E09D53804A76DF6400A360712D8E7E228B7F971054BB4FB2496
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	<?xml version="1.0" encoding="utf-8"?>.. Copyright (c) .NET Foundation and contributors. All rights reserved. Licensed under the Microsoft Reciprocal License. See LICENSE.TXT file in the project root for full license information. -->......<WixLocalization Culture="zh-tw" Language="1028" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <String Id="Caption">[WixBundleName] ....</String>.. <String Id="Title">[WixBundleName] ...... Microsoft .NET Framework</String>.. <String Id="ConfirmCancelMessage">.......?</String>.. <String Id="HelpHeader">......</String>.. <String Id="HelpText">/passive \| /quiet - ...... UI ............ UI ... ........... UI ........../norestart - ................UI ............./log log.txt - ............ %TEMP% ......</String>.. <Stri

C:\Windows\Temp\{FFE22A89-11FD-4A47-9FF0-982DA2A5AD2F}\.ba\1029\mbapreq.wxl

Download File

Process:	C:\Windows\Temp\{562041EC-09A3-44AA-87AE-CC1700EABB21}\.cr\jlK7Q70gbN.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	2458
Entropy (8bit):	5.36165936198009
Encrypted:	false
SSDEEP:	48:cxX7DTZT8u9cktosM6re4mSTcIIyfI7sh/DMNwIHWAoN3mepNRfKPnWZ0hqAQZfC:8LxTK23f33AwIViRrRynRuZfiMS
MD5:	CC8C6D04DC707B38E0F0C08BA16FE49B
SHA1:	95EA7F570677AEA52393D02FDB21CEBB218A7343
SHA-256:	DC445E2457ED31ABF536871F90FF7CC96800A40B6BC033F37D45E3156A3B4FA9
SHA-512:	A4B19EBC8BB0D88ABA7D3D5783E28F8B6E0960582A540059BC71076B1203BF43BCA15EA726272D15395C7B4E431046ADA1CBB9D55072BBC5DBE7729C4599F0E0
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	<?xml version="1.0" encoding="utf-8"?>.. Copyright (c) .NET Foundation and contributors. All rights reserved. Licensed under the Microsoft Reciprocal License. See LICENSE.TXT file in the project root for full license information. -->......<WixLocalization Culture="cs-cz" Language="1029" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <String Id="Caption">Instalace produktu [WixBundleName]</String>.. <String Id="Title">Pro instalaci produktu [WixBundleName] je vy.adov.no rozhran. Microsoft .NET Framework.</String>.. <String Id="ConfirmCancelMessage">Opravdu chcete akci zru.it?</String>.. <String Id="HelpHeader">N.pov.da k instalaci</String>.. <String Id="HelpText">/passive \| /quiet - Zobraz. minim.ln. u.ivatelsk. rozhran. bez jak.chkoli.. v.zev, nebo nezobraz. ..dn. u.ivatelsk. rozhran. ani ..dn. v.zvy. Ve v.choz.m.. nastaven. se jak u.ivatelsk. rozhran., tak i v.echny v.zvy zobrazuj....../norestart - Potla.. jak.koli p

C:\Windows\Temp\{FFE22A89-11FD-4A47-9FF0-982DA2A5AD2F}\.ba\1030\mbapreq.wxl

Download File

Process:	C:\Windows\Temp\{562041EC-09A3-44AA-87AE-CC1700EABB21}\.cr\jlK7Q70gbN.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	2286
Entropy (8bit):	5.061915970731254
Encrypted:	false
SSDEEP:	48:cxX7DCrT81tbzjamsjFq7LhzqGgdRDJNbqoN3mpN+ELPnfyOwYxPyzraXnAF:8LaTOkaEOiGd/BwF
MD5:	7C6E4CE87870B3B5E71D3EF4555500F8
SHA1:	E831E8978A48BEAFA04AAD52A564B7EADED4311D
SHA-256:	CAC263E0E90A4087446A290055257B1C39F17E11F065598CB2286DF4332C7696
SHA-512:	2A02415A3E5F073F4530FD87C97B685D95B8C0E1B15EFD185CC5CB046FCF1D0DCE28DB9889AD52588B96FE01841A7A61F6B7D6D2F669EAB10A8926C46B8E93D1
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	<?xml version="1.0" encoding="utf-8"?>.. Copyright (c) .NET Foundation and contributors. All rights reserved. Licensed under the Microsoft Reciprocal License. See LICENSE.TXT file in the project root for full license information. -->......<WixLocalization Culture="da-dk" Language="1030" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <String Id="Caption">Installation af [WixBundleName]</String>.. <String Id="Title">Microsoft .NET Framework skal v.re installeret i forbindelse med Installationen af [WixBundleName]</String>.. <String Id="ConfirmCancelMessage">Er du sikker p., at du vil annullere?</String>.. <String Id="HelpHeader">Hj.lp til installation</String>.. <String Id="HelpText">/passive \| /quiet - viser en minimal brugergr.nseflade uden prompter eller.. viser ingen brugergr.nseflade og ingen prompter... Brugergr.nsefladen og alle prompter vises som standard...../norestart - skjuler fors.g p. genstart. Der vises som standard en.. foresp.rgse

C:\Windows\Temp\{FFE22A89-11FD-4A47-9FF0-982DA2A5AD2F}\.ba\1031\mbapreq.wxl

Download File

Process:	C:\Windows\Temp\{562041EC-09A3-44AA-87AE-CC1700EABB21}\.cr\jlK7Q70gbN.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	2442
Entropy (8bit):	5.094465051245675
Encrypted:	false
SSDEEP:	48:cxX7DASTcCwit/soJy9hkVByUZN+29N3mfN65PS9CvZwZi7uuASD:8LxT8itGeVB97+gyC9BdaSD
MD5:	C8E7E0B4E63B3076047B7F49C76D56E1
SHA1:	4E44E656A0D552B2FFD65911CB45245364E5DBF3
SHA-256:	631D46CB048FB6CF0B9A1362F8E5A1854C46E9525A0260C7841A04B2316C8295
SHA-512:	FD7E8896F9414F0DB7A88F926F55EE24E0591DA676F330200BC6BB829EB32648D90D3094E0011BFE36C7BA8BE41DFD74B12D444AFEA0D2866801258DA4FA16E8
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	<?xml version="1.0" encoding="utf-8"?>.. Copyright (c) .NET Foundation and contributors. All rights reserved. Licensed under the Microsoft Reciprocal License. See LICENSE.TXT file in the project root for full license information. -->......<WixLocalization Culture="de-de" Language="1031" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <UI Control="InstallButton" Width="180" />.. .. <String Id="Caption">[WixBundleName]-Setup</String>.. <String Id="Title">F.r das [WixBundleName]-Setup ist Microsoft .NET Framework erforderlich.</String>.. <String Id="ConfirmCancelMessage">Sind Sie sicher, dass Sie den Vorgang abbrechen m.chten?</String>.. <String Id="HelpHeader">Setup-Hilfe</String>.. <String Id="HelpText">/passive \| /quiet - zeigt eine minimale Benutzeroberfl.che ohne.. Eingabeaufforderungen oder keine Benutzeroberfl.che und keine.. Eingabeaufforderungen an. Standardm..ig werden die Benutzeroberfl.che und.. alle Eingabeaufforderungen angezeigt...../no

C:\Windows\Temp\{FFE22A89-11FD-4A47-9FF0-982DA2A5AD2F}\.ba\1032\mbapreq.wxl

Download File

Process:	C:\Windows\Temp\{562041EC-09A3-44AA-87AE-CC1700EABB21}\.cr\jlK7Q70gbN.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	3400
Entropy (8bit):	5.279888750092028
Encrypted:	false
SSDEEP:	48:cxX7D8jVT8dUk9Ug/usOo2pNSBIbESvR2drdESPzghC76DeN2hL0eLoN3mOLSNIx:8L45TCyop5riGzH7xgJit8IqSsBwqk
MD5:	074D5921AF07E6126049CB45814246ED
SHA1:	91D4BDDA8D2B703879CFE2C28550E0A46074FA57
SHA-256:	B8E90E20EDF110AAAAEA54FBC8533872831777BE5589E380CFDD17E1F93147B5
SHA-512:	28DAC36516BCC76BCC598C6E7ABDE359695F85AB7A830D6ADBC844EB240D9FA372CB5A5CE4DBE21E250408C6B246D371D3CDD656D2178FB0EC22DAC7D39CBD9F
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. Copyright (c) .NET Foundation and contributors. All rights reserved. Licensed under the Microsoft Reciprocal License. See LICENSE.TXT file in the project root for full license information. -->......<WixLocalization Culture="el-gr" Language="1032" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <String Id="Caption">........... ... [WixBundleName]</String>.. <String Id="Title">... ... ........... ... [WixBundleName] .......... .. Microsoft .NET Framework</String>.. <String Id="ConfirmCancelMessage">..... ....... ... ...... .. ..... .......;</String>.. <String Id="HelpHeader">....... ... ... ...........</String>.. <String Id="HelpText">/passive \| /quiet - ......... ........ ........... ... ............. .......... ...... ..... ........ . ... ..

C:\Windows\Temp\{FFE22A89-11FD-4A47-9FF0-982DA2A5AD2F}\.ba\1035\mbapreq.wxl

Download File

Process:	C:\Windows\Temp\{562041EC-09A3-44AA-87AE-CC1700EABB21}\.cr\jlK7Q70gbN.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	2235
Entropy (8bit):	5.142592159444541
Encrypted:	false
SSDEEP:	48:cxX7DE+T8Z+bm5snwETMAoQEATN27uNBDReq4N3mJeNHNP64NsFKJJem4vyAs:8LZTDkZ7+2IBCht6J8neHs
MD5:	E338408F1101499EB22507A3451F7B06
SHA1:	83B42F9D7307265A108FC339D0460D36B66A8B94
SHA-256:	B7D9528F29761C82C3D926EFE5E0D5036A0E0D83EB4CCA7282846C86A9D6F9F3
SHA-512:	F7BE923DC2856E0941D0669E2DE5A5C307C98DC7EBA0A1B68728EB29C95B4625145C2AD3AC6F6B6D82F062887EA349E2187F1F91785DDE5A5083BC1150E56326
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. Copyright (c) .NET Foundation and contributors. All rights reserved. Licensed under the Microsoft Reciprocal License. See LICENSE.TXT file in the project root for full license information. -->......<WixLocalization Culture="fi-fi" Language="1035" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <String Id="Caption">[WixBundleName] -asennus</String>.. <String Id="Title">Microsoft .NET Framework tarvitaan [WixBundleName] -asennusta varten</String>.. <String Id="ConfirmCancelMessage">Haluatko varmasti peruuttaa?</String>.. <String Id="HelpHeader">Asennusohjelman ohje</String>.. <String Id="HelpText">/passive \| /quiet - n.ytt.. mahdollisimman v.h.n k.ytt.liittym.st.; ei.. kehotteita tai ei k.ytt.liittym.. ja kehotteita. Oletusarvoisesti.. k.ytt.liittym. ja kaikki kehotteet n.ytet..n...../norestart - est.. uudelleenk.ynnistysyritykset. Oletusarvoisesti.. k.ytt.liittym. kysyy ennen uudelleenk.yn

C:\Windows\Temp\{FFE22A89-11FD-4A47-9FF0-982DA2A5AD2F}\.ba\1036\mbapreq.wxl

Download File

Process:	C:\Windows\Temp\{562041EC-09A3-44AA-87AE-CC1700EABB21}\.cr\jlK7Q70gbN.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	2306
Entropy (8bit):	5.076293283609686
Encrypted:	false
SSDEEP:	48:cxX7DyBT81BbKBswAL1xV1wjRcDSNwDXoN3mSZfNhkLPkQpznsdMEodAY:8LwTK5KHsijmEXY
MD5:	AA32A059AADD42431F7837CB1BE7257F
SHA1:	4CD21661E341080FB8C2DEFD9F32F134561FC3BA
SHA-256:	88E7DDACD6B714D94D5322876BD50051479B7A0C686DC2E9EB06B3B7A0BC06C9
SHA-512:	78E201F369E65535E25722DFC0EFE99EDF641F7C14EFF1526DC1CC047FF11640079F1E3D25C9072CF25F4804195891BE006FC5ED313063AFCB91FB5700120B88
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. Copyright (c) .NET Foundation and contributors. All rights reserved. Licensed under the Microsoft Reciprocal License. See LICENSE.TXT file in the project root for full license information. -->......<WixLocalization Culture="fr-fr" Language="1036" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <String Id="Caption">Installation de [WixBundleName]</String>.. <String Id="Title">Microsoft .NET Framework requis pour l'installation de [WixBundleName]</String>.. <String Id="ConfirmCancelMessage">.tes-vous s.r de vouloir annuler.?</String>.. <String Id="HelpHeader">Aide de l'installation</String>.. <String Id="HelpText">/passive \| /quiet - affiche une interface minimale sans invites ou n'affiche.. aucune interface ni aucune invite. Par d.faut, l'interface et toutes les.. invites sont affich.es...../norestart - annule toute tentative de red.marrage. Par d.faut, l'interface.. affiche une invite avant de red.marrer..

C:\Windows\Temp\{FFE22A89-11FD-4A47-9FF0-982DA2A5AD2F}\.ba\1038\mbapreq.wxl

Download File

Process:	C:\Windows\Temp\{562041EC-09A3-44AA-87AE-CC1700EABB21}\.cr\jlK7Q70gbN.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	2392
Entropy (8bit):	5.293225307744296
Encrypted:	false
SSDEEP:	48:cxX7DwzT8cSwvs48mF7GD/g1v0wH7N3wwJxL99oN3m/ZNRUYPBZRT1XESW3o/ULG:8LQT2wpFGbgT3wMN2QRj/y/LKr
MD5:	17FB605A2F02DA203DF06F714D1CC6DE
SHA1:	3A71D13D4CCA06116B111625C90DD1C451EA9228
SHA-256:	55CF62D54EFB79801A9D94B24B3C9BA221C2465417A068950D40A67C52BA66EF
SHA-512:	D05008D37143A1CC031F4B6268490A5A10FBB686C86984D20DB94843BDC4624EF9651D158DCB5B660FC239C3C3E8D087EB5D23FFFB8C4681910CBC376148F0F0
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. Copyright (c) .NET Foundation and contributors. All rights reserved. Licensed under the Microsoft Reciprocal License. See LICENSE.TXT file in the project root for full license information. -->......<WixLocalization Culture="hu-hu" Language="1038" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <String Id="Caption">[WixBundleName] telep.t.</String>.. <String Id="Title">A(z) [WixBundleName] telep.t.s.hez Microsoft .NET-keretrendszer sz.ks.ges</String>.. <String Id="ConfirmCancelMessage">Biztosan megszak.tja?</String>.. <String Id="HelpHeader">A telep.t. s.g.ja</String>.. <String Id="HelpText">/passive \| /quiet - Minim.lis felhaszn.l.i fel.let megjelen.t.se k.rd.sek.. n.lk.l, illetve felhaszn.l.i fel.let .s k.rd.sek megjelen.t.se n.lk.li.. telep.t.s. Alapesetben a felhaszn.l.i fel.let .s minden k.rd.s megjelenik...../norestart - Az .jraind.t.si k.r.sek elrejt.se. Alapeset

C:\Windows\Temp\{FFE22A89-11FD-4A47-9FF0-982DA2A5AD2F}\.ba\1040\mbapreq.wxl

Download File

Process:	C:\Windows\Temp\{562041EC-09A3-44AA-87AE-CC1700EABB21}\.cr\jlK7Q70gbN.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	2304
Entropy (8bit):	4.985260685429469
Encrypted:	false
SSDEEP:	48:cxX7DQyT81ebRcesyB+lY25ukVpkXJM2DJNXhpXZoN3mMhNTM+POYO/n1YxXlcI5:8LFTzLtkfwWKXHZi37MIDp
MD5:	50261379B89457B1980FF19CFABE6A08
SHA1:	F80B1F416539D33206CE3C24BA3B14B799A84813
SHA-256:	A40C94EB33F8841C79E9F6958433AFFD517F97B4570F731666AF572E63178BB7
SHA-512:	BBD9794181EEC95D6BE7A1B7BA83FD61AF2B2DF61D9DA8DDA2788B61BEC53C30FCEFE5222EDF134166532B36D3AB6CE8996F2D670DC6907C1864AF881A21EA40
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. Copyright (c) .NET Foundation and contributors. All rights reserved. Licensed under the Microsoft Reciprocal License. See LICENSE.TXT file in the project root for full license information. -->......<WixLocalization Culture="it-it" Language="1040" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <String Id="Caption">Installazione di [WixBundleName]</String>.. <String Id="Title">Microsoft .NET Framework necessario per l'installazione di [WixBundleName]</String>.. <String Id="ConfirmCancelMessage">Annullare?</String>.. <String Id="HelpHeader">Guida dell'installazione</String>.. <String Id="HelpText">/passive \| /quiet - visualizza l'interfaccia utente minima senza istruzioni.. oppure non visualizza n. l'interfaccia utente n. le istruzioni. Per.. impostazione predefinita vengono visualizzate interfaccia utente e.. istruzioni...../norestart - elimina eventuali tentativi di riavvio. Per impostazione.. predefinita l'int

C:\Windows\Temp\{FFE22A89-11FD-4A47-9FF0-982DA2A5AD2F}\.ba\1041\mbapreq.wxl

Download File

Process:	C:\Windows\Temp\{562041EC-09A3-44AA-87AE-CC1700EABB21}\.cr\jlK7Q70gbN.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	2545
Entropy (8bit):	5.923292576429967
Encrypted:	false
SSDEEP:	48:cxX7DpcYT86WyscLpTIFw6tnOUjsj/D3NIgHcQN3mKN/WPOhT0SXsDay+z8QZEcE:8L1TccOFw6tnOUjsjpICnlOO934apWz
MD5:	DB0F5BAB42403FD67C0A18E35E6880EC
SHA1:	C0A18C8C5BCD7B88C384B5304B56EEB85A0DA3DC
SHA-256:	CCDCDB111EFA152C5F9FF4930033698B843390A549699AE802098D87431F16FE
SHA-512:	589522BD4A26BF54CCF3564E392E41BBBA4E7B3FD1ED74E7F4F6AD6F2E65CDE11FFF32D0C5F3BCD09052FE5110FDC361D1926E220FD0BAD2D38CAC21BBE93211
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. Copyright (c) .NET Foundation and contributors. All rights reserved. Licensed under the Microsoft Reciprocal License. See LICENSE.TXT file in the project root for full license information. -->......<WixLocalization Culture="ja-jp" Language="1041" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <String Id="Caption">[WixBundleName] ......</String>.. <String Id="Title">[WixBundleName] ........ Microsoft .NET Framework .....</String>.. <String Id="ConfirmCancelMessage">.......?</String>.. <String Id="HelpHeader">..........</String>.. <String Id="HelpText">/passive \| /quiet - ... UI ....................UI.. .............. .....UI ....................../norestart - ........................

C:\Windows\Temp\{FFE22A89-11FD-4A47-9FF0-982DA2A5AD2F}\.ba\1042\mbapreq.wxl

Download File

Process:	C:\Windows\Temp\{562041EC-09A3-44AA-87AE-CC1700EABB21}\.cr\jlK7Q70gbN.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	2236
Entropy (8bit):	5.97627825234954
Encrypted:	false
SSDEEP:	48:cxX7D3sT8ZeusKOwOWGyKCstFmhENI2Y+kN3mp4iNmi6IPa0dDaoIunvZqIHU5UH:8LQTXvRFhIzl44wmgko04U5TY
MD5:	442F8463EF5CA42B99B2EFACA696BD01
SHA1:	67496DB91CBAA85AC0727B12FC2D35E990537DAC
SHA-256:	D22F6ADA97DBFFC1E7548E52163807F982B30B11A2A5109E71F42985102CCCBD
SHA-512:	A350EAF9E7AEAFAB1163D7C0B8D014AFE07EE98BAE3915CBDD3C26282E345A0838E853C89BAE8943474758DCBCFD0BB0724A0C75CBF969F321FAB4944E8704FD
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. Copyright (c) .NET Foundation and contributors. All rights reserved. Licensed under the Microsoft Reciprocal License. See LICENSE.TXT file in the project root for full license information. -->......<WixLocalization Culture="ko-kr" Language="1042" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <String Id="Caption">[WixBundleName] ..</String>.. <String Id="Title">[WixBundleName] ... ... Microsoft .NET Framework</String>.. <String Id="ConfirmCancelMessage">........?</String>.. <String Id="HelpHeader">.. ...</String>.. <String Id="HelpText">/passive \| /quiet - ... .. .. UI. ..... UI. .... .... .... ..... ..... UI . .. .... ........../norestart - .. ..... ... ...... ..... UI. .. .... .. .... ......../log log.txt - .

C:\Windows\Temp\{FFE22A89-11FD-4A47-9FF0-982DA2A5AD2F}\.ba\1043\mbapreq.wxl

Download File

Process:	C:\Windows\Temp\{562041EC-09A3-44AA-87AE-CC1700EABB21}\.cr\jlK7Q70gbN.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2312
Entropy (8bit):	4.965432037520827
Encrypted:	false
SSDEEP:	48:cxX7DK1T8u7hbU7Asd7MqpSwzCcHGFN9OsNN3mvoNBC7hPFtO7+xw7t0Yza2Al:8LcTtpGLFSwJHmPnnKhEBtsl
MD5:	67F28BCDB3BA6774CD66AA198B06FF38
SHA1:	85D843B7248A5E1173FF9BD59CB73BB505F69B66
SHA-256:	226B778604236931B4AE45F6F272586C884A11517444A34BF45CD5CAE49BE62E
SHA-512:	7BC7D3E6E19ECF865B2CABFC46C75D516561D5A8A81A8ED55B4EDBA41A13A7110F474473740200AFB035B9597A2511D08C2A2E7A9ADE2C2AB4D3F168944B8328
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. Copyright (c) .NET Foundation and contributors. All rights reserved. Licensed under the Microsoft Reciprocal License. See LICENSE.TXT file in the project root for full license information. -->......<WixLocalization Culture="nl-nl" Language="1043" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <String Id="Caption">[WixBundleName] Installatie</String>.. <String Id="Title">Microsoft .NET Framework is vereist voor installatie [WixBundleName]</String>.. <String Id="ConfirmCancelMessage">Weet u zeker dat u de installatie wilt annuleren?</String>.. <String Id="HelpHeader">Help bij Setup</String>.. <String Id="HelpText">/passive \| /quiet - geeft een minimale gebruikersinterface weer zonder prompts.. of geeft geen gebruikersinterface en geen prompts weer. Gebruikersinterface.. en alle prompts worden standaard weergegeven...../norestart - pogingen tot opnieuw opstarten onderdrukken... Gebruikersinterface vraagt standaard al

C:\Windows\Temp\{FFE22A89-11FD-4A47-9FF0-982DA2A5AD2F}\.ba\1044\mbapreq.wxl

Download File

Process:	C:\Windows\Temp\{562041EC-09A3-44AA-87AE-CC1700EABB21}\.cr\jlK7Q70gbN.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	2171
Entropy (8bit):	5.089922193759582
Encrypted:	false
SSDEEP:	48:cxX7DTeT8uUbnFdsLnFHv+Gpm1qL5DQNDDaoN3mpZfN15dPnfuOOg5wZ5uAq8fAS:8L+Tec1x8Siule4S
MD5:	5454F724C9CDAB8172678A1CC7057220
SHA1:	241A57018ACE1210881583A9CF646E7D2E51412F
SHA-256:	41545AC1247B61C3C3E2A7E4659D9FAD2BCCA8347C69F2EB7B9D0CF5FC31E113
SHA-512:	40E311EADA299996E32A7D35223CA678A03C869D63C023D59BC97A7B2049B0252AA9D0A7EC8558D5ACB73BD14C7BFA913097E65ABEE7455658DB7E35BBDA8AE1
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. Copyright (c) .NET Foundation and contributors. All rights reserved. Licensed under the Microsoft Reciprocal License. See LICENSE.TXT file in the project root for full license information. -->......<WixLocalization Culture="nb-no" Language="1044" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <String Id="Caption">[WixBundleName] Installasjonsprogram</String>.. <String Id="Title">Microsoft .NET Framework kreves for [WixBundleName]-installasjon</String>.. <String Id="ConfirmCancelMessage">Er du sikker p. at du vil avbryte?</String>.. <String Id="HelpHeader">Installasjonshjelp</String>.. <String Id="HelpText">/passive \| /quiet - viser minimalt brukergrensesnitt uten ledetekster, eller.. ikke noe brukergrensesnitt og ingen ledetekster. Som standard vises.. brukergrensesnitt og alle ledetekster...../norestart - undertrykker alle fors.k p. omstart. Som standard sp.r.. brukergrensesnittet f.r omstart.../log log.txt

C:\Windows\Temp\{FFE22A89-11FD-4A47-9FF0-982DA2A5AD2F}\.ba\1045\mbapreq.wxl

Download File

Process:	C:\Windows\Temp\{562041EC-09A3-44AA-87AE-CC1700EABB21}\.cr\jlK7Q70gbN.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	2368
Entropy (8bit):	5.270514043715206
Encrypted:	false
SSDEEP:	48:cxX7Du4OT82gXusarwkfpYrKD8DTNkbNuoN3mjbsNniIPh8ynN1NYd4iYuffAL:8LKTsXgpYr2IyoiiOffpT3L
MD5:	96ACAAA5AEF7798E9048BAFF4C3FA8D3
SHA1:	E76629973F6C1CFC06F60BA64FE9F237B2DB9698
SHA-256:	F4AA983E39FB29C95E3306082F034B3A43E1D26489C997B8E6697B6A3B2F9F3C
SHA-512:	964F73E572BDCB1AD946C770E6A2FB4A1CE54AF4B5BB072F64256083BA27A223F4DAD4A95B9D2A646180806D1F977726147970B06AAC35EED75AEC6CA89ED337
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. Copyright (c) .NET Foundation and contributors. All rights reserved. Licensed under the Microsoft Reciprocal License. See LICENSE.TXT file in the project root for full license information. -->......<WixLocalization Culture="pl-pl" Language="1045" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <String Id="Caption">Instalator programu [WixBundleName]</String>.. <String Id="Title">Do zainstalowania programu [WixBundleName] jest wymagany program Microsoft .NET Framework</String>.. <String Id="ConfirmCancelMessage">Czy na pewno chcesz anulowa.?</String>.. <String Id="HelpHeader">Pomoc instalatora</String>.. <String Id="HelpText">/passive \| /quiet - wy.wietla minimalny interfejs u.ytkownika bez monit.w.. lub nie wy.wietla interfejsu u.ytkownika ani monit.w. Domy.lnie jest.. wy.wietlany interfejs u.ytkownika i wszystkie monity...../norestart - pomija wszelkie pr.by ponownego uruchomienia. Domy.lnie.. interf

C:\Windows\Temp\{FFE22A89-11FD-4A47-9FF0-982DA2A5AD2F}\.ba\1046\mbapreq.wxl

Download File

Process:	C:\Windows\Temp\{562041EC-09A3-44AA-87AE-CC1700EABB21}\.cr\jlK7Q70gbN.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	2147
Entropy (8bit):	5.130635342194656
Encrypted:	false
SSDEEP:	48:cxX7DuoT85b0s/4TDoYDj4NF5j2hN3mMNYskPDXKIMaKcP9A5g:8L1TmBHjs59M8r6
MD5:	BD39ADB6B872163FD2D570028E9F3213
SHA1:	688B8A109688D3EA483548F29DE2E57A8A56C868
SHA-256:	ECB5C22E6C2423CAF07AEBE69F4FAF22450164EEE9587B64EF45A2D7F658CA15
SHA-512:	F2826BE203E767D09FF0D7677E1CF5B13113B773D529166DAE02A1F5DB2DC58E0856A34901DF70011EBABB6E964FAB7ACF38590E650BD629D4E4DC4CB36C8D45
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. Copyright (c) .NET Foundation and contributors. All rights reserved. Licensed under the Microsoft Reciprocal License. See LICENSE.TXT file in the project root for full license information. -->......<WixLocalization Culture="pt-br" Language="1046" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <String Id="Caption">[WixBundleName] Instala..o</String>.. <String Id="Title">Microsoft .NET Framework . necess.rio para instala..o do [WixBundleName]</String>.. <String Id="ConfirmCancelMessage">Tem certeza de que deseja cancelar?</String>.. <String Id="HelpHeader">Ajuda da Instala..o</String>.. <String Id="HelpText">/passive \| /quiet - exibe UI m.nima sem avisos ou exibe sem UI e.. sem avisos. Por padr.o a UI e todos avisos s.o exibidos...../norestart - suprime qualquer tentativa de reinicializa..o. Por padr.o a UI.. ir. solicitar antes de reiniciar.../log log.txt - logs para um arquivo espec.fico. Por padr.

C:\Windows\Temp\{FFE22A89-11FD-4A47-9FF0-982DA2A5AD2F}\.ba\1049\mbapreq.wxl

Download File

Process:	C:\Windows\Temp\{562041EC-09A3-44AA-87AE-CC1700EABB21}\.cr\jlK7Q70gbN.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	2880
Entropy (8bit):	5.408094213063887
Encrypted:	false
SSDEEP:	48:cxX7DkTT8fjtEeusogrohY2Ar7DHNnjTh53oN3miRMNKrdPin+/uYcbSkuEIcOvG:8LYT8EeHMMJRNi1Ruwi3OwL
MD5:	DAF167AF4031EF47E562056A7D51AA73
SHA1:	0156B230CADD6169AC2820865E3C031ED79785EF
SHA-256:	C91C9E87AB4A6DB078F1991F4A2CDC726B58A40E47BCE49D39168A8F8F151C3B
SHA-512:	5E87EE3838E3595ADBD7EABA6E3E33CDFEA5E15ED716FBCCDBD55235B3E53E1E41EA5A907F425E96C35167543C7F75AC5214B5AEE177D299FC2464A68B22851E
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. Copyright (c) .NET Foundation and contributors. All rights reserved. Licensed under the Microsoft Reciprocal License. See LICENSE.TXT file in the project root for full license information. -->......<WixLocalization Culture="ru-ru" Language="1049" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <String Id="Caption">......... [WixBundleName]</String>.. <String Id="Title">... ......... [WixBundleName] ......... Microsoft .NET Framework</String>.. <String Id="ConfirmCancelMessage">.. ............. ...... ........ ........?</String>.. <String Id="HelpHeader">....... .. .........</String>.. <String Id="HelpText">/passive \| /quiet - ........... ............ .. ... ........ ... ...... ... .. .. . ............ .. ......... ............ .. . ... ......

C:\Windows\Temp\{FFE22A89-11FD-4A47-9FF0-982DA2A5AD2F}\.ba\1051\mbapreq.wxl

Download File

Process:	C:\Windows\Temp\{562041EC-09A3-44AA-87AE-CC1700EABB21}\.cr\jlK7Q70gbN.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	2334
Entropy (8bit):	5.397882326481071
Encrypted:	false
SSDEEP:	48:cxX7D+cT8muPusz2qs1u+Vh1TqDINHZJoN3m8fN0vPp3OAwa2ywSODAm:8L1TuPdKNzfifFmcatm
MD5:	016C278E515F87F589AD22C856B201F7
SHA1:	F20C7DB38B3161B143DEC4E578CE71D7F585F436
SHA-256:	4A7FDF4A9033FE05C31F565ED3AE5B8C67D324B7AEADB737CE95DBB416D46868
SHA-512:	310C85B27E1ECF4C6729E88051037150CFBA0234A0138666C26662B3D665FF38B74E95ABCADDEEF6CBEBB23E3357FAC487E6EE5EB8FE158C269D77672191B042
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. Copyright (c) .NET Foundation and contributors. All rights reserved. Licensed under the Microsoft Reciprocal License. See LICENSE.TXT file in the project root for full license information. -->......<WixLocalization Culture="sk-sk" Language="1051" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <String Id="Caption">[WixBundleName] . in.tal.cia</String>.. <String Id="Title">Na in.tal.ciu aplik.cie [WixBundleName] sa vy.aduje s..as. Microsoft .NET Framework</String>.. <String Id="ConfirmCancelMessage">Naozaj chcete zru.i. oper.ciu?</String>.. <String Id="HelpHeader">Pomocn.k pre in.tal.ciu</String>.. <String Id="HelpText">/passive \| /quiet . zobraz. minim.lne pou..vate.sk. rozhranie bez v.ziev alebo.. nezobraz. .iadne pou..vate.sk. rozhranie ani v.zvy. Predvolene sa.. zobrazuje pou..vate.sk. rozhranie aj v.etky v.zvy...../norestart . zru.. v.etky pokusy o re.tart. Pou..vate

C:\Windows\Temp\{FFE22A89-11FD-4A47-9FF0-982DA2A5AD2F}\.ba\1053\mbapreq.wxl

Download File

Process:	C:\Windows\Temp\{562041EC-09A3-44AA-87AE-CC1700EABB21}\.cr\jlK7Q70gbN.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	2132
Entropy (8bit):	5.1255014007111495
Encrypted:	false
SSDEEP:	48:cxX7DviT8NFLbu9sM2vECjf26axBZYXcqADCNKTbkoN3maT6NWOjEXPauOOKYnhf:8LmTAcRnQXFPK0iHMsfb2Ws3M
MD5:	D95E81164C57B6FD75E7C3022454192E
SHA1:	5D5ACBC56E7078AF4D04C45B78C0FF090C02EE6A
SHA-256:	6DD61CC6B87B53EAF28430068A2A459730FD4B2BCF876CCDF040212D04C4FE7D
SHA-512:	9E4BA81A145574818DD6A1F1D0EC38EA1629C7771919C35923F440E31EA9912E1630D94FCDB82B71104EBD61D0321DCDF935BA20D69988EE6E9B22259186AF0C
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. Copyright (c) .NET Foundation and contributors. All rights reserved. Licensed under the Microsoft Reciprocal License. See LICENSE.TXT file in the project root for full license information. -->......<WixLocalization Culture="sv-se" Language="1053" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <String Id="Caption">[WixBundleName]-installation</String>.. <String Id="Title">Microsoft .NET Framework kr.vs f.r installation av [WixBundleName]</String>.. <String Id="ConfirmCancelMessage">Vill du avbryta?</String>.. <String Id="HelpHeader">Installationshj.lp</String>.. <String Id="HelpText">/passive \| /quiet - visar ett minimalt anv.ndargr.nssnitt utan prompter,.. alternativt inget anv.ndargr.nssnitt och inga prompter. Som standard visas.. anv.ndargr.nssnitt och samtliga prompter...../norestart - hejdar omstart. Som standard visar anv.ndargr.nssnittet en.. prompt f.re omstart.../log log.txt - skapar logg till

C:\Windows\Temp\{FFE22A89-11FD-4A47-9FF0-982DA2A5AD2F}\.ba\1055\mbapreq.wxl

Download File

Process:	C:\Windows\Temp\{562041EC-09A3-44AA-87AE-CC1700EABB21}\.cr\jlK7Q70gbN.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	2303
Entropy (8bit):	5.2754753523795275
Encrypted:	false
SSDEEP:	48:cxX7DNcYT8anOSMsHEqGpcBztpvrJlrs2ZmNI2+Yo6irN3m22NFcPc+4Trzrdgc7:8LZHTE7APaTI9sq6yEbgg
MD5:	01B200E06BA600A4EF00C00F7AAC5CE4
SHA1:	22234426C42637E069A46217019551E4434A4AB6
SHA-256:	06BFB6DFBC38105C699DEA226A029DF3EF673C33E4B8928DC4EC7FB8F761487D
SHA-512:	8BDCF7533A6BCFA231B42A7EF845A70C7535FBF607D62FF6404928D5941BA6AFBF139450A1A1B58C65FACF88DC0785AEC4ABEFBCC803466A58B1930F7C468CDD
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. Copyright (c) .NET Foundation and contributors. All rights reserved. Licensed under the Microsoft Reciprocal License. See LICENSE.TXT file in the project root for full license information. -->......<WixLocalization Culture="tr-tr" Language="1055" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <String Id="Caption">[WixBundleName] Kurulumu</String>.. <String Id="Title">[WixBundleName] kurulumu i.in Microsoft .NET Framework gerekir</String>.. <String Id="ConfirmCancelMessage">.ptal etmek istedi.inizden emin misiniz?</String>.. <String Id="HelpHeader">Kurulum Yard.m.</String>.. <String Id="HelpText">/passive \| /quiet - komut istemi olmayan olabildi.ince k...k bir UI.. g.r.nt.ler veya komut istemi ve UI g.r.nt.lemez. Varsay.lan olarak UI.. ve t.m komut istemleri g.r.nt.lenir...../norestart - yeniden ba.latma denemelerini engeller. Varsay.lan.. olarak UI yeniden ba.latmadan .nce komut isteyecekt

C:\Windows\Temp\{FFE22A89-11FD-4A47-9FF0-982DA2A5AD2F}\.ba\1060\mbapreq.wxl

Download File

Process:	C:\Windows\Temp\{562041EC-09A3-44AA-87AE-CC1700EABB21}\.cr\jlK7Q70gbN.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	2200
Entropy (8bit):	5.1485120966265
Encrypted:	false
SSDEEP:	48:cxX7DZ0T8obZsw9g5gS56K97D7NCt2VoN3mQXNJPOhP58vqc1qwueo3RAL:8LyTLlS9h9hCtsihdxOh+NL
MD5:	5836F0C655BDD97093F68AAF69AB2BAB
SHA1:	B6842E816F9E0DCC559A5692E4D26101D10B4B16
SHA-256:	C015247D022BDC108B4FFCAE89CB55D1E313034D7E6EED18744C1BB55F108F8C
SHA-512:	640A79D6A756E591AD02DDCCC53BC43F855C5148B8CBB5CE6C1CAF5419CA02F7B2AFF89CCA4C056356814D3899EF79BF038B4E8B4B79EB85138A3CEDCCE93E5B
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. Copyright (c) .NET Foundation and contributors. All rights reserved. Licensed under the Microsoft Reciprocal License. See LICENSE.TXT file in the project root for full license information. -->......<WixLocalization Culture="sl-si" Language="1060" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <String Id="Caption">[WixBundleName] Namestitev</String>.. <String Id="Title">Microsoft .NET Framework, potreben za namestitev paketa [WixBundleName]</String>.. <String Id="ConfirmCancelMessage">Ali ste prepri.ani, da .elite preklicati?</String>.. <String Id="HelpHeader">Pomo. za namestitev</String>.. <String Id="HelpText">/passive \| /quiet - prika.e minimalni uporabni.ki vmesnik brez pozivov ali ne prika.e.. uporabni.kega vmesnika in pozivov. Privzeto so prikazani uporabni.ki vmesnik in.. vsi pozivi...../norestart - skrije vse mo.nosti za vnovicni zagon. Privzeto uporabni.ki vmesnik.. prika.e poziv pred ponovnim zag

C:\Windows\Temp\{FFE22A89-11FD-4A47-9FF0-982DA2A5AD2F}\.ba\2052\mbapreq.wxl

Download File

Process:	C:\Windows\Temp\{562041EC-09A3-44AA-87AE-CC1700EABB21}\.cr\jlK7Q70gbN.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	1980
Entropy (8bit):	6.189594519053644
Encrypted:	false
SSDEEP:	48:cxX7DjQT8tOBousi+zq+frUR2ropNV2rfN3msNUqPPT9T+DwZ9f5wDTAV:8L4TGUGw3V8N3RykV
MD5:	A34DCF7771198C779648B89156483E83
SHA1:	A6E0FA91CD50048511C7BEF1BE3A8D32B42B6D1F
SHA-256:	89C559C6765F8D643469E3C8F4AA93023F09369B0395EA647FAD5AF3C2893EB6
SHA-512:	0F1D7BC4FD64E18EEEC488CDCE01FB6BFA5CD3BFF614A8D03E388D39F569B8341E74302946877EB25BA1EB17AEC137499189605E251FAFB6B20051744CB463B1
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. Copyright (c) .NET Foundation and contributors. All rights reserved. Licensed under the Microsoft Reciprocal License. See LICENSE.TXT file in the project root for full license information. -->......<WixLocalization Culture="zh-ch" Language="2052" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <String Id="Caption">[WixBundleName] ..</String>.. <String Id="Title">[WixBundleName] .... Microsoft .NET Framework</String>.. <String Id="ConfirmCancelMessage">.......?</String>.. <String Id="HelpHeader">......</String>.. <String Id="HelpText">/passive \| /quiet - ..... UI .......... UI ... ........... UI ........../norestart - .............. UI ........../log log.txt - .............. %TEMP% ........</String>.. <String Id="HelpCloseButton"

C:\Windows\Temp\{FFE22A89-11FD-4A47-9FF0-982DA2A5AD2F}\.ba\2070\mbapreq.wxl

Download File

Process:	C:\Windows\Temp\{562041EC-09A3-44AA-87AE-CC1700EABB21}\.cr\jlK7Q70gbN.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	2211
Entropy (8bit):	5.1155097909395035
Encrypted:	false
SSDEEP:	48:cxX7DbT8QGls54nK3znI5zKDj4NLkdoN3mMNYsEPbpK2Aegeu9A5g:8LXTUasJnYdi59som6
MD5:	8A278E519EF81B2847490EFB070219BC
SHA1:	7365EDF6E4F9E66B6CEE47933B6C70FF0B9ECFF8
SHA-256:	E2BFDB2CF3BEAE2E988827C52C58006D7EEAD4ABA5312B5EAE1F6CCF3863C385
SHA-512:	88275C1136FFB15AB04D315E8601BE2DE77387F3E00F17E9807E415A9DFC4A73E2CD3B5710E4CA58006F91E18180D7CFAEEF4E8319C624E1B81397F9CB9ECA92
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. Copyright (c) .NET Foundation and contributors. All rights reserved. Licensed under the Microsoft Reciprocal License. See LICENSE.TXT file in the project root for full license information. -->......<WixLocalization Culture="pt-pt" Language="2070" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <String Id="Caption">Configura..o do [WixBundleName]</String>.. <String Id="Title">O Microsoft .NET Framework . necess.rio para a configura..o do [WixBundleName]</String>.. <String Id="ConfirmCancelMessage">Tem a certeza de que pretende cancelar?</String>.. <String Id="HelpHeader">Ajuda da Configura..o</String>.. <String Id="HelpText">/passive \| /quiet - apresenta IU m.nima sem mensagens ou n.o apresenta IU nem.. mensagens. Por predefini..o, s.o apresentadas a IU e todas as mensagens...../norestart - suprimir qualquer tentativa de rein.cio. Por predefini..o, a IU.. avisar. antes de reiniciar.../log log.txt - r

C:\Windows\Temp\{FFE22A89-11FD-4A47-9FF0-982DA2A5AD2F}\.ba\3082\mbapreq.wxl

Download File

Process:	C:\Windows\Temp\{562041EC-09A3-44AA-87AE-CC1700EABB21}\.cr\jlK7Q70gbN.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	2400
Entropy (8bit):	4.992567587099768
Encrypted:	false
SSDEEP:	48:cxX7DLT8/OusS2V8j4Lq+7dKzCLdqaaD6NJaXFoN3mRNLo3PWKWnRcsB9A8:8LfTz+8EPqKqTJiFikUgk8
MD5:	1024AA88AE01BC7BA797193CC6023375
SHA1:	9252A309C1CB32573F4D58A595A78660FDF54B2F
SHA-256:	B884C4ABB8867553C1FFADD6721C2135EC5F9F1455C3F668D711CCEA65363D1A
SHA-512:	77E6DD332104C0461B7C5A08469161AF3F1DC51D3B55585D39DD9FC9E2088DA036BDF2278CFB96CA702FD26CE073C6C6F66611313270700B9E7A76600C1C8E38
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. Copyright (c) .NET Foundation and contributors. All rights reserved. Licensed under the Microsoft Reciprocal License. See LICENSE.TXT file in the project root for full license information. -->......<WixLocalization Culture="es-es" Language="3082" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <String Id="Caption">Instalaci.n de [WixBundleName]</String>.. <String Id="Title">La instalaci.n de [WixBundleName] requiere Microsoft .NET Framework</String>.. <String Id="ConfirmCancelMessage">.Est. seguro de que desea cancelar?</String>.. <String Id="HelpHeader">Ayuda del programa de instalaci.n</String>.. <String Id="HelpText">/passive \| /quiet - muestra una interfaz de usuario m.nima y no realiza.. preguntas, o bien no muestra interfaz de usuario y no realiza preguntas... De manera predeterminada se muestra la interfaz de usuario completa y se.. realizan todas las preguntas necesarias...../norestart - suprime cu

C:\Windows\Temp\{FFE22A89-11FD-4A47-9FF0-982DA2A5AD2F}\.ba\BootstrapperApplicationData.xml

Download File

Process:	C:\Windows\Temp\{562041EC-09A3-44AA-87AE-CC1700EABB21}\.cr\jlK7Q70gbN.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with very long lines (506), with CRLF line terminators
Category:	dropped
Size (bytes):	308790
Entropy (8bit):	3.736233023525819
Encrypted:	false
SSDEEP:	1536:XXshb2C9gjPPi5bA61e3eQEGK/G9fcLjIqrJ3vEFy3Y6rMir7le:Xqz9GHQb1wY/GaLFrJ3cFy3Zr7le
MD5:	E2791919CC8A75143683C44C7798ECAD
SHA1:	3D1ADC54618DC2349350A18BA363F29C24C146C9
SHA-256:	466BC232084A5EB301D0256E7BF6AAE9BF222B8CDE54E5B7FB75E443C31C442F
SHA-512:	9B1FA1DCD15F78F89C95B0AFD42DE6FEE342767555E584A3F239221B9A067707B7B9DCE7A990D400860AF418B3C512DF8988EF03B29CCA1F54A9DFC1A5DB211D
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.B.o.o.t.s.t.r.a.p.p.e.r.A.p.p.l.i.c.a.t.i.o.n.D.a.t.a. .x.m.l.n.s.=.".h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.x./.2.0.1.0./.B.o.o.t.s.t.r.a.p.p.e.r.A.p.p.l.i.c.a.t.i.o.n.D.a.t.a.".>..... . .<.W.i.x.B.u.n.d.l.e.P.r.o.p.e.r.t.i.e.s. .D.i.s.p.l.a.y.N.a.m.e.=.".E.M.A.3.D. .2.0.2.4.R.2.". .L.o.g.P.a.t.h.V.a.r.i.a.b.l.e.=.".W.i.x.B.u.n.d.l.e.L.o.g.". .C.o.m.p.r.e.s.s.e.d.=.".n.o.". .I.d.=.".{.f.7.0.7.6.d.3.a.-.b.9.d.e.-.4.1.0.c.-.a.6.a.0.-.0.8.9.3.d.b.e.7.8.5.d.3.}.". .U.p.g.r.a.d.e.C.o.d.e.=.".{.D.B.D.B.1.0.B.C.-.6.4.F.F.-.4.1.2.7.-.B.E.F.4.-.1.9.1.7.4.E.B.D.4.6.D.4.}.". .P.e.r.M.a.c.h.i.n.e.=.".y.e.s.". ./.>..... . .<.W.i.x.M.b.a.P.r.e.r.e.q.I.n.f.o.r.m.a.t.i.o.n. .P.a.c.k.a.g.e.I.d.=.".N.e.t.f.x.4.F.u.l.l.". .L.i.c.e.n.s.e.U.r.l.=.".N.e.t.f.x.L.i.c.e.n.s.e...r.t.f.". ./.>..... . .<.W.i.x.P.a.c.k.a.g.e.P.r.o.p.e.r.t.i.e.s. .P.a.c.k.a.g.e.=.".D.i.s.c.o.v.e.r.y.". .V.i.t.a.l.=.".n.o.".

C:\Windows\Temp\{FFE22A89-11FD-4A47-9FF0-982DA2A5AD2F}\.ba\BootstrapperCore.config

Download File

Process:	C:\Windows\Temp\{562041EC-09A3-44AA-87AE-CC1700EABB21}\.cr\jlK7Q70gbN.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	706
Entropy (8bit):	4.978464774518615
Encrypted:	false
SSDEEP:	12:MMHd41Pd7lzc+TXYr+XFy9bWzc+TXYcXII3VymhsSY9g3XmG8jDjXRg3uxT:Jd67RtYrx9itYhmhV3WzPO3I
MD5:	B9E73DA1D0C74D457129E7B40ACA313D
SHA1:	4DAF6F7D0C10EDC6FAE3117377D559BF7C4D6788
SHA-256:	58FAB427D606F7F59FE13D6E59A3D707F92EAC96E17BF27C7B5A28A173AFCF7A
SHA-512:	A63B82C07C3F581CFE86B81711AEBED92491EDCA645388EB3DAB94221B708DD0BFA8ADD37A403FA02A2F9DB75CDA0E0F724CA3566A6BDB66A3C089147D713895
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8" ?>..<configuration>.. <configSections>.. <sectionGroup name="wix.bootstrapper" type="Microsoft.Tools.WindowsInstallerXml.Bootstrapper.BootstrapperSectionGroup, BootstrapperCore">.. <section name="host" type="Microsoft.Tools.WindowsInstallerXml.Bootstrapper.HostSection, BootstrapperCore" />.. </sectionGroup>.. </configSections>.. <startup useLegacyV2RuntimeActivationPolicy="true">.. <supportedRuntime version="v4.0" />.. </startup>.. <wix.bootstrapper>.. <host assemblyName="ema3d.UI.Boot">.. <supportedFramework version="v4\Full" />.. <supportedFramework version="v4\Client" />.. </host>.. </wix.bootstrapper>..</configuration>

C:\Windows\Temp\{FFE22A89-11FD-4A47-9FF0-982DA2A5AD2F}\.ba\BootstrapperCore.dll

Download File

Process:	C:\Windows\Temp\{562041EC-09A3-44AA-87AE-CC1700EABB21}\.cr\jlK7Q70gbN.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	90032
Entropy (8bit):	5.688056417150366
Encrypted:	false
SSDEEP:	1536:lHMBp/GRbgi5ofpiG2pq+51FogDTY11UfV:luUbV5jlq+51Fo626
MD5:	6193421A522A7DB8821FC4DED2170132
SHA1:	0D8A6F348F4D2BA1782E6ECED6678B51E05E2BDE
SHA-256:	AD7CE3129176F150B9FFFBA9BED86814C61E8F01EC8827F12B23272013C91F62
SHA-512:	A201A9D3D91772DD711A4DC52207F4FA104EFBF10750174ECBACC9D9F1810ADF704915B6497EE59DC7E8902E5CD578BC5647FB51A3D878B829F5BAE27A08AED8
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....g^.........." ..0...... ........... ...@....... ....................................@.................................`...O....@...............@.......`......(-............................................... ............... ..H............text........ ...................... ..`.rsrc........@....... ..............@..@.reloc.......`.......0..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\{FFE22A89-11FD-4A47-9FF0-982DA2A5AD2F}\.ba\Microsoft.Deployment.WindowsInstaller.dll

Download File

Process:	C:\Windows\Temp\{562041EC-09A3-44AA-87AE-CC1700EABB21}\.cr\jlK7Q70gbN.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	184240
Entropy (8bit):	5.87607955863929
Encrypted:	false
SSDEEP:	3072:PGfZS7hUuK3PcbFeRRLxyR69UgoCaf8ZECnfKlRUjW01KyFD:bzMRLkR6joxfe1z
MD5:	ADAC22D3A7E4FBEEA84F14A87BB06893
SHA1:	505D710D57D53C97AF2AEE9CAD6486E4B96F93E4
SHA-256:	E8A011E7CF01CC512CF3350767E40576BA78559429443EBD2BEDAE6B0E869BB5
SHA-512:	5EB8A59978487145815BFB03932313AA6B308C0300473005682228E857642D522D45B0C94CE50DB3DBAE41438297E39AEE0A12256D10D0750F9D48541D87E0C2
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....g^.........." ..0...... ......z.... ........... ..............................m.....@.................................(...O................................................................................... ............... ..H............text....w... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\{FFE22A89-11FD-4A47-9FF0-982DA2A5AD2F}\.ba\ema3d.UI.Boot.dll

Download File

Process:	C:\Windows\Temp\{562041EC-09A3-44AA-87AE-CC1700EABB21}\.cr\jlK7Q70gbN.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	343776
Entropy (8bit):	6.342368825094352
Encrypted:	false
SSDEEP:	6144:hjR3hvRexOPu3FwQkFr5YQLALz6mbqvFrE:tdFEIPu3yQkF3tFE
MD5:	D735420B968EFA87E11F8D5AB1151D6B
SHA1:	F662D3310B45D917F8B917198B62B27C4A01E376
SHA-256:	9093786E788A2182C59D66C9710C349E6578E1896AE212AC84D90EC1EC5C3B89
SHA-512:	9A0D8502287C1252EFFDB917C0CBF67F36D262C07A59D6F8FC6C03DF0A955C2CA13AF82AFD2E463C8008FB92AAD62D9C31A34028C54E1446BF2ED69201713019
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......f.........." ..0.............b ... ...@....... ...............................H....`.................................. ..O....@...................&...`....................................................... ............... ..H............text...h.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................D ......H...........h............E...................................................X(,...(.........X(,...(......(-...(.......(-...(.......0..s..........(s.....(s...(,...(.......(u.....(u...(,...(.......(s.....(s...(.....(....Y(.......(u.....(u...(.....(....Y(......{...."..}......{...."..}......{...."..}......{...."..}....J.(.....(....sp.....(.....(....X.(.....(....Xsp.....(.....(....#.......@[X.(.....(....#.......@[Xsp.....(....#.......@[.(....#.......@[sp.....0..E...

C:\Windows\Temp\{FFE22A89-11FD-4A47-9FF0-982DA2A5AD2F}\.ba\mbahost.dll

Download File

Process:	C:\Windows\Temp\{562041EC-09A3-44AA-87AE-CC1700EABB21}\.cr\jlK7Q70gbN.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	126896
Entropy (8bit):	6.637074858344021
Encrypted:	false
SSDEEP:	3072:RO4ChgervCKABl5n4lMuMtN8cYmuXHyPKdeGlT:MJfBidDuUY6qNT
MD5:	62A89C59A1ABDF48AF7F00122DAD6B94
SHA1:	ADF012CE9FC22C5C128F9AF63F6B54C7C1D03B23
SHA-256:	8D9E0FE6B3F1EB231FDB4DECBB49E4E4E2B64DCB188DFC03261A9179B4DB7816
SHA-512:	6B4CB3EB89D3D5620A31FBD12AB854DC3FB31018468357797786D43315EEF4DE675C1905F21C8E8E7D22DAB9BAAEDC688FD767325FE3A0F0A2A09A2CAA9E2002
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......0m..t..Vt..Vt..V.j.W~..V.j.W...V.j.Wf..V&d.Wd..V&d.We..V&d.Wi..V.j.We..Vt..V...V.e.W{..V.e.Wu..V.e.Vu..Vt.`Vu..V.e.Wu..VRicht..V........PE..L.....g^...........!.....6..........(>.......P............................... ......![....@.................................8...x...............................\|......T...........................8...@............P...............................text...[5.......6.................. ..`.rdata...s...P...t...:..............@..@.data...4...........................@....rsrc...............................@..@.reloc..\|...........................@..B................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\{FFE22A89-11FD-4A47-9FF0-982DA2A5AD2F}\.ba\mbapreq.dll

Download File

Process:	C:\Windows\Temp\{562041EC-09A3-44AA-87AE-CC1700EABB21}\.cr\jlK7Q70gbN.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	192432
Entropy (8bit):	6.602750370249682
Encrypted:	false
SSDEEP:	3072:cjWIuq/+AIIzkioKPS6LJp9LYelv7ShV/GdmX01Qk2U5r/E6JyT1/t5MDi21jxeU:cjWIN/+1ivqa7nwhg0kQC/Ex1/tN95L4
MD5:	025B447A432C7C2C5F4A07D5BDF8B454
SHA1:	1ABA9A9C6FE4AE74049B8F4668D31F174FF6BC1C
SHA-256:	2270E987EE91F4B0FA174A9987A3D5D05D2E98D2ACDBA9128680CD18F21F7304
SHA-512:	A29F370E3F61422945223CA8A81CE2171130F111F7A95FEB8B85F9FE12CA61D3C9ECE01A4C02201F2A7454315A1AD5B30F183A8D5B64B6C70D8C4D08689D5128
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$........P...1...1...1...W...1...W..y1...Y...1...Y...1...Y...1...W...1...W...1...W...1...1...1..hX...1..hX...1..hX...1...1j..1..hX...1..Rich.1..........................PE..L.....g^...........!.....................................................................@.................................l...................................h.......T...........................8...@...............X............................text............................... ..`.rdata..8...........................@..@.data...............................@....rsrc...............................@..@.reloc..h...........................@..B........................................................................................................................................................................................................................................................................

C:\Windows\Temp\{FFE22A89-11FD-4A47-9FF0-982DA2A5AD2F}\.ba\mbapreq.png

Download File

Process:	C:\Windows\Temp\{562041EC-09A3-44AA-87AE-CC1700EABB21}\.cr\jlK7Q70gbN.exe
File Type:	PNG image data, 63 x 63, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	797
Entropy (8bit):	7.648767094164769
Encrypted:	false
SSDEEP:	12:6v/7rW3M/jDYAlFTzdvhKZ7e/cbp4/82UNb6MjmlKPNXheD1H0oJodqSXaTbutak:lQD1lldv8Z7g04/82Y6+Pxi19mDoqt5
MD5:	A356956FD269567B8F4612A33802637B
SHA1:	75AE41181581FD6376CA9CA88147011E48BF9A30
SHA-256:	A401A225ADDAF89110B4B0F6E8CF94779E7C0640BCDD2D670FFCF05AAB0DAD03
SHA-512:	A0F7836AEFA1747F481C116F6B085F503B5C09B3A1DD97CD2189F7CE4E6E7EA98F1F66503CBA2E6A83E873248CC7507328710DFA670AA5763DF8AEDCC560285E
Malicious:	false
Preview:	.PNG........IHDR...?...?.....W_......sRGB.........gAMA......a.....pHYs..........+......IDAThC./W.0....P(...Db+q8$.........J...-..8.e]._..;........Y... .Y....z\........{W\|..../q..<%.....C5...0....OrU....,..^........).....2.......i.Ge..T9T..}.7..J.......}..b...S.>.%y..Fc..j.X.....y."...e.U..M(ez....4\..C....u.......w..0..J.Wo."...mM.r.h..8..q..X..k!...j..xn...l...W`..r.+.R..J........c.T.}......cz..<43..@.c..rH...\|..V.....K.mN.........k....,..4OL..5..M.tm%=.U.t-7.w....k.R.....c...-].5~..]2..5...GA..[..={.5..].=(.$}.\.9..5...MWu..[#.....F..j.F...d...,..MWu.7..3......$.......G.t.....=;N<_:[......0.,1.y.\.Z.\|..%..>}...q.s....y.#p......!-.;.6!o.KO..E.6...........<..c..9_B....y....im...b...Xn.....)t9Q...........V.WMtP. .P..Z.&..KR.ac......IEND.B`.

C:\Windows\Temp\{FFE22A89-11FD-4A47-9FF0-982DA2A5AD2F}\.ba\mbapreq.thm

Download File

Process:	C:\Windows\Temp\{562041EC-09A3-44AA-87AE-CC1700EABB21}\.cr\jlK7Q70gbN.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3915
Entropy (8bit):	5.15881451198739
Encrypted:	false
SSDEEP:	48:cecHddpXBT2E/zPHWgtpmAPH8TSJmBP+NPHrM/O8YpQbFUuhJ3PK7usPH4Lr:wHdHxS4Z9UG4BmNjCOhpsB3PswP
MD5:	A20778EC90A094A62A6C3A6AB2A6DC7D
SHA1:	74C131B5FD80446FFDF2AFAD723762DD36621309
SHA-256:	F8C3A03F47F0B9B3C20F0522A2481DA28C77FECDBB302F8DD8FBED87758CBAEA
SHA-512:	47F34A9F416D223DCBF071E7292A05554AF3D27CDE67FC8C161C1BED564C6E7FC448C2F482E05F33149C782E09C681BD65730CA00CF9EC68B284128214B75529
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<Theme xmlns="http://wixtoolset.org/schemas/thmutil/2010">.. <Window Width="485" Height="300" HexStyle="100a0000" FontId="0">#(loc.Caption)</Window>.. <Font Id="0" Height="-12" Weight="500" Foreground="000000" Background="FFFFFF">Segoe UI</Font>.. <Font Id="1" Height="-24" Weight="500" Foreground="000000">Segoe UI</Font>.. <Font Id="2" Height="-22" Weight="500" Foreground="666666">Segoe UI</Font>.. <Font Id="3" Height="-12" Weight="500" Foreground="000000" Background="FFFFFF">Segoe UI</Font>.. <Font Id="4" Height="-12" Weight="500" Foreground="ff0000" Background="FFFFFF" Underline="yes">Segoe UI</Font>.... <Image X="11" Y="11" Width="64" Height="64" ImageFile="mbapreq.png" Visible="yes"/>.. <Text X="80" Y="11" Width="-11" Height="96" FontId="1" Visible="yes" DisablePrefix="yes">#(loc.Title)</Text>.... <Page Name="Help">.. <Text X="11" Y="112" Width="-11" Height="30" FontId="2" DisablePrefix="yes">#(loc.HelpHeader

C:\Windows\Temp\{FFE22A89-11FD-4A47-9FF0-982DA2A5AD2F}\.ba\mbapreq.wxl

Download File

Process:	C:\Windows\Temp\{562041EC-09A3-44AA-87AE-CC1700EABB21}\.cr\jlK7Q70gbN.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2464
Entropy (8bit):	5.076345322304751
Encrypted:	false
SSDEEP:	48:cxX7DxMT8dbCsK19Wqq8+JIDxN3Wm2WcN3miNlLPDHXsmkaYXfXQ2BmGA7b1fABP:8LuTY1xmmmTerNR0AT1O
MD5:	4D2C8D10C5DCCA6B938B71C8F02CA8A8
SHA1:	11577021465379E9D1FF4260E607149BA5DFA6B3
SHA-256:	C63DE5F309502F9272402587A6BE22624D1BC2FEACD1BD33FB11E44CD6614B96
SHA-512:	AE791C1F05821167F1D2E1D07DBF95FE7E72B35B3E4B1E22720006C7A672B1330B748414792392B0E806F111AA4EFC1C424F4479EBDE349E3F079792DBB3BF47
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. Copyright (c) .NET Foundation and contributors. All rights reserved. Licensed under the Microsoft Reciprocal License. See LICENSE.TXT file in the project root for full license information. -->......<WixLocalization Culture="en-us" Language="1033" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <String Id="Caption">[WixBundleName] Setup</String>.. <String Id="Title">Microsoft .NET Framework required for [WixBundleName] setup</String>.. <String Id="ConfirmCancelMessage">Are you sure you want to cancel?</String>.. <String Id="HelpHeader">Setup Help</String>.. <String Id="HelpText">/passive \| /quiet - displays minimal UI with no prompts or displays no UI and.. no prompts. By default UI and all prompts are displayed...../norestart - suppress any attempts to restart. By default UI will prompt before restart.../log log.txt - logs to a specific file. By default a log file is created in %TEMP%.</String>.. <String Id="HelpClos

C:\Windows\Temp\{FFE22A89-11FD-4A47-9FF0-982DA2A5AD2F}\.be\EMA3D.exe

Download File

Process:	C:\Windows\Temp\{562041EC-09A3-44AA-87AE-CC1700EABB21}\.cr\jlK7Q70gbN.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1048328
Entropy (8bit):	7.595028138776364
Encrypted:	false
SSDEEP:	24576:5VnVr6ecc38BetTec6cXC6v8WlYKeuIsPUSy+4NY0yk7b7z:p67KTec/yclYK1rf4NxRX
MD5:	F51103F1E13618AE83B88837789FE62C
SHA1:	D5F2AF880AEB85B3B8933F8969D2A886A4B32574
SHA-256:	893CDA166AF5049C8C8A9C116BE2D75FA6122B6E90A13B8DF8F84FC355CE9A8D
SHA-512:	2B8B3FB4EF655BB9E7256716022E032BB8EA495198F8C125E4CFA2E1CEBD4398D2826FF6ACA57A032F2C8627E6D70C11E47746696F6F5ABD8FE12357E4EB0B7B
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B...#..#..#...E..#...E...#...K..#...K..#...K..#...E..#...E..#...E..#..#..."...J...#...JQ.#..#9.#...J..#..Rich.#..........PE..L...A.g^.....................T....................@..........................@.......h....@.................................t.......................(....&.......=...z..T....................{.......z..@...........................................text............................... ..`.rdata..............................@..@.data...............................@....wixburn8...........................@..@.rsrc...............................@..@.reloc...=.......>..................@..B........................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.674392800672086
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	jlK7Q70gbN.exe
File size:	1'204'392 bytes
MD5:	fa7b382660c277341e573e54ea81ac1f
SHA1:	b84161e5c80dadd9efd6a8307e5d6cdd607b8bc8
SHA256:	39e87c245f3df670592eac79160e0de43421742c0e0ab1cfb1452790f07747c9
SHA512:	c0cfc4b06ebfc3ffb57595ed9d7d7169581ab9608e23e03a621c4fd0cbd34ec90bfde6c3468bf60cc7b5c86ce22e2528211716d684c057d1358ada84beb34ff2
SSDEEP:	24576:5ZnVr6ecc38BetTecucXC6v8WlYKeuIsPUSy+4NY0yk7b7uIsvkX:J67KTecTyclYK1rf4NxR6IN
TLSH:	3B45CF32E561402AE7F101F3B87897303D6CAB28275089EAE3D4BD1D7A7449667BF217
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B...#...#...#...E...#...E...#...K...#...K...#...K...#...E...#...E...#...E...#...#..."...J...#...JQ..#...#9..#...J...#..Rich.#.

File Icon


Icon Hash:	0e96933333317969

Static PE Info

General

Entrypoint:	0x42df91
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE, REMOVABLE_RUN_FROM_SWAP, NET_RUN_FROM_SWAP
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x5E67C141 [Tue Mar 10 16:33:05 2020 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	2a47c65375416ebacde9ef7e2931050a

Authenticode Signature

Signature Valid:	true
Signature Issuer:	CN=Sectigo Public Code Signing CA R36, O=Sectigo Limited, C=GB
Signature Validation Error:	The operation completed successfully
Error Number:	0
Not Before, Not After	02/08/2023 02:00:00 02/08/2026 01:59:59
Subject Chain	CN="Electro Magnetic Applications, Inc", O="Electro Magnetic Applications, Inc", S=Colorado, C=US
Version:	3
Thumbprint MD5:	108711BB85EFC58B76D316A4EF7CEE70
Thumbprint SHA-1:	5A4FF1ADF82F020F2C6AA0EB4413D83E3B4D3746
Thumbprint SHA-256:	71ED552650D578FF0A728BA2ADF92B23E7F5C4EB3BBD2C10B081F850512A5775
Serial:	6AD5B0A8BC68EA1CE815864097608736

Entrypoint Preview

Instruction
call 00007F0C34E4FA9Fh
jmp 00007F0C34E4F3DFh
int3
int3
int3
int3
int3
mov eax, dword ptr [esp+08h]
mov ecx, dword ptr [esp+10h]
or ecx, eax
mov ecx, dword ptr [esp+0Ch]
jne 00007F0C34E4F56Bh
mov eax, dword ptr [esp+04h]
mul ecx
retn 0010h
push ebx
mul ecx
mov ebx, eax
mov eax, dword ptr [esp+08h]
mul dword ptr [esp+14h]
add ebx, eax
mov eax, dword ptr [esp+08h]
mul ecx
add edx, ebx
pop ebx
retn 0010h
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
cmp cl, 00000040h
jnc 00007F0C34E4F577h
cmp cl, 00000020h
jnc 00007F0C34E4F568h
shrd eax, edx, cl
shr edx, cl
ret
mov eax, edx
xor edx, edx
and cl, 0000001Fh
shr eax, cl
ret
xor eax, eax
xor edx, edx
ret
push ebp
mov ebp, esp
jmp 00007F0C34E4F56Fh
push dword ptr [ebp+08h]
call 00007F0C34E55C04h
pop ecx
test eax, eax
je 00007F0C34E4F571h
push dword ptr [ebp+08h]
call 00007F0C34E55C76h
pop ecx
test eax, eax
je 00007F0C34E4F548h
pop ebp
ret
cmp dword ptr [ebp+08h], FFFFFFFFh
je 00007F0C34E4FE64h
jmp 00007F0C34E4FE41h
push ebp
mov ebp, esp
push dword ptr [ebp+08h]
call 00007F0C34E4FE7Dh
pop ecx
pop ebp
ret
push ebp
mov ebp, esp
test byte ptr [ebp+08h], 00000001h
push esi
mov esi, ecx
mov dword ptr [esi], 0046130Ch
je 00007F0C34E4F56Ch
push 0000000Ch
push esi
call 00007F0C34E4F53Dh
pop ecx

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x68b74	0xb4	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x6e000	0x11488	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x1239c8	0x26e0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x80000	0x3d98	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x67ac0	0x54	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x67b14	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x67a00	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x4b000	0x3d8	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x686f4	0x100	.rdata
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x49a03	0x49c00	c552f17ca270eab049c92efc369a84ca	False	0.5400721663135594	data	6.567127031294	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x4b000	0x1f1e4	0x1f200	ed4c0b6ba10247249759c26d8bc81464	False	0.3012518825301205	data	5.08278823204171	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x6b000	0x1814	0xc00	0a7fbbd0bda6cb08de192ef47f25e53c	False	0.23307291666666666	data	2.8642627912652303	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.wixburn	0x6d000	0x38	0x200	ba3da9ac5fce2b7d7ee162aa46ad9b52	False	0.12890625	data	0.7244003241542494	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x6e000	0x11488	0x11600	46e7b737dbfa2cdbeee948cb726b0e4c	False	0.5234375	data	6.605533687491705	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x80000	0x3d98	0x3e00	d6533570cd82aea87b99e92b9410e9b6	False	0.8092237903225806	data	6.772376538385135	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x6e328	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 640	English	United States	0.668010752688172
RT_ICON	0x6e610	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	United States	0.7027027027027027
RT_ICON	0x6e738	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2688	English	United States	0.5573027718550106
RT_ICON	0x6f5e0	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1152	English	United States	0.7328519855595668
RT_ICON	0x6fe88	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 320	English	United States	0.7854046242774566
RT_ICON	0x703f0	0x4344	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States	0.9901277584204413
RT_ICON	0x74734	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16896	English	United States	0.26641473783656117
RT_ICON	0x7895c	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.3351659751037344
RT_ICON	0x7af04	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	United States	0.450515947467167
RT_ICON	0x7bfac	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.6932624113475178
RT_MESSAGETABLE	0x7c414	0x2840	data	English	United States	0.28823757763975155
RT_GROUP_ICON	0x7ec54	0x92	data	English	United States	0.6643835616438356
RT_VERSION	0x7ece8	0x2cc	data	English	United States	0.473463687150838
RT_MANIFEST	0x7efb4	0x4d2	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (1174), with CRLF line terminators	English	United States	0.47568881685575365

Imports

DLL	Import
ADVAPI32.dll	RegCloseKey, RegOpenKeyExW, OpenProcessToken, AdjustTokenPrivileges, LookupPrivilegeValueW, InitiateSystemShutdownExW, GetUserNameW, RegQueryValueExW, RegDeleteValueW, CloseEventLog, OpenEventLogW, ReportEventW, ConvertStringSecurityDescriptorToSecurityDescriptorW, CreateWellKnownSid, InitializeAcl, DecryptFileW, SetEntriesInAclW, ChangeServiceConfigW, CloseServiceHandle, ControlService, OpenSCManagerW, OpenServiceW, QueryServiceStatus, SetNamedSecurityInfoW, CheckTokenMembership, AllocateAndInitializeSid, SetEntriesInAclA, SetSecurityDescriptorGroup, SetSecurityDescriptorOwner, SetSecurityDescriptorDacl, InitializeSecurityDescriptor, RegSetValueExW, RegQueryInfoKeyW, RegEnumValueW, RegEnumKeyExW, RegDeleteKeyW, RegCreateKeyExW, GetTokenInformation, CryptDestroyHash, CryptHashData, CryptCreateHash, CryptGetHashParam, CryptReleaseContext, CryptAcquireContextW, QueryServiceConfigW
USER32.dll	PeekMessageW, PostMessageW, IsWindow, WaitForInputIdle, PostQuitMessage, GetMessageW, TranslateMessage, MsgWaitForMultipleObjects, PostThreadMessageW, GetMonitorInfoW, MonitorFromPoint, IsDialogMessageW, LoadCursorW, LoadBitmapW, SetWindowLongW, GetWindowLongW, GetCursorPos, MessageBoxW, CreateWindowExW, UnregisterClassW, RegisterClassW, DefWindowProcW, DispatchMessageW
OLEAUT32.dll	VariantInit, SysAllocString, VariantClear, SysFreeString
GDI32.dll	DeleteDC, DeleteObject, SelectObject, StretchBlt, GetObjectW, CreateCompatibleDC
SHELL32.dll	CommandLineToArgvW, SHGetFolderPathW, ShellExecuteExW
ole32.dll	CoUninitialize, CoInitializeEx, CoInitialize, StringFromGUID2, CoCreateInstance, CoTaskMemFree, CLSIDFromProgID, CoInitializeSecurity
KERNEL32.dll	GetCommandLineW, GetCommandLineA, GetCPInfo, CreateFileW, CloseHandle, GetProcAddress, LocalFree, HeapSetInformation, GetLastError, GetModuleHandleW, FormatMessageW, lstrlenA, lstrlenW, MultiByteToWideChar, WideCharToMultiByte, LCMapStringW, Sleep, GetLocalTime, GetModuleFileNameW, ExpandEnvironmentStringsW, GetTempPathW, GetTempFileNameW, CreateDirectoryW, GetFullPathNameW, CompareStringW, GetCurrentProcessId, WriteFile, SetFilePointer, LoadLibraryW, GetSystemDirectoryW, CreateFileA, HeapAlloc, HeapReAlloc, HeapFree, HeapSize, GetEnvironmentStringsW, FindClose, SetCurrentDirectoryW, GetCurrentDirectoryW, RemoveDirectoryW, SetFileAttributesW, GetFileAttributesW, DeleteFileW, FindFirstFileW, FindNextFileW, MoveFileExW, InitializeCriticalSection, DeleteCriticalSection, ReleaseMutex, GetCurrentProcess, GetCurrentThreadId, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, CreateProcessW, GetVersionExW, VerSetConditionMask, GetVolumePathNameW, EnterCriticalSection, LeaveCriticalSection, GetSystemTime, GetWindowsDirectoryW, GetNativeSystemInfo, FreeEnvironmentStringsW, FreeLibrary, GetModuleHandleExW, GetComputerNameW, VerifyVersionInfoW, GetDateFormatW, GetUserDefaultUILanguage, GetUserDefaultLangID, GetSystemDefaultLangID, GetStringTypeW, ReadFile, SetFilePointerEx, DuplicateHandle, LoadLibraryExW, CreateEventW, ProcessIdToSessionId, ConnectNamedPipe, SetNamedPipeHandleState, CreateNamedPipeW, WaitForSingleObject, GetProcessId, OpenProcess, CreateThread, GetExitCodeThread, SetEvent, WaitForMultipleObjects, LocalFileTimeToFileTime, SetEndOfFile, SetFileTime, ResetEvent, DosDateTimeToFileTime, CompareStringA, GetExitCodeProcess, SetThreadExecutionState, CopyFileExW, CreateMutexW, CreateFileMappingW, MapViewOfFile, UnmapViewOfFile, GetThreadLocale, GetOEMCP, GetACP, IsValidCodePage, SetStdHandle, GetFileSizeEx, FlushFileBuffers, GetConsoleCP, GetConsoleMode, DecodePointer, WriteConsoleW, InterlockedIncrement, InterlockedDecrement, GetModuleHandleA, GlobalAlloc, GlobalFree, CopyFileW, VirtualAlloc, VirtualFree, SystemTimeToTzSpecificLocalTime, GetTimeZoneInformation, SystemTimeToFileTime, GetSystemInfo, VirtualProtect, VirtualQuery, GetSystemWow64DirectoryW, GetProcessHeap, FindFirstFileExW, GetFileType, ExitProcess, GetStdHandle, InitializeCriticalSectionAndSpinCount, SetLastError, RtlUnwind, RaiseException, UnhandledExceptionFilter, SetUnhandledExceptionFilter, TerminateProcess, IsProcessorFeaturePresent, QueryPerformanceCounter, GetSystemTimeAsFileTime, InitializeSListHead, IsDebuggerPresent, GetStartupInfoW, LoadLibraryExA
RPCRT4.dll	UuidCreate

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 7, 2024 23:30:33.144845963 CEST	53	56377	1.1.1.1	192.168.2.5

Target ID:	0
Start time:	17:30:12
Start date:	07/10/2024
Path:	C:\Users\user\Desktop\jlK7Q70gbN.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\jlK7Q70gbN.exe"
Imagebase:	0x6d0000
File size:	1'204'392 bytes
MD5 hash:	FA7B382660C277341E573E54EA81AC1F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	17:30:12
Start date:	07/10/2024
Path:	C:\Windows\Temp\{562041EC-09A3-44AA-87AE-CC1700EABB21}\.cr\jlK7Q70gbN.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Temp\{562041EC-09A3-44AA-87AE-CC1700EABB21}\.cr\jlK7Q70gbN.exe" -burn.clean.room="C:\Users\user\Desktop\jlK7Q70gbN.exe" -burn.filehandle.attached=528 -burn.filehandle.self=540
Imagebase:	0x7d0000
File size:	1'048'328 bytes
MD5 hash:	F51103F1E13618AE83B88837789FE62C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	3
Start time:	17:30:14
Start date:	07/10/2024
Path:	C:\Windows\Temp\{FFE22A89-11FD-4A47-9FF0-982DA2A5AD2F}\.be\EMA3D.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Temp\{FFE22A89-11FD-4A47-9FF0-982DA2A5AD2F}\.be\EMA3D.exe" -q -burn.elevated BurnPipe.{01823A2F-6092-4017-B70C-7D2B2DE988B6} {636B081A-FA87-43E7-BB2F-5B923C0323C7} 6180
Imagebase:	0xa10000
File size:	1'048'328 bytes
MD5 hash:	F51103F1E13618AE83B88837789FE62C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Function 006D51D2 Relevance: 38.8, APIs: 5, Strings: 17, Instructions: 314
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,?,?,?,?), ref: 006D5254

Part of subcall function 00710816: InitializeCriticalSection.KERNEL32(0073C6EC,?,006D5260,00000000,?,?,?,?,?,?), ref: 0071082D

Part of subcall function 006D1206: CommandLineToArgvW.SHELL32(00000000,00000000,00000000,00000000,00000000,00000000,ignored ,00000000,?,00000000,?,?,?,006D527C,00000000,?), ref: 006D1244
Part of subcall function 006D1206: GetLastError.KERNEL32(?,?,?,006D527C,00000000,?,?,00000003,00000000,00000000,?,?,?,?,?,?), ref: 006D124E

CoInitializeEx.COMBASE(00000000,00000000,?,?,00000000,?,?,00000003,00000000,00000000,?,?,?,?,?,?), ref: 006D52C2

Part of subcall function 00711112: GetProcAddress.KERNEL32(RegDeleteKeyExW,AdvApi32.dll), ref: 00711133

GetVersionExW.KERNEL32(?,?,?,?,?,?,?), ref: 006D5354
GetLastError.KERNEL32(?,?,?,?,?,?), ref: 006D535E
CoUninitialize.OLE32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 006D55CB

Strings

Failed to run untrusted mode., xrefs: 006D54F3
3.14.0.3910, xrefs: 006D53C1
Failed to parse command line., xrefs: 006D5282
Failed to run embedded mode., xrefs: 006D5481
Failed to initialize core., xrefs: 006D5400
Failed to initialize XML util., xrefs: 006D5336
Failed to initialize Regutil., xrefs: 006D5306
Failed to initialize Cryputil., xrefs: 006D52E3
Failed to get OS info., xrefs: 006D538C
Invalid run mode., xrefs: 006D5436
Failed to initialize engine state., xrefs: 006D52A9
Failed to run per-machine mode., xrefs: 006D54A9
Failed to run per-user mode., xrefs: 006D54D1
Failed to initialize COM., xrefs: 006D52CE
Failed to initialize Wiutil., xrefs: 006D531E
c:\agent\_work\79\s\src\burn\engine\engine.cpp, xrefs: 006D5382
Failed to run RunOnce mode., xrefs: 006D5459

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: ErrorInitializeLast$AddressArgvCommandCriticalHandleLineModuleProcSectionUninitializeVersion
String ID: 3.14.0.3910$Failed to get OS info.$Failed to initialize COM.$Failed to initialize Cryputil.$Failed to initialize Regutil.$Failed to initialize Wiutil.$Failed to initialize XML util.$Failed to initialize core.$Failed to initialize engine state.$Failed to parse command line.$Failed to run RunOnce mode.$Failed to run embedded mode.$Failed to run per-machine mode.$Failed to run per-user mode.$Failed to run untrusted mode.$Invalid run mode.$c:\agent\_work\79\s\src\burn\engine\engine.cpp
API String ID: 3262001429-1276476639
Opcode ID: eaa0058087e17a40acdc1b516f9e3029efe81b694f3286e823c8574125c52449
Instruction ID: 26cb15506287a1920d8f247707ef7b64d47aa8035d70cf00b3ca748dafcbb1d2
Opcode Fuzzy Hash: eaa0058087e17a40acdc1b516f9e3029efe81b694f3286e823c8574125c52449
Instruction Fuzzy Hash: C5B1D471D00A299BDB32AF688C45BED76B6AF04700F04019BF90AB6791DB749F848F95

Function 0071330F Relevance: 24.7, APIs: 8, Strings: 6, Instructions: 152libraryloadercomCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,00000000,00000000,007138BD,00000000,?,00000000), ref: 00713329
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,BTm,006FBD36,0071B518,BTm,?,00000000,?), ref: 00713335
GetProcAddress.KERNEL32(00000000,IsWow64Process), ref: 00713375
GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 00713381
GetProcAddress.KERNEL32(00000000,Wow64EnableWow64FsRedirection), ref: 0071338C
GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 00713396
CoCreateInstance.OLE32(0073C7A0,00000000,00000001,0071B878,?,?,?,?,?,?,?,?,?,?,BTm,006FBD36), ref: 007133D1
ExitProcess.KERNEL32 ref: 00713480

Strings

kernel32.dll, xrefs: 00713319
Wow64EnableWow64FsRedirection, xrefs: 00713383
Wow64RevertWow64FsRedirection, xrefs: 0071338E
IsWow64Process, xrefs: 0071336F
Wow64DisableWow64FsRedirection, xrefs: 0071337B
c:\agent\_work\79\s\src\libs\dutil\xmlutil.cpp, xrefs: 00713359

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: AddressProc$CreateErrorExitHandleInstanceLastModuleProcess
String ID: IsWow64Process$Wow64DisableWow64FsRedirection$Wow64EnableWow64FsRedirection$Wow64RevertWow64FsRedirection$c:\agent\_work\79\s\src\libs\dutil\xmlutil.cpp$kernel32.dll
API String ID: 2124981135-2947744589
Opcode ID: ec0275d04d6118a48cc3a6524e614baa8551e371c0032f807c84c2ccf9341680
Instruction ID: 9e7a5b54e9d9ff79cdec4a38a9454fd2da7fbefb316f10b003315bb044ca32e3
Opcode Fuzzy Hash: ec0275d04d6118a48cc3a6524e614baa8551e371c0032f807c84c2ccf9341680
Instruction Fuzzy Hash: 1A41B375A00355ABDB229BACC844BEE7BA4EF44B10F114169ED11EB2C1DB7DDF808B94

Function 006D1070 Relevance: 17.6, APIs: 2, Strings: 8, Instructions: 77fileCOMMON

Download Yara Rule

APIs

Part of subcall function 006D34C4: GetModuleFileNameW.KERNEL32(?,?,00000104,?,00000104,?,?,?,?,006D10DD,?,00000000), ref: 006D34E5

CreateFileW.KERNELBASE(?,80000000,00000005,00000000,00000003,00000080,00000000,?,00000000), ref: 006D10F6

Part of subcall function 006D1173: HeapSetInformation.KERNEL32(00000000,00000001,00000000,00000000,?,?,?,?,?,006D111A,cabinet.dll,00000009,?,?,00000000), ref: 006D1184
Part of subcall function 006D1173: GetModuleHandleW.KERNEL32(kernel32,?,?,?,?,?,006D111A,cabinet.dll,00000009,?,?,00000000), ref: 006D118F
Part of subcall function 006D1173: GetProcAddress.KERNEL32(00000000,SetDefaultDllDirectories), ref: 006D119D
Part of subcall function 006D1173: GetLastError.KERNEL32(?,?,?,?,?,006D111A,cabinet.dll,00000009,?,?,00000000), ref: 006D11B8
Part of subcall function 006D1173: GetProcAddress.KERNEL32(00000000,SetDllDirectoryW), ref: 006D11C0
Part of subcall function 006D1173: GetLastError.KERNEL32(?,?,?,?,?,006D111A,cabinet.dll,00000009,?,?,00000000), ref: 006D11D5

CloseHandle.KERNEL32(?,?,?,?,0071B4D0,?,cabinet.dll,00000009,?,?,00000000), ref: 006D1131

Strings

msasn1.dll, xrefs: 006D10C3
clbcatq.dll, xrefs: 006D10BC
wininet.dll, xrefs: 006D10AE
feclient.dll, xrefs: 006D10D1
version.dll, xrefs: 006D10A7
cabinet.dll, xrefs: 006D1099, 006D1114
msi.dll, xrefs: 006D10A0
crypt32.dll, xrefs: 006D10CA

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: AddressErrorFileHandleLastModuleProc$CloseCreateHeapInformationName
String ID: cabinet.dll$clbcatq.dll$crypt32.dll$feclient.dll$msasn1.dll$msi.dll$version.dll$wininet.dll
API String ID: 3687706282-221319812
Opcode ID: d1bf0812c9321932f798a3e7e75614c24325bf942810d24ef6cd7f781c163154
Instruction ID: 44d5048d317731f1c5a39ef13bbbadba244edd5e3cdda594b208e22fecae0435
Opcode Fuzzy Hash: d1bf0812c9321932f798a3e7e75614c24325bf942810d24ef6cd7f781c163154
Instruction Fuzzy Hash: FE219471D0021CABDB509FA8CC45BDEBBBAAB09714F50812AEA11BB3C1D7B459448BA4

Function 006E9FA4 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 50COMMON

Download Yara Rule

Strings

Failed to calculate working folder to ensure it exists., xrefs: 006E9FC1
Failed create working folder., xrefs: 006E9FD7
Failed to copy working folder., xrefs: 006E9FFF

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: CurrentDirectoryErrorLastProcessWindows
String ID: Failed create working folder.$Failed to calculate working folder to ensure it exists.$Failed to copy working folder.
API String ID: 3841436932-2072961686
Opcode ID: 5b4517009ecff0f3b78a1d3eb12acfbc94618cb7e196d97cd0a64b983ff9ec85
Instruction ID: 52fdcb1de07655e1c07bab9456f9bbe1b95b7b7f23158cf3686f11d860c7438d
Opcode Fuzzy Hash: 5b4517009ecff0f3b78a1d3eb12acfbc94618cb7e196d97cd0a64b983ff9ec85
Instruction Fuzzy Hash: 5D01D4319013A4FA8B226B9ADC05CDE7F77DF90B247114116F800B6214E6359F50AA95

Function 006D39DF Relevance: 3.0, APIs: 2, Instructions: 13memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(?,000001C7,?,006D237C,?,00000001,80004005,8007139F,?,?,0071058B,8007139F,?,00000000,00000000,8007139F), ref: 006D39F0
RtlAllocateHeap.NTDLL(00000000,?,006D237C,?,00000001,80004005,8007139F,?,?,0071058B,8007139F,?,00000000,00000000,8007139F), ref: 006D39F7

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: Heap$AllocateProcess
String ID:
API String ID: 1357844191-0
Opcode ID: 5d41d96900651bd1ffe2d0990a4a1511a48dde726a049db6816917992a5c88e7
Instruction ID: 25673d6a543a6c7e3d074e0ba45632f8bf9031e541490a2631c0836f5615c3a9
Opcode Fuzzy Hash: 5d41d96900651bd1ffe2d0990a4a1511a48dde726a049db6816917992a5c88e7
Instruction Fuzzy Hash: DAC012331A020CAB8B006FFCEC0ECCA3BACBB28602B00C500B909C61A0C73CE0549B64

Function 006DF97E Relevance: 117.7, APIs: 3, Strings: 64, Instructions: 445
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

AboutUrl, xrefs: 006DFBD2
Failed to get @Publisher., xrefs: 006DFB7A
Invalid modify disabled type: %ls, xrefs: 006DFD2F
Failed to select ARP node., xrefs: 006DFAEA
Failed to get @UpdateUrl., xrefs: 006DFC0E
Failed to set registration paths., xrefs: 006DFEA3
button, xrefs: 006DFCB0
Failed to get @Department., xrefs: 006DFE29
Failed to parse @Version: %ls, xrefs: 006DFA60
Failed to get @Register., xrefs: 006DFB0B
Comments, xrefs: 006DFC44
Manufacturer, xrefs: 006DFDEE
Version, xrefs: 006DFA2C
Failed to get @Comments., xrefs: 006DFC5B
ParentDisplayName, xrefs: 006DFC1C
Publisher, xrefs: 006DFB63
DisplayName, xrefs: 006DFB19
Failed to get @ParentDisplayName., xrefs: 006DFC33
Failed to get @ProductFamily., xrefs: 006DFE4E
Contact, xrefs: 006DFC6C
Registration, xrefs: 006DF998
c:\agent\_work\79\s\src\burn\engine\registration.cpp, xrefs: 006DFD22
ProviderKey, xrefs: 006DFA6E
yes, xrefs: 006DFCD1
Arp, xrefs: 006DFACE
Failed to get @DisableModify., xrefs: 006DFD53
BTm, xrefs: 006DF97E
Failed to get @ProviderKey., xrefs: 006DFA81
Failed to get @Id., xrefs: 006DF9E4
UpdateUrl, xrefs: 006DFBF7
Failed to get @DisplayVersion., xrefs: 006DFB55
PerMachine, xrefs: 006DFAAD
Failed to get @Version., xrefs: 006DFA3F
Failed to get @AboutUrl., xrefs: 006DFBE9
Classification, xrefs: 006DFE7D
Failed to get @Tag., xrefs: 006DFA05
msasn1.dll, xrefs: 006DF9C9, 006DF9D0
Failed to get @Contact., xrefs: 006DFC83
Department, xrefs: 006DFE12
Failed to get @HelpTelephone., xrefs: 006DFBC4
ProductFamily, xrefs: 006DFE37
HelpLink, xrefs: 006DFB88
Failed to get @Name., xrefs: 006DFE6F
Failed to get @ExecutableName., xrefs: 006DFAA2
HelpTelephone, xrefs: 006DFBAD
DisplayVersion, xrefs: 006DFB3E
Failed to get @Manufacturer., xrefs: 006DFE01
Failed to parse related bundles, xrefs: 006DFA1E
Failed to get @HelpLink., xrefs: 006DFB9F
Failed to parse software tag., xrefs: 006DFDAB
DisableModify, xrefs: 006DFC91
Failed to get @PerMachine., xrefs: 006DFAC0
Failed to select registration node., xrefs: 006DF9B7
Failed to select Update node., xrefs: 006DFDD7
Tag, xrefs: 006DF9F2
Register, xrefs: 006DFAF8
DisableRemove, xrefs: 006DFD64
Update, xrefs: 006DFDB9
Failed to get @DisableRemove., xrefs: 006DFD7B
Failed to get @DisplayName., xrefs: 006DFB30
clbcatq.dll, xrefs: 006DF9F1
ExecutableName, xrefs: 006DFA8F
Name, xrefs: 006DFE5C
Failed to get @Classification., xrefs: 006DFE90

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: StringVariant$AllocClearFreeInit
String ID: AboutUrl$Arp$BTm$Classification$Comments$Contact$Department$DisableModify$DisableRemove$DisplayName$DisplayVersion$ExecutableName$Failed to get @AboutUrl.$Failed to get @Classification.$Failed to get @Comments.$Failed to get @Contact.$Failed to get @Department.$Failed to get @DisableModify.$Failed to get @DisableRemove.$Failed to get @DisplayName.$Failed to get @DisplayVersion.$Failed to get @ExecutableName.$Failed to get @HelpLink.$Failed to get @HelpTelephone.$Failed to get @Id.$Failed to get @Manufacturer.$Failed to get @Name.$Failed to get @ParentDisplayName.$Failed to get @PerMachine.$Failed to get @ProductFamily.$Failed to get @ProviderKey.$Failed to get @Publisher.$Failed to get @Register.$Failed to get @Tag.$Failed to get @UpdateUrl.$Failed to get @Version.$Failed to parse @Version: %ls$Failed to parse related bundles$Failed to parse software tag.$Failed to select ARP node.$Failed to select Update node.$Failed to select registration node.$Failed to set registration paths.$HelpLink$HelpTelephone$Invalid modify disabled type: %ls$Manufacturer$Name$ParentDisplayName$PerMachine$ProductFamily$ProviderKey$Publisher$Register$Registration$Tag$Update$UpdateUrl$Version$button$c:\agent\_work\79\s\src\burn\engine\registration.cpp$clbcatq.dll$msasn1.dll$yes
API String ID: 760788290-1019891731
Opcode ID: 19c68cd606cc3b98338a2fa1c92432fd10698427b686cddeae69208042bef03a
Instruction ID: 0799a6cbb797c48fffc0b1929af1181d8d8fc8f3d34f7b45888563a8fb65c58e
Opcode Fuzzy Hash: 19c68cd606cc3b98338a2fa1c92432fd10698427b686cddeae69208042bef03a
Instruction Fuzzy Hash: F6E1C272E40675FACB21AB64CC42EFD76A7BB10B10F554233F812B63A2D7649E615780

Function 006DB45A Relevance: 93.3, APIs: 24, Strings: 29, Instructions: 577
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32(?,?,?,00000000,76EDC3F0,00000000), ref: 006DB4D1
SetFilePointerEx.KERNELBASE(000000FF,00000000,00000000,00000000,00000000,?,?,?,00000000,76EDC3F0,00000000), ref: 006DB51F
GetLastError.KERNEL32(?,?,?,00000000,76EDC3F0,00000000), ref: 006DB525
ReadFile.KERNELBASE(00000000,006D44B0,00000040,?,00000000,?,?,?,00000000,76EDC3F0,00000000), ref: 006DB56D
GetLastError.KERNEL32(?,?,?,00000000,76EDC3F0,00000000), ref: 006DB573
SetFilePointerEx.KERNELBASE(00000000,00000000,?,00000000,00000000,?,?,?,00000000,76EDC3F0,00000000), ref: 006DB5D0
GetLastError.KERNEL32(?,00000000,00000000,?,?,?,00000000,76EDC3F0,00000000), ref: 006DB5D6
ReadFile.KERNELBASE(00000000,?,00000018,00000040,00000000,?,00000000,00000000,?,?,?,00000000,76EDC3F0,00000000), ref: 006DB61F
GetLastError.KERNEL32(?,00000000,00000000,?,?,?,00000000,76EDC3F0,00000000), ref: 006DB625
SetFilePointerEx.KERNELBASE(00000000,-00000098,00000000,00000000,00000000,?,00000000,00000000,?,?,?,00000000,76EDC3F0,00000000), ref: 006DB696
GetLastError.KERNEL32(?,00000000,00000000,?,?,?,00000000,76EDC3F0,00000000), ref: 006DB69C
ReadFile.KERNEL32(00000000,?,00000004,00000018,00000000,?,00000000,00000000,?,?,?,00000000,76EDC3F0,00000000), ref: 006DB6E5
GetLastError.KERNEL32(?,00000000,00000000,?,?,?,00000000,76EDC3F0,00000000), ref: 006DB6EB
ReadFile.KERNEL32(00000000,?,00000004,00000018,00000000,?,00000000,00000000,?,?,?,00000000,76EDC3F0,00000000), ref: 006DB734
GetLastError.KERNEL32(?,00000000,00000000,?,?,?,00000000,76EDC3F0,00000000), ref: 006DB73A
SetFilePointerEx.KERNELBASE(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,?,?,?,00000000,76EDC3F0,00000000), ref: 006DB786
GetLastError.KERNEL32(?,00000000,00000000,?,?,?,00000000,76EDC3F0,00000000), ref: 006DB78C

Part of subcall function 006D39DF: GetProcessHeap.KERNEL32(?,000001C7,?,006D237C,?,00000001,80004005,8007139F,?,?,0071058B,8007139F,?,00000000,00000000,8007139F), ref: 006D39F0
Part of subcall function 006D39DF: RtlAllocateHeap.NTDLL(00000000,?,006D237C,?,00000001,80004005,8007139F,?,?,0071058B,8007139F,?,00000000,00000000,8007139F), ref: 006D39F7

ReadFile.KERNEL32(00000000,?,00000028,00000018,00000000,?,00000000,00000000,?,?,?,00000000,76EDC3F0,00000000), ref: 006DB7DF
ReadFile.KERNEL32(00000000,?,00000028,00000028,00000000,?,00000000,00000000,?,?,?,00000000,76EDC3F0,00000000), ref: 006DB841
SetFilePointerEx.KERNELBASE(00000000,?,00000000,00000000,00000000,00000034,00000001,?,00000000,00000000,?,?,?,00000000,76EDC3F0,00000000), ref: 006DB8CB
GetLastError.KERNEL32(?,00000000,00000000,?,?,?,00000000,76EDC3F0,00000000), ref: 006DB8D5

Strings

c:\agent\_work\79\s\src\burn\engine\section.cpp, xrefs: 006DB4F2, 006DB546, 006DB594, 006DB5F7, 006DB646, 006DB6BD, 006DB70C, 006DB75B, 006DB7B0, 006DB867, 006DB8A7, 006DB8F9, 006DB95E, 006DB988, 006DB9AF, 006DBA96, 006DBAF5, 006DBB32, 006DBB70, 006DBB93, 006DBBAE
Failed to read signature offset., xrefs: 006DB716
PE Header from file didn't match PE Header in memory., xrefs: 006DBAE0
Failed to seek to section info., xrefs: 006DB6C7, 006DB903
Failed to read complete image section header, index: %u, xrefs: 006DBB44
4, xrefs: 006DB853
Failed to get total size of bundle., xrefs: 006DB9F2
Failed to read DOS header., xrefs: 006DB59E
Failed to allocate buffer for section info., xrefs: 006DB8B3
Failed to read section info, unsupported version: %08x, xrefs: 006DB9C4
Failed to find valid DOS image header in buffer., xrefs: 006DBBBA
(, xrefs: 006DB7EC
Failed to seek past optional headers., xrefs: 006DB7BA
Failed to find valid NT image header in buffer., xrefs: 006DBB9F
Failed to read section info., xrefs: 006DB968
.wix, xrefs: 006DB7FF
Failed to read image section header, index: %u, xrefs: 006DBB7B
Failed to read section info, data to short: %u, xrefs: 006DB879
Failed to seek to start of file., xrefs: 006DB550
burn, xrefs: 006DB807
Failed to read NT header., xrefs: 006DB650
hDq, xrefs: 006DBAD6
Failed to allocate memory for container sizes., xrefs: 006DBAA2
Failed to seek to NT header., xrefs: 006DB601
PE, xrefs: 006DB667
Failed to open handle to engine process path., xrefs: 006DB4FC
Failed to read signature size., xrefs: 006DB765
Failed to read complete section info., xrefs: 006DB994
Failed to find Burn section., xrefs: 006DBB01

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: File$ErrorLast$Read$Pointer$Heap$AllocateProcess
String ID: ($.wix$4$Failed to allocate buffer for section info.$Failed to allocate memory for container sizes.$Failed to find Burn section.$Failed to find valid DOS image header in buffer.$Failed to find valid NT image header in buffer.$Failed to get total size of bundle.$Failed to open handle to engine process path.$Failed to read DOS header.$Failed to read NT header.$Failed to read complete image section header, index: %u$Failed to read complete section info.$Failed to read image section header, index: %u$Failed to read section info, data to short: %u$Failed to read section info, unsupported version: %08x$Failed to read section info.$Failed to read signature offset.$Failed to read signature size.$Failed to seek past optional headers.$Failed to seek to NT header.$Failed to seek to section info.$Failed to seek to start of file.$PE$PE Header from file didn't match PE Header in memory.$burn$c:\agent\_work\79\s\src\burn\engine\section.cpp$hDq
API String ID: 3411815225-1256511360
Opcode ID: d52fc1e652cedc2a9a3d3a4101e7ace56ffea1ff31e3f640811112b0fa7cbc5b
Instruction ID: 30276bf5d256864acc4cb06bac6eaa083093a6ee7f7e657fa1dc29d73c305e38
Opcode Fuzzy Hash: d52fc1e652cedc2a9a3d3a4101e7ace56ffea1ff31e3f640811112b0fa7cbc5b
Instruction Fuzzy Hash: CB12D876E40235EBD7709A198C46FEB76AAAF04B10F0241AAFD04BB3C4D7789D418BD5

Function 006DCD76 Relevance: 84.4, APIs: 3, Strings: 45, Instructions: 365
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 006D39DF: GetProcessHeap.KERNEL32(?,000001C7,?,006D237C,?,00000001,80004005,8007139F,?,?,0071058B,8007139F,?,00000000,00000000,8007139F), ref: 006D39F0
Part of subcall function 006D39DF: RtlAllocateHeap.NTDLL(00000000,?,006D237C,?,00000001,80004005,8007139F,?,?,0071058B,8007139F,?,00000000,00000000,8007139F), ref: 006D39F7

CompareStringW.KERNEL32(0000007F,00000000,00000000,000000FF,download,000000FF,00000000,Packaging,00000000,00000000,FilePath,0071B4B8,00000000,0071CB64,?,00000000), ref: 006DCEAC

Strings

msasn1.dll, xrefs: 006DCFDD
Failed to get @FilePath., xrefs: 006DD1D1
Failed to get @Container., xrefs: 006DD144
embedded, xrefs: 006DCEBE
CertificateRootPublicKeyIdentifier, xrefs: 006DCFF6
Failed to get @Hash., xrefs: 006DD19A
Failed to get @LayoutOnly., xrefs: 006DD14E
Packaging, xrefs: 006DCE7F
Failed to hex decode @CertificateRootPublicKeyIdentifier., xrefs: 006DD169
msi.dll, xrefs: 006DD018
FileSize, xrefs: 006DCFBB
Failed to allocate memory for payload structs., xrefs: 006DCE02
c:\agent\_work\79\s\src\burn\engine\payload.cpp, xrefs: 006DCDF8
Failed to select payload nodes., xrefs: 006DCDA4
wininet.dll, xrefs: 006DD0C7
feclient.dll, xrefs: 006DCF45
Failed to get @CertificateRootPublicKeyIdentifier., xrefs: 006DD170
Invalid value for @Packaging: %ls, xrefs: 006DD1B7
Container, xrefs: 006DCF04
SourcePath, xrefs: 006DCF69
Failed to get @Catalog., xrefs: 006DD18C
Payload, xrefs: 006DCD91
Failed to parse @FileSize., xrefs: 006DD158
Catalog, xrefs: 006DD0A5
Failed to get next node., xrefs: 006DD1DF
CertificateRootThumbprint, xrefs: 006DD033
download, xrefs: 006DCE9E
Failed to get @DownloadUrl., xrefs: 006DD1A1
Failed to get @CertificateRootThumbprint., xrefs: 006DD17E
cabinet.dll, xrefs: 006DD059
Failed to to find container: %ls, xrefs: 006DD13D
Failed to get @FileSize., xrefs: 006DD162
Hash, xrefs: 006DD070
Failed to get @Packaging., xrefs: 006DD1CA
Failed to get @SourcePath., xrefs: 006DD1A8
Failed to get payload node count., xrefs: 006DCDC9
Failed to get @Id., xrefs: 006DD1D8
external, xrefs: 006DCEDA
FilePath, xrefs: 006DCE64
version.dll, xrefs: 006DD01C
Failed to find catalog., xrefs: 006DD185
Failed to hex decode the Payload/@Hash., xrefs: 006DD193
LayoutOnly, xrefs: 006DCF46
DownloadUrl, xrefs: 006DCF92
Failed to hex decode @CertificateRootThumbprint., xrefs: 006DD177

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: Heap$AllocateCompareProcessString
String ID: Catalog$CertificateRootPublicKeyIdentifier$CertificateRootThumbprint$Container$DownloadUrl$Failed to allocate memory for payload structs.$Failed to find catalog.$Failed to get @Catalog.$Failed to get @CertificateRootPublicKeyIdentifier.$Failed to get @CertificateRootThumbprint.$Failed to get @Container.$Failed to get @DownloadUrl.$Failed to get @FilePath.$Failed to get @FileSize.$Failed to get @Hash.$Failed to get @Id.$Failed to get @LayoutOnly.$Failed to get @Packaging.$Failed to get @SourcePath.$Failed to get next node.$Failed to get payload node count.$Failed to hex decode @CertificateRootPublicKeyIdentifier.$Failed to hex decode @CertificateRootThumbprint.$Failed to hex decode the Payload/@Hash.$Failed to parse @FileSize.$Failed to select payload nodes.$Failed to to find container: %ls$FilePath$FileSize$Hash$Invalid value for @Packaging: %ls$LayoutOnly$Packaging$Payload$SourcePath$c:\agent\_work\79\s\src\burn\engine\payload.cpp$cabinet.dll$download$embedded$external$feclient.dll$msasn1.dll$msi.dll$version.dll$wininet.dll
API String ID: 1171520630-214904704
Opcode ID: 60cf5ae2820771582ffc8a918f5a313e6c5aff61a4ae0b2253b9c45c3bb02a38
Instruction ID: 8470fd330afcc3eb06cdb37ecbb25a6c56abbf7fa98800cb0da027a5ada06f44
Opcode Fuzzy Hash: 60cf5ae2820771582ffc8a918f5a313e6c5aff61a4ae0b2253b9c45c3bb02a38
Instruction Fuzzy Hash: 75C1A3B1D4062AFBCB11AA58CD05EEDBA6AEF00B20F104267F911B63D0D774EE95D690

Function 006F0AE0 Relevance: 54.6, APIs: 20, Strings: 11, Instructions: 306
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetEvent.KERNEL32(?,?,?,?,?,006F0690,?,?), ref: 006F0AEF
GetLastError.KERNEL32(?,?,?,?,006F0690,?,?), ref: 006F0AF9
WaitForSingleObject.KERNEL32(?,000000FF,?,?,?,?,006F0690,?,?), ref: 006F0B3E
GetLastError.KERNEL32(?,?,?,?,006F0690,?,?), ref: 006F0B49
ResetEvent.KERNEL32(?,?,?,?,?,006F0690,?,?), ref: 006F0B81
GetLastError.KERNEL32(?,?,?,?,006F0690,?,?), ref: 006F0B8B

Strings

Failed to set file pointer to end of file., xrefs: 006F0E19
Failed to create file: %ls, xrefs: 006F0DCB
Failed to copy stream name: %ls, xrefs: 006F0C1A
Invalid operation for this state., xrefs: 006F0BE7
Failed to set end of file., xrefs: 006F0E5E
Failed to reset begin operation event., xrefs: 006F0BB9, 006F0CF5
c:\agent\_work\79\s\src\burn\engine\cabextract.cpp, xrefs: 006F0B1D, 006F0B6D, 006F0BAF, 006F0BDB, 006F0C5E, 006F0CA6, 006F0CEB, 006F0D53, 006F0DBE, 006F0E0F, 006F0E54, 006F0E98
Failed to allocate buffer for stream., xrefs: 006F0D5D
Failed to wait for begin operation event., xrefs: 006F0B77, 006F0CB0
Failed to set operation complete event., xrefs: 006F0B27, 006F0C68
Failed to set file pointer to beginning of file., xrefs: 006F0EA2

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: ErrorLast$Event$ObjectResetSingleWait
String ID: Failed to allocate buffer for stream.$Failed to copy stream name: %ls$Failed to create file: %ls$Failed to reset begin operation event.$Failed to set end of file.$Failed to set file pointer to beginning of file.$Failed to set file pointer to end of file.$Failed to set operation complete event.$Failed to wait for begin operation event.$Invalid operation for this state.$c:\agent\_work\79\s\src\burn\engine\cabextract.cpp
API String ID: 1865021742-2724965156
Opcode ID: 1fed2d93a03d10c6f7b79ac6732cee18085cad801ebfa0b8434d77216f03ae7c
Instruction ID: 3deb1ef81203910a627069a653425886704b470989f97c1d6fd12203f7dd8289
Opcode Fuzzy Hash: 1fed2d93a03d10c6f7b79ac6732cee18085cad801ebfa0b8434d77216f03ae7c
Instruction Fuzzy Hash: 96911177A8063ABBF33116A85D0ABBA2912BF04B21F124214FF50BE7D2D36DEC0085D5

Function 006D4D7A Relevance: 42.2, APIs: 6, Strings: 18, Instructions: 219
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 006D34C4: GetModuleFileNameW.KERNEL32(?,?,00000104,?,00000104,?,?,?,?,006D10DD,?,00000000), ref: 006D34E5

CloseHandle.KERNEL32(00000000,?,000000FF,?,?,?,?,?,00000000,?,?,?,?,?,?,00000000), ref: 006D4F81
CloseHandle.KERNEL32(000000FF,?,000000FF,?,?,?,?,?,00000000,?,?,?,?,?,?,00000000), ref: 006D4F90
CloseHandle.KERNEL32(000000FF,?,000000FF,?,?,?,?,?,00000000,?,?,?,?,?,?,00000000), ref: 006D4F9F
CloseHandle.KERNEL32(?,?,000000FF,?,?,?,?,?,00000000,?,?,?,?,?,?,00000000), ref: 006D4FAA

Strings

Failed to wait for clean room process: %ls, xrefs: 006D4F64
Tm, xrefs: 006D4F8D
-%ls="%ls", xrefs: 006D4E27
"%ls" %ls, xrefs: 006D4EBB
Failed to allocate parameters for unelevated process., xrefs: 006D4E3B
Failed to append original command line., xrefs: 006D4EAA
Failed to cache to clean room., xrefs: 006D4E03
D, xrefs: 006D4EEA
%ls %ls, xrefs: 006D4E96
Failed to allocate full command-line., xrefs: 006D4ECF
Failed to get path for current process., xrefs: 006D4DC4
burn.clean.room, xrefs: 006D4E1F
Failed to launch clean room process: %ls, xrefs: 006D4F38
Failed to append %ls, xrefs: 006D4E5D
burn.filehandle.self, xrefs: 006D4E86
c:\agent\_work\79\s\src\burn\engine\engine.cpp, xrefs: 006D4F2B
burn.filehandle.attached, xrefs: 006D4E58
Tm, xrefs: 006D4E76, 006D4E79

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: CloseHandle$FileModuleName
String ID: "%ls" %ls$%ls %ls$-%ls="%ls"$D$Failed to allocate full command-line.$Failed to allocate parameters for unelevated process.$Failed to append %ls$Failed to append original command line.$Failed to cache to clean room.$Failed to get path for current process.$Failed to launch clean room process: %ls$Failed to wait for clean room process: %ls$burn.clean.room$burn.filehandle.attached$burn.filehandle.self$c:\agent\_work\79\s\src\burn\engine\engine.cpp$Tm$Tm
API String ID: 3884789274-2779114772
Opcode ID: 19c029bb4a51c781a182f12c36eddd7655017f9ae26be59c42b93a15442855d1
Instruction ID: d0bc266e543896df889a9df2773f9bc9ee525806537e0618237e0f65ee78f74f
Opcode Fuzzy Hash: 19c029bb4a51c781a182f12c36eddd7655017f9ae26be59c42b93a15442855d1
Instruction Fuzzy Hash: 87717272D00229BBCB219BA8CC45DEFBB7AAF44720F114156FA10B7391DB749E418BE0

Function 006E7430 Relevance: 37.0, APIs: 1, Strings: 20, Instructions: 290
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Failed to open manifest stream., xrefs: 006E74B1
Failed to extract bootstrapper application payloads., xrefs: 006E76F5
Failed to get manifest stream from container., xrefs: 006E74D2
WixBundleElevated, xrefs: 006E75AB, 006E75BC
Failed to parse command line., xrefs: 006E756D
WixBundleSourceProcessFolder, xrefs: 006E763A
Failed to set source process folder variable., xrefs: 006E764B
Failed to load catalog files., xrefs: 006E7715
Failed to initialize internal cache functionality., xrefs: 006E76A5
Failed to open attached UX container., xrefs: 006E7494
Failed to set source process path variable., xrefs: 006E760F
WixBundleUILevel, xrefs: 006E75DC, 006E75ED
WixBundleOriginalSource, xrefs: 006E765F
Failed to get unique temporary folder for bootstrapper application., xrefs: 006E76D4
Failed to initialize variables., xrefs: 006E7477
Failed to get source process folder from path., xrefs: 006E762B
Failed to overwrite the %ls built-in variable., xrefs: 006E75C1
Failed to load manifest., xrefs: 006E74EE
Failed to set original source variable., xrefs: 006E7670
WixBundleSourceProcessPath, xrefs: 006E75FE

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: CriticalInitializeSection
String ID: Failed to extract bootstrapper application payloads.$Failed to get manifest stream from container.$Failed to get source process folder from path.$Failed to get unique temporary folder for bootstrapper application.$Failed to initialize internal cache functionality.$Failed to initialize variables.$Failed to load catalog files.$Failed to load manifest.$Failed to open attached UX container.$Failed to open manifest stream.$Failed to overwrite the %ls built-in variable.$Failed to parse command line.$Failed to set original source variable.$Failed to set source process folder variable.$Failed to set source process path variable.$WixBundleElevated$WixBundleOriginalSource$WixBundleSourceProcessFolder$WixBundleSourceProcessPath$WixBundleUILevel
API String ID: 32694325-1564579409
Opcode ID: 0772692353aaead6c1b3978322e963ffba4a1a684b6e68041e141ef107c71023
Instruction ID: e6e9e7d2d46da260f755498271809593ea5226632a4c42aca2dc3dd967014c11
Opcode Fuzzy Hash: 0772692353aaead6c1b3978322e963ffba4a1a684b6e68041e141ef107c71023
Instruction Fuzzy Hash: BFA1A6B2E45B6ABADF12DAB5CC41EEEB76EBB14700F010226F501E7241D774EA448BD4

Function 006E85C4 Relevance: 35.2, APIs: 9, Strings: 11, Instructions: 208
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(00000000,40000000,00000005,00000000,00000002,08000080,00000000,?,00000000,00000000,006D4DFD,?,?,00000000,006D4DFD,00000000), ref: 006E8607
GetLastError.KERNEL32 ref: 006E8614

Part of subcall function 0071415B: ReadFile.KERNELBASE(?,?,00000000,?,00000000), ref: 007141F1

SetFilePointerEx.KERNELBASE(00000000,0071B4B8,00000000,00000000,00000000,?,00000000,0071B500,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 006E86C1
GetLastError.KERNEL32 ref: 006E86CB
CloseHandle.KERNELBASE(00000000,?,00000000,0071B500,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 006E87F6

Strings

Failed to copy engine from: %ls to: %ls, xrefs: 006E869C
Failed to seek to original data in exe burn section header., xrefs: 006E87CF
Failed to seek to beginning of engine file: %ls, xrefs: 006E866D
Failed to update signature offset., xrefs: 006E8715
Failed to create engine file at path: %ls, xrefs: 006E8645
Failed to seek to signature table in exe header., xrefs: 006E8760
c:\agent\_work\79\s\src\burn\engine\cache.cpp, xrefs: 006E8638, 006E86EF, 006E8756, 006E87C5
cabinet.dll, xrefs: 006E876F
Failed to zero out original data offset., xrefs: 006E87E8
msi.dll, xrefs: 006E8708
Failed to seek to checksum in exe header., xrefs: 006E86F9

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: File$ErrorLast$CloseCreateHandlePointerRead
String ID: Failed to copy engine from: %ls to: %ls$Failed to create engine file at path: %ls$Failed to seek to beginning of engine file: %ls$Failed to seek to checksum in exe header.$Failed to seek to original data in exe burn section header.$Failed to seek to signature table in exe header.$Failed to update signature offset.$Failed to zero out original data offset.$c:\agent\_work\79\s\src\burn\engine\cache.cpp$cabinet.dll$msi.dll
API String ID: 3456208997-3624690521
Opcode ID: 6f076211c93681c1a03bf2fa7d45e26e56c03d7b3c8c7ccf167b09f3d2610b54
Instruction ID: 35e63b5dd11fdd3b199df81a63c4147fa678077146be0f92027eec86809636a4
Opcode Fuzzy Hash: 6f076211c93681c1a03bf2fa7d45e26e56c03d7b3c8c7ccf167b09f3d2610b54
Instruction Fuzzy Hash: 6851EA73D42775BFEB1157A99C46FFF266AAB04B10F114119FE04FB280EB689C4086E5

Function 006D762D Relevance: 34.9, APIs: 1, Strings: 22, Instructions: 419
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSection.KERNEL32(006E7471,006D53FA,00000000,006D5482), ref: 006D764D

Strings

WixBundleTag, xrefs: 006D7EAF
WixBundleExecutePackageAction, xrefs: 006D7DF9
WixBundleAction, xrefs: 006D7D77
WixBundleExecutePackageCacheFolder, xrefs: 006D7D99
WixBundleElevated, xrefs: 006D7E47
WixBundleSourceProcessFolder, xrefs: 006D7E9F
LogonUser, xrefs: 006D7883
#, xrefs: 006D76CC
InstallerName, xrefs: 006D7813
WixBundleVersion, xrefs: 006D7ECF
InstallerVersion, xrefs: 006D7834
', xrefs: 006D78EC
$, xrefs: 006D7D4A
WixBundleActiveParent, xrefs: 006D7E63
WixBundleUILevel, xrefs: 006D7EBF
Failed to add built-in variable: %ls., xrefs: 006D7F1A
WixBundleProviderKey, xrefs: 006D7E7F
0, xrefs: 006D7664
WixBundleInstalled, xrefs: 006D7E2B
Date, xrefs: 006D7771
WixBundleForcedRestartPackage, xrefs: 006D7E15
WixBundleSourceProcessPath, xrefs: 006D7E8F

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: CriticalInitializeSection
String ID: #$$$'$0$Date$Failed to add built-in variable: %ls.$InstallerName$InstallerVersion$LogonUser$WixBundleAction$WixBundleActiveParent$WixBundleElevated$WixBundleExecutePackageAction$WixBundleExecutePackageCacheFolder$WixBundleForcedRestartPackage$WixBundleInstalled$WixBundleProviderKey$WixBundleSourceProcessFolder$WixBundleSourceProcessPath$WixBundleTag$WixBundleUILevel$WixBundleVersion
API String ID: 32694325-3635313340
Opcode ID: 0afc8a96a4cecd7dc9decd2dc2819cb6c5ef58da8e72ff071ae23a72ed5c9693
Instruction ID: 60fb6caaad8ed3dfddb086180a6edab044fc459d15ed0cf57d15aea378d1eee5
Opcode Fuzzy Hash: 0afc8a96a4cecd7dc9decd2dc2819cb6c5ef58da8e72ff071ae23a72ed5c9693
Instruction Fuzzy Hash: 553249B0D516699BDB66CF9AC9883DDFAB5BB48304F5081EED20CB6250C7B41BC88F45

Function 006E81B2 Relevance: 31.7, APIs: 7, Strings: 11, Instructions: 152
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(00000000,00000000,00000000,006D54C6), ref: 006E8208

Part of subcall function 00710B93: OpenProcessToken.ADVAPI32(?,00000008,?,006D53FA,00000000,?,?,?,?,?,?,?,006E75A3,00000000), ref: 00710BB1
Part of subcall function 00710B93: GetLastError.KERNEL32(?,?,?,?,?,?,?,006E75A3,00000000), ref: 00710BBB
Part of subcall function 00710B93: CloseHandle.KERNELBASE(?,?,?,?,?,?,?,?,006E75A3,00000000), ref: 00710C45

GetWindowsDirectoryW.KERNEL32(?,00000104,00000000), ref: 006E822E
GetLastError.KERNEL32 ref: 006E8238
GetTempPathW.KERNEL32(00000104,?,00000000), ref: 006E82B5
GetLastError.KERNEL32 ref: 006E82BF
UuidCreate.RPCRT4(?), ref: 006E82FE

Strings

Failed to get windows path for working folder., xrefs: 006E8266
Failed to convert working folder guid into string., xrefs: 006E833E
Failed to append bundle id on to temp path for working folder., xrefs: 006E8368
Failed to ensure windows path for working folder ended in backslash., xrefs: 006E8283
Failed to get temp path for working folder., xrefs: 006E82ED
Failed to create working folder guid., xrefs: 006E830B
c:\agent\_work\79\s\src\burn\engine\cache.cpp, xrefs: 006E825C, 006E82E3, 006E8334
%ls%ls\, xrefs: 006E8350
Failed to concat Temp directory on windows path for working folder., xrefs: 006E82A5
Temp\, xrefs: 006E828D
Failed to copy working folder path., xrefs: 006E8383

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: ErrorLast$Process$CloseCreateCurrentDirectoryHandleOpenPathTempTokenUuidWindows
String ID: %ls%ls\$Failed to append bundle id on to temp path for working folder.$Failed to concat Temp directory on windows path for working folder.$Failed to convert working folder guid into string.$Failed to copy working folder path.$Failed to create working folder guid.$Failed to ensure windows path for working folder ended in backslash.$Failed to get temp path for working folder.$Failed to get windows path for working folder.$Temp\$c:\agent\_work\79\s\src\burn\engine\cache.cpp
API String ID: 266130487-3370790371
Opcode ID: 896e32e77f04a78a4d8a1f85f3d7d8fb071600c1e1c237c164744081ab2000f2
Instruction ID: ca0a1f03269d3b2bd015de3b937b5aabe0a6f7bff418b1e7e8a91bc400e0de30
Opcode Fuzzy Hash: 896e32e77f04a78a4d8a1f85f3d7d8fb071600c1e1c237c164744081ab2000f2
Instruction Fuzzy Hash: 77412CB2E42778AFD72096E59C0AFDB72A96F10B11F004156FA08F7280EF789E4486D5

Function 006F0EC5 Relevance: 30.0, APIs: 8, Strings: 9, Instructions: 216
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoInitializeEx.OLE32(00000000,00000000), ref: 006F0EE7
CoUninitialize.COMBASE ref: 006F1162

Strings

<the>.cab, xrefs: 006F0F87
Invalid operation for this state., xrefs: 006F1146
Failed to reset begin operation event., xrefs: 006F111A
c:\agent\_work\79\s\src\burn\engine\cabextract.cpp, xrefs: 006F0F5D, 006F1084, 006F10D1, 006F1110, 006F113C
Failed to initialize cabinet.dll., xrefs: 006F0F69
Failed to wait for begin operation event., xrefs: 006F10DB
Failed to initialize COM., xrefs: 006F0EF3
Failed to set operation complete event., xrefs: 006F108E
Failed to extract all files from container, erf: %d:%X:%d, xrefs: 006F1043

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: InitializeUninitialize
String ID: <the>.cab$Failed to extract all files from container, erf: %d:%X:%d$Failed to initialize COM.$Failed to initialize cabinet.dll.$Failed to reset begin operation event.$Failed to set operation complete event.$Failed to wait for begin operation event.$Invalid operation for this state.$c:\agent\_work\79\s\src\burn\engine\cabextract.cpp
API String ID: 3442037557-4128139206
Opcode ID: 49295924065bbd9fb77a4407a495aebfcce51233be813ab9c4858bbec143cce8
Instruction ID: 8c541c3aacb3c130a9f1f1e7fcb1dae892d41222ab90c3fd8994682495232113
Opcode Fuzzy Hash: 49295924065bbd9fb77a4407a495aebfcce51233be813ab9c4858bbec143cce8
Instruction Fuzzy Hash: 48515B77E4027EE7933056584C06EBB26539B02BE0B12432AFF11BF385DE6D8C4296D6

Function 006D4326 Relevance: 28.2, APIs: 10, Strings: 6, Instructions: 157
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSection.KERNEL32(00000000,?,00000000,00000000,?,?,006D52A3,?,?,00000000,?,?), ref: 006D4352
InitializeCriticalSection.KERNEL32(000000D0,?,?,006D52A3,?,?,00000000,?,?), ref: 006D435B
lstrlenW.KERNEL32(burn.filehandle.attached,000004B8,000004A0,?,?,006D52A3,?,?,00000000,?,?), ref: 006D43A1
lstrlenW.KERNEL32(burn.filehandle.attached,burn.filehandle.attached,00000000,?,?,006D52A3,?,?,00000000,?,?), ref: 006D43AB
CompareStringW.KERNEL32(0000007F,00000001,?,00000000,?,?,006D52A3,?,?,00000000,?,?), ref: 006D43BF
lstrlenW.KERNEL32(burn.filehandle.attached,?,?,006D52A3,?,?,00000000,?,?), ref: 006D43CF
lstrlenW.KERNEL32(burn.filehandle.self,?,?,006D52A3,?,?,00000000,?,?), ref: 006D441F
lstrlenW.KERNEL32(burn.filehandle.self,burn.filehandle.self,00000000,?,?,006D52A3,?,?,00000000,?,?), ref: 006D4429
CompareStringW.KERNEL32(0000007F,00000001,?,00000000,?,?,006D52A3,?,?,00000000,?,?), ref: 006D443D
lstrlenW.KERNEL32(burn.filehandle.self,?,?,006D52A3,?,?,00000000,?,?), ref: 006D444D

Strings

Missing required parameter for switch: %ls, xrefs: 006D44F1
Failed to parse file handle: '%ls', xrefs: 006D44CF
burn.filehandle.self, xrefs: 006D441A, 006D4422, 006D4427, 006D4428, 006D4448, 006D4518
c:\agent\_work\79\s\src\burn\engine\engine.cpp, xrefs: 006D44E2, 006D450E
Failed to initialize engine section., xrefs: 006D44B6
burn.filehandle.attached, xrefs: 006D439C, 006D43A4, 006D43A9, 006D43AA, 006D43CA, 006D44EC

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: lstrlen$CompareCriticalInitializeSectionString
String ID: Failed to initialize engine section.$Failed to parse file handle: '%ls'$Missing required parameter for switch: %ls$burn.filehandle.attached$burn.filehandle.self$c:\agent\_work\79\s\src\burn\engine\engine.cpp
API String ID: 3039292287-348208256
Opcode ID: cbf927a2e6e98445ef2d12bd63c6e05d1172a704394929ae09fc770433380cd7
Instruction ID: fa05b07297225ee4914a94582b804d5ab58af3990746cc56e02544fb5e498d52
Opcode Fuzzy Hash: cbf927a2e6e98445ef2d12bd63c6e05d1172a704394929ae09fc770433380cd7
Instruction Fuzzy Hash: 4B5180B1E40215BFC7249B68DC46F9A77AAEB44720F10411AF618DB390DB74AD90CAA4

Function 006DC252 Relevance: 28.1, APIs: 8, Strings: 8, Instructions: 131
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNEL32(00000000,80000000,00000001,00000000,00000003,08000080,00000000,?,00000000,00000000,BTm,006DC442,BTm,?,?,006D5482), ref: 006DC299
GetLastError.KERNEL32 ref: 006DC2AA
GetCurrentProcess.KERNEL32(?,00000000,00000000,00000002,?,00000000,00000000,BTm,006DC442,BTm,?,?,006D5482,006D5482,00000000,?), ref: 006DC2F9
GetCurrentProcess.KERNEL32(000000FF,00000000), ref: 006DC2FF
DuplicateHandle.KERNELBASE(00000000), ref: 006DC302
GetLastError.KERNEL32 ref: 006DC30C
SetFilePointerEx.KERNELBASE(?,00000000,00000000,00000000,00000000), ref: 006DC35E
GetLastError.KERNEL32 ref: 006DC368

Strings

Failed to move file pointer to container offset., xrefs: 006DC396
Failed to open file: %ls, xrefs: 006DC2DB
Failed to open container., xrefs: 006DC3B4
feclient.dll, xrefs: 006DC35B
BTm, xrefs: 006DC252
Failed to duplicate handle to container: %ls, xrefs: 006DC33D
c:\agent\_work\79\s\src\burn\engine\container.cpp, xrefs: 006DC2CE, 006DC330, 006DC38C
crypt32.dll, xrefs: 006DC35A

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: ErrorLast$CurrentFileProcess$CreateDuplicateHandlePointer
String ID: BTm$Failed to duplicate handle to container: %ls$Failed to move file pointer to container offset.$Failed to open container.$Failed to open file: %ls$c:\agent\_work\79\s\src\burn\engine\container.cpp$crypt32.dll$feclient.dll
API String ID: 2619879409-786298395
Opcode ID: 8bf5c8141be30476feb3641f15987e25fdb633218ee1099818a0bd2291b3c477
Instruction ID: 3e7ed178b4d1afe682070ebbedbfd9cb96a6d3d53174badfc99138d8a343cdb6
Opcode Fuzzy Hash: 8bf5c8141be30476feb3641f15987e25fdb633218ee1099818a0bd2291b3c477
Instruction Fuzzy Hash: 0541E77654021AABD7209F5D9D49E9B3BB7ABC5730B22C01AFD14EB381E735D801DBA0

Function 00712DBA Relevance: 26.3, APIs: 7, Strings: 8, Instructions: 78
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 006D38D1: GetSystemDirectoryW.KERNEL32(?,00000104), ref: 006D3910
Part of subcall function 006D38D1: GetLastError.KERNEL32 ref: 006D391A

Part of subcall function 00714CDB: GetLastError.KERNEL32(?,00000000,00000000,00000000,00000000,00000001), ref: 00714D0C

GetProcAddress.KERNEL32(MsiDeterminePatchSequenceW,00000000), ref: 00712E04
GetProcAddress.KERNEL32(MsiDetermineApplicablePatchesW), ref: 00712E24
GetProcAddress.KERNEL32(MsiEnumProductsExW), ref: 00712E44
GetProcAddress.KERNEL32(MsiGetPatchInfoExW), ref: 00712E64
GetProcAddress.KERNEL32(MsiGetProductInfoExW), ref: 00712E84
GetProcAddress.KERNEL32(MsiSetExternalUIRecord), ref: 00712EA4
GetProcAddress.KERNEL32(MsiSourceListAddSourceExW), ref: 00712EC4

Strings

MsiSourceListAddSourceExW, xrefs: 00712EB9
MsiSetExternalUIRecord, xrefs: 00712E99
MsiGetProductInfoExW, xrefs: 00712E79
MsiEnumProductsExW, xrefs: 00712E39
MsiDetermineApplicablePatchesW, xrefs: 00712E19
MsiDeterminePatchSequenceW, xrefs: 00712DF9
MsiGetPatchInfoExW, xrefs: 00712E59
Msi.dll, xrefs: 00712DCC

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: AddressProc$ErrorLast$DirectorySystem
String ID: Msi.dll$MsiDetermineApplicablePatchesW$MsiDeterminePatchSequenceW$MsiEnumProductsExW$MsiGetPatchInfoExW$MsiGetProductInfoExW$MsiSetExternalUIRecord$MsiSourceListAddSourceExW
API String ID: 2510051996-1735120554
Opcode ID: 0b767808ebb50470e9ff356561404501a49360a7200da246decd8113dd9d1d06
Instruction ID: 53257d9aca78c6f4fab2e44d8fa871fa41cd712851d0698b173801023eca031d
Opcode Fuzzy Hash: 0b767808ebb50470e9ff356561404501a49360a7200da246decd8113dd9d1d06
Instruction Fuzzy Hash: DD31EAB1A40318EEFB139F65EE067A53AA0F715706F10C12AE800761B2E77D49A5DF88

Function 006F1508 Relevance: 22.9, APIs: 6, Strings: 7, Instructions: 106COMMON

Download Yara Rule

APIs

CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,wininet.dll,?,00000000,00000000,00000000,?,?,006DC3AE,?,?), ref: 006F153F
GetLastError.KERNEL32(?,006DC3AE,?,?), ref: 006F1548

Strings

Failed to create begin operation event., xrefs: 006F1576
Failed to create extraction thread., xrefs: 006F1608
c:\agent\_work\79\s\src\burn\engine\cabextract.cpp, xrefs: 006F156C, 006F15B2, 006F15FE
Failed to copy file name., xrefs: 006F152A
wininet.dll, xrefs: 006F151E
Failed to wait for operation complete., xrefs: 006F161B
Failed to create operation complete event., xrefs: 006F15BC

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: CreateErrorEventLast
String ID: Failed to copy file name.$Failed to create begin operation event.$Failed to create extraction thread.$Failed to create operation complete event.$Failed to wait for operation complete.$c:\agent\_work\79\s\src\burn\engine\cabextract.cpp$wininet.dll
API String ID: 545576003-3114295247
Opcode ID: cc5b0d0c0954fe60b2ea3a97e6c33eb2658f40992be654a9652e3e579ecb9f18
Instruction ID: d104561236a5e5b11a51043f23676d842449599d4e3c7e74afeb7299c5a3eca5
Opcode Fuzzy Hash: cc5b0d0c0954fe60b2ea3a97e6c33eb2658f40992be654a9652e3e579ecb9f18
Instruction Fuzzy Hash: 302129F3E8163EB7E22016695C45E7B699EAF41BE1F024115FE01FF680E658DC0045E9

Function 0070FFDC Relevance: 22.8, APIs: 6, Strings: 7, Instructions: 76libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNELBASE(SystemFunction040,AdvApi32.dll), ref: 00710004
GetProcAddress.KERNEL32(SystemFunction041), ref: 00710016
GetProcAddress.KERNEL32(CryptProtectMemory,Crypt32.dll), ref: 00710059
GetLastError.KERNEL32(?,?,?,?,?,?), ref: 0071006D
GetProcAddress.KERNEL32(CryptUnprotectMemory), ref: 007100A5
GetLastError.KERNEL32(?,?,?,?,?,?), ref: 007100B9

Strings

SystemFunction041, xrefs: 00710006
Crypt32.dll, xrefs: 0071003A
CryptProtectMemory, xrefs: 0071004E
SystemFunction040, xrefs: 0070FFF9
CryptUnprotectMemory, xrefs: 0071009A
c:\agent\_work\79\s\src\libs\dutil\cryputil.cpp, xrefs: 0071008E
AdvApi32.dll, xrefs: 0070FFE3

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: AddressProc$ErrorLast
String ID: AdvApi32.dll$Crypt32.dll$CryptProtectMemory$CryptUnprotectMemory$SystemFunction040$SystemFunction041$c:\agent\_work\79\s\src\libs\dutil\cryputil.cpp
API String ID: 4214558900-2260022107
Opcode ID: 463e8908d67b9f29e2b5ad2b9a943142d67ce93b9d1a28700833758c4ad579bb
Instruction ID: d682efd9c03d3d0f48e16ad6775743680a1aa77895916a1bcaa593a8064dc4d7
Opcode Fuzzy Hash: 463e8908d67b9f29e2b5ad2b9a943142d67ce93b9d1a28700833758c4ad579bb
Instruction Fuzzy Hash: 0821D677941632E7F3329B58AC0BB966950B718751F02D015ED40BA2E1D3BDCCC09BD8

Function 006F0696 Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 105fileCOMMON

Download Yara Rule

APIs

CompareStringA.KERNELBASE(00000000,00000000,<the>.cab,?,?), ref: 006F06C6
GetCurrentProcess.KERNEL32(?,00000000,00000000,00000000,?,?), ref: 006F06DE
GetCurrentProcess.KERNEL32(?,00000000,?,?), ref: 006F06E3
DuplicateHandle.KERNELBASE(00000000,?,?), ref: 006F06E6
GetLastError.KERNEL32(?,?), ref: 006F06F0
CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,08000080,00000000,?,?), ref: 006F075F
GetLastError.KERNEL32(?,?), ref: 006F076C

Strings

<the>.cab, xrefs: 006F06BF
Failed to add virtual file pointer for cab container., xrefs: 006F0745
c:\agent\_work\79\s\src\burn\engine\cabextract.cpp, xrefs: 006F0714, 006F0790
Failed to duplicate handle to cab container., xrefs: 006F071E
Failed to open cabinet file: %hs, xrefs: 006F079D

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: CurrentErrorLastProcess$CompareCreateDuplicateFileHandleString
String ID: <the>.cab$Failed to add virtual file pointer for cab container.$Failed to duplicate handle to cab container.$Failed to open cabinet file: %hs$c:\agent\_work\79\s\src\burn\engine\cabextract.cpp
API String ID: 3030546534-4222385192
Opcode ID: 410a0bd4e840c0e3dd2d5402f9b6980de470878fde762af2f3fb161e8d43fd2d
Instruction ID: a7165304e39ea3ecd4fd09abf1ba95af9332e75ed9bc88571ae4050f152a8b29
Opcode Fuzzy Hash: 410a0bd4e840c0e3dd2d5402f9b6980de470878fde762af2f3fb161e8d43fd2d
Instruction Fuzzy Hash: 58310176A01139BBE7216B589C49EAB7F6AEF04760F114155FE04A7292D728AD008EE4

Function 006D6DCB Relevance: 19.7, APIs: 2, Strings: 11, Instructions: 164COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(00000000,006D53FA,00000000,006D5482,00000000,?,006D82B1,?,?,?,00000000,00000000), ref: 006D6DDA

Part of subcall function 006D56E2: CompareStringW.KERNELBASE(0000007F,00001000,?,000000FF,version.dll,000000FF,?,?,00000000,006D65B1,006D65B1,?,006D5678,?,?,00000000), ref: 006D571E
Part of subcall function 006D56E2: GetLastError.KERNEL32(?,006D5678,?,?,00000000,?,?,006D65B1,?,006D7F03,?,?,?,?,?), ref: 006D574D

LeaveCriticalSection.KERNEL32(00000000,?,?,00000000,00000000,00000000), ref: 006D6F6A

Strings

Unsetting variable '%ls', xrefs: 006D6EF3, 006D6F26
Failed to find variable value '%ls'., xrefs: 006D6DF5
Setting version variable '%ls' to value '%hu.%hu.%hu.%hu', xrefs: 006D6EDF
Setting numeric variable '%ls' to value %lld, xrefs: 006D6F0B
Setting hidden variable '%ls', xrefs: 006D6E98
c:\agent\_work\79\s\src\burn\engine\variable.cpp, xrefs: 006D6E5D
Failed to set value of variable: %ls, xrefs: 006D6F52
Attempt to set built-in variable value: %ls, xrefs: 006D6E68
Setting variable failed: ID '%ls', HRESULT 0x%x, xrefs: 006D6F7C
Failed to insert variable '%ls'., xrefs: 006D6E1F
Setting string variable '%ls' to value '%ls', xrefs: 006D6EFA, 006D6F02

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: CriticalSection$CompareEnterErrorLastLeaveString
String ID: Attempt to set built-in variable value: %ls$Failed to find variable value '%ls'.$Failed to insert variable '%ls'.$Failed to set value of variable: %ls$Setting hidden variable '%ls'$Setting numeric variable '%ls' to value %lld$Setting string variable '%ls' to value '%ls'$Setting variable failed: ID '%ls', HRESULT 0x%x$Setting version variable '%ls' to value '%hu.%hu.%hu.%hu'$Unsetting variable '%ls'$c:\agent\_work\79\s\src\burn\engine\variable.cpp
API String ID: 2716280545-2805439763
Opcode ID: 47fa57458c658741bdbd9724dff07a1c4982e1fcd5eea7e65a0c88b992f8f568
Instruction ID: f50594610dffe91fa84796bf0f7f69da6ec8a5d80c9da3cfc68ff26f4b8fa56d
Opcode Fuzzy Hash: 47fa57458c658741bdbd9724dff07a1c4982e1fcd5eea7e65a0c88b992f8f568
Instruction Fuzzy Hash: 5251B471E40215ABCB309E59DC4AFEB3BABEB95700F14412AF845963C2C279DD81CAE1

Function 006E6952 Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 68COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(000000FF,00000000,00000001,00000002,?,00000000,?,?,006D4E52,?,?), ref: 006E6972
GetCurrentProcess.KERNEL32(?,00000000,?,?,006D4E52,?,?), ref: 006E6978
DuplicateHandle.KERNELBASE(00000000,?,?,006D4E52,?,?), ref: 006E697B
GetLastError.KERNEL32(?,?,006D4E52,?,?), ref: 006E6985
CloseHandle.KERNEL32(000000FF,?,006D4E52,?,?), ref: 006E69FE

Strings

Failed to append the file handle to the command line., xrefs: 006E69E6
burn.filehandle.attached, xrefs: 006E69CB
%ls -%ls=%u, xrefs: 006E69D2
RNm, xrefs: 006E69C8, 006E69D0, 006E69D7
Failed to duplicate file handle for attached container., xrefs: 006E69B3
c:\agent\_work\79\s\src\burn\engine\core.cpp, xrefs: 006E69A9

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: CurrentHandleProcess$CloseDuplicateErrorLast
String ID: %ls -%ls=%u$Failed to append the file handle to the command line.$Failed to duplicate file handle for attached container.$RNm$burn.filehandle.attached$c:\agent\_work\79\s\src\burn\engine\core.cpp
API String ID: 4224961946-4038015273
Opcode ID: 678688ab34013a1c1bd30769654a835b58751eb79cd129f4f0980718cd6a85f1
Instruction ID: 2b61eedbc99e374aaa1efa09a0d32e2bb85eb7f3716a92cbd13e411f2381602f
Opcode Fuzzy Hash: 678688ab34013a1c1bd30769654a835b58751eb79cd129f4f0980718cd6a85f1
Instruction Fuzzy Hash: BA11E472941326FBCB109BA9CD09A8E7BA9AB14770F114315F920FB2D1D3789E0196A0

Function 006D3171 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 209COMMON

Download Yara Rule

APIs

ExpandEnvironmentStringsW.KERNEL32(00000040,00000000,00000040,00000000,00000040,00000000,00000000), ref: 006D31BC
GetLastError.KERNEL32 ref: 006D31C2
ExpandEnvironmentStringsW.KERNEL32(00000040,00000000,00000040,00000000,00000000), ref: 006D321C
GetLastError.KERNEL32 ref: 006D3222
GetFullPathNameW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 006D32D6
GetLastError.KERNEL32 ref: 006D32E0
GetFullPathNameW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000), ref: 006D3336
GetLastError.KERNEL32 ref: 006D3340

Strings

c:\agent\_work\79\s\src\libs\dutil\pathutil.cpp, xrefs: 006D31E6

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: ErrorLast$EnvironmentExpandFullNamePathStrings
String ID: c:\agent\_work\79\s\src\libs\dutil\pathutil.cpp
API String ID: 1547313835-1445327374
Opcode ID: cc073349548820ee35e22a1c0633c004f2bddc7eb0fc643fcf8df037443ba51d
Instruction ID: ebdfdb457dc8437bfbf1f4898b3c3b0d52c725270cc1f457cc875eb9884aaf46
Opcode Fuzzy Hash: cc073349548820ee35e22a1c0633c004f2bddc7eb0fc643fcf8df037443ba51d
Instruction Fuzzy Hash: C761A173D0027AABDB219AD48D44BDEBAAAAB04760F164167EE00BB350E735DF0097D5

Function 007135AF Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 83memoryCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(0071B594), ref: 007135C5
SysAllocString.OLEAUT32(?), ref: 007135E1
VariantClear.OLEAUT32(?), ref: 00713668
SysFreeString.OLEAUT32(00000000), ref: 00713673

Strings

`)u, xrefs: 00713673
c:\agent\_work\79\s\src\libs\dutil\xmlutil.cpp, xrefs: 007135F8

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: StringVariant$AllocClearFreeInit
String ID: `)u$c:\agent\_work\79\s\src\libs\dutil\xmlutil.cpp
API String ID: 760788290-2301883107
Opcode ID: 879789242e55ac75c66b00cf45aa854a51e3b7ec63657e52e8c3df995a1fa46a
Instruction ID: 2204e751c5d9afc2b3e89d2719a608a08eb7ce964cfdeae0bc53288bb2a1b809
Opcode Fuzzy Hash: 879789242e55ac75c66b00cf45aa854a51e3b7ec63657e52e8c3df995a1fa46a
Instruction Fuzzy Hash: 2621A675900115FFDB11DB58C848EEEBBB9EF44B21F114158F915AB390C7399E44CB90

Function 00710B93 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 72COMMON

Download Yara Rule

APIs

OpenProcessToken.ADVAPI32(?,00000008,?,006D53FA,00000000,?,?,?,?,?,?,?,006E75A3,00000000), ref: 00710BB1
GetLastError.KERNEL32(?,?,?,?,?,?,?,006E75A3,00000000), ref: 00710BBB
GetTokenInformation.KERNELBASE(?,00000014(TokenIntegrityLevel),?,00000004,?,?,?,?,?,?,?,?,006E75A3,00000000), ref: 00710BED
GetLastError.KERNEL32(?,?,?,?,?,?,?,006E75A3,00000000), ref: 00710C06
CloseHandle.KERNELBASE(?,?,?,?,?,?,?,?,006E75A3,00000000), ref: 00710C45

Strings

c:\agent\_work\79\s\src\libs\dutil\procutil.cpp, xrefs: 00710C33

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: ErrorLastToken$CloseHandleInformationOpenProcess
String ID: c:\agent\_work\79\s\src\libs\dutil\procutil.cpp
API String ID: 4040495316-1009431558
Opcode ID: b6d553728e81585726d7856ad1a1d2a5f60e44e4dc0c9116bc6bf021433fdbca
Instruction ID: 0304bf77a712851312e548329546146a82147aa619f79f73c3611377afd507c6
Opcode Fuzzy Hash: b6d553728e81585726d7856ad1a1d2a5f60e44e4dc0c9116bc6bf021433fdbca
Instruction Fuzzy Hash: FB21A472D00129EBD7219F9D9D44ADEBAA8EF14710F118156ED15FB2D0D3B88E80DAE4

Function 006E6A0C Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 68fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,80000000,00000005,?,00000003,00000080,00000000,?,00000000,?,?,?), ref: 006E6A40
CloseHandle.KERNEL32(00000000), ref: 006E6AB0

Strings

Failed to append the file handle to the command line., xrefs: 006E6A6C
burn.filehandle.self, xrefs: 006E6A51, 006E6A83
%ls -%ls=%u, xrefs: 006E6A58, 006E6A8A
Failed to append the file handle to the obfuscated command line., xrefs: 006E6A9E

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: CloseCreateFileHandle
String ID: %ls -%ls=%u$Failed to append the file handle to the command line.$Failed to append the file handle to the obfuscated command line.$burn.filehandle.self
API String ID: 3498533004-3263533295
Opcode ID: 551c99adc53762c4e807efae4f53eb5e53088ea001ea36ee1c2216db0ad82eab
Instruction ID: 368d05392d339938f5252c74a2cdba3054715d7f50eace3f84521e74417c763a
Opcode Fuzzy Hash: 551c99adc53762c4e807efae4f53eb5e53088ea001ea36ee1c2216db0ad82eab
Instruction Fuzzy Hash: BD113871E01365BBCB21AAADDD49F9F3BA9AB41B70F008212F920B72D1E374454286A0

Function 00713819 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 33COMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 00713828
InterlockedIncrement.KERNEL32(0073C7B4), ref: 00713845
CLSIDFromProgID.COMBASE(Msxml2.DOMDocument,0073C7A0,?,?,?,?,?,?), ref: 00713860
CLSIDFromProgID.OLE32(MSXML.DOMDocument,0073C7A0,?,?,?,?,?,?), ref: 0071386C

Strings

Msxml2.DOMDocument, xrefs: 0071385B
MSXML.DOMDocument, xrefs: 00713867

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: FromProg$IncrementInitializeInterlocked
String ID: MSXML.DOMDocument$Msxml2.DOMDocument
API String ID: 2109125048-2356320334
Opcode ID: 563745507ca630215a6b260da242eef99188f98dd36e002fa395e120fd6db2c6
Instruction ID: 3b6dd02d3c4de41a64c5be670cb81ebcaad3feee5db01277323a095b649bf36a
Opcode Fuzzy Hash: 563745507ca630215a6b260da242eef99188f98dd36e002fa395e120fd6db2c6
Instruction Fuzzy Hash: 0DF06531744271A6F72107ADAC08B972DA6EB91F62F60C426FC44E21E4D36CD9C5CBB4

Function 00714CDB Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 98memoryCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,00000000,00000000,00000000,00000000,00000001), ref: 00714D0C
GlobalAlloc.KERNEL32(00000000,00000000,?,00000000,00000000,00000000,00000000,00000001), ref: 00714D39
GetLastError.KERNEL32(?,00000000,?,00000000), ref: 00714D65
GetLastError.KERNEL32(00000000,0071B800,?,00000000,?,00000000,?,00000000), ref: 00714DA3
GlobalFree.KERNEL32(00000000), ref: 00714DD4

Strings

c:\agent\_work\79\s\src\libs\dutil\fileutil.cpp, xrefs: 00714D27, 00714D80

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: ErrorLast$Global$AllocFree
String ID: c:\agent\_work\79\s\src\libs\dutil\fileutil.cpp
API String ID: 1145190524-3405085980
Opcode ID: 765a76c4e4d0889086d3b140fe3713bc05a410dec66eb4efc1f61fea5b46ab07
Instruction ID: 2d66d737ea89a35df077781778b18e8db03ab33ea55595c5a4c5ad9687278c20
Opcode Fuzzy Hash: 765a76c4e4d0889086d3b140fe3713bc05a410dec66eb4efc1f61fea5b46ab07
Instruction Fuzzy Hash: 4D31F673A00229ABDF219A9C9C01EEFBAB8AF45760F114155FE44EB3C0D738DD4096E0

Function 006F0851 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 101COMMON

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?), ref: 006F08F7
GetLastError.KERNEL32(?,?,?), ref: 006F0901

Strings

Invalid seek type., xrefs: 006F088D
c:\agent\_work\79\s\src\burn\engine\cabextract.cpp, xrefs: 006F0925
Failed to move file pointer 0x%x bytes., xrefs: 006F0932

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID: Failed to move file pointer 0x%x bytes.$Invalid seek type.$c:\agent\_work\79\s\src\burn\engine\cabextract.cpp
API String ID: 2976181284-3594109541
Opcode ID: 6bae5a8ea8fada41656e4e263866cf4a6ed8229437cac62199808b88c55e5830
Instruction ID: 3a6e38fdd70f2e17d87d83fb6fc6eee221805498286d0a1e7025524475ce41e5
Opcode Fuzzy Hash: 6bae5a8ea8fada41656e4e263866cf4a6ed8229437cac62199808b88c55e5830
Instruction Fuzzy Hash: 9E318075A0021EFFEB14DFA8D885DADB7BAFB04764B048115FA2497352E374EE108B90

Function 006D415F Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 84COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(?,840F01E8,00000000,00000000,?,006E9FD1,00000000,00000000,?,00000000,006D53FA,00000000,?,?,006DD561,?), ref: 006D416D
GetLastError.KERNEL32(?,006E9FD1,00000000,00000000,?,00000000,006D53FA,00000000,?,?,006DD561,?,00000000,00000000), ref: 006D417B
CreateDirectoryW.KERNEL32(?,840F01E8,006D54C6,?,006E9FD1,00000000,00000000,?,00000000,006D53FA,00000000,?,?,006DD561,?,00000000), ref: 006D41EB
GetLastError.KERNEL32(?,006E9FD1,00000000,00000000,?,00000000,006D53FA,00000000,?,?,006DD561,?,00000000,00000000), ref: 006D41F5

Strings

c:\agent\_work\79\s\src\libs\dutil\dirutil.cpp, xrefs: 006D4225

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID: c:\agent\_work\79\s\src\libs\dutil\dirutil.cpp
API String ID: 1375471231-4184845720
Opcode ID: 569468fcbf62934986f697d797c4e9e81e8f865e340161d67fb6982a08c2e956
Instruction ID: 660a1ab80f29f4b004ade9247c55d923bb009360a1c12a658b799c2676170207
Opcode Fuzzy Hash: 569468fcbf62934986f697d797c4e9e81e8f865e340161d67fb6982a08c2e956
Instruction Fuzzy Hash: 2821D726E50231E7DB311AA55C84BBB6667AF65B61B12802BFD44EA340DE348D4192D4

Function 006D56E2 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 78COMMONLIBRARYCODE

Download Yara Rule

APIs

CompareStringW.KERNELBASE(0000007F,00001000,?,000000FF,version.dll,000000FF,?,?,00000000,006D65B1,006D65B1,?,006D5678,?,?,00000000), ref: 006D571E
GetLastError.KERNEL32(?,006D5678,?,?,00000000,?,?,006D65B1,?,006D7F03,?,?,?,?,?), ref: 006D574D

Strings

Failed to compare strings., xrefs: 006D577B
c:\agent\_work\79\s\src\burn\engine\variable.cpp, xrefs: 006D5771
version.dll, xrefs: 006D5710

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: CompareErrorLastString
String ID: Failed to compare strings.$c:\agent\_work\79\s\src\burn\engine\variable.cpp$version.dll
API String ID: 1733990998-2738194785
Opcode ID: b620b50c9a37658f860246350c9cad49355ccff751f1feda0f457610ee8fab6a
Instruction ID: 8be41340dae57ff84151aead1038e2b6c2aa002012dcccc4fefc3477857f456b
Opcode Fuzzy Hash: b620b50c9a37658f860246350c9cad49355ccff751f1feda0f457610ee8fab6a
Instruction Fuzzy Hash: DF213E37E00525EBC7148F5CCD44A99BBA6BF09730B31031AF812AB3C0D634DE018A90

Function 006F07BC Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 54fileCOMMON

Download Yara Rule

APIs

Part of subcall function 006F11D6: SetFilePointerEx.KERNELBASE(?,?,?,00000000,00000000,?,?,?,00000000,?,006F07EB,?,?,?), ref: 006F11FE
Part of subcall function 006F11D6: GetLastError.KERNEL32(?,006F07EB,?,?,?), ref: 006F1208

ReadFile.KERNELBASE(?,?,?,?,00000000,?,?,?), ref: 006F07F9
GetLastError.KERNEL32 ref: 006F0803

Strings

c:\agent\_work\79\s\src\burn\engine\cabextract.cpp, xrefs: 006F0827
Failed to read during cabinet extraction., xrefs: 006F0831

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: ErrorFileLast$PointerRead
String ID: Failed to read during cabinet extraction.$c:\agent\_work\79\s\src\burn\engine\cabextract.cpp
API String ID: 2170121939-535368954
Opcode ID: 26a57b9152582f1f4adc785455540e8c8f67f753403b152ff376d56581998565
Instruction ID: a2c4beaa22468567fec594c285a6acff8482dc7e14bb9a887375043768b68abe
Opcode Fuzzy Hash: 26a57b9152582f1f4adc785455540e8c8f67f753403b152ff376d56581998565
Instruction Fuzzy Hash: 1101E172A00239BBDB209FA9DC04D9A7BA9FF087A0B014119FE14A7291D334E910DAD4

Function 006F11D6 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 47COMMON

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE(?,?,?,00000000,00000000,?,?,?,00000000,?,006F07EB,?,?,?), ref: 006F11FE
GetLastError.KERNEL32(?,006F07EB,?,?,?), ref: 006F1208

Strings

c:\agent\_work\79\s\src\burn\engine\cabextract.cpp, xrefs: 006F122C
Failed to move to virtual file pointer., xrefs: 006F1236

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID: Failed to move to virtual file pointer.$c:\agent\_work\79\s\src\burn\engine\cabextract.cpp
API String ID: 2976181284-2647110642
Opcode ID: 4e5504c79883b634cd64e6eb9f17ef47ea4c9b921619d53f9f6fddf5b5bce113
Instruction ID: e31eb30a277dff04194b6a46576f16c3e8d3c8e952b177bea4d3be2a2d37be31
Opcode Fuzzy Hash: 4e5504c79883b634cd64e6eb9f17ef47ea4c9b921619d53f9f6fddf5b5bce113
Instruction Fuzzy Hash: 6301DF33A0063AF7D7211ACA9C0899BBF26FF41BB07018129FE18AA241D72999509AD4

Function 0071415B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 99fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(?,?,00000000,?,00000000), ref: 007141F1
GetLastError.KERNEL32 ref: 00714254

Strings

c:\agent\_work\79\s\src\libs\dutil\fileutil.cpp, xrefs: 00714278

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: ErrorFileLastRead
String ID: c:\agent\_work\79\s\src\libs\dutil\fileutil.cpp
API String ID: 1948546556-3405085980
Opcode ID: 6334c30ae119a16d53d706b43c95496981fce04cf84f6fba2aa181fdca7aee42
Instruction ID: e9d5ee8fa383195f577c074bf394e054ed93fcadb95d562b6c698c8f1b8b0638
Opcode Fuzzy Hash: 6334c30ae119a16d53d706b43c95496981fce04cf84f6fba2aa181fdca7aee42
Instruction Fuzzy Hash: 34316071A0026DABDB25CF5CCC407DA77B5FB44751F0081AAF948E7280D7B89EC49BA4

Function 007150A2 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNELBASE(00000000,00000000,00000000,?,00000000,00000000,00000000,?,?,?,00714218,?,?,?), ref: 007150C6
GetLastError.KERNEL32(?,?,00714218,?,?,?), ref: 007150D0

Strings

c:\agent\_work\79\s\src\libs\dutil\fileutil.cpp, xrefs: 007150F9

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: c:\agent\_work\79\s\src\libs\dutil\fileutil.cpp
API String ID: 442123175-3405085980
Opcode ID: f46627c1ebe2b84fcf8a8157d31ab2cf14fe90e29a2deb0502c00c82f3abb742
Instruction ID: f50f62721046198980e4426206e22794c013f274ba62aaff12ccfe9ce5936cdc
Opcode Fuzzy Hash: f46627c1ebe2b84fcf8a8157d31ab2cf14fe90e29a2deb0502c00c82f3abb742
Instruction Fuzzy Hash: CFF06D73A00529FBD7118AAECD45EDFBB69FB84B61F114126FD04EA180E674AA00D6E0

Function 00714B80 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 40COMMON

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE(?,?,?,?,?,00000000,?,?,?,006E8664,00000000,00000000,00000000,00000000,00000000), ref: 00714B98
GetLastError.KERNEL32(?,?,?,006E8664,00000000,00000000,00000000,00000000,00000000), ref: 00714BA2

Strings

c:\agent\_work\79\s\src\libs\dutil\fileutil.cpp, xrefs: 00714BC6

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID: c:\agent\_work\79\s\src\libs\dutil\fileutil.cpp
API String ID: 2976181284-3405085980
Opcode ID: 9bbc27d7748fd9520fc23d95aa4f3e9e0244684bb5c94ff64fa76c9f5e2470f6
Instruction ID: a20f6b1a8f562269d554ea60de120aacecb883f6bb81e83d1537eca9365550ed
Opcode Fuzzy Hash: 9bbc27d7748fd9520fc23d95aa4f3e9e0244684bb5c94ff64fa76c9f5e2470f6
Instruction Fuzzy Hash: C2F086B6604129AB9B248F89DC05ADB7FA8EF04750B014059BD04AB291D238DD50D6E4

Function 006D38D1 Relevance: 4.6, APIs: 3, Instructions: 79libraryCOMMON

Download Yara Rule

APIs

GetSystemDirectoryW.KERNEL32(?,00000104), ref: 006D3910
GetLastError.KERNEL32 ref: 006D391A
LoadLibraryW.KERNELBASE(?,?,00000104,?), ref: 006D3983

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: DirectoryErrorLastLibraryLoadSystem
String ID:
API String ID: 1230559179-0
Opcode ID: 1ef31d137dabf9965c342495ded0e059e1cb3df63f0cceb0ffbe3e746790ae9a
Instruction ID: e04216892445026f51063ee0df0438733c3d688152e528c230b7c787e75b1e13
Opcode Fuzzy Hash: 1ef31d137dabf9965c342495ded0e059e1cb3df63f0cceb0ffbe3e746790ae9a
Instruction Fuzzy Hash: DF2125B2D0133967CB209BA48C59FDA73A99F04724F114266FE04FB381F674EE408695

Function 006D3AA4 Relevance: 4.5, APIs: 3, Instructions: 21memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000000,00000000,?,007105D9,00000000,8007139F,?,00000000,00000000,8007139F,?,?,?,0071056D,000001C7), ref: 006D3AAE
RtlFreeHeap.NTDLL(00000000,?,007105D9,00000000,8007139F,?,00000000,00000000,8007139F,?,?,?,0071056D,000001C7,?,?), ref: 006D3AB5
GetLastError.KERNEL32(?,007105D9,00000000,8007139F,?,00000000,00000000,8007139F,?,?,?,0071056D,000001C7,?,?), ref: 006D3ABF

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: Heap$ErrorFreeLastProcess
String ID:
API String ID: 406640338-0
Opcode ID: 517896343bb8ba99cba19682486b0d1746c2ad2c4549df7e2222d5c096bba3b4
Instruction ID: c17bdf2432570dbd9bc4b4311ad870019a1b3d9d72fd6f520f2b768c3037b232
Opcode Fuzzy Hash: 517896343bb8ba99cba19682486b0d1746c2ad2c4549df7e2222d5c096bba3b4
Instruction Fuzzy Hash: 12D01273B0013A67862117EE6C0C9DBBE58EF056A17068121FD44DA350EB29DD0097E9

Function 00713877 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 100COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 007138AC

Part of subcall function 0071330F: GetModuleHandleA.KERNEL32(kernel32.dll,00000000,00000000,007138BD,00000000,?,00000000), ref: 00713329
Part of subcall function 0071330F: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,BTm,006FBD36,0071B518,BTm,?,00000000,?), ref: 00713335

Strings

BTm, xrefs: 00713877

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: ErrorHandleInitLastModuleVariant
String ID: BTm
API String ID: 52713655-1636500745
Opcode ID: 0155d294a8412adc5ed46a07add49e5c5ca12afd46058fab529f4d22e762c9ae
Instruction ID: f928938e77098b4a7f7a40e574ef3ffb150e14c9ab77b22ff13adebcf830a979
Opcode Fuzzy Hash: 0155d294a8412adc5ed46a07add49e5c5ca12afd46058fab529f4d22e762c9ae
Instruction Fuzzy Hash: F1316076E002299FDB01DFA8C884ADEB7F4EF08720F01456AE915FB351D774AD448BA4

Function 00711275 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 39registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(00000000,00000000,00000000,00000000,00000001,0073BB7C,00000000,?,00715A32,80000002,00000000,00020019,00000000,SOFTWARE\Policies\,00000000,00000000), ref: 00711289

Strings

c:\agent\_work\79\s\src\libs\dutil\regutil.cpp, xrefs: 007112C6

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: Open
String ID: c:\agent\_work\79\s\src\libs\dutil\regutil.cpp
API String ID: 71445658-1128744096
Opcode ID: 3d3bea12c582aff08b74685aa3582684d3e48a7219a5eb73e3a9642819202b4a
Instruction ID: 5943d5d5df0ffd8ec17be0c3e86accccc9bda37cfa0f80e23529011b80ba5b56
Opcode Fuzzy Hash: 3d3bea12c582aff08b74685aa3582684d3e48a7219a5eb73e3a9642819202b4a
Instruction Fuzzy Hash: 57F0B432B4012A639B31099A9C05AE77D85EB857F0F558126BF48DF2A0D57DCC5097E8

Function 00715ABD Relevance: 1.6, APIs: 1, Instructions: 59registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32(80070490,00000000,80070490,0073BB7C,00000000,80070490,?,?,006E8A07,WiX\Burn,PackageCache,00000000,0073BB7C,00000000,00000000,80070490), ref: 00715B17

Part of subcall function 007113B0: RegQueryValueExW.ADVAPI32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000002,00000001,00000000,00000000,00000000,00000000,00000000), ref: 00711426
Part of subcall function 007113B0: RegQueryValueExW.ADVAPI32(?,00000000,00000000,?,00000000,00000000,00000000,?), ref: 0071145E

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: QueryValue$Close
String ID:
API String ID: 1979452859-0
Opcode ID: d3040958452a1f4c8ff65b2f849f3aac901f169a713e46880e01ef406663b64b
Instruction ID: 3c2017b232f243884d85f939e235ff54c7cfb6ac60e8f81050e9c7b722a2ece1
Opcode Fuzzy Hash: d3040958452a1f4c8ff65b2f849f3aac901f169a713e46880e01ef406663b64b
Instruction Fuzzy Hash: 7911A0B680462AEB8B39AE9CCC859EEF775EB84360B114129ED5267250C3394E90E7D0

Function 006D2DE3 Relevance: 1.5, APIs: 1, Instructions: 44COMMON

Download Yara Rule

APIs

Part of subcall function 006D3171: ExpandEnvironmentStringsW.KERNEL32(00000040,00000000,00000040,00000000,00000040,00000000,00000000), ref: 006D31BC
Part of subcall function 006D3171: GetLastError.KERNEL32 ref: 006D31C2

Part of subcall function 006D3171: ExpandEnvironmentStringsW.KERNEL32(00000040,00000000,00000040,00000000,00000000), ref: 006D321C
Part of subcall function 006D3171: GetLastError.KERNEL32 ref: 006D3222
Part of subcall function 006D3171: GetFullPathNameW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 006D32D6
Part of subcall function 006D3171: GetLastError.KERNEL32 ref: 006D32E0

CompareStringW.KERNEL32(00000000,00000001,00000000,000000FF,00000000,000000FF,00000000,00000000,00000003,00000000,00000000,00000003,00000000), ref: 006D2E27

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: ErrorLast$EnvironmentExpandStrings$CompareFullNamePathString
String ID:
API String ID: 1340564764-0
Opcode ID: 7e3041eee8f199f3f250d68c8a9660e3462b2a047a28082aafd818b6e049efb0
Instruction ID: 3b2b437c90dd77b847e0666aac11e16038daf8581a2d112a44b936d4b44e343f
Opcode Fuzzy Hash: 7e3041eee8f199f3f250d68c8a9660e3462b2a047a28082aafd818b6e049efb0
Instruction Fuzzy Hash: FB017C35D0122AFBDF129B94CC16BCEBB7AAB10726F104255F910763E0C7749B40DB94

Function 006D35A8 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

SHGetFolderPathW.SHELL32(00000000,00000000,00000000,00000000,00000000,00000000,00000104,00000000,?,006E8AC1,0000001C,80070490,00000000,00000000,80070490), ref: 006D35C8

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: FolderPath
String ID:
API String ID: 1514166925-0
Opcode ID: 95eff6679835a91bfc92b10f5dc8f7545140a383569de50b2757f5e175b4c9de
Instruction ID: f441cea77d0f82cead7554bd0769b5f3b88f42164fed7f6d707de0948bfaa203
Opcode Fuzzy Hash: 95eff6679835a91bfc92b10f5dc8f7545140a383569de50b2757f5e175b4c9de
Instruction Fuzzy Hash: 6DE0C2727002243BA6002AA46C00CEB3B8DDF153907004016FE00D6200DB61D61053B5

Function 0070F7B9 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0070F7A0

Part of subcall function 00719B04: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00719B77
Part of subcall function 00719B04: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00719B88

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 29d017ff02d2f7ca28566877df06316ad37712804f3b249191077e7122073f22
Instruction ID: eab2a3f6d1038ade2d2fc030f6d4aecb57f3da67b600dfe4532722c4156f657d
Opcode Fuzzy Hash: 29d017ff02d2f7ca28566877df06316ad37712804f3b249191077e7122073f22
Instruction Fuzzy Hash: 3EB092E125D201ED329451182806C360198C080B20764822AB100C0582E86C49814133

Function 0070F7A9 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0070F7A0

Part of subcall function 00719B04: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00719B77
Part of subcall function 00719B04: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00719B88

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 4ea2d1c65f1c76387648766d5357f868399ab086c2c7137984bace49355ba5d4
Instruction ID: 3c7536d3b1c2ed56873958ebbf04efbd83dc16a461a3e074fb0de71dbe11b11d
Opcode Fuzzy Hash: 4ea2d1c65f1c76387648766d5357f868399ab086c2c7137984bace49355ba5d4
Instruction Fuzzy Hash: 6FB012F125D101ED33D451182D07C37019CC0C0F20774813AF100C05C3EC6C4D824033

Function 0070F788 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0070F7A0

Part of subcall function 00719B04: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00719B77
Part of subcall function 00719B04: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00719B88

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 2ac2ba1c915b3c09f31be0223e71156210fc413bc5c91a11b122e57ecefac2d6
Instruction ID: a465ebc3d5cb38cc0ffbaf48395c47ebc35484bc590552873d3ad2adbea75203
Opcode Fuzzy Hash: 2ac2ba1c915b3c09f31be0223e71156210fc413bc5c91a11b122e57ecefac2d6
Instruction Fuzzy Hash: DCB092E12AD201ED329411142806C360158C090B21764812AB50480482A86C49814033

Function 0071984F Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00719836

Part of subcall function 00719B04: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00719B77
Part of subcall function 00719B04: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00719B88

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 6ef53a81190ca62bbfc247faec0456bfc2e974961aea5c034a30df4227b08d0f
Instruction ID: d17373995f3a376fa41f84a8b3b82ac3685760a92e7cd81cc4769f7c596e50b5
Opcode Fuzzy Hash: 6ef53a81190ca62bbfc247faec0456bfc2e974961aea5c034a30df4227b08d0f
Instruction Fuzzy Hash: 27B092E925C201AC339451582916DBA0119C0C4B20734802AB200C00C2A84C1D828032

Function 0071983F Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00719836

Part of subcall function 00719B04: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00719B77
Part of subcall function 00719B04: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00719B88

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 09c16658bed5cb5ad3360175b572980a42c041370316ba76b1111e18415790b9
Instruction ID: 57380b4eb60ae486b38b9f3d3c6e71e735fbe19c36616e591f92ff984c0c86f0
Opcode Fuzzy Hash: 09c16658bed5cb5ad3360175b572980a42c041370316ba76b1111e18415790b9
Instruction Fuzzy Hash: 96B012F926C101AC33D4515C2C16CFA011DC0C0F20734C02BF700C00C3F84C1D8A8032

Function 0071981E Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00719836

Part of subcall function 00719B04: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00719B77
Part of subcall function 00719B04: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00719B88

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: bdc708501ddb355f3896ad958e9c24d155ca7da9ea9a6b3c5c46b0ece5c4a1a3
Instruction ID: 5f10fc4c67900c954c3d6ccb03d76b359f0097aa7dde9c2ec5bb617ac2f6f7bd
Opcode Fuzzy Hash: bdc708501ddb355f3896ad958e9c24d155ca7da9ea9a6b3c5c46b0ece5c4a1a3
Instruction Fuzzy Hash: 28B012F925C209BC33A411582D56CFA011EC1C5F30734803AF301C00C3A94C1DC29032

Function 006D14AC Relevance: 1.3, APIs: 1, Instructions: 52stringCOMMONLIBRARYCODE

Download Yara Rule

APIs

lstrlenW.KERNEL32(00000000,00000000,00000000,?,?,006D22B1,?,00000000,?,00000000,?,006D39A5,00000000,?,00000104), ref: 006D14DC

Part of subcall function 006D3C5F: GetProcessHeap.KERNEL32(00000000,000001C7,?,006D22D5,000001C7,80004005,8007139F,?,?,0071058B,8007139F,?,00000000,00000000,8007139F), ref: 006D3C67
Part of subcall function 006D3C5F: HeapSize.KERNEL32(00000000,?,006D22D5,000001C7,80004005,8007139F,?,?,0071058B,8007139F,?,00000000,00000000,8007139F), ref: 006D3C6E

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: Heap$ProcessSizelstrlen
String ID:
API String ID: 3492610842-0
Opcode ID: 61b23ccf51ae6b93a47939ec8edf0cefc95efdc4497e7431b31d2f1766fc2d9e
Instruction ID: 18d21b52b74121dba6525c0651cc7d1bc75f5faac9b9da2d309b03f90a0ae55b
Opcode Fuzzy Hash: 61b23ccf51ae6b93a47939ec8edf0cefc95efdc4497e7431b31d2f1766fc2d9e
Instruction Fuzzy Hash: 8901D836900128BBCF216E55DC80FDA7BABAF82760F118117FE15AF391C7B1AD4096A4

Non-executed Functions

Function 006D3D4E Relevance: 45.8, APIs: 23, Strings: 3, Instructions: 309fileCOMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32(?,?,?,?,00000001,00000000,?), ref: 006D3DAD
GetLastError.KERNEL32(?,?,?,00000001,00000000,?), ref: 006D3DC0
SetFileAttributesW.KERNEL32(?,00000080,?,?,?,00000001,00000000,?), ref: 006D3E0C
GetLastError.KERNEL32(?,?,?,00000001,00000000,?), ref: 006D3E16
GetTempPathW.KERNEL32(00000104,?,?,?,?,00000001,00000000,?), ref: 006D3E5D
GetLastError.KERNEL32(?,?,?,00000001,00000000,?), ref: 006D3E67
FindFirstFileW.KERNEL32(?,?,?,*.*,?,?,?,?,00000001,00000000,?), ref: 006D3EB5
GetLastError.KERNEL32(?,?,?,00000001,00000000,?), ref: 006D3EC6
SetFileAttributesW.KERNEL32(?,00000080,?,?,?,?,?,?,00000001,00000000,?), ref: 006D3F98
DeleteFileW.KERNEL32(?,?,?,?,?,?,?,00000001,00000000,?), ref: 006D3FAC
GetTempFileNameW.KERNEL32(?,DEL,00000000,?,?,?,?,00000001,00000000,?), ref: 006D3FD5
MoveFileExW.KERNEL32(?,?,00000001,?,?,?,00000001,00000000,?), ref: 006D3FF8
MoveFileExW.KERNEL32(?,00000000,00000004,?,?,?,00000001,00000000,?), ref: 006D4011
FindNextFileW.KERNEL32(000000FF,?,?,?,?,?,?,?,00000001,00000000,?), ref: 006D4021
GetLastError.KERNEL32(?,?,?,00000001,00000000,?), ref: 006D4036
GetLastError.KERNEL32(?,?,?,00000001,00000000,?), ref: 006D4065
GetLastError.KERNEL32(?,?,?,00000001,00000000,?), ref: 006D4087
GetLastError.KERNEL32(?,?,?,00000001,00000000,?), ref: 006D40A9
RemoveDirectoryW.KERNEL32(?,?,?,?,00000001,00000000,?), ref: 006D40B3
GetLastError.KERNEL32(?,?,?,00000001,00000000,?), ref: 006D40BD
MoveFileExW.KERNEL32(?,00000000,00000004,?,?,?,00000001,00000000,?), ref: 006D40E1
GetLastError.KERNEL32(?,?,?,00000001,00000000,?), ref: 006D40FC
FindClose.KERNEL32(000000FF,?,?,?,00000001,00000000,?), ref: 006D4132

Strings

*.*, xrefs: 006D3E93
DEL, xrefs: 006D3FC9
c:\agent\_work\79\s\src\libs\dutil\dirutil.cpp, xrefs: 006D3DE3, 006D4056

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: ErrorFileLast$AttributesFindMove$Temp$CloseDeleteDirectoryFirstNameNextPathRemove
String ID: *.*$DEL$c:\agent\_work\79\s\src\libs\dutil\dirutil.cpp
API String ID: 1544372074-4233457899
Opcode ID: d05266b981a75757669d8646454658729d925e58b332ce0965697325f1ed7ea6
Instruction ID: ccd9dd8a06d6b081b1bd8796c8fa9714b6d7fd422d024c0149175d2f7538a2d1
Opcode Fuzzy Hash: d05266b981a75757669d8646454658729d925e58b332ce0965697325f1ed7ea6
Instruction Fuzzy Hash: 55A11972D01239A7D73097648C05BEA766B9F50760F024297EE44FB3D0DB768E80DAD5

Function 006F3F96 Relevance: 43.0, Strings: 34, Instructions: 497COMMON

Download Yara Rule

Strings

msasn1.dll, xrefs: 006F41B7
Failed to get cached path for package: %ls, xrefs: 006F40FB
Failed to uninstall MSI package., xrefs: 006F459B
WixBundleExecutePackageAction, xrefs: 006F4163, 006F4660
Failed to add reinstall all property on minor upgrade., xrefs: 006F4396
WixBundleExecutePackageCacheFolder, xrefs: 006F4116, 006F4650
Failed to add reboot suppression property on uninstall., xrefs: 006F4529
Failed to add patch properties to argument string., xrefs: 006F42A9
REBOOT=ReallySuppress, xrefs: 006F434C, 006F4518
REINSTALL=ALL, xrefs: 006F437F, 006F43F9
Failed to enable logging for package: %ls to: %ls, xrefs: 006F41CB
%ls %ls=ALL, xrefs: 006F4462, 006F4541
Failed to perform minor upgrade of MSI package., xrefs: 006F43E4
IGNOREDEPENDENCIES, xrefs: 006F4451, 006F4530
feclient.dll, xrefs: 006F4071, 006F40F9, 006F41C9, 006F42F7, 006F4584
Failed to run maintanance mode for MSI package., xrefs: 006F44A2
Failed to add reinstall mode and reboot suppression properties on minor upgrade., xrefs: 006F43B8
Failed to build MSI path., xrefs: 006F4149
Failed to add feature action properties to obfuscated argument string., xrefs: 006F4287
%ls%ls REINSTALLMODE="cmus%ls" REBOOT=ReallySuppress, xrefs: 006F4433
Failed to add the list of dependencies to ignore to the properties., xrefs: 006F4476
ACTION=ADMIN, xrefs: 006F44B5
REINSTALLMODE="vomus" REBOOT=ReallySuppress, xrefs: 006F43A1
Failed to add patch properties to obfuscated argument string., xrefs: 006F42CB
Failed to add properties to argument string., xrefs: 006F420F
Failed to add reinstall mode and reboot suppression properties on repair., xrefs: 006F4447
Failed to add reboot suppression property on install., xrefs: 006F4367
Failed to add ADMIN property on admin install., xrefs: 006F44CA
Failed to add obfuscated properties to argument string., xrefs: 006F4243
Failed to install MSI package., xrefs: 006F44F2
Failed to add feature action properties to argument string., xrefs: 006F4265
Failed to initialize external UI handler., xrefs: 006F41A0
VersionString, xrefs: 006F403A, 006F409B
crypt32.dll, xrefs: 006F41B6

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID:
String ID: ACTION=ADMIN$ REBOOT=ReallySuppress$ REINSTALL=ALL$ REINSTALLMODE="vomus" REBOOT=ReallySuppress$%ls %ls=ALL$%ls%ls REINSTALLMODE="cmus%ls" REBOOT=ReallySuppress$Failed to add ADMIN property on admin install.$Failed to add feature action properties to argument string.$Failed to add feature action properties to obfuscated argument string.$Failed to add obfuscated properties to argument string.$Failed to add patch properties to argument string.$Failed to add patch properties to obfuscated argument string.$Failed to add properties to argument string.$Failed to add reboot suppression property on install.$Failed to add reboot suppression property on uninstall.$Failed to add reinstall all property on minor upgrade.$Failed to add reinstall mode and reboot suppression properties on minor upgrade.$Failed to add reinstall mode and reboot suppression properties on repair.$Failed to add the list of dependencies to ignore to the properties.$Failed to build MSI path.$Failed to enable logging for package: %ls to: %ls$Failed to get cached path for package: %ls$Failed to initialize external UI handler.$Failed to install MSI package.$Failed to perform minor upgrade of MSI package.$Failed to run maintanance mode for MSI package.$Failed to uninstall MSI package.$IGNOREDEPENDENCIES$VersionString$WixBundleExecutePackageAction$WixBundleExecutePackageCacheFolder$crypt32.dll$feclient.dll$msasn1.dll
API String ID: 0-2033600224
Opcode ID: 4ab81fb25a3042347c53d6e6b7c0efc9420c9bba0ef4f7544233cfab657c04b0
Instruction ID: 7d77617b530cc14f6bc6983569f320907616da6a369e1642dfd8c1c0430dc8f9
Opcode Fuzzy Hash: 4ab81fb25a3042347c53d6e6b7c0efc9420c9bba0ef4f7544233cfab657c04b0
Instruction Fuzzy Hash: A102827190063AAFDB229F54CC41EBAB77BBF54710F0001A5F608A7651DB36EEA5CB90

Function 007119F8 Relevance: 38.8, APIs: 21, Strings: 1, Instructions: 336COMMON

Download Yara Rule

APIs

InitializeSecurityDescriptor.ADVAPI32(?,00000001), ref: 00711A90
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00711A9A
CreateWellKnownSid.ADVAPI32(0000001A,00000000,?,?), ref: 00711AE7
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00711AED
CreateWellKnownSid.ADVAPI32(00000017,00000000,?,?), ref: 00711B27
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00711B2D
CreateWellKnownSid.ADVAPI32(00000018,00000000,?,?), ref: 00711B6D
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00711B73
CreateWellKnownSid.ADVAPI32(00000010,00000000,?,?), ref: 00711BB3
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00711BB9
CreateWellKnownSid.ADVAPI32(00000016,00000000,?,?), ref: 00711BF9
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00711BFF
SetEntriesInAclA.ADVAPI32(00000005,?,00000000,?), ref: 00711CF0
SetSecurityDescriptorOwner.ADVAPI32(?,?,00000000), ref: 00711D2A
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00711D34
SetSecurityDescriptorGroup.ADVAPI32(?,?,00000000), ref: 00711D6C
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00711D76
SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 00711DAF
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00711DB9
CoInitializeSecurity.OLE32(?,000000FF,00000000,00000000,00000006,00000002,00000000,00003000,00000000), ref: 00711DF7
LocalFree.KERNEL32(?), ref: 00711E0D

Strings

c:\agent\_work\79\s\src\libs\dutil\srputil.cpp, xrefs: 00711ABB

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: ErrorLast$CreateKnownSecurityWell$Descriptor$Initialize$DaclEntriesFreeGroupLocalOwner
String ID: c:\agent\_work\79\s\src\libs\dutil\srputil.cpp
API String ID: 267631441-2400857673
Opcode ID: 87a8c9292013cb0171ef3345324b864cc4e7fb10aa5a667ecdbfe91985906594
Instruction ID: 9b0157da6724ec70c340dc36a7e4194bfd2ed22914444c931c1034e23dc968ac
Opcode Fuzzy Hash: 87a8c9292013cb0171ef3345324b864cc4e7fb10aa5a667ecdbfe91985906594
Instruction Fuzzy Hash: F6C17B76D4123DABDB308F999C44BDFFAB8AF44710F41419AEA04FB280E7749D408EA4

Function 006FC041 Relevance: 37.1, APIs: 1, Strings: 20, Instructions: 375COMMON

Download Yara Rule

Strings

Failed to allocate space for burn payload inside of related bundle struct, xrefs: 006FC0CC
Failed to copy local source path for pseudo bundle., xrefs: 006FC149
Failed to copy filename for pseudo bundle., xrefs: 006FC125
Failed to copy key for pseudo bundle., xrefs: 006FC24E
-%ls, xrefs: 006FC05E
Failed to copy install arguments for related bundle package, xrefs: 006FC295
Failed to copy version for pseudo bundle., xrefs: 006FC43B
c:\agent\_work\79\s\src\burn\engine\pseudobundle.cpp, xrefs: 006FC087, 006FC0C0, 006FC1AF, 006FC3E0
Failed to append relation type to install arguments for related bundle package, xrefs: 006FC2B6
Failed to append relation type to repair arguments for related bundle package, xrefs: 006FC2FF
Failed to allocate space for burn package payload inside of related bundle struct, xrefs: 006FC093
Failed to copy uninstall arguments for related bundle package, xrefs: 006FC331
Failed to copy download source for pseudo bundle., xrefs: 006FC177
Failed to append relation type to uninstall arguments for related bundle package, xrefs: 006FC352
Failed to copy cache id for pseudo bundle., xrefs: 006FC26D
Failed to allocate memory for pseudo bundle payload hash., xrefs: 006FC1BB
Failed to copy key for pseudo bundle payload., xrefs: 006FC101
Failed to allocate memory for dependency providers., xrefs: 006FC3EC
Failed to copy repair arguments for related bundle package, xrefs: 006FC2DE
Failed to copy display name for pseudo bundle., xrefs: 006FC45D

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: Heap$AllocateProcess
String ID: -%ls$Failed to allocate memory for dependency providers.$Failed to allocate memory for pseudo bundle payload hash.$Failed to allocate space for burn package payload inside of related bundle struct$Failed to allocate space for burn payload inside of related bundle struct$Failed to append relation type to install arguments for related bundle package$Failed to append relation type to repair arguments for related bundle package$Failed to append relation type to uninstall arguments for related bundle package$Failed to copy cache id for pseudo bundle.$Failed to copy display name for pseudo bundle.$Failed to copy download source for pseudo bundle.$Failed to copy filename for pseudo bundle.$Failed to copy install arguments for related bundle package$Failed to copy key for pseudo bundle payload.$Failed to copy key for pseudo bundle.$Failed to copy local source path for pseudo bundle.$Failed to copy repair arguments for related bundle package$Failed to copy uninstall arguments for related bundle package$Failed to copy version for pseudo bundle.$c:\agent\_work\79\s\src\burn\engine\pseudobundle.cpp
API String ID: 1357844191-1088614172
Opcode ID: 3ba4ad8577f80d7d5afc9537c96ecc575f28699503b8cd1d981e0d09b4217e8a
Instruction ID: 0b31abbcd83e427b36779a9549b8176eb9839e51ea84006689da1da3f05fc7bd
Opcode Fuzzy Hash: 3ba4ad8577f80d7d5afc9537c96ecc575f28699503b8cd1d981e0d09b4217e8a
Instruction Fuzzy Hash: 3FC1E172A4061EABEB65DF28C951E7AB796FF05720F00422AFE15EB341D770ED109B90

Function 006D4639 Relevance: 29.9, APIs: 11, Strings: 6, Instructions: 140sleepshutdownCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000020,?,00000001,00000000,?,?,?,?,?,?,?), ref: 006D4662
OpenProcessToken.ADVAPI32(00000000,?,?,?,?,?,?,?,00000000,?,?,?,?,?,?), ref: 006D4669
GetLastError.KERNEL32(?,?,?,?,?,?,?,00000000,?,?,?,?,?,?), ref: 006D4673
LookupPrivilegeValueW.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 006D46C3
GetLastError.KERNEL32 ref: 006D46CD
AdjustTokenPrivileges.ADVAPI32(?,00000000,00000001,00000010,00000000,00000000), ref: 006D4711
GetLastError.KERNEL32 ref: 006D471B
Sleep.KERNEL32(000003E8), ref: 006D4757
InitiateSystemShutdownExW.ADVAPI32(00000000,00000000,00000000,00000000,00000001,80040002), ref: 006D4768
GetLastError.KERNEL32 ref: 006D4772
CloseHandle.KERNEL32(?), ref: 006D47C8

Strings

SeShutdownPrivilege, xrefs: 006D46B6
c:\agent\_work\79\s\src\burn\engine\engine.cpp, xrefs: 006D4697, 006D46F1, 006D473F, 006D47A9
Failed to schedule restart., xrefs: 006D47B3
Failed to adjust token to add shutdown privileges., xrefs: 006D4749
Failed to get shutdown privilege LUID., xrefs: 006D46FB
Failed to get process token., xrefs: 006D46A1

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: ErrorLast$ProcessToken$AdjustCloseCurrentHandleInitiateLookupOpenPrivilegePrivilegesShutdownSleepSystemValue
String ID: Failed to adjust token to add shutdown privileges.$Failed to get process token.$Failed to get shutdown privilege LUID.$Failed to schedule restart.$SeShutdownPrivilege$c:\agent\_work\79\s\src\burn\engine\engine.cpp
API String ID: 2241679041-962387770
Opcode ID: ba8c86e0271f24f90e31f5f217efba92e21f729fef4387853a20df03be3add9c
Instruction ID: de0768e1dbb9616556b668e43782aa260545f5078263fcae4a28d6801fd7919c
Opcode Fuzzy Hash: ba8c86e0271f24f90e31f5f217efba92e21f729fef4387853a20df03be3add9c
Instruction Fuzzy Hash: 3D41EDB6E8023977E72157E84C4ABEF6669AF05751F024126FE01FB3C0DB789C4055E5

Function 006E4E67 Relevance: 28.2, APIs: 8, Strings: 8, Instructions: 164pipeCOMMON

Download Yara Rule

APIs

ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32(D:(A;;GA;;;SY)(A;;GA;;;BA)(A;;GRGW0x00100000;;;WD),00000001,?,00000000), ref: 006E4E95
GetLastError.KERNEL32(?,00000000,?,?,006D457C,?), ref: 006E4E9E
CreateNamedPipeW.KERNEL32(000000FF,00080003,00000000,00000001,00010000,00010000,00000001,?,?,00000000,?,?,006D457C,?), ref: 006E4F40
GetLastError.KERNEL32(?,006D457C,?), ref: 006E4F4D
CreateNamedPipeW.KERNEL32(000000FF,00080003,00000000,00000001,00010000,00010000,00000001,00000000,?,?,?,?,?,?,?,006D457C), ref: 006E4FC8
GetLastError.KERNEL32(?,?,?,?,?,?,?,006D457C,?), ref: 006E4FD3
CloseHandle.KERNEL32(00000000,c:\agent\_work\79\s\src\burn\engine\pipe.cpp,00000132,00000000,?,?,?,?,?,?,?,006D457C,?), ref: 006E5013
LocalFree.KERNEL32(00000000,?,006D457C,?), ref: 006E5041

Strings

Failed to create the security descriptor for the connection event and pipe., xrefs: 006E4ECC
D:(A;;GA;;;SY)(A;;GA;;;BA)(A;;GRGW0x00100000;;;WD), xrefs: 006E4E90
\\.\pipe\%ls, xrefs: 006E4EF6
c:\agent\_work\79\s\src\burn\engine\pipe.cpp, xrefs: 006E4EC2, 006E4F71, 006E4FF7
\\.\pipe\%ls.Cache, xrefs: 006E4F94
Failed to allocate full name of pipe: %ls, xrefs: 006E4F0C
Failed to create pipe: %ls, xrefs: 006E4F7E, 006E5004
Failed to allocate full name of cache pipe: %ls, xrefs: 006E4FAA

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: ErrorLast$CreateDescriptorNamedPipeSecurity$CloseConvertFreeHandleLocalString
String ID: D:(A;;GA;;;SY)(A;;GA;;;BA)(A;;GRGW0x00100000;;;WD)$Failed to allocate full name of cache pipe: %ls$Failed to allocate full name of pipe: %ls$Failed to create pipe: %ls$Failed to create the security descriptor for the connection event and pipe.$\\.\pipe\%ls$\\.\pipe\%ls.Cache$c:\agent\_work\79\s\src\burn\engine\pipe.cpp
API String ID: 1214480349-256891332
Opcode ID: bb4a163bf526bd5b665b8dc4ae775684488813f171dbde12b81f238ca9e4a20d
Instruction ID: 4d38fd09c0be497f6843e8e1d848c4c50c8e180bd895068d42fc2ce93354ddd6
Opcode Fuzzy Hash: bb4a163bf526bd5b665b8dc4ae775684488813f171dbde12b81f238ca9e4a20d
Instruction Fuzzy Hash: C6512572D41325FBDB219BA99C46BDEBB76AF04710F114115FD00BA2C0E7B95E408AD4

Function 0070FD8F Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 172encryptionfileCOMMON

Download Yara Rule

APIs

CryptAcquireContextW.ADVAPI32(?,00000000,00000000,00000003,F0000040,00000003,00000000,00000000,006E9DED,00000003,000007D0,00000003,?,000007D0,?,000007D0), ref: 0070FDF4
GetLastError.KERNEL32 ref: 0070FDFE
CryptCreateHash.ADVAPI32(?,?,00000000,00000000,?), ref: 0070FE3B
GetLastError.KERNEL32 ref: 0070FE45
CryptHashData.ADVAPI32(?,?,?,00000000), ref: 0070FE8C
ReadFile.KERNEL32(00000000,?,00001000,?,00000000), ref: 0070FEB0
GetLastError.KERNEL32 ref: 0070FEBA
CryptDestroyHash.ADVAPI32(00000000), ref: 0070FEF7
CryptReleaseContext.ADVAPI32(00000000,00000000), ref: 0070FF0E
GetLastError.KERNEL32 ref: 0070FF27
CryptGetHashParam.ADVAPI32(?,00000002,?,?,00000000), ref: 0070FF5F
GetLastError.KERNEL32 ref: 0070FF69
SetFilePointerEx.KERNEL32(00000000,00000000,00000000,00008004,00000001), ref: 0070FFA2
GetLastError.KERNEL32 ref: 0070FFB0

Strings

c:\agent\_work\79\s\src\libs\dutil\cryputil.cpp, xrefs: 0070FEDE

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: CryptErrorLast$Hash$ContextFile$AcquireCreateDataDestroyParamPointerReadRelease
String ID: c:\agent\_work\79\s\src\libs\dutil\cryputil.cpp
API String ID: 3955742341-4166059025
Opcode ID: 34ec1967c0585e1fa952f80495b5130be2395b7a74235fdc12b7f4fd5830bc2d
Instruction ID: 254014f5f65cefb45d275680c4033478412acc716ec6c4ba28c14ba9be74172f
Opcode Fuzzy Hash: 34ec1967c0585e1fa952f80495b5130be2395b7a74235fdc12b7f4fd5830bc2d
Instruction Fuzzy Hash: 05518737D4023AEBD7318A55CD08BDB76A4AF08751F0181B5FE48FA5D0D7789D809AE4

Function 006E9D87 Relevance: 19.4, APIs: 2, Strings: 9, Instructions: 180COMMON

Download Yara Rule

Strings

copying, xrefs: 006E9F19, 006E9F21
Failed to reset permissions on unverified cached payload: %ls, xrefs: 006E9EDA
Failed to move verified file to complete payload path: %ls, xrefs: 006E9F55
Failed to find payload: %ls in working path: %ls and unverified path: %ls, xrefs: 006E9EB4
Failed to get cached path for package with cache id: %ls, xrefs: 006E9DB1
Failed to concat complete cached path., xrefs: 006E9DDD
Failed to create unverified path., xrefs: 006E9E57
moving, xrefs: 006E9F12
Failed to transfer working path to unverified path for payload: %ls., xrefs: 006E9E8D

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID:
String ID: Failed to concat complete cached path.$Failed to create unverified path.$Failed to find payload: %ls in working path: %ls and unverified path: %ls$Failed to get cached path for package with cache id: %ls$Failed to move verified file to complete payload path: %ls$Failed to reset permissions on unverified cached payload: %ls$Failed to transfer working path to unverified path for payload: %ls.$copying$moving
API String ID: 0-1289240508
Opcode ID: 577f819ffe8c1ab415e5c31437963efe852fd58230f402a7ec8364c46da4421a
Instruction ID: a6343b010ff6d5109bc1c8e4d3dcfd154341564a44e56ba828241acaab488226
Opcode Fuzzy Hash: 577f819ffe8c1ab415e5c31437963efe852fd58230f402a7ec8364c46da4421a
Instruction Fuzzy Hash: 4251B131D41369FBDF226B95CC06FDEBA37AF14700F104051FA00B52A1E7769EA1ABA4

Function 006D62CC Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 143COMMON

Download Yara Rule

APIs

GetVersionExW.KERNEL32(0000011C), ref: 006D631A
GetLastError.KERNEL32 ref: 006D6324

Strings

Failed to get OS info., xrefs: 006D6352
c:\agent\_work\79\s\src\burn\engine\variable.cpp, xrefs: 006D6348
Failed to set variant value., xrefs: 006D6445

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: ErrorLastVersion
String ID: Failed to get OS info.$Failed to set variant value.$c:\agent\_work\79\s\src\burn\engine\variable.cpp
API String ID: 305913169-697277656
Opcode ID: e02dc8187d29e51c1b8e40942195a4b201985c04a7a6fb12cc2e8dd8fb8590c8
Instruction ID: a13fdeec4fd83eba02723c8c72eaa1995e1acf769d5a71970ce63dbb75569ce3
Opcode Fuzzy Hash: e02dc8187d29e51c1b8e40942195a4b201985c04a7a6fb12cc2e8dd8fb8590c8
Instruction Fuzzy Hash: F241D571E00228ABDB20DB59CC45EEF7BB9EB85710F11809BF545E7380DA34AE81CB94

Function 006D605F Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 106timeCOMMON

Download Yara Rule

APIs

GetSystemTime.KERNEL32(?), ref: 006D608A
GetDateFormatW.KERNEL32(00000400,00000001,?,00000000,00000000,00000000), ref: 006D609E
GetLastError.KERNEL32 ref: 006D60B0
GetDateFormatW.KERNEL32(00000400,00000001,?,00000000,?,00000000,?,00000000), ref: 006D6104
GetLastError.KERNEL32 ref: 006D610E

Strings

c:\agent\_work\79\s\src\burn\engine\variable.cpp, xrefs: 006D60CB, 006D6129
Failed to set variant value., xrefs: 006D614C
Failed to get the Date., xrefs: 006D6133
Failed to allocate the buffer for the Date., xrefs: 006D60EC
Failed to get the required buffer length for the Date., xrefs: 006D60D5

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: DateErrorFormatLast$SystemTime
String ID: Failed to allocate the buffer for the Date.$Failed to get the Date.$Failed to get the required buffer length for the Date.$Failed to set variant value.$c:\agent\_work\79\s\src\burn\engine\variable.cpp
API String ID: 2700948981-2785940276
Opcode ID: 4a101637a547540887c3e053d4267c404e8b06f5341535b1b2c6b6f813b8940e
Instruction ID: 9485b5deef8c5ec2d159f84bb0bc0723e56f89f5c0ddf676a20a29ea1ec1d269
Opcode Fuzzy Hash: 4a101637a547540887c3e053d4267c404e8b06f5341535b1b2c6b6f813b8940e
Instruction Fuzzy Hash: 27319972E402297BDB2196ECCC42FEFBA7AAF04750F114126FB01F7381DA649D4486E5

Function 007101F0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 131threadtimeCOMMONLIBRARYCODE

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(0073C6EC,00000000,?,?,?,?,006F1099,8007139F,Invalid operation for this state.,c:\agent\_work\79\s\src\burn\engine\cabextract.cpp,000001C7,8007139F), ref: 0071021E
GetCurrentProcessId.KERNEL32(00000000,?,006F1099,8007139F,Invalid operation for this state.,c:\agent\_work\79\s\src\burn\engine\cabextract.cpp,000001C7,8007139F), ref: 0071022E
GetCurrentThreadId.KERNEL32 ref: 00710237
GetLocalTime.KERNEL32(8007139F,?,006F1099,8007139F,Invalid operation for this state.,c:\agent\_work\79\s\src\burn\engine\cabextract.cpp,000001C7,8007139F), ref: 0071024D
LeaveCriticalSection.KERNEL32(0073C6EC,006F1099,?,00000000,0000FDE9,?,006F1099,8007139F,Invalid operation for this state.,c:\agent\_work\79\s\src\burn\engine\cabextract.cpp,000001C7,8007139F), ref: 00710344

Strings

%ls[%04X:%04X][%04hu-%02hu-%02huT%02hu:%02hu:%02hu]%hs%03d:%ls %ls%ls, xrefs: 007102EA

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: CriticalCurrentSection$EnterLeaveLocalProcessThreadTime
String ID: %ls[%04X:%04X][%04hu-%02hu-%02huT%02hu:%02hu:%02hu]%hs%03d:%ls %ls%ls
API String ID: 296830338-59366893
Opcode ID: a2182b77cd04edd132e970857eb107901cda264ffaf052b3b320524d23cbde24
Instruction ID: ef50e144b16e41cce8e41db5912024f28dc63ad9425b50e030dfec018a6ae46d
Opcode Fuzzy Hash: a2182b77cd04edd132e970857eb107901cda264ffaf052b3b320524d23cbde24
Instruction Fuzzy Hash: 96415071D00219ABDB619FA8D845AFEB7B5BB08751F10802AF901E6290D77C9DC0DBE1

Function 006E9A30 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 107filestringCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,00000000,?,*.*,?,?,?,00000000,.unverified,?), ref: 006E9ADF
lstrlenW.KERNEL32(?), ref: 006E9B06
FindNextFileW.KERNEL32(00000000,00000010), ref: 006E9B66
FindClose.KERNEL32(00000000), ref: 006E9B71

Part of subcall function 006D3D4E: GetFileAttributesW.KERNEL32(?,?,?,?,00000001,00000000,?), ref: 006D3DAD
Part of subcall function 006D3D4E: GetLastError.KERNEL32(?,?,?,00000001,00000000,?), ref: 006D3DC0

Strings

*.*, xrefs: 006E9AB9
.unverified, xrefs: 006E9A73

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: FileFind$AttributesCloseErrorFirstLastNextlstrlen
String ID: *.*$.unverified
API String ID: 457978746-2528915496
Opcode ID: 21e674fc211ba05f2dccd8c3ea3413ace4091e149b494fdfff785598c66d202e
Instruction ID: 61eb832752c74a5cc1ad8069e52cca7561970d13dd7c6bc7c6f2942155de744c
Opcode Fuzzy Hash: 21e674fc211ba05f2dccd8c3ea3413ace4091e149b494fdfff785598c66d202e
Instruction Fuzzy Hash: 0741913090126CAECF60AB65ED49BEE77BAEF44301F1041E5E508E11A0EB759EC4DF68

Function 00718A8F Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 76timeCOMMON

Download Yara Rule

APIs

GetTimeZoneInformation.KERNEL32(?,00000001,00000000), ref: 00718AE4
SystemTimeToTzSpecificLocalTime.KERNEL32(?,?,?), ref: 00718AF6

Strings

%04hu-%02hu-%02huT%02hu:%02hu:%02hu%c%02u:%02u, xrefs: 00718B41
feclient.dll, xrefs: 00718ABE
%04hu-%02hu-%02huT%02hu:%02hu:%02huZ, xrefs: 00718ACD
crypt32.dll, xrefs: 00718AB4

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: Time$InformationLocalSpecificSystemZone
String ID: %04hu-%02hu-%02huT%02hu:%02hu:%02hu%c%02u:%02u$%04hu-%02hu-%02huT%02hu:%02hu:%02huZ$crypt32.dll$feclient.dll
API String ID: 1772835396-1985132828
Opcode ID: 69a38e46b50cd63fa79e102faecd4633adb4102ba91ae7d0ce016af27fffcf6b
Instruction ID: 21260029aa00b19326eebb4ed0cf31d620b636d721b01b500c7d7f221b1e86c4
Opcode Fuzzy Hash: 69a38e46b50cd63fa79e102faecd4633adb4102ba91ae7d0ce016af27fffcf6b
Instruction Fuzzy Hash: 9D210CA2900128AED764DB99CC45FBFB3FDEB4C711F00855AB945D2180E73CAA80D774

Function 0070A9A8 Relevance: 10.1, APIs: 1, Strings: 4, Instructions: 1343COMMONLIBRARYCODE

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 0070AB23

Strings

1#INF, xrefs: 0070BCF0
1#IND, xrefs: 0070BCC5
1#QNAN, xrefs: 0070BCD3
1#SNAN, xrefs: 0070BCCC

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: 30a0d407aa8b3771bc351351438d54ab826518551480bfaa36f1eaab386a2aed
Instruction ID: 250b602118c01723ffeab31c95e7a3adfd78f2c2f4b08a068597036872d65ac8
Opcode Fuzzy Hash: 30a0d407aa8b3771bc351351438d54ab826518551480bfaa36f1eaab386a2aed
Instruction Fuzzy Hash: 1FC22771E04629CFDB25CE28CD407AAB3F5EB48315F1446EAD84DE7280E779AE818F41

Function 006D6203 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 52COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(?,?), ref: 006D6233
GetLastError.KERNEL32 ref: 006D623D

Strings

c:\agent\_work\79\s\src\burn\engine\variable.cpp, xrefs: 006D625C
Failed to set variant value., xrefs: 006D6282
Failed to get the user name., xrefs: 006D6266

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: ErrorLastNameUser
String ID: Failed to get the user name.$Failed to set variant value.$c:\agent\_work\79\s\src\burn\engine\variable.cpp
API String ID: 2054405381-3472711869
Opcode ID: 0208ad5bd83374eba7b5fde51c79370479f6893fa22555849043d2a121247307
Instruction ID: 0cb050ba3469fbe69f36347ee5b161566e04ff0a8161a5200e0b2a3aeed97f54
Opcode Fuzzy Hash: 0208ad5bd83374eba7b5fde51c79370479f6893fa22555849043d2a121247307
Instruction Fuzzy Hash: 3D01F972E0033D67D7219B98CC45EEF77A9AF00710F114256F854E7381DA789F448AD4

Function 006D2078 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 54windowCOMMON

Download Yara Rule

APIs

FormatMessageW.KERNEL32(006D42CC,006D54CB,?,00000000,00000000,00000000,?,80070656,?,?,?,006EE5DB,00000000,006D54CB,00000000,80070656), ref: 006D20A9
GetLastError.KERNEL32(?,?,?,006EE5DB,00000000,006D54CB,00000000,80070656,?,?,006E403F,006D54CB,?,80070656,00000001,crypt32.dll), ref: 006D20B6
LocalFree.KERNEL32(00000000,?,00000000,00000000,?,?,?,006EE5DB,00000000,006D54CB,00000000,80070656,?,?,006E403F,006D54CB), ref: 006D20FD

Strings

c:\agent\_work\79\s\src\libs\dutil\strutil.cpp, xrefs: 006D20DA

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: ErrorFormatFreeLastLocalMessage
String ID: c:\agent\_work\79\s\src\libs\dutil\strutil.cpp
API String ID: 1365068426-2901571208
Opcode ID: e79e6bc3bd3b3675ef02ecbc04617c6b2ce8ad17acbdd532d2390c76797f8c8e
Instruction ID: b93381a0e71c303f9066096db2d55d5396724ea09c7bff7f6e3bbc502e0be6a9
Opcode Fuzzy Hash: e79e6bc3bd3b3675ef02ecbc04617c6b2ce8ad17acbdd532d2390c76797f8c8e
Instruction Fuzzy Hash: 6B0161B6D4112AFBDB209B95DD05ADF7AADEF04750F018166BE01E7340E6349E00D6E4

Function 006F6913 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 40COMMON

Download Yara Rule

APIs

ChangeServiceConfigW.ADVAPI32(00000000,000000FF,00000003,000000FF,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,006F68BF,00000000,00000003), ref: 006F692A
GetLastError.KERNEL32(?,006F68BF,00000000,00000003,00000000,?,?,?,?,?,?,?,?,?,006F6CAE,?), ref: 006F6934

Strings

c:\agent\_work\79\s\src\burn\engine\msuengine.cpp, xrefs: 006F6958
Failed to set service start type., xrefs: 006F6962

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: ChangeConfigErrorLastService
String ID: Failed to set service start type.$c:\agent\_work\79\s\src\burn\engine\msuengine.cpp
API String ID: 1456623077-436683145
Opcode ID: d44f7fed8008fa2a5827e116058fd0c7ad023ea43f9909f77a888a1a515b036d
Instruction ID: 9a2a4824e2f58424c90d60f223c2b40527729a76c2b37be3945e6e0919e78521
Opcode Fuzzy Hash: d44f7fed8008fa2a5827e116058fd0c7ad023ea43f9909f77a888a1a515b036d
Instruction Fuzzy Hash: CCF0EC33A4513A739630159D9C09EDB7D59EF12B71B128315FE78BA2D0DA698C0046D4

Function 007037AA Relevance: 4.6, APIs: 3, Instructions: 78COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,?), ref: 007038A2
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,?), ref: 007038AC
UnhandledExceptionFilter.KERNEL32(80003CDD,?,?,?,?,?,?), ref: 007038B9

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: 9b10ac32f02d5638a65f07f978a1d0763b870323ab0b770ab7908a028c38a8cb
Instruction ID: 4d84ad3091b159a1d1e2e6cea5a5a6c1864b2388ad16697b5dbbbdb94eb26320
Opcode Fuzzy Hash: 9b10ac32f02d5638a65f07f978a1d0763b870323ab0b770ab7908a028c38a8cb
Instruction Fuzzy Hash: 9431B77490121C9BCB61DF64D8897DDBBB8FF08310F5082EAE51CA72A1E7349B858F59

Function 00704413 Relevance: 4.5, APIs: 3, Instructions: 20COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,00704412,00000000,80004004,?,00000000,?,00701641), ref: 00704435
TerminateProcess.KERNEL32(00000000,?,00704412,00000000,80004004,?,00000000,?,00701641), ref: 0070443C
ExitProcess.KERNEL32 ref: 0070444E

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: e164e6654a3813269447576c74810a3f6d127c2e4921b1fd76b91b1c065a8c28
Instruction ID: 48491b68c4448f67c211cb1fc52ffbf2ee0a80baa946b450bd187fef1f840b09
Opcode Fuzzy Hash: e164e6654a3813269447576c74810a3f6d127c2e4921b1fd76b91b1c065a8c28
Instruction Fuzzy Hash: E2E0B671000189EBCF116F68DD0DA9C3BA9FB80381F00C554FA59861B2CB7DDD92DA45

Function 0070A510 Relevance: 3.5, APIs: 2, Instructions: 452COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40db5b7c9d8279b3a366fc659f2216b5f731865f41114b0c604240d22f025072
Instruction ID: 8062b7c35ff5d5cf6633c9fd708b23a93de9d5e9f53701bad39ab8a6c49347ab
Opcode Fuzzy Hash: 40db5b7c9d8279b3a366fc659f2216b5f731865f41114b0c604240d22f025072
Instruction Fuzzy Hash: C5022A71E01219EFDF14CFA8C8806AEB7F1FF88314F158269D919AB385D735AA41CB91

Function 00713D0B Relevance: 3.1, APIs: 2, Instructions: 57memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00713E9A: RegCloseKey.ADVAPI32(00000000,80000002,SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,00020019,00000000,?,?,?,?,?,00713D3A,?), ref: 00713F0B

AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,?), ref: 00713D5E
CheckTokenMembership.ADVAPI32(00000000,?,?), ref: 00713D6F

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: AllocateCheckCloseInitializeMembershipToken
String ID:
API String ID: 2114926846-0
Opcode ID: 52b072d44b9fcc210990823ce6d53812d15c632673d175f73c4ba4848fef94ad
Instruction ID: e46bf5c9b16eff7c7c0d1401857405729675d9762b0d129ab7adec16c21bce33
Opcode Fuzzy Hash: 52b072d44b9fcc210990823ce6d53812d15c632673d175f73c4ba4848fef94ad
Instruction Fuzzy Hash: 56113970A0020EEBDB10DFA8DC85BEFB7F8FF08304F50482DA251A6191D7789A84CB54

Function 007146C4 Relevance: 3.0, APIs: 2, Instructions: 43fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(006F8F8D,?,00000100,00000000,00000000), ref: 007146FF
FindClose.KERNEL32(00000000), ref: 0071470B

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: e68d1b66801c8e540707f5fb1acdb40ab4c112e8dfacc6550cabf9c869d5b757
Instruction ID: e09486d66efe89670da3a8c07e378a81cf1134ce5fbc0e41af68e64b8a6dbcf2
Opcode Fuzzy Hash: e68d1b66801c8e540707f5fb1acdb40ab4c112e8dfacc6550cabf9c869d5b757
Instruction Fuzzy Hash: EA01817560020CABDB10EFA99D89DEBB7BDEFC6316F004065E919D32C0D738AD898B54

Function 0070F1B2 Relevance: 1.8, APIs: 1, Instructions: 274COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,0070F1AD,?,?,00000008,?,?,0070EE41,00000000), ref: 0070F3DF

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: d0281919849f78638de89fbb93ac6fe771c02ce7c433cf8a3d59111ce43c593a
Instruction ID: 504e8975a26019e688c39f9459b6ae7d04ba85e137cf213cab457e7ff848e341
Opcode Fuzzy Hash: d0281919849f78638de89fbb93ac6fe771c02ce7c433cf8a3d59111ce43c593a
Instruction Fuzzy Hash: D6B14C35610609CFD724CF28C486B697BE0FF45364F258668E999CF6E1C339E992CB40

Function 00707767 Relevance: 1.6, APIs: 1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3fb8338d501391d05a1fd7068e30b64c304bed43e3ea9ab900391464e9efb64c
Instruction ID: 90e0e88ba6136394f7eb2de59929a4ca820071029a633f5a29580a2558a3dd40
Opcode Fuzzy Hash: 3fb8338d501391d05a1fd7068e30b64c304bed43e3ea9ab900391464e9efb64c
Instruction Fuzzy Hash: ED31B472D04219EFDB28DF69CC89DAB77B9EB84350F148659F905972C1EA34BE40CB50

Function 006FE727 Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_0002E733,006FDE08), ref: 006FE72C

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: d38ff2b8e735cf27ba010bc3a6541c4b7efd8a75c2a8be32438296477e000483
Instruction ID: f87df1ef04dc3d6562b03ad5a1669b869fcbc62b994d74bb75cff511c23b1c9d
Opcode Fuzzy Hash: d38ff2b8e735cf27ba010bc3a6541c4b7efd8a75c2a8be32438296477e000483
Instruction Fuzzy Hash:

Function 00702815 Relevance: 1.5, Strings: 1, Instructions: 240COMMONLIBRARYCODE

Download Yara Rule

Strings

0, xrefs: 007029AD

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 44ee74e08a45ab47a5fbf058204854090db78880ec3f422a79573c2b98e1bc1d
Instruction ID: 259ea3a12599e7e745fc1b387d46e2874fdfbfb3db7d81595567dd286313500a
Opcode Fuzzy Hash: 44ee74e08a45ab47a5fbf058204854090db78880ec3f422a79573c2b98e1bc1d
Instruction Fuzzy Hash: 2B615777710205D6DB38AA28889D7BEB3D5AB51704F548B1EE442EB2C3DB6DED838305

Function 007025E1 Relevance: 1.5, Strings: 1, Instructions: 217COMMONLIBRARYCODE

Download Yara Rule

Strings

0, xrefs: 0070275D

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 17e95ed392a724f7cd599a3e1a6932c07ecfe8e0e91b59132266eab648f21c0b
Instruction ID: 1508bea591a0025d8442393aea2d0c7b81f05aae989d6a483bc997e8f93b84de
Opcode Fuzzy Hash: 17e95ed392a724f7cd599a3e1a6932c07ecfe8e0e91b59132266eab648f21c0b
Instruction Fuzzy Hash: 7B519E73604608DADF398968C89D7BEA7DDAF01300F14035ED582D7AC3DA1FAD4B8606

Function 007001C6 Relevance: .3, Instructions: 254COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93657a121f16255c59120ad0d08fdbba6372c273009ad596b4ecdf6e8f3c6909
Instruction ID: 84288a33c791bbf06138781656dc15bd893495ea7d57fc2de2468db6d5ca84cb
Opcode Fuzzy Hash: 93657a121f16255c59120ad0d08fdbba6372c273009ad596b4ecdf6e8f3c6909
Instruction Fuzzy Hash: 6791B9721090E38ADB6E463D853853EFFE15E523B1B1A07ADE4F2CB5C1EE28C564D660

Function 00700481 Relevance: .2, Instructions: 244COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05e0b846b00456d0f1e87463b9d189974beed2fe63262d4392584e128a114ea2
Instruction ID: f769538891543ddb576732ce9e0f50bb178f98f9cb8876bde8624fd8edc366f5
Opcode Fuzzy Hash: 05e0b846b00456d0f1e87463b9d189974beed2fe63262d4392584e128a114ea2
Instruction Fuzzy Hash: 2D91AD721080E38DDB69423D853453DFFE15A923B1B1A07ADD4F2CB5D5EE28C574DA60

Function 006FFEFF Relevance: .2, Instructions: 240COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40101273f58913c3cb3bc7eb54df01d47b4121c3e67d19f11ec2cb23d33ea445
Instruction ID: 1e9f3d32a30adf3dfd722c1eb0f0048fa81856c54749d789a20d325f08475d42
Opcode Fuzzy Hash: 40101273f58913c3cb3bc7eb54df01d47b4121c3e67d19f11ec2cb23d33ea445
Instruction Fuzzy Hash: E09194722090E74EDB69433E843417EFFE25E523B171A07ADE4F2CA1C1EE28C564D660

Function 006FFC55 Relevance: .2, Instructions: 232COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70da388f96bbbf26b230a155b4728740b34f0d100ea60ab2bbadb9d7d0befbf0
Instruction ID: fea67298acdcf863e0b4ee083315b28b35c1ccfbb442b8282baca60a94a32b63
Opcode Fuzzy Hash: 70da388f96bbbf26b230a155b4728740b34f0d100ea60ab2bbadb9d7d0befbf0
Instruction Fuzzy Hash: E78186722080AB0EDB69433D853447EFFE35E513A131A07BDD5F2CA6D6EE24C564D620

Function 0070DC52 Relevance: .1, Instructions: 105COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b30ba7d3b3a086f661f5c9c6ca10734b9223244faa3fc9e900ac31b1920a109
Instruction ID: 2615740aa27680c75dd647cd9440fa99cf206cb38ba702f4a4c553d0148a4b0f
Opcode Fuzzy Hash: 3b30ba7d3b3a086f661f5c9c6ca10734b9223244faa3fc9e900ac31b1920a109
Instruction Fuzzy Hash: 1F21A473F2053847770CC47E8C562B9B6E1C68C501745827AE9A6DA3C1D968D917E2E4

Function 0070DB2E Relevance: .1, Instructions: 82COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: af2de9e3a2a527ca0d8387873407ce3f01140a323231b3c25390372088802005
Instruction ID: 7d6723d69beb044b95eab42fc3f0a6dc7cdba26ccf353a3dc76084058949e721
Opcode Fuzzy Hash: af2de9e3a2a527ca0d8387873407ce3f01140a323231b3c25390372088802005
Instruction Fuzzy Hash: 6911A723F30C295B675C81AD8C172BAA2D6DBD825070F433AD826E7384E994DE23D290

Function 00708491 Relevance: .0, Instructions: 23COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9cc6b2dd824b08b2f17b87951fe2886d4bc0a590ba30c1ec50195a6cc8cb7c91
Instruction ID: 72a7d966cf30d97eb21c7882d24206a5ca45cff0585a8f03f41371e92fa98492
Opcode Fuzzy Hash: 9cc6b2dd824b08b2f17b87951fe2886d4bc0a590ba30c1ec50195a6cc8cb7c91
Instruction Fuzzy Hash: 2DE04632912268EBC725DEC8994899AF3ECEB09B20B11469AF914D3241C678DE00C7D1

Function 006DFF32 Relevance: 86.2, APIs: 1, Strings: 48, Instructions: 482registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32(00000000,00000000,00000001,00000000,00000101,?,?,00020006,00000000), ref: 006E0528

Strings

ModifyPath, xrefs: 006E034B, 006E0361
"%ls" /modify, xrefs: 006E0346
EngineVersion, xrefs: 006E0133, 006E0138
3.14.0.3910, xrefs: 006E0129
/modify, xrefs: 006E040A
VersionMinor, xrefs: 006E00CE, 006E00D4
HelpLink, xrefs: 006E01F0, 006E0203
SystemComponent, xrefs: 006E03BE, 006E03D1
"%ls" %ls, xrefs: 006E041A
HelpTelephone, xrefs: 006E0216, 006E0229
DisplayVersion, xrefs: 006E0197, 006E01AA
URLUpdateInfo, xrefs: 006E0262, 006E0275
BundleDetectCode, xrefs: 006E002C, 006E0034
BundleAddonCode, xrefs: 006E000E, 006E0016
DisplayIcon, xrefs: 006E0151, 006E015B
Comments, xrefs: 006E02D0, 006E02E3
BundlePatchCode, xrefs: 006E004A, 006E0052
NoElevateOnModify, xrefs: 006E036D, 006E0380
NoModify, xrefs: 006E0321, 006E0334
EstimatedSize, xrefs: 006E04B2, 006E04B7, 006E04C6
QuietUninstallString, xrefs: 006E03E3, 006E03F9
/uninstall, xrefs: 006E0411, 006E0416
BundleUpgradeCode, xrefs: 006DFFF0, 006DFFF8
UninstallString, xrefs: 006E041F, 006E0435
BundleProviderKey, xrefs: 006E00F0, 006E00F5
VersionMajor, xrefs: 006E00A5, 006E00AB
ParentDisplayName, xrefs: 006E0288, 006E029B
Publisher, xrefs: 006E01CA, 006E01DD
Failed to write %ls value., xrefs: 006E04C7
BundleCachePath, xrefs: 006DFFD5, 006DFFDA
Contact, xrefs: 006E02F8, 006E030B
Failed to update resume mode., xrefs: 006E0503
%s,0, xrefs: 006E0156
%hu.%hu.%hu.%hu, xrefs: 006E0086
"%ls" /uninstall /quiet, xrefs: 006E03DE
NoRemove, xrefs: 006E0399, 006E03AC
Failed to cache bundle from path: %ls, xrefs: 006DFF88
%hs, xrefs: 006E012E
Failed to register the bundle dependency key., xrefs: 006E04E9
URLInfoAbout, xrefs: 006E023C, 006E024F
Failed to write update registration., xrefs: 006E047B
ParentKeyName, xrefs: 006E02A8, 006E02BB
Failed to update name and publisher., xrefs: 006E0184
Failed to write software tags., xrefs: 006E045B
BundleTag, xrefs: 006E0111, 006E0116
Failed to create registration key., xrefs: 006DFFB5
BundleVersion, xrefs: 006E0068, 006E008B
crypt32.dll, xrefs: 006E0177, 006E01B8, 006E044F, 006E046E

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: Close
String ID: /uninstall$"%ls" %ls$"%ls" /modify$"%ls" /uninstall /quiet$%hs$%hu.%hu.%hu.%hu$%s,0$/modify$3.14.0.3910$BundleAddonCode$BundleCachePath$BundleDetectCode$BundlePatchCode$BundleProviderKey$BundleTag$BundleUpgradeCode$BundleVersion$Comments$Contact$DisplayIcon$DisplayVersion$EngineVersion$EstimatedSize$Failed to cache bundle from path: %ls$Failed to create registration key.$Failed to register the bundle dependency key.$Failed to update name and publisher.$Failed to update resume mode.$Failed to write %ls value.$Failed to write software tags.$Failed to write update registration.$HelpLink$HelpTelephone$ModifyPath$NoElevateOnModify$NoModify$NoRemove$ParentDisplayName$ParentKeyName$Publisher$QuietUninstallString$SystemComponent$URLInfoAbout$URLUpdateInfo$UninstallString$VersionMajor$VersionMinor$crypt32.dll
API String ID: 3535843008-3464079327
Opcode ID: fd00b6b4ba6569694af45f57ebc4de5e0d85a879fa623b12c435997fddb0fdc5
Instruction ID: 8a763bb088f5269cc98d254bcf23863dd297302ee11fae59e0547c3bb198d53d
Opcode Fuzzy Hash: fd00b6b4ba6569694af45f57ebc4de5e0d85a879fa623b12c435997fddb0fdc5
Instruction Fuzzy Hash: 75F12971903BBAFBEB225655DE46FA975A6BB10710F404160FE007A3D1D7B8EEE096C0

Function 006D8463 Relevance: 63.3, APIs: 5, Strings: 31, Instructions: 331COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,msasn1.dll,00000000,80070490,?,?,?,?,?,?,?,BTm,006FBED0,0071B570,?,0071B594), ref: 006D8494
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,BTm,006FBED0,0071B570,?,0071B594,?,?,Chain), ref: 006D87F7

Strings

msasn1.dll, xrefs: 006D8470
Failed to find variable value '%ls'., xrefs: 006D87C5
Initializing numeric variable '%ls' to value '%ls', xrefs: 006D85CF
Hidden, xrefs: 006D851C
Failed to get @Type., xrefs: 006D8771
Attempt to set built-in variable value: %ls, xrefs: 006D87BB
Invalid value for @Type: %ls, xrefs: 006D875E
Failed to get @Persisted., xrefs: 006D87D4
Failed to get @Value., xrefs: 006D877F
numeric, xrefs: 006D85A9
Variable, xrefs: 006D849E
c:\agent\_work\79\s\src\burn\engine\variable.cpp, xrefs: 006D87AC
Failed to set variant value., xrefs: 006D8778
Failed to change variant type., xrefs: 006D87CD
version, xrefs: 006D8619
Failed to get next node., xrefs: 006D87E9
Initializing version variable '%ls' to value '%ls', xrefs: 006D8640
Persisted, xrefs: 006D8537
Failed to set variant encryption, xrefs: 006D8790
Initializing hidden variable '%ls', xrefs: 006D865E
BTm, xrefs: 006D8463
Failed to insert variable '%ls'., xrefs: 006D8789
Type, xrefs: 006D8590
Failed to get @Id., xrefs: 006D87E2
Initializing string variable '%ls' to value '%ls', xrefs: 006D8607
string, xrefs: 006D85E4
Failed to select variable nodes., xrefs: 006D84B1
Failed to set value of variable: %ls, xrefs: 006D879A
Failed to get variable node count., xrefs: 006D84CE
Value, xrefs: 006D8552
Failed to get @Hidden., xrefs: 006D87DB

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: Attempt to set built-in variable value: %ls$BTm$Failed to change variant type.$Failed to find variable value '%ls'.$Failed to get @Hidden.$Failed to get @Id.$Failed to get @Persisted.$Failed to get @Type.$Failed to get @Value.$Failed to get next node.$Failed to get variable node count.$Failed to insert variable '%ls'.$Failed to select variable nodes.$Failed to set value of variable: %ls$Failed to set variant encryption$Failed to set variant value.$Hidden$Initializing hidden variable '%ls'$Initializing numeric variable '%ls' to value '%ls'$Initializing string variable '%ls' to value '%ls'$Initializing version variable '%ls' to value '%ls'$Invalid value for @Type: %ls$Persisted$Type$Value$Variable$c:\agent\_work\79\s\src\burn\engine\variable.cpp$msasn1.dll$numeric$string$version
API String ID: 3168844106-1245998078
Opcode ID: f40e6ef7f1ddc4ac9268de8223ea410c5b2459b6697eb15420effab7f71593c0
Instruction ID: c00f54f33d4538b2a2b72d9e1aced85ba4ffa07ba56040457d07eac6846eaac7
Opcode Fuzzy Hash: f40e6ef7f1ddc4ac9268de8223ea410c5b2459b6697eb15420effab7f71593c0
Instruction Fuzzy Hash: 08B1B3B2D40219FFCB129B98CC49EEEBB76AF44710F204156F914B73D1DB789A819B90

Function 006F6A52 Relevance: 58.1, APIs: 7, Strings: 26, Instructions: 378COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,00000000,?,?,?,?,?,?,?,?,006EBCAE,00000007,?,?,?), ref: 006F6AA6

Part of subcall function 00710DDC: GetModuleHandleW.KERNEL32(kernel32,IsWow64Process,?,?,?,006D5EE0,00000000), ref: 00710DF0
Part of subcall function 00710DDC: GetProcAddress.KERNEL32(00000000), ref: 00710DF7
Part of subcall function 00710DDC: GetLastError.KERNEL32(?,?,?,006D5EE0,00000000), ref: 00710E0E

CloseHandle.KERNEL32(00000000,?,000001F4,?,?,?,?,?,?,?,?,?,?,wusa.exe,?,00000025), ref: 006F6E95
CloseHandle.KERNEL32(00000000,?,000001F4,?,?,?,?,?,?,?,?,?,?,wusa.exe,?,00000025), ref: 006F6EA9

Strings

wusa.exe, xrefs: 006F6B26
Failed to get cached path for package: %ls, xrefs: 006F6B82
WixBundleExecutePackageCacheFolder, xrefs: 006F6B91, 006F6EC1
Failed to append SysNative directory., xrefs: 006F6B03
Failed to append log switch to MSU command-line., xrefs: 006F6C3C
Failed to wait for executable to complete: %ls, xrefs: 006F6E24
D, xrefs: 006F6CC1
Failed to allocate WUSA.exe path., xrefs: 006F6B39
Failed to get process exit code., xrefs: 006F6DB2
"%ls" /uninstall /kb:%ls /quiet /norestart, xrefs: 006F6BFB
Failed to build MSU path., xrefs: 006F6BBB
Failed to determine WOW64 status., xrefs: 006F6AB8
Failed to find System32 directory., xrefs: 006F6B1B
/log:, xrefs: 006F6C28
"%ls" "%ls" /quiet /norestart, xrefs: 006F6BCE
Failed to format MSU uninstall command., xrefs: 006F6C0F
c:\agent\_work\79\s\src\burn\engine\msuengine.cpp, xrefs: 006F6D13, 006F6DA8, 006F6DD0
Failed to format MSU install command., xrefs: 006F6BE2
Failed to CreateProcess on path: %ls, xrefs: 006F6D20
Failed to get action arguments for MSU package., xrefs: 006F6B5C
Bootstrapper application aborted during MSU progress., xrefs: 006F6DDA
Failed to append log path to MSU command-line., xrefs: 006F6C5A
Failed to find Windows directory., xrefs: 006F6AE5
2, xrefs: 006F6D39
SysNative\, xrefs: 006F6AF0
Failed to ensure WU service was enabled to install MSU package., xrefs: 006F6CB4

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: Handle$Close$AddressCurrentErrorLastModuleProcProcess
String ID: /log:$"%ls" "%ls" /quiet /norestart$"%ls" /uninstall /kb:%ls /quiet /norestart$2$Bootstrapper application aborted during MSU progress.$D$Failed to CreateProcess on path: %ls$Failed to allocate WUSA.exe path.$Failed to append SysNative directory.$Failed to append log path to MSU command-line.$Failed to append log switch to MSU command-line.$Failed to build MSU path.$Failed to determine WOW64 status.$Failed to ensure WU service was enabled to install MSU package.$Failed to find System32 directory.$Failed to find Windows directory.$Failed to format MSU install command.$Failed to format MSU uninstall command.$Failed to get action arguments for MSU package.$Failed to get cached path for package: %ls$Failed to get process exit code.$Failed to wait for executable to complete: %ls$SysNative\$WixBundleExecutePackageCacheFolder$c:\agent\_work\79\s\src\burn\engine\msuengine.cpp$wusa.exe
API String ID: 1400713077-82762285
Opcode ID: 75f33a10fe07d6a147597778a37e42ae8259c4907ee5d7fa4a58d1b0d007974a
Instruction ID: da89296337763377e76cc976c0a33116f443a77c8ce64612f60fb4dd2472d142
Opcode Fuzzy Hash: 75f33a10fe07d6a147597778a37e42ae8259c4907ee5d7fa4a58d1b0d007974a
Instruction Fuzzy Hash: 49D190B1A0031EAFDB219FE4DD85EFE7ABAAF18700F10412AF700A6251D7B59E54DB50

Function 006E545A Relevance: 51.0, APIs: 17, Strings: 12, Instructions: 228filepipesleepCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,?,00000000,?,?,00000000,75A8B390,?,006D457C,?,0071B500), ref: 006E547B
GetCurrentProcessId.KERNEL32(?,006D457C,?,0071B500), ref: 006E5486
SetNamedPipeHandleState.KERNEL32(?,000000FF,00000000,00000000,?,006D457C,?,0071B500), ref: 006E54BD
ConnectNamedPipe.KERNEL32(?,00000000,?,006D457C,?,0071B500), ref: 006E54D2
GetLastError.KERNEL32(?,006D457C,?,0071B500), ref: 006E54DC
Sleep.KERNEL32(00000064,?,006D457C,?,0071B500), ref: 006E5511
SetNamedPipeHandleState.KERNEL32(?,00000000,00000000,00000000,?,006D457C,?,0071B500), ref: 006E5534
WriteFile.KERNEL32(?,crypt32.dll,00000004,00000000,00000000,?,006D457C,?,0071B500), ref: 006E554F
WriteFile.KERNEL32(?,|Em,0071B500,00000000,00000000,?,006D457C,?,0071B500), ref: 006E556A
WriteFile.KERNEL32(?,0071B4B8,00000004,feclient.dll,00000000,?,006D457C,?,0071B500), ref: 006E5585
ReadFile.KERNEL32(?,wininet.dll,00000004,feclient.dll,00000000,?,006D457C,?,0071B500), ref: 006E55A0
GetLastError.KERNEL32(?,006D457C,?,0071B500), ref: 006E55FB
GetLastError.KERNEL32(?,006D457C,?,0071B500), ref: 006E562F
GetLastError.KERNEL32(?,006D457C,?,0071B500), ref: 006E5663
GetLastError.KERNEL32(?,006D457C,?,0071B500), ref: 006E5697
GetLastError.KERNEL32(?,006D457C,?,0071B500), ref: 006E56C8
GetLastError.KERNEL32(?,006D457C,?,0071B500), ref: 006E56F9

Strings

Failed to write secret length to pipe., xrefs: 006E56C1
Failed to read ACK from pipe., xrefs: 006E5625
Failed to wait for child to connect to pipe., xrefs: 006E55F1
Failed to reset pipe to blocking., xrefs: 006E56F2
wininet.dll, xrefs: 006E559E
c:\agent\_work\79\s\src\burn\engine\pipe.cpp, xrefs: 006E55E7, 006E561B, 006E564F, 006E5683, 006E56B7, 006E56E8, 006E5719
feclient.dll, xrefs: 006E557D, 006E5598
Failed to set pipe to non-blocking., xrefs: 006E5723
Failed to write our process id to pipe., xrefs: 006E5659
Failed to write secret to pipe., xrefs: 006E568D
|Em, xrefs: 006E5566
crypt32.dll, xrefs: 006E554D

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: ErrorLast$File$NamedPipeWrite$HandleState$ConnectCurrentProcessReadSleeplstrlen
String ID: Failed to read ACK from pipe.$Failed to reset pipe to blocking.$Failed to set pipe to non-blocking.$Failed to wait for child to connect to pipe.$Failed to write our process id to pipe.$Failed to write secret length to pipe.$Failed to write secret to pipe.$c:\agent\_work\79\s\src\burn\engine\pipe.cpp$crypt32.dll$feclient.dll$wininet.dll$|Em
API String ID: 2944378912-2147848423
Opcode ID: 3cfeb0d155f8a0650ae5b496084b4d0fb0fe9d2fe5c62b14164a21193cf6ec1b
Instruction ID: 44199c1a1dfe0b22a5aa6fd4936aef21f3cf466721cdaee5058785160c4b842c
Opcode Fuzzy Hash: 3cfeb0d155f8a0650ae5b496084b4d0fb0fe9d2fe5c62b14164a21193cf6ec1b
Instruction Fuzzy Hash: F961FA77D82735ABD7209AAA8C45BDE66AA6F00754F124125FE02FF2D0D77CCD008AE5

Function 0071766F Relevance: 47.6, APIs: 13, Strings: 14, Instructions: 339COMMON

Download Yara Rule

APIs

Part of subcall function 006D39DF: GetProcessHeap.KERNEL32(?,000001C7,?,006D237C,?,00000001,80004005,8007139F,?,?,0071058B,8007139F,?,00000000,00000000,8007139F), ref: 006D39F0
Part of subcall function 006D39DF: RtlAllocateHeap.NTDLL(00000000,?,006D237C,?,00000001,80004005,8007139F,?,?,0071058B,8007139F,?,00000000,00000000,8007139F), ref: 006D39F7

CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,generator,000000FF,?,?,?), ref: 00717782
SysFreeString.OLEAUT32(00000000), ref: 0071794B
SysFreeString.OLEAUT32(00000000), ref: 007179E8

Strings

updated, xrefs: 00717829
author, xrefs: 007176C0, 00717851
title, xrefs: 0071780D
logo, xrefs: 007177D5
generator, xrefs: 00717775
subtitle, xrefs: 007177F1
entry, xrefs: 007176FA, 007178C3
icon, xrefs: 00717799
category, xrefs: 007176DD, 0071788A
c:\agent\_work\79\s\src\libs\dutil\atomutil.cpp, xrefs: 0071769C, 007179D2
@, xrefs: 007178F1
`)u, xrefs: 0071794B, 007179E8
(, xrefs: 00717926
link, xrefs: 00717717, 007178F9

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: String$FreeHeap$AllocateCompareProcess
String ID: ($@$`)u$author$c:\agent\_work\79\s\src\libs\dutil\atomutil.cpp$category$entry$generator$icon$link$logo$subtitle$title$updated
API String ID: 1555028553-2690593432
Opcode ID: 30c6f9667ed735d095e02cfe3950322c8e396494bf638a6fe978e25c78e65b94
Instruction ID: a4b2acb317caa55a52d9ce26b8590804212a25bc5cdf311e91b164458b768234
Opcode Fuzzy Hash: 30c6f9667ed735d095e02cfe3950322c8e396494bf638a6fe978e25c78e65b94
Instruction Fuzzy Hash: 6FB1BF7194C216BBDB289B68CC86FEDB674AB04730F204355F521BA2D1D778EE84D790

Function 00717334 Relevance: 47.5, APIs: 11, Strings: 16, Instructions: 297COMMON

Download Yara Rule

APIs

CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,00737460,000000FF,?,?,?), ref: 007173FB
CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,summary,000000FF), ref: 00717420
CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,title,000000FF), ref: 00717440
CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,published,000000FF), ref: 0071745C
CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,updated,000000FF), ref: 00717484
CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,author,000000FF), ref: 007174A0
CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,category,000000FF), ref: 007174D9
CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,content,000000FF), ref: 00717512

Part of subcall function 00716F7D: SysFreeString.OLEAUT32(00000000), ref: 007170B6
Part of subcall function 00716F7D: SysFreeString.OLEAUT32(00000000), ref: 007170F5

SysFreeString.OLEAUT32(00000000), ref: 00717596
SysFreeString.OLEAUT32(00000000), ref: 00717646

Strings

updated, xrefs: 00717476
author, xrefs: 0071735F, 00717492
title, xrefs: 00717432
cabinet.dll, xrefs: 00717377
content, xrefs: 00717504
published, xrefs: 0071744E
msi.dll, xrefs: 0071735E
category, xrefs: 0071737C, 007174CB
c:\agent\_work\79\s\src\libs\dutil\atomutil.cpp, xrefs: 00717633
(, xrefs: 00717571
`)u, xrefs: 00717596, 00717646
clbcatq.dll, xrefs: 00717469
version.dll, xrefs: 0071735A
feclient.dll, xrefs: 0071742D
summary, xrefs: 00717412
link, xrefs: 00717399, 00717544

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: String$Compare$Free
String ID: ($`)u$author$c:\agent\_work\79\s\src\libs\dutil\atomutil.cpp$cabinet.dll$category$clbcatq.dll$content$feclient.dll$link$msi.dll$published$summary$title$updated$version.dll
API String ID: 318886736-4277159395
Opcode ID: 85dd9bf5594885447acdfcd5f9556e88dc80ecafb7eee1a47827b1e17eff7e04
Instruction ID: 9c18176009d46df7380a0f5e6216028650f36e629ea96bef691a0991201cb3b1
Opcode Fuzzy Hash: 85dd9bf5594885447acdfcd5f9556e88dc80ecafb7eee1a47827b1e17eff7e04
Instruction Fuzzy Hash: FCA1DF71908626FBDB298B9CCC41FEDB674AF04730F204355F925AA1D1D778EA90DB90

Function 006FD130 Relevance: 47.5, APIs: 12, Strings: 15, Instructions: 283synchronizationprocessCOMMON

Download Yara Rule

APIs

UuidCreate.RPCRT4(?), ref: 006FD1A5
StringFromGUID2.OLE32(?,?,00000027), ref: 006FD1CE
CreateProcessW.KERNEL32(?,?,00000000,00000000,00000000,08000000,00000000,00000000,?,?,?,?,?,?), ref: 006FD2B7
GetLastError.KERNEL32(?,?,?,?), ref: 006FD2C1
WaitForMultipleObjects.KERNEL32(00000002,?,00000000,00000064,?,?,?,?), ref: 006FD35A
WaitForSingleObject.KERNEL32(0071B500,000000FF,?,?,?,?), ref: 006FD365
ReleaseMutex.KERNEL32(0071B500,?,?,?,?), ref: 006FD38F
GetExitCodeProcess.KERNEL32(?,?), ref: 006FD3B0
GetLastError.KERNEL32(?,?,?,?), ref: 006FD3BE
GetLastError.KERNEL32(?,?,?,?), ref: 006FD3F6

Part of subcall function 006FD038: WaitForSingleObject.KERNEL32(?,000000FF,759230B0,00000000,?,?,?,006FD334,?), ref: 006FD057
Part of subcall function 006FD038: ReleaseMutex.KERNEL32(?,?,?,006FD334,?), ref: 006FD06B
Part of subcall function 006FD038: WaitForSingleObject.KERNEL32(?,000000FF), ref: 006FD0B0
Part of subcall function 006FD038: ReleaseMutex.KERNEL32(?), ref: 006FD0C3
Part of subcall function 006FD038: SetEvent.KERNEL32(?), ref: 006FD0CC

CloseHandle.KERNEL32(00000000,?,?,?,?,?,?), ref: 006FD49F
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?), ref: 006FD4B7

Strings

c:\agent\_work\79\s\src\burn\engine\netfxchainer.cpp, xrefs: 006FD1E3, 006FD2E5, 006FD3E2, 006FD41A
Failed to CreateProcess on path: %ls, xrefs: 006FD2F0
Failed to create netfx chainer., xrefs: 006FD250
Failed to wait for netfx chainer process to complete, xrefs: 006FD424
Failed to create netfx chainer guid., xrefs: 006FD1B2
Failed to get netfx return code., xrefs: 006FD3EC
Failed to allocate event name., xrefs: 006FD231
Failed to process netfx chainer message., xrefs: 006FD33A
Failed to convert netfx chainer guid into string., xrefs: 006FD1ED
NetFxEvent.%ls, xrefs: 006FD21D
D, xrefs: 006FD29C
Failed to allocate netfx chainer arguments., xrefs: 006FD285
NetFxSection.%ls, xrefs: 006FD1FB
Failed to allocate section name., xrefs: 006FD20F
%ls /pipe %ls, xrefs: 006FD271

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: Wait$ErrorLastMutexObjectReleaseSingle$CloseCreateHandleProcess$CodeEventExitFromMultipleObjectsStringUuid
String ID: %ls /pipe %ls$D$Failed to CreateProcess on path: %ls$Failed to allocate event name.$Failed to allocate netfx chainer arguments.$Failed to allocate section name.$Failed to convert netfx chainer guid into string.$Failed to create netfx chainer guid.$Failed to create netfx chainer.$Failed to get netfx return code.$Failed to process netfx chainer message.$Failed to wait for netfx chainer process to complete$NetFxEvent.%ls$NetFxSection.%ls$c:\agent\_work\79\s\src\burn\engine\netfxchainer.cpp
API String ID: 1533322865-3196626710
Opcode ID: ded273d365e2d56e0c3737ac88437b15d68d18a9eb10aae986f8031e850b62c5
Instruction ID: 3d6fa20f9ffd6ed17da753db1b9a6cdca2e1e6b0ce90c38ce73f39e51be0d72e
Opcode Fuzzy Hash: ded273d365e2d56e0c3737ac88437b15d68d18a9eb10aae986f8031e850b62c5
Instruction Fuzzy Hash: 29A17072D0022DABEB219BA8CC45BEEB7B7AB04710F114169EA08B7291D735AD44CF91

Function 006DA3D4 Relevance: 44.1, APIs: 8, Strings: 17, Instructions: 311registryCOMMON

Download Yara Rule

APIs

_MREFOpen@16.MSPDB140-MSVCRT ref: 006DA418
_MREFOpen@16.MSPDB140-MSVCRT ref: 006DA440
RegCloseKey.ADVAPI32(00000000,?,00000000,?,?,?,?,?), ref: 006DA73F

Strings

Registry key not found. Key = '%ls', xrefs: 006DA478
c:\agent\_work\79\s\src\burn\engine\search.cpp, xrefs: 006DA510, 006DA545, 006DA598, 006DA6A1
Unsupported registry key value type. Type = '%u', xrefs: 006DA5D2
Failed to change value type., xrefs: 006DA6E3, 006DA706
Failed to format key string., xrefs: 006DA425
Failed to set variable., xrefs: 006DA701
Failed to open registry key., xrefs: 006DA4B3
Failed to read registry value., xrefs: 006DA6C8
Failed to clear variable., xrefs: 006DA49E
Failed to query registry key value size., xrefs: 006DA51C
Failed to format value string., xrefs: 006DA44D
Failed to query registry key value., xrefs: 006DA5A4
Failed to allocate string buffer., xrefs: 006DA633
Failed to get expand environment string., xrefs: 006DA6AD
Registry value not found. Key = '%ls', Value = '%ls', xrefs: 006DA4E2
Failed to allocate memory registry value., xrefs: 006DA54F
RegistrySearchValue failed: ID '%ls', HRESULT 0x%x, xrefs: 006DA717

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: Open@16$Close
String ID: Failed to allocate memory registry value.$Failed to allocate string buffer.$Failed to change value type.$Failed to clear variable.$Failed to format key string.$Failed to format value string.$Failed to get expand environment string.$Failed to open registry key.$Failed to query registry key value size.$Failed to query registry key value.$Failed to read registry value.$Failed to set variable.$Registry key not found. Key = '%ls'$Registry value not found. Key = '%ls', Value = '%ls'$RegistrySearchValue failed: ID '%ls', HRESULT 0x%x$Unsupported registry key value type. Type = '%u'$c:\agent\_work\79\s\src\burn\engine\search.cpp
API String ID: 2348241696-664579708
Opcode ID: 15f3ae2a8b79bb21eb50f18e9afba93d539e00810a66d92cbd890a8caa1fa18b
Instruction ID: 47fb0ae19c45eb59a62b08505e07882d8bd98b4819df81996c80a4558814575e
Opcode Fuzzy Hash: 15f3ae2a8b79bb21eb50f18e9afba93d539e00810a66d92cbd890a8caa1fa18b
Instruction Fuzzy Hash: D0A1A472E04125EBDF219AE88805EEE7ABAAF08710F148126F905BB390D775DD4197E2

Function 006D57A7 Relevance: 42.5, APIs: 5, Strings: 19, Instructions: 477stringCOMMONLIBRARYCODE

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(00000100,00000100,00000100,00000000,00000100,00000000,?,006DA889,00000100,000002C0,000002C0,00000100), ref: 006D57CC
lstrlenW.KERNEL32(000002C0,?,006DA889,00000100,000002C0,000002C0,00000100), ref: 006D57D6
_wcschr.LIBVCRUNTIME ref: 006D59DB
LeaveCriticalSection.KERNEL32(00000100,00000000,000002C0,000002C0,00000000,000002C0,00000001,?,006DA889,00000100,000002C0,000002C0,00000100), ref: 006D5C7E

Strings

Failed to determine variable visibility: '%ls'., xrefs: 006D5A6E
Failed to set record string., xrefs: 006D5B94
[%d], xrefs: 006D5996
Failed to reallocate variable array., xrefs: 006D5A60
Failed to append placeholder., xrefs: 006D5A81
Failed to set variable value., xrefs: 006D5A95
Failed to format record., xrefs: 006D5C42
Failed to allocate variable array., xrefs: 006D5AB9
Failed to set record format string., xrefs: 006D5B08
Failed to allocate record., xrefs: 006D5A3F
Failed to copy string., xrefs: 006D5C62
Failed to get variable name., xrefs: 006D5AC0
Failed to format placeholder string., xrefs: 006D5A8B
Failed to allocate string., xrefs: 006D5BF5
Failed to get formatted length., xrefs: 006D5BC6
c:\agent\_work\79\s\src\burn\engine\variable.cpp, xrefs: 006D5A32, 006D5A53, 006D5AAC, 006D5AFE, 006D5B8A, 006D5BBC, 006D5C38
Failed to append string., xrefs: 006D5852
Failed to allocate buffer for format string., xrefs: 006D57F4
*****, xrefs: 006D594D

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: CriticalSection$EnterLeave_wcschrlstrlen
String ID: *****$Failed to allocate buffer for format string.$Failed to allocate record.$Failed to allocate string.$Failed to allocate variable array.$Failed to append placeholder.$Failed to append string.$Failed to copy string.$Failed to determine variable visibility: '%ls'.$Failed to format placeholder string.$Failed to format record.$Failed to get formatted length.$Failed to get variable name.$Failed to reallocate variable array.$Failed to set record format string.$Failed to set record string.$Failed to set variable value.$[%d]$c:\agent\_work\79\s\src\burn\engine\variable.cpp
API String ID: 1026845265-680246530
Opcode ID: 44c0ce90d62dc3225a60070c8e2dc84fbd6e633a7bf7bafaf460b99e916f2b41
Instruction ID: 3fdcdd58c6972b97bfefc36ce4a822821a3cec5aaadff39269a9ab088bf298d4
Opcode Fuzzy Hash: 44c0ce90d62dc3225a60070c8e2dc84fbd6e633a7bf7bafaf460b99e916f2b41
Instruction Fuzzy Hash: 74F1C571D00625EBDB209FA48841EFF7B66AB04B50F15812BFD06AB780D7389E419FA4

Function 006FCB7F Relevance: 40.5, APIs: 12, Strings: 11, Instructions: 239synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 006D39DF: GetProcessHeap.KERNEL32(?,000001C7,?,006D237C,?,00000001,80004005,8007139F,?,?,0071058B,8007139F,?,00000000,00000000,8007139F), ref: 006D39F0
Part of subcall function 006D39DF: RtlAllocateHeap.NTDLL(00000000,?,006D237C,?,00000001,80004005,8007139F,?,?,0071058B,8007139F,?,00000000,00000000,8007139F), ref: 006D39F7

CreateEventW.KERNEL32(00000000,00000000,00000000,?,00000000,00000018,00000001,?,00000000,?,?,006FD24A,?,?,?), ref: 006FCBC5
GetLastError.KERNEL32(?,?,006FD24A,?,?,?), ref: 006FCBD2
ReleaseMutex.KERNEL32(?), ref: 006FCE3A

Strings

c:\agent\_work\79\s\src\burn\engine\netfxchainer.cpp, xrefs: 006FCBA1, 006FCBF3, 006FCC58, 006FCCC7, 006FCD19, 006FCD61
failed to allocate memory for event name, xrefs: 006FCC18
Failed to allocate memory for NetFxChainer struct., xrefs: 006FCBAB
Failed to create event: %ls, xrefs: 006FCC65
Failed to MapViewOfFile for %ls., xrefs: 006FCD6E
%ls_send, xrefs: 006FCC04
Failed to memory map cabinet file: %ls, xrefs: 006FCD26
failed to copy event name to shared memory structure., xrefs: 006FCD98
Failed to create mutex: %ls, xrefs: 006FCCD4
failed to allocate memory for mutex name, xrefs: 006FCC87
%ls_mutex, xrefs: 006FCC73

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: Heap$AllocateCreateErrorEventLastMutexProcessRelease
String ID: %ls_mutex$%ls_send$Failed to MapViewOfFile for %ls.$Failed to allocate memory for NetFxChainer struct.$Failed to create event: %ls$Failed to create mutex: %ls$Failed to memory map cabinet file: %ls$c:\agent\_work\79\s\src\burn\engine\netfxchainer.cpp$failed to allocate memory for event name$failed to allocate memory for mutex name$failed to copy event name to shared memory structure.
API String ID: 3944734951-596133599
Opcode ID: 131de2d484d192578513d10234efe49c2b927fe70e365f1cab4b99d355930d2a
Instruction ID: 96f42d90cea7cf6ced55cc36d1859a9bcd9f674e530d4ac24a7ada064fd62717
Opcode Fuzzy Hash: 131de2d484d192578513d10234efe49c2b927fe70e365f1cab4b99d355930d2a
Instruction Fuzzy Hash: DF81F9B6A4172ABBD3214B688D59FAB7EA5BF04720F018165FE04AB381D778DD00D6E4

Function 006DE9F9 Relevance: 38.7, APIs: 4, Strings: 18, Instructions: 230COMMON

Download Yara Rule

APIs

Part of subcall function 007135AF: VariantInit.OLEAUT32(0071B594), ref: 007135C5
Part of subcall function 007135AF: SysAllocString.OLEAUT32(?), ref: 007135E1
Part of subcall function 007135AF: VariantClear.OLEAUT32(?), ref: 00713668
Part of subcall function 007135AF: SysFreeString.OLEAUT32(00000000), ref: 00713673

CompareStringW.KERNEL32(0000007F,00000000,000000FF,000000FF,Detect,000000FF,?,0071CB64,?,?,Action,?,?,?,00000000,?), ref: 006DEACA
CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,Upgrade,000000FF), ref: 006DEB14

Strings

Patch, xrefs: 006DEB94
Failed to get @Action., xrefs: 006DEC20
Failed to resize Detect code array in registration, xrefs: 006DEBE5
Failed to resize Addon code array in registration, xrefs: 006DEBF3
Failed to get next RelatedBundle element., xrefs: 006DEC27
Detect, xrefs: 006DEABB
cabinet.dll, xrefs: 006DEB71
Failed to get RelatedBundle nodes, xrefs: 006DEA29
Failed to resize Upgrade code array in registration, xrefs: 006DEBEC
RelatedBundle, xrefs: 006DEA07
Failed to get RelatedBundle element count., xrefs: 006DEA4E
Failed to get @Id., xrefs: 006DEC19
Upgrade, xrefs: 006DEB07
Failed to resize Patch code array in registration, xrefs: 006DEBFA
version.dll, xrefs: 006DEB27
Addon, xrefs: 006DEB51
Action, xrefs: 006DEA87
Invalid value for @Action: %ls, xrefs: 006DEC09

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: String$CompareVariant$AllocClearFreeInit
String ID: Action$Addon$Detect$Failed to get @Action.$Failed to get @Id.$Failed to get RelatedBundle element count.$Failed to get RelatedBundle nodes$Failed to get next RelatedBundle element.$Failed to resize Addon code array in registration$Failed to resize Detect code array in registration$Failed to resize Patch code array in registration$Failed to resize Upgrade code array in registration$Invalid value for @Action: %ls$Patch$RelatedBundle$Upgrade$cabinet.dll$version.dll
API String ID: 702752599-130283994
Opcode ID: a150bc62f50b180da840d3c46b0119d54a3a39c8a04f7d2360588b550749fc8d
Instruction ID: c747fa968db22cfef62303003a7c50c9e38920ac8dde6bc048f8b3778305be29
Opcode Fuzzy Hash: a150bc62f50b180da840d3c46b0119d54a3a39c8a04f7d2360588b550749fc8d
Instruction Fuzzy Hash: 9071B170E45626FBC720AB54C941EAEB776FB04724F204256E921AB3C1C735EE52CB90

Function 006E4665 Relevance: 36.9, APIs: 10, Strings: 11, Instructions: 184fileCOMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(?,8000FFFF,feclient.dll,?,006E4B78,0071B4E8,?,feclient.dll,00000000,?,?), ref: 006E467C
ReadFile.KERNEL32(feclient.dll,feclient.dll,00000004,?,00000000,?,006E4B78,0071B4E8,?,feclient.dll,00000000,?,?), ref: 006E469D
GetLastError.KERNEL32(?,006E4B78,0071B4E8,?,feclient.dll,00000000,?,?), ref: 006E46A3
ReadFile.KERNEL32(feclient.dll,00000000,0071B518,?,00000000,00000000,0071B519,?,006E4B78,0071B4E8,?,feclient.dll,00000000,?,?), ref: 006E4731
GetLastError.KERNEL32(?,006E4B78,0071B4E8,?,feclient.dll,00000000,?,?), ref: 006E4737

Strings

msasn1.dll, xrefs: 006E47B4
Failed to read verification secret from parent pipe., xrefs: 006E4765
Failed to read verification process id from parent pipe., xrefs: 006E47EA
Verification process id from parent does not match., xrefs: 006E4884
Failed to read size of verification secret from parent pipe., xrefs: 006E46D1
c:\agent\_work\79\s\src\burn\engine\pipe.cpp, xrefs: 006E46C7, 006E46F2, 006E475B, 006E4793, 006E47E0, 006E483A, 006E4878
Failed to inform parent process that child is running., xrefs: 006E4844
feclient.dll, xrefs: 006E466B, 006E469B, 006E469C, 006E4730, 006E47B5, 006E480B
Failed to allocate buffer for verification secret., xrefs: 006E471A
Verification secret from parent does not match., xrefs: 006E479F
Verification secret from parent is too big., xrefs: 006E46FE

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: ErrorFileLastRead$CurrentProcess
String ID: Failed to allocate buffer for verification secret.$Failed to inform parent process that child is running.$Failed to read size of verification secret from parent pipe.$Failed to read verification process id from parent pipe.$Failed to read verification secret from parent pipe.$Verification process id from parent does not match.$Verification secret from parent does not match.$Verification secret from parent is too big.$c:\agent\_work\79\s\src\burn\engine\pipe.cpp$feclient.dll$msasn1.dll
API String ID: 1233551569-195037519
Opcode ID: 45b326bada5bfc175b0344ea67c3c9adacec7466783c4f928000d785fc1d2665
Instruction ID: 246bc92f6a573c2157a84c205f6654778089a2aa9a6218eacff864fe7cdff6e6
Opcode Fuzzy Hash: 45b326bada5bfc175b0344ea67c3c9adacec7466783c4f928000d785fc1d2665
Instruction Fuzzy Hash: AF513777D42376B7DB219AA65C45FAF766AAF00B20F114119FE10BB280DB38DD0096E5

Function 006F25BB Relevance: 36.9, APIs: 3, Strings: 18, Instructions: 144COMMON

Download Yara Rule

Strings

Failed to get @RepairArguments., xrefs: 006F264A
burn, xrefs: 006F269F
UninstallArguments, xrefs: 006F2617
Failed to get @Protocol., xrefs: 006F2733
Failed to parse exit codes., xrefs: 006F26CB
DetectCondition, xrefs: 006F25D3
netfx4, xrefs: 006F26D4
Invalid protocol type: %ls, xrefs: 006F271B
Failed to get @InstallArguments., xrefs: 006F2606
InstallArguments, xrefs: 006F25F5
Failed to parse command lines., xrefs: 006F2747
Failed to get @Repairable., xrefs: 006F2674
Repairable, xrefs: 006F265B
Protocol, xrefs: 006F2682
Failed to get @UninstallArguments., xrefs: 006F2628
Failed to get @DetectCondition., xrefs: 006F25E4
none, xrefs: 006F26F5
RepairArguments, xrefs: 006F2639

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: StringVariant$AllocClearFreeInit
String ID: DetectCondition$Failed to get @DetectCondition.$Failed to get @InstallArguments.$Failed to get @Protocol.$Failed to get @RepairArguments.$Failed to get @Repairable.$Failed to get @UninstallArguments.$Failed to parse command lines.$Failed to parse exit codes.$InstallArguments$Invalid protocol type: %ls$Protocol$RepairArguments$Repairable$UninstallArguments$burn$netfx4$none
API String ID: 760788290-1911311241
Opcode ID: 583eefe9592f8e99628b3c0ae665f90e2cc8d2354ed8dd39999257febd741dbe
Instruction ID: 5bb3760649efce6a1a5cf2d95f89b501d0ca57d1ed1a34b3f3f16fe0fb69285a
Opcode Fuzzy Hash: 583eefe9592f8e99628b3c0ae665f90e2cc8d2354ed8dd39999257febd741dbe
Instruction Fuzzy Hash: 66412D71A8477FF7C711B5649C52FBA775AAB10B30F200311FB20B62C2DB68AD055AD0

Function 006D8F3F Relevance: 35.4, APIs: 8, Strings: 12, Instructions: 430COMMON

Download Yara Rule

APIs

GetStringTypeW.KERNEL32(00000001,560071DC,00000001,?,006D990B,?,00000000,00000000,?,?,006D98F3,?,?,00000000,?), ref: 006D8F7D

Strings

Failed to parse condition "%ls". Unexpected character at position %d., xrefs: 006D912F
Failed to parse condition "%ls". Unterminated literal at position %d., xrefs: 006D9065
Failed to parse condition "%ls". Unexpected '~' operator at position %d., xrefs: 006D93D5
-, xrefs: 006D90E5
Failed to parse condition "%ls". Invalid version format, at position %d., xrefs: 006D920F
Failed to parse condition "%ls". Version can have a maximum of 4 parts, at position %d., xrefs: 006D91AB
NOT, xrefs: 006D92A8
Failed to parse condition "%ls". Constant too big, at position %d., xrefs: 006D934D
Failed to parse condition "%ls". Identifier cannot start at a digit, at position %d., xrefs: 006D9391
Failed to set symbol value., xrefs: 006D902D
AND, xrefs: 006D9289
c:\agent\_work\79\s\src\burn\engine\condition.cpp, xrefs: 006D9051, 006D911B, 006D9197, 006D91FB, 006D9339, 006D937D, 006D93C1

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: StringType
String ID: -$AND$Failed to parse condition "%ls". Constant too big, at position %d.$Failed to parse condition "%ls". Identifier cannot start at a digit, at position %d.$Failed to parse condition "%ls". Invalid version format, at position %d.$Failed to parse condition "%ls". Unexpected '~' operator at position %d.$Failed to parse condition "%ls". Unexpected character at position %d.$Failed to parse condition "%ls". Unterminated literal at position %d.$Failed to parse condition "%ls". Version can have a maximum of 4 parts, at position %d.$Failed to set symbol value.$NOT$c:\agent\_work\79\s\src\burn\engine\condition.cpp
API String ID: 4177115715-2443282359
Opcode ID: 50472c8af6e208658dc88204f69b3e33f26939069eaf45ca7dc9260ab982f390
Instruction ID: 0b8f7b3716988e110b60c9df0c1fedc5878775501012c989cd2093f0eeac84d8
Opcode Fuzzy Hash: 50472c8af6e208658dc88204f69b3e33f26939069eaf45ca7dc9260ab982f390
Instruction Fuzzy Hash: 49F1E6B1D00215FBDB24CF54C849BFA7BA6FB05704F10814BF9019A385C3B9DA96DBA0

Function 006F1976 Relevance: 35.2, APIs: 4, Strings: 16, Instructions: 211COMMON

Download Yara Rule

APIs

Part of subcall function 006D39DF: GetProcessHeap.KERNEL32(?,000001C7,?,006D237C,?,00000001,80004005,8007139F,?,?,0071058B,8007139F,?,00000000,00000000,8007139F), ref: 006D39F0
Part of subcall function 006D39DF: RtlAllocateHeap.NTDLL(00000000,?,006D237C,?,00000001,80004005,8007139F,?,?,0071058B,8007139F,?,00000000,00000000,8007139F), ref: 006D39F7

CompareStringW.KERNEL32(0000007F,00000000,00000000,000000FF,success,000000FF,?,Type,00000000,?,?,00000000,?,00000001,?), ref: 006F1A7D
CompareStringW.KERNEL32(0000007F,00000000,00000000,000000FF,error,000000FF), ref: 006F1A9B

Strings

Invalid exit code type: %ls, xrefs: 006F1B6C
success, xrefs: 006F1A6E
Failed to get @Code., xrefs: 006F1B5D
forceReboot, xrefs: 006F1AC8
Failed to get next node., xrefs: 006F1B83
Failed to get exit code node count., xrefs: 006F19C8
Failed to get @Type., xrefs: 006F1B7C
error, xrefs: 006F1A8E
Code, xrefs: 006F1AEA
Type, xrefs: 006F1A55
Failed to select exit code nodes., xrefs: 006F19A3
ExitCode, xrefs: 006F1984
Failed to allocate memory for exit code structs., xrefs: 006F1A08
Failed to parse @Code value: %ls, xrefs: 006F1B56
c:\agent\_work\79\s\src\burn\engine\exeengine.cpp, xrefs: 006F19FE
scheduleReboot, xrefs: 006F1AAA

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: CompareHeapString$AllocateProcess
String ID: Code$ExitCode$Failed to allocate memory for exit code structs.$Failed to get @Code.$Failed to get @Type.$Failed to get exit code node count.$Failed to get next node.$Failed to parse @Code value: %ls$Failed to select exit code nodes.$Invalid exit code type: %ls$Type$c:\agent\_work\79\s\src\burn\engine\exeengine.cpp$error$forceReboot$scheduleReboot$success
API String ID: 2664528157-3285546140
Opcode ID: b140c248c101043c977e4fb3d9159b523bfd05a64164623a93afad53840eb65c
Instruction ID: 6b613f6a870ead8724a61cdb7ccb7c67545bb59b7eef5b9c628328f1c96c98e0
Opcode Fuzzy Hash: b140c248c101043c977e4fb3d9159b523bfd05a64164623a93afad53840eb65c
Instruction Fuzzy Hash: B261E170A0422AFBCB109B54CC45EBEBBB6AF52760F204255F624AF2D0E7749A41DB90

Function 006E6ABF Relevance: 33.6, APIs: 6, Strings: 13, Instructions: 355synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 006DD461: EnterCriticalSection.KERNEL32(000000D0,?,000000B8,00000000,?,006E6F34,000000B8,00000000,?,00000000,75A8B390), ref: 006DD470
Part of subcall function 006DD461: LeaveCriticalSection.KERNEL32(000000D0,?,006E6F34,000000B8,00000000,?,00000000,75A8B390), ref: 006DD493

ReleaseMutex.KERNEL32(00000000,?,00000000,crypt32.dll,00000000,00000001,00000000), ref: 006E6E83
CloseHandle.KERNEL32(00000000), ref: 006E6E8C
CloseHandle.KERNEL32(?,?,00000000,crypt32.dll,00000000,00000001,00000000), ref: 006E6EAC

Part of subcall function 006FBA1A: SetThreadExecutionState.KERNEL32(80000001), ref: 006FBA1F

Strings

Another per-machine setup is already executing., xrefs: 006E6CC5
Failed to cache engine to working directory., xrefs: 006E6C65
Failed to elevate., xrefs: 006E6C8B
Engine cannot start apply because it is busy with another action., xrefs: 006E6B20
Failed to set initial apply variables., xrefs: 006E6BFB
c:\agent\_work\79\s\src\burn\engine\core.cpp, xrefs: 006E6B87, 006E6D58
Failed while caching, aborting execution., xrefs: 006E6D8A
UX aborted apply begin., xrefs: 006E6B91
Another per-user setup is already executing., xrefs: 006E6BD1
Failed to register bundle., xrefs: 006E6CE8
Failed to create cache thread., xrefs: 006E6D62
crypt32.dll, xrefs: 006E6BC3
oEm, xrefs: 006E6DBF, 006E6D0B, 006E6DC2

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: CloseCriticalHandleSection$EnterExecutionLeaveMutexReleaseStateThread
String ID: Another per-machine setup is already executing.$Another per-user setup is already executing.$Engine cannot start apply because it is busy with another action.$Failed to cache engine to working directory.$Failed to create cache thread.$Failed to elevate.$Failed to register bundle.$Failed to set initial apply variables.$Failed while caching, aborting execution.$UX aborted apply begin.$c:\agent\_work\79\s\src\burn\engine\core.cpp$crypt32.dll$oEm
API String ID: 303827279-4291315641
Opcode ID: f82e0ae283a7cc917e9428b9f181cf9d90372be713c6bec2c04745b9d083d980
Instruction ID: 50388efb31b06a766dd8f47c79acc5cc7385a08208bf24db648c6c56a3ba62b1
Opcode Fuzzy Hash: f82e0ae283a7cc917e9428b9f181cf9d90372be713c6bec2c04745b9d083d980
Instruction Fuzzy Hash: 99C1E3B2D02365EBDF159F65CC85BEE37AAAF14740F04417AFD05AE281DB348940CB64

Function 0071834D Relevance: 31.8, APIs: 9, Strings: 9, Instructions: 308COMMON

Download Yara Rule

APIs

CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,http://appsyndication.org/2006/appsyn,000000FF,00000000,00000000,000002C0,00000410), ref: 0071837A
CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,application,000000FF), ref: 00718395
CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,upgrade,000000FF), ref: 00718438
CompareStringW.KERNEL32(0000007F,00000000,00700079,000000FF,version,000000FF,000002D8,0071B518,00000000), ref: 00718477
CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,exclusive,000000FF), ref: 007184CA
CompareStringW.KERNEL32(0000007F,00000000,0071B518,000000FF,true,000000FF), ref: 007184E8
CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,version,000000FF), ref: 00718520
CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,enclosure,000000FF), ref: 00718664

Strings

version, xrefs: 00718469, 00718512
exclusive, xrefs: 007184BC
type, xrefs: 007183C0
upgrade, xrefs: 0071842A
c:\agent\_work\79\s\src\libs\dutil\apuputil.cpp, xrefs: 00718587
true, xrefs: 007184DA
application, xrefs: 00718387
http://appsyndication.org/2006/appsyn, xrefs: 0071836D
enclosure, xrefs: 00718652

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: CompareString
String ID: application$c:\agent\_work\79\s\src\libs\dutil\apuputil.cpp$enclosure$exclusive$http://appsyndication.org/2006/appsyn$true$type$upgrade$version
API String ID: 1825529933-3198828006
Opcode ID: 5ed4ee420eebfe88f3e4d9242ed4d13ea93d63a75be3728e2e9f96f6e3b61005
Instruction ID: c9a3a87f058209e8404ff37a1535add6642ee4890c7902cc92d804232bea0206
Opcode Fuzzy Hash: 5ed4ee420eebfe88f3e4d9242ed4d13ea93d63a75be3728e2e9f96f6e3b61005
Instruction Fuzzy Hash: B7B1C471544206ABDBA0CF5CCC41F9A77A6AF04730F218619F935AB2D2DF78E990CB05

Function 00717A1A Relevance: 31.7, APIs: 8, Strings: 10, Instructions: 205COMMON

Download Yara Rule

APIs

CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,rel,000000FF,?,?,?,00000000), ref: 00717A7A
CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,href,000000FF), ref: 00717A9F
CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,length,000000FF), ref: 00717ABF
CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,title,000000FF), ref: 00717AF2
CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,type,000000FF), ref: 00717B0E
SysFreeString.OLEAUT32(00000000), ref: 00717B39
SysFreeString.OLEAUT32(00000000), ref: 00717BB0
SysFreeString.OLEAUT32(00000000), ref: 00717BFC

Strings

msasn1.dll, xrefs: 00717BEA
href, xrefs: 00717A91
type, xrefs: 00717B00
length, xrefs: 00717AB1
`)u, xrefs: 00717B39, 00717BB0, 00717BFC
title, xrefs: 00717AE4
feclient.dll, xrefs: 00717AAC
version.dll, xrefs: 00717B1D
rel, xrefs: 00717A6D
msi.dll, xrefs: 00717B98

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: String$Compare$Free
String ID: `)u$feclient.dll$href$length$msasn1.dll$msi.dll$rel$title$type$version.dll
API String ID: 318886736-2442510206
Opcode ID: 9d11e4aab3514a87a68717a17d6196ea9b5a2e07ed0453f44868aee656c1dda2
Instruction ID: 1a2374880a7ffae8dce563f9e4bf96fcb37cdb7f3a514ff562e4fad2e5c9ffea
Opcode Fuzzy Hash: 9d11e4aab3514a87a68717a17d6196ea9b5a2e07ed0453f44868aee656c1dda2
Instruction Fuzzy Hash: 16616375909119FBDF29DB98CC45EEDB7B8AF04721F2042A5F521A71E0D738AE80DB90

Function 006EE24B Relevance: 31.6, APIs: 12, Strings: 6, Instructions: 145registryCOMMON

Download Yara Rule

APIs

Part of subcall function 006EE134: LoadBitmapW.USER32(?,00000001), ref: 006EE16A
Part of subcall function 006EE134: GetLastError.KERNEL32 ref: 006EE176

LoadCursorW.USER32(00000000,00007F00), ref: 006EE2AC
RegisterClassW.USER32(?), ref: 006EE2C0
GetLastError.KERNEL32 ref: 006EE2CB
UnregisterClassW.USER32(WixBurnSplashScreen,?), ref: 006EE3D0
DeleteObject.GDI32(00000000), ref: 006EE3DF

Strings

c:\agent\_work\79\s\src\burn\engine\splashscreen.cpp, xrefs: 006EE2EF, 006EE358
Failed to register window., xrefs: 006EE2F9
Failed to create window., xrefs: 006EE362
Unexpected return value from message pump., xrefs: 006EE3BA
WixBurnSplashScreen, xrefs: 006EE2B9, 006EE3CB
Failed to load splash screen., xrefs: 006EE284

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: ClassErrorLastLoad$BitmapCursorDeleteObjectRegisterUnregister
String ID: Failed to create window.$Failed to load splash screen.$Failed to register window.$Unexpected return value from message pump.$WixBurnSplashScreen$c:\agent\_work\79\s\src\burn\engine\splashscreen.cpp
API String ID: 164797020-3924656102
Opcode ID: 3d7a1a621d609c5a3fe9229bde788848cf6b25db6bded14a88fd994f43813fc6
Instruction ID: 31414a712bb881bd246b79ebc5782f7704b0ffa386fead53350c36871fb9f068
Opcode Fuzzy Hash: 3d7a1a621d609c5a3fe9229bde788848cf6b25db6bded14a88fd994f43813fc6
Instruction Fuzzy Hash: 3E41D272901729BFEB119BE9DD49EEEBB7AFF04700B108125FA01E6290E7359D108B91

Function 006F9B31 Relevance: 30.0, APIs: 4, Strings: 13, Instructions: 232threadCOMMON

Download Yara Rule

APIs

WaitForMultipleObjects.KERNEL32(00000001,006FB99A,00000000,000000FF,00000001,00000000,00000000,006FB99A,00000001,?), ref: 006F9B96
GetLastError.KERNEL32 ref: 006F9D06
GetExitCodeThread.KERNEL32(?,00000001), ref: 006F9D46
GetLastError.KERNEL32 ref: 006F9D50

Strings

Failed to get cache thread exit code., xrefs: 006F9D81
Failed to execute MSU package., xrefs: 006F9C4B
Failed to execute MSI package., xrefs: 006F9BF6
Failed to execute EXE package., xrefs: 006F9BCD
Cache thread exited unexpectedly., xrefs: 006F9D97
c:\agent\_work\79\s\src\burn\engine\apply.cpp, xrefs: 006F9D2D, 006F9D77
Invalid execute action., xrefs: 006F9DA6
Failed to execute dependency action., xrefs: 006F9C86
Failed to execute MSP package., xrefs: 006F9C1B
Failed to execute package provider registration action., xrefs: 006F9C67
Failed to load compatible package on per-machine package., xrefs: 006F9CAC
Failed to wait for cache check-point., xrefs: 006F9D37
Failed to execute compatible package action., xrefs: 006F9CC3

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: ErrorLast$CodeExitMultipleObjectsThreadWait
String ID: Cache thread exited unexpectedly.$Failed to execute EXE package.$Failed to execute MSI package.$Failed to execute MSP package.$Failed to execute MSU package.$Failed to execute compatible package action.$Failed to execute dependency action.$Failed to execute package provider registration action.$Failed to get cache thread exit code.$Failed to load compatible package on per-machine package.$Failed to wait for cache check-point.$Invalid execute action.$c:\agent\_work\79\s\src\burn\engine\apply.cpp
API String ID: 3703294532-3958039320
Opcode ID: 8450e8af2b822138d4c7661037a36e0770dfae95a27a9959a2085e3498b0d19c
Instruction ID: dde2c48742fba6c4e739b8210e1243e9b6b12e44ca016e23864f5b31bef8b0c8
Opcode Fuzzy Hash: 8450e8af2b822138d4c7661037a36e0770dfae95a27a9959a2085e3498b0d19c
Instruction Fuzzy Hash: D5714BB1A41629EBDB11CF64D941FBE7BBAEF05710F20416AFA05E7340D275AE019BA0

Function 006DF1B7 Relevance: 29.9, APIs: 3, Strings: 14, Instructions: 182registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00713D9B: GetVersionExW.KERNEL32(?,?,?,00000000), ref: 00713DEA

RegCloseKey.ADVAPI32(00000000,?,00720F38,00020006,00000000,?,00000000,00000000,00000000,?,00000000,00000001,00000000,00000000), ref: 006DF3E7

Part of subcall function 0071178B: RegSetValueExW.ADVAPI32(?,00000005,00000000,00000004,?,00000004,00000001,?,006DF234,00720F38,Resume,00000005,?,00000000,00000000,00000000), ref: 007117A0

Strings

Resume, xrefs: 006DF229
"%ls" /%ls, xrefs: 006DF28C
c:\agent\_work\79\s\src\burn\engine\registration.cpp, xrefs: 006DF36B, 006DF3B9
BundleResumeCommandLine, xrefs: 006DF2EF, 006DF382
Failed to format resume command line for RunOnce., xrefs: 006DF2A0
Failed to write Resume value., xrefs: 006DF23A
Failed to write resume command line value., xrefs: 006DF304
Failed to write run key value., xrefs: 006DF2E2
Failed to delete run key value., xrefs: 006DF375
Installed, xrefs: 006DF24C
burn.runonce, xrefs: 006DF281
Failed to write Installed value., xrefs: 006DF25D
Failed to create run key., xrefs: 006DF2C4
Failed to delete resume command line value., xrefs: 006DF3C3

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: CloseValueVersion
String ID: "%ls" /%ls$BundleResumeCommandLine$Failed to create run key.$Failed to delete resume command line value.$Failed to delete run key value.$Failed to format resume command line for RunOnce.$Failed to write Installed value.$Failed to write Resume value.$Failed to write resume command line value.$Failed to write run key value.$Installed$Resume$burn.runonce$c:\agent\_work\79\s\src\burn\engine\registration.cpp
API String ID: 2348918689-4238253642
Opcode ID: c9db4f1e873002824b785770beba7409f8929f5830752a2c49b1e32e46e96588
Instruction ID: 2e421ac175b0ed1b161bfa44d10f9b85a9ed976df0dd13c5242bd20d3da5a037
Opcode Fuzzy Hash: c9db4f1e873002824b785770beba7409f8929f5830752a2c49b1e32e46e96588
Instruction Fuzzy Hash: A151D372D4133AFBCF119BA59C06AEEB666BB10710F07413BF902B6391D7789A509BD0

Function 006FC991 Relevance: 29.9, APIs: 7, Strings: 10, Instructions: 173processCOMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(75918FB0,00000000,00000000), ref: 006FC99D

Part of subcall function 006E4D17: UuidCreate.RPCRT4(?), ref: 006E4D4A

CreateProcessW.KERNEL32(?,?,00000000,00000000,00000001,08000000,00000000,00000000,?,006F21C2,?,?,00000000,?,?,?), ref: 006FCA7B
GetLastError.KERNEL32(?,?,00000000,?,?,?,?), ref: 006FCA85
GetProcessId.KERNEL32(006F21C2,?,?,00000000,?,?,?,?), ref: 006FCABD

Part of subcall function 006E545A: lstrlenW.KERNEL32(?,?,00000000,?,?,00000000,75A8B390,?,006D457C,?,0071B500), ref: 006E547B
Part of subcall function 006E545A: GetCurrentProcessId.KERNEL32(?,006D457C,?,0071B500), ref: 006E5486
Part of subcall function 006E545A: SetNamedPipeHandleState.KERNEL32(?,000000FF,00000000,00000000,?,006D457C,?,0071B500), ref: 006E54BD
Part of subcall function 006E545A: ConnectNamedPipe.KERNEL32(?,00000000,?,006D457C,?,0071B500), ref: 006E54D2
Part of subcall function 006E545A: GetLastError.KERNEL32(?,006D457C,?,0071B500), ref: 006E54DC
Part of subcall function 006E545A: Sleep.KERNEL32(00000064,?,006D457C,?,0071B500), ref: 006E5511
Part of subcall function 006E545A: SetNamedPipeHandleState.KERNEL32(?,00000000,00000000,00000000,?,006D457C,?,0071B500), ref: 006E5534
Part of subcall function 006E545A: WriteFile.KERNEL32(?,crypt32.dll,00000004,00000000,00000000,?,006D457C,?,0071B500), ref: 006E554F
Part of subcall function 006E545A: WriteFile.KERNEL32(?,|Em,0071B500,00000000,00000000,?,006D457C,?,0071B500), ref: 006E556A
Part of subcall function 006E545A: WriteFile.KERNEL32(?,0071B4B8,00000004,feclient.dll,00000000,?,006D457C,?,0071B500), ref: 006E5585

Part of subcall function 00710D3E: WaitForSingleObject.KERNEL32(000000FF,?,00000000,?,006D4F5D,?,000000FF,?,?,?,?,?,00000000,?,?,?), ref: 00710D4A
Part of subcall function 00710D3E: GetLastError.KERNEL32(?,006D4F5D,?,000000FF,?,?,?,?,?,00000000,?,?,?,?,?,?), ref: 00710D58

CloseHandle.KERNEL32(00000000,?,000000FF,00000000,?,006FC8F1,?,?,?,?,?,00000000,?,?,?,?), ref: 006FCB41
CloseHandle.KERNEL32(00000000,?,000000FF,00000000,?,006FC8F1,?,?,?,?,?,00000000,?,?,?,?), ref: 006FCB50
CloseHandle.KERNEL32(00000000,?,?,000000FF,00000000,?,006FC8F1,?,?,?,?,?,00000000,?,?,?), ref: 006FCB67

Strings

Failed to create embedded pipe name and client token., xrefs: 006FCA00
Failed to allocate embedded command., xrefs: 006FCA54
Failed to create embedded pipe., xrefs: 006FCA27
%ls -%ls %ls %ls %u, xrefs: 006FCA40
Failed to wait for embedded executable: %ls, xrefs: 006FCB24
Failed to create embedded process at path: %ls, xrefs: 006FCAB3
burn.embedded, xrefs: 006FCA38
Failed to wait for embedded process to connect to pipe., xrefs: 006FCADF
Failed to process messages from embedded message., xrefs: 006FCB04
c:\agent\_work\79\s\src\burn\engine\embedded.cpp, xrefs: 006FCAA6

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: Handle$Process$CloseErrorFileLastNamedPipeWrite$CreateCurrentState$ConnectObjectSingleSleepUuidWaitlstrlen
String ID: %ls -%ls %ls %ls %u$Failed to allocate embedded command.$Failed to create embedded pipe name and client token.$Failed to create embedded pipe.$Failed to create embedded process at path: %ls$Failed to process messages from embedded message.$Failed to wait for embedded executable: %ls$Failed to wait for embedded process to connect to pipe.$burn.embedded$c:\agent\_work\79\s\src\burn\engine\embedded.cpp
API String ID: 875070380-43293018
Opcode ID: f6c1bacf40fe363b242eaa87e6d2f62c6c43735b1198c17c551ee42e319a46cd
Instruction ID: d746d1337742f411732f3a8249300067c68d4b8cd09c6cfa754a6a9c86a66846
Opcode Fuzzy Hash: f6c1bacf40fe363b242eaa87e6d2f62c6c43735b1198c17c551ee42e319a46cd
Instruction Fuzzy Hash: E2519172D4122DBBDF11DBA4CE06FEE7BBAAF04720F114115FA00B6291D774AA449BD4

Function 006DEC73 Relevance: 29.9, APIs: 2, Strings: 15, Instructions: 172COMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32(?), ref: 006DEE01

Part of subcall function 006D39DF: GetProcessHeap.KERNEL32(?,000001C7,?,006D237C,?,00000001,80004005,8007139F,?,?,0071058B,8007139F,?,00000000,00000000,8007139F), ref: 006D39F0
Part of subcall function 006D39DF: RtlAllocateHeap.NTDLL(00000000,?,006D237C,?,00000001,80004005,8007139F,?,?,0071058B,8007139F,?,00000000,00000000,8007139F), ref: 006D39F7

SysFreeString.OLEAUT32(?), ref: 006DEDB9

Strings

Failed to convert SoftwareTag text to UTF-8, xrefs: 006DEE34
Failed to get @Regid., xrefs: 006DEE52
Failed to allocate memory for software tag structs., xrefs: 006DED00
Failed to get next node., xrefs: 006DEE66
Filename, xrefs: 006DED34
Failed to get SoftwareTag text., xrefs: 006DEE3E
c:\agent\_work\79\s\src\burn\engine\registration.cpp, xrefs: 006DECF6
Failed to select software tag nodes., xrefs: 006DECA3
`)u, xrefs: 006DEDB9, 006DEE01
Failed to get @Filename., xrefs: 006DEE5C
SoftwareTag, xrefs: 006DEC82
Regid, xrefs: 006DED4F
Failed to get software tag count., xrefs: 006DECC8
Failed to get @Path., xrefs: 006DEE48
Path, xrefs: 006DED67

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: FreeHeapString$AllocateProcess
String ID: Failed to allocate memory for software tag structs.$Failed to convert SoftwareTag text to UTF-8$Failed to get @Filename.$Failed to get @Path.$Failed to get @Regid.$Failed to get SoftwareTag text.$Failed to get next node.$Failed to get software tag count.$Failed to select software tag nodes.$Filename$Path$Regid$SoftwareTag$`)u$c:\agent\_work\79\s\src\burn\engine\registration.cpp
API String ID: 336948655-3309293895
Opcode ID: 04a9cf0442e5dce60153847fefb9906ce9af125e599992a38dfc12fe39c617a3
Instruction ID: d0e8971e914b325e150530a1f093ad5c389acb3a48bd60385fc015fddffd1f37
Opcode Fuzzy Hash: 04a9cf0442e5dce60153847fefb9906ce9af125e599992a38dfc12fe39c617a3
Instruction Fuzzy Hash: AB51B475E41225EBDB21EF58C885EAEB776BF04B10B50416AF811AF390C775DE409760

Function 00718197 Relevance: 29.9, APIs: 8, Strings: 9, Instructions: 153stringCOMMON

Download Yara Rule

APIs

CompareStringW.KERNEL32(0000007F,00000000,msi.dll,000000FF,http://appsyndication.org/2006/appsyn,000000FF,00000000,00000000,000002C0,?,00718681,00000001,?), ref: 007181B7
CompareStringW.KERNEL32(0000007F,00000000,digest,000000FF,002E0069,000000FF,?,00718681,00000001,?), ref: 007181D2
CompareStringW.KERNEL32(0000007F,00000000,name,000000FF,002E0069,000000FF,?,00718681,00000001,?), ref: 007181ED
CompareStringW.KERNEL32(0000007F,00000000,algorithm,000000FF,?,000000FF,?,00718681,00000001,?), ref: 00718259
CompareStringW.KERNEL32(0000007F,00000001,md5,000000FF,?,000000FF,?,00718681,00000001,?), ref: 0071827D
CompareStringW.KERNEL32(0000007F,00000001,sha1,000000FF,?,000000FF,?,00718681,00000001,?), ref: 007182A1
CompareStringW.KERNEL32(0000007F,00000001,sha256,000000FF,?,000000FF,?,00718681,00000001,?), ref: 007182C1
lstrlenW.KERNEL32(006C0064,?,00718681,00000001,?), ref: 007182DC

Strings

c:\agent\_work\79\s\src\libs\dutil\apuputil.cpp, xrefs: 007182F4
algorithm, xrefs: 00718250
sha256, xrefs: 007182B8
md5, xrefs: 00718274
sha1, xrefs: 00718298
http://appsyndication.org/2006/appsyn, xrefs: 007181AA
name, xrefs: 007181E4
digest, xrefs: 007181C9
msi.dll, xrefs: 007181B1

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: CompareString$lstrlen
String ID: algorithm$c:\agent\_work\79\s\src\libs\dutil\apuputil.cpp$digest$http://appsyndication.org/2006/appsyn$md5$msi.dll$name$sha1$sha256
API String ID: 1657112622-1078064088
Opcode ID: c2e909b7b2084562621bac50b5269353353280636600f59478993c62bf275c7f
Instruction ID: a5710baad7da384111067e398344145954f511448e6b5edc0d919f376a77cfdb
Opcode Fuzzy Hash: c2e909b7b2084562621bac50b5269353353280636600f59478993c62bf275c7f
Instruction Fuzzy Hash: 5951B971688A12BBEB614E4CCC56F957B61BB11730F308305F934AE2E5CB78E890D795

Function 006D9FFE Relevance: 28.2, APIs: 1, Strings: 15, Instructions: 214COMMON

Download Yara Rule

APIs

_MREFOpen@16.MSPDB140-MSVCRT ref: 006DA076

Strings

State, xrefs: 006DA058
Failed to get product info., xrefs: 006DA1A3
Language, xrefs: 006DA05F
Failed to change value type., xrefs: 006DA1DD
AssignmentType, xrefs: 006DA051
Failed to set variable., xrefs: 006DA1FC
Product or related product not found: %ls, xrefs: 006DA161
Failed to format GUID string., xrefs: 006DA081
Failed to enumerate related products for upgrade code., xrefs: 006DA0B1
Trying per-user extended info for property '%ls' for product: %ls, xrefs: 006DA135
Failed to copy upgrade code., xrefs: 006DA0D6
MsiProductSearch failed: ID '%ls', HRESULT 0x%x, xrefs: 006DA20F
VersionString, xrefs: 006DA066, 006DA0F1, 006DA107, 006DA11B, 006DA134, 006DA148
Unsupported product search type: %u, xrefs: 006DA03E
Trying per-machine extended info for property '%ls' for product: %ls, xrefs: 006DA108

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: Open@16
String ID: AssignmentType$Failed to change value type.$Failed to copy upgrade code.$Failed to enumerate related products for upgrade code.$Failed to format GUID string.$Failed to get product info.$Failed to set variable.$Language$MsiProductSearch failed: ID '%ls', HRESULT 0x%x$Product or related product not found: %ls$State$Trying per-machine extended info for property '%ls' for product: %ls$Trying per-user extended info for property '%ls' for product: %ls$Unsupported product search type: %u$VersionString
API String ID: 3613110473-2134270738
Opcode ID: 6ede35765dcba54361a4207b977c2a0dc40e5659918481c4e312db78bc775c82
Instruction ID: ce7a69ee54ae3cbbefd3f4587c562d31b6be7363441295b888a534c8d1b1c3a4
Opcode Fuzzy Hash: 6ede35765dcba54361a4207b977c2a0dc40e5659918481c4e312db78bc775c82
Instruction Fuzzy Hash: 4A610372E44118FBCB119EE8CD4ADEEBB7AAB04704F144066F904BB391D236DF819792

Function 006E4AAD Relevance: 28.2, APIs: 7, Strings: 9, Instructions: 157sleepfileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,C0000000,00000000,00000000,00000003,00000000,00000000,00000000,?,?), ref: 006E4B07
GetLastError.KERNEL32 ref: 006E4B15
Sleep.KERNEL32(00000064), ref: 006E4B39

Strings

Failed to open companion process with PID: %u, xrefs: 006E4C61
Failed to allocate name of parent pipe., xrefs: 006E4AD3
\\.\pipe\%ls, xrefs: 006E4ABF
c:\agent\_work\79\s\src\burn\engine\pipe.cpp, xrefs: 006E4B52, 006E4C55
\\.\pipe\%ls.Cache, xrefs: 006E4B9A
feclient.dll, xrefs: 006E4B6C, 006E4C07, 006E4C1B, 006E4C5F
Failed to open parent pipe: %ls, xrefs: 006E4B5F
Failed to allocate name of parent cache pipe., xrefs: 006E4BAE
Failed to verify parent pipe: %ls, xrefs: 006E4B81

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: CreateErrorFileLastSleep
String ID: Failed to allocate name of parent cache pipe.$Failed to allocate name of parent pipe.$Failed to open companion process with PID: %u$Failed to open parent pipe: %ls$Failed to verify parent pipe: %ls$\\.\pipe\%ls$\\.\pipe\%ls.Cache$c:\agent\_work\79\s\src\burn\engine\pipe.cpp$feclient.dll
API String ID: 408151869-21451366
Opcode ID: a4e7acb3b86baa3f36a02d4b73f3c975fa649611fc1d96f3ff0dc8a2f1d9f390
Instruction ID: 28cf896388a11a7162665bda576f0e34964b5467ef910af751a68a849c9bc12b
Opcode Fuzzy Hash: a4e7acb3b86baa3f36a02d4b73f3c975fa649611fc1d96f3ff0dc8a2f1d9f390
Instruction Fuzzy Hash: AD412C76D43372FBD72157B59D46F9A7666AF04B20F214211FD00BB2C0DB68ED4096D8

Function 006DF528 Relevance: 28.2, APIs: 1, Strings: 15, Instructions: 151registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32(00000000,00000000,006E0475,InstallerVersion,InstallerVersion,00000000,006E0475,InstallerName,InstallerName,00000000,006E0475,Date,InstalledDate,00000000,006E0475,LogonUser), ref: 006DF6D6

Part of subcall function 007117D9: RegSetValueExW.ADVAPI32(00020006,00720F38,00000000,00000001,?,00000000,?,000000FF,00000000,00000000,?,?,006DF2DC,00000000,?,00020006), ref: 0071180C

Strings

InstalledBy, xrefs: 006DF647, 006DF660
Publisher, xrefs: 006DF5E2, 006DF5F5
Failed to write %ls value., xrefs: 006DF6BF
Failed to get the formatted key path for update registration., xrefs: 006DF54A
ReleaseType, xrefs: 006DF62D, 006DF632, 006DF641
PublishingGroup, xrefs: 006DF60A, 006DF61D
LogonUser, xrefs: 006DF64C
Failed to create the key for update registration., xrefs: 006DF576
InstallerName, xrefs: 006DF687, 006DF68C, 006DF68D, 006DF69D
InstallerVersion, xrefs: 006DF6A4, 006DF6A9, 006DF6AA, 006DF6BA
PackageName, xrefs: 006DF5A2, 006DF5B5
PackageVersion, xrefs: 006DF5C2, 006DF5D5
ThisVersionInstalled, xrefs: 006DF582, 006DF595
InstalledDate, xrefs: 006DF667, 006DF680
Date, xrefs: 006DF66C

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: CloseValue
String ID: Date$Failed to create the key for update registration.$Failed to get the formatted key path for update registration.$Failed to write %ls value.$InstalledBy$InstalledDate$InstallerName$InstallerVersion$LogonUser$PackageName$PackageVersion$Publisher$PublishingGroup$ReleaseType$ThisVersionInstalled
API String ID: 3132538880-2703781546
Opcode ID: f927d69b7c22c7810d9077f2a17539d36b1ae155cb1f5b78f9e078aab4c0722c
Instruction ID: 643f0e01c667e483f7c09ea432d09266fb551feef5315e94395f4769b7a2672a
Opcode Fuzzy Hash: f927d69b7c22c7810d9077f2a17539d36b1ae155cb1f5b78f9e078aab4c0722c
Instruction Fuzzy Hash: DD41C972E406B5F7CB1367A4EC02EAE7967AB10B10F110172F801B67B2D779DE51A6C4

Function 006EE631 Relevance: 28.1, APIs: 11, Strings: 5, Instructions: 134registryCOMMON

Download Yara Rule

APIs

TlsSetValue.KERNEL32(?,?), ref: 006EE677
RegisterClassW.USER32(?), ref: 006EE6A3
GetLastError.KERNEL32 ref: 006EE6AE
CreateWindowExW.USER32(00000080,0072A1B4,00000000,90000000,80000000,00000008,00000000,00000000,00000000,00000000,?,?), ref: 006EE715
GetLastError.KERNEL32 ref: 006EE71F
UnregisterClassW.USER32(WixBurnMessageWindow,?), ref: 006EE7BD

Strings

WixBurnMessageWindow, xrefs: 006EE69C, 006EE7B8
Failed to create window., xrefs: 006EE74D
Failed to register window., xrefs: 006EE6DC
Unexpected return value from message pump., xrefs: 006EE7A8
c:\agent\_work\79\s\src\burn\engine\uithread.cpp, xrefs: 006EE6D2, 006EE743

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: ClassErrorLast$CreateRegisterUnregisterValueWindow
String ID: Failed to create window.$Failed to register window.$Unexpected return value from message pump.$WixBurnMessageWindow$c:\agent\_work\79\s\src\burn\engine\uithread.cpp
API String ID: 213125376-717246376
Opcode ID: dcbf2cb7313a035163352de8e26827ecbdc30e4da4ddfd986c87fa07e7a3a6ef
Instruction ID: 11545a58194166768851424a3f889c63e7d75bb7017e2eec994cfc82413f6749
Opcode Fuzzy Hash: dcbf2cb7313a035163352de8e26827ecbdc30e4da4ddfd986c87fa07e7a3a6ef
Instruction Fuzzy Hash: 46411776A01325BBCF208FA5DC48ACEBFB9FF08750F118125F915BA290E7359910CBA5

Function 006FC480 Relevance: 26.5, APIs: 1, Strings: 14, Instructions: 271COMMON

Download Yara Rule

Strings

Failed to allocate space for burn payload inside of related bundle struct, xrefs: 006FC6F3
Failed to copy filename for passthrough pseudo bundle., xrefs: 006FC6CA
Failed to recreate command-line arguments., xrefs: 006FC74F
c:\agent\_work\79\s\src\burn\engine\pseudobundle.cpp, xrefs: 006FC4B4, 006FC6AD, 006FC6E7
Failed to copy install arguments for passthrough bundle package, xrefs: 006FC76E
Failed to copy key for passthrough pseudo bundle payload., xrefs: 006FC6D1
Failed to copy cache id for passthrough pseudo bundle., xrefs: 006FC711
Failed to copy local source path for passthrough pseudo bundle., xrefs: 006FC6C3
Failed to copy related arguments for passthrough bundle package, xrefs: 006FC78E
Failed to copy uninstall arguments for passthrough bundle package, xrefs: 006FC7B8
Failed to allocate memory for pseudo bundle payload hash., xrefs: 006FC6B9
Failed to allocate space for burn package payload inside of passthrough bundle., xrefs: 006FC4C0
Failed to copy key for passthrough pseudo bundle., xrefs: 006FC694
Failed to copy download source for passthrough pseudo bundle., xrefs: 006FC69B

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: Heap$AllocateProcess
String ID: Failed to allocate memory for pseudo bundle payload hash.$Failed to allocate space for burn package payload inside of passthrough bundle.$Failed to allocate space for burn payload inside of related bundle struct$Failed to copy cache id for passthrough pseudo bundle.$Failed to copy download source for passthrough pseudo bundle.$Failed to copy filename for passthrough pseudo bundle.$Failed to copy install arguments for passthrough bundle package$Failed to copy key for passthrough pseudo bundle payload.$Failed to copy key for passthrough pseudo bundle.$Failed to copy local source path for passthrough pseudo bundle.$Failed to copy related arguments for passthrough bundle package$Failed to copy uninstall arguments for passthrough bundle package$Failed to recreate command-line arguments.$c:\agent\_work\79\s\src\burn\engine\pseudobundle.cpp
API String ID: 1357844191-3708701997
Opcode ID: 0880a51c34fdf78abe1c8879ad6124da6e14b27116b959dd301655f7e2b4f092
Instruction ID: 61cbcf2fe03618b4e350c4a3845d51b84c2dedfd2100a4d71bd0c2ebe0175920
Opcode Fuzzy Hash: 0880a51c34fdf78abe1c8879ad6124da6e14b27116b959dd301655f7e2b4f092
Instruction Fuzzy Hash: 46B18C71A4061AEFDB61DF28C991F65BBA2BF08320F10416AFE14AB351D775E921DB80

Function 006FDB18 Relevance: 26.5, APIs: 2, Strings: 13, Instructions: 203stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,?,?,?,?,?,00000000,?,?,?,00000000,00000000,?), ref: 006FDB33

Strings

Failed to set callback interface for BITS job., xrefs: 006FDC6B
Failed to download BITS job., xrefs: 006FDCCA
Failed to initialize BITS job callback., xrefs: 006FDC54
Falied to start BITS job., xrefs: 006FDCEB
Failed to set credentials for BITS job., xrefs: 006FDBE1
Failed to create BITS job., xrefs: 006FDBC2
Failed while waiting for BITS download., xrefs: 006FDCE4
c:\agent\_work\79\s\src\burn\engine\bitsengine.cpp, xrefs: 006FDB49, 006FDC3C
Failed to complete BITS job., xrefs: 006FDCDD
Failed to create BITS job callback., xrefs: 006FDC46
Failed to add file to BITS job., xrefs: 006FDC00
Invalid BITS engine URL: %ls, xrefs: 006FDB55
Failed to copy download URL., xrefs: 006FDB7A

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: lstrlen
String ID: Failed to add file to BITS job.$Failed to complete BITS job.$Failed to copy download URL.$Failed to create BITS job callback.$Failed to create BITS job.$Failed to download BITS job.$Failed to initialize BITS job callback.$Failed to set callback interface for BITS job.$Failed to set credentials for BITS job.$Failed while waiting for BITS download.$Falied to start BITS job.$Invalid BITS engine URL: %ls$c:\agent\_work\79\s\src\burn\engine\bitsengine.cpp
API String ID: 1659193697-3636711892
Opcode ID: 458611f31ef9af7ed761470f09a15e0f6538938d9ff6587c1596206bbbf81df6
Instruction ID: cb57a9338124388400461ddeb159bf857ba030f055fd4d7a8a5b9359edbc984c
Opcode Fuzzy Hash: 458611f31ef9af7ed761470f09a15e0f6538938d9ff6587c1596206bbbf81df6
Instruction Fuzzy Hash: 8951C571A4022DEBDB119B54C985EBE7BBBAF04B10B124155FE04AB351D7B4FD40EB90

Function 006DBC5E Relevance: 26.4, APIs: 6, Strings: 9, Instructions: 189processCOMMON

Download Yara Rule

APIs

_MREFOpen@16.MSPDB140-MSVCRT ref: 006DBCB0
CreateProcessW.KERNEL32(?,?,00000000,00000000,00000000,00000200,00000000,?,00000044,?,?,?,?,?), ref: 006DBDBD
GetLastError.KERNEL32(?,?,?,?), ref: 006DBDC7
WaitForInputIdle.USER32(?,?), ref: 006DBE1B
CloseHandle.KERNEL32(?,?,?), ref: 006DBE66
CloseHandle.KERNEL32(?,?,?), ref: 006DBE73

Strings

Failed to format obfuscated argument string., xrefs: 006DBD07
Failed to CreateProcess on path: %ls, xrefs: 006DBDF8
D, xrefs: 006DBD9C
"%ls", xrefs: 006DBD2D, 006DBD47
Failed to create obfuscated executable command., xrefs: 006DBD5B
c:\agent\_work\79\s\src\burn\engine\approvedexe.cpp, xrefs: 006DBDEB
"%ls" %s, xrefs: 006DBCD6, 006DBD17
Failed to create executable command., xrefs: 006DBCEA
Failed to format argument string., xrefs: 006DBCBB

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: CloseHandle$CreateErrorIdleInputLastOpen@16ProcessWait
String ID: "%ls"$"%ls" %s$D$Failed to CreateProcess on path: %ls$Failed to create executable command.$Failed to create obfuscated executable command.$Failed to format argument string.$Failed to format obfuscated argument string.$c:\agent\_work\79\s\src\burn\engine\approvedexe.cpp
API String ID: 155678114-3929666505
Opcode ID: 38a8bc362aa4be1d46cec5888aa5a16d065d0f52d0be5aa80fb5c542f867f2f1
Instruction ID: f0a33e1737e576871793b21eb06f84540b9ad43350aa1d52668df077190736d4
Opcode Fuzzy Hash: 38a8bc362aa4be1d46cec5888aa5a16d065d0f52d0be5aa80fb5c542f867f2f1
Instruction Fuzzy Hash: C8517C72D0021AFBDF229FD4CC429EEBB7AFF14300B01416AEA04B6360D7359E609B95

Function 006F675F Relevance: 26.4, APIs: 8, Strings: 7, Instructions: 152serviceCOMMON

Download Yara Rule

APIs

OpenSCManagerW.ADVAPI32(00000000,00000000,000F003F,?,?,00000000,?,?,?,?,?,?,?,?,006F6CAE,?), ref: 006F6798
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,006F6CAE,?,?,?), ref: 006F67A5
OpenServiceW.ADVAPI32(00000000,wuauserv,00000027,?,?,?,?,?,?,?,?,006F6CAE,?,?,?), ref: 006F67ED
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,006F6CAE,?,?,?), ref: 006F67F9
QueryServiceStatus.ADVAPI32(00000000,?,?,?,?,?,?,?,?,?,006F6CAE,?,?,?), ref: 006F6833
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,006F6CAE,?,?,?), ref: 006F683D
CloseServiceHandle.ADVAPI32(00000000), ref: 006F68F4
CloseServiceHandle.ADVAPI32(?), ref: 006F68FE

Strings

Failed to query status of WU service., xrefs: 006F686B
c:\agent\_work\79\s\src\burn\engine\msuengine.cpp, xrefs: 006F67C9, 006F681D, 006F6861
Failed to read configuration for WU service., xrefs: 006F68A4
wuauserv, xrefs: 006F67E7
Failed to open WU service., xrefs: 006F6827
Failed to open service control manager., xrefs: 006F67D3
Failed to mark WU service to start on demand., xrefs: 006F68C5

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: Service$ErrorLast$CloseHandleOpen$ManagerQueryStatus
String ID: Failed to mark WU service to start on demand.$Failed to open WU service.$Failed to open service control manager.$Failed to query status of WU service.$Failed to read configuration for WU service.$c:\agent\_work\79\s\src\burn\engine\msuengine.cpp$wuauserv
API String ID: 971853308-2572658123
Opcode ID: 92bc90c7fca61aa8dad0e812859de326813c9d84869ba166be9d317306336236
Instruction ID: 4cb53d9e0e946117081441b1a9f62670938e07044bc5e43e7a56262d17f968f1
Opcode Fuzzy Hash: 92bc90c7fca61aa8dad0e812859de326813c9d84869ba166be9d317306336236
Instruction Fuzzy Hash: 41419776E003399BD7219B68CC45AFEB6A6AF04750B118529FE11BB341D778DC0086A4

Function 006DB1D7 Relevance: 24.6, APIs: 3, Strings: 11, Instructions: 137COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,00000000,00000000,?,006DBACA,00000008,?,00000000,00000000,?,?,?,00000000,76EDC3F0,00000000), ref: 006DB1DF
GetLastError.KERNEL32(?,006DBACA,00000008,?,00000000,00000000,?,?,?,00000000,76EDC3F0,00000000), ref: 006DB1EB
_memcmp.LIBVCRUNTIME ref: 006DB293

Strings

burn, xrefs: 006DB2BA
Failed to find valid NT image header in buffer., xrefs: 006DB277
.wix, xrefs: 006DB2B2
c:\agent\_work\79\s\src\burn\engine\section.cpp, xrefs: 006DB20F, 006DB240, 006DB26B, 006DB2D4, 006DB2F5, 006DB31E, 006DB35E
Failed to read section info, unsupported version: %08x, xrefs: 006DB32D
Failed to find valid DOS image header in buffer., xrefs: 006DB24C
Bundle guid didn't match the guid in the PE Header in memory., xrefs: 006DB36A
.wixburn, xrefs: 006DB28D
Failed to get module handle to process., xrefs: 006DB219
Failed to read section info, data to short: %u, xrefs: 006DB2E3
Failed to find Burn section., xrefs: 006DB301

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: ErrorHandleLastModule_memcmp
String ID: .wix$.wixburn$Bundle guid didn't match the guid in the PE Header in memory.$Failed to find Burn section.$Failed to find valid DOS image header in buffer.$Failed to find valid NT image header in buffer.$Failed to get module handle to process.$Failed to read section info, data to short: %u$Failed to read section info, unsupported version: %08x$burn$c:\agent\_work\79\s\src\burn\engine\section.cpp
API String ID: 3888311042-1220921555
Opcode ID: 69db54d1b9056fa69fb5c3a1d75c3a6b4a11e5ba100f08102b8052f175b4c7ee
Instruction ID: e067788da76934c66ee544bc4a403d29d5a92b8ceca7081e89a3fcdd692e4d00
Opcode Fuzzy Hash: 69db54d1b9056fa69fb5c3a1d75c3a6b4a11e5ba100f08102b8052f175b4c7ee
Instruction Fuzzy Hash: F8417B72A80220E7D72055498C42EFE2157AF41B21B27402BFD026F3C5D7ADCA8397AA

Function 00716F7D Relevance: 22.9, APIs: 6, Strings: 7, Instructions: 164COMMON

Download Yara Rule

APIs

CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,label,000000FF,?,?,?,7591DFD0,?,007174EF,?,?), ref: 00716FD3
SysFreeString.OLEAUT32(00000000), ref: 0071703E
SysFreeString.OLEAUT32(00000000), ref: 007170B6
SysFreeString.OLEAUT32(00000000), ref: 007170F5

Strings

tq, xrefs: 00716FBB, 00716FE1, 0071709E
`)u, xrefs: 0071703E, 007170B6, 007170F5
tq, xrefs: 00717108, 00717077, 0071708D, 0071707A, 00717111
feclient.dll, xrefs: 00717025, 007170C9, 007170D8
scheme, xrefs: 00716FE6
label, xrefs: 00716FC5
term, xrefs: 00717006

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: String$Free$Compare
String ID: `)u$feclient.dll$label$scheme$term$tq$tq
API String ID: 1324494773-1945504176
Opcode ID: 08781087ef608115537287047c695f12294b763b2e12078fbb4197b563917add
Instruction ID: 71a7afac26e280eea09d8c676d998e7a98f1de366ba7d8152c8512baca874ce3
Opcode Fuzzy Hash: 08781087ef608115537287047c695f12294b763b2e12078fbb4197b563917add
Instruction Fuzzy Hash: 9A516175905219FBCB29DB98CC45FEEBB78AF08721F214294E511B71E0DB399E80DB50

Function 006DA249 Relevance: 22.9, APIs: 4, Strings: 9, Instructions: 140registryCOMMON

Download Yara Rule

APIs

_MREFOpen@16.MSPDB140-MSVCRT ref: 006DA271
RegCloseKey.ADVAPI32(00000000,00000100,00000000,000002C0,?,00000001,00000000,00000000,?,00000000,?,000002C0,000002C0,?,00000000,00000000), ref: 006DA3C5

Strings

Registry key not found. Key = '%ls', xrefs: 006DA2B2
c:\agent\_work\79\s\src\burn\engine\search.cpp, xrefs: 006DA349
Failed to format value string., xrefs: 006DA2FD
Failed to query registry key value., xrefs: 006DA353
Registry value not found. Key = '%ls', Value = '%ls', xrefs: 006DA360
Failed to open registry key. Key = '%ls', xrefs: 006DA2C6
RegistrySearchExists failed: ID '%ls', HRESULT 0x%x, xrefs: 006DA39D
Failed to format key string., xrefs: 006DA27C
Failed to set variable., xrefs: 006DA388

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: CloseOpen@16
String ID: Failed to format key string.$Failed to format value string.$Failed to open registry key. Key = '%ls'$Failed to query registry key value.$Failed to set variable.$Registry key not found. Key = '%ls'$Registry value not found. Key = '%ls', Value = '%ls'$RegistrySearchExists failed: ID '%ls', HRESULT 0x%x$c:\agent\_work\79\s\src\burn\engine\search.cpp
API String ID: 1561904661-2790297598
Opcode ID: 9f31bfa0952692201a9ca8c976bf1d8c1e30a8277db135283a7500e6af221354
Instruction ID: 79bee17642d8f122f1fa9d423c68f11c21a547b0d1002ab0b4470b1a9b842f3a
Opcode Fuzzy Hash: 9f31bfa0952692201a9ca8c976bf1d8c1e30a8277db135283a7500e6af221354
Instruction Fuzzy Hash: 4C41B172D04124FBDB125EE8CC06EEE7A67AF04710F164166FC04E6391E6758E509B92

Function 006D695F Relevance: 22.9, APIs: 6, Strings: 7, Instructions: 132libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,ntdll,?), ref: 006D69AF
GetLastError.KERNEL32 ref: 006D69B9
GetProcAddress.KERNEL32(?,RtlGetVersion), ref: 006D69FC
GetLastError.KERNEL32 ref: 006D6A06
FreeLibrary.KERNEL32(00000000,00000000,?), ref: 006D6B17

Strings

Failed to get OS info., xrefs: 006D6A57
RtlGetVersion, xrefs: 006D69F1
ntdll, xrefs: 006D69A9
c:\agent\_work\79\s\src\burn\engine\variable.cpp, xrefs: 006D69DD, 006D6A2A
Failed to set variant value., xrefs: 006D6AFB
Failed to locate RtlGetVersion., xrefs: 006D6A34
Failed to locate NTDLL., xrefs: 006D69E7

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: ErrorLast$AddressFreeHandleLibraryModuleProc
String ID: Failed to get OS info.$Failed to locate NTDLL.$Failed to locate RtlGetVersion.$Failed to set variant value.$RtlGetVersion$c:\agent\_work\79\s\src\burn\engine\variable.cpp$ntdll
API String ID: 3057421322-29314153
Opcode ID: f6ff7767c5c8a23549f26e85fd7916e9b57ea2240b0dfeef32aaf8eec932d04f
Instruction ID: 4d1410df9b79bb240618b211406e0bb7bd2627397636e204b6bc709e7a63fe5a
Opcode Fuzzy Hash: f6ff7767c5c8a23549f26e85fd7916e9b57ea2240b0dfeef32aaf8eec932d04f
Instruction Fuzzy Hash: BD41D972D4023967D7319B69CC05BEE7AB5AB09710F01419AF948F6381D778DE84CF94

Function 006E3AD4 Relevance: 22.9, APIs: 5, Strings: 8, Instructions: 129COMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(00000104,?,?,00000000,crypt32.dll), ref: 006E3B28
GetLastError.KERNEL32(?,00000000,crypt32.dll), ref: 006E3B32
GetCurrentProcessId.KERNEL32(?,?,?,00000104,?,?,00000000,crypt32.dll), ref: 006E3B9B
ProcessIdToSessionId.KERNEL32(00000000,?,00000000,crypt32.dll), ref: 006E3BA2
CompareStringW.KERNEL32(00000000,00000000,?,?,?,?,?,7FFFFFFF,?,?,?,?,?,00000000,crypt32.dll), ref: 006E3C2C

Strings

c:\agent\_work\79\s\src\burn\engine\logging.cpp, xrefs: 006E3B56
Failed to get length of session id string., xrefs: 006E3BF7
Failed to get temp folder., xrefs: 006E3B60
%u\, xrefs: 006E3BBC
Failed to get length of temp folder., xrefs: 006E3B8C
Failed to format session id as a string., xrefs: 006E3BD0
Failed to copy temp folder., xrefs: 006E3C55
crypt32.dll, xrefs: 006E3AE7

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: Process$CompareCurrentErrorLastPathSessionStringTemp
String ID: %u\$Failed to copy temp folder.$Failed to format session id as a string.$Failed to get length of session id string.$Failed to get length of temp folder.$Failed to get temp folder.$c:\agent\_work\79\s\src\burn\engine\logging.cpp$crypt32.dll
API String ID: 2407829081-2226602420
Opcode ID: 21d96ceb849d86a0ca2ceb0b051dc54c7e9913049b18dd30cd5e8a2fb0dd3f11
Instruction ID: 0b59b11b50ba1a7ac0fb1652c8f3963cf23ad511bd3c7a3b4178987fbf410d61
Opcode Fuzzy Hash: 21d96ceb849d86a0ca2ceb0b051dc54c7e9913049b18dd30cd5e8a2fb0dd3f11
Instruction Fuzzy Hash: CC41E372D8233DABCB219B559C4DEDA77BAAF20B10F110195F809B7380D6749F808F94

Function 006D7FA2 Relevance: 21.2, APIs: 2, Strings: 12, Instructions: 215COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(00000000,00000000,00000000,?,00000000,00000000,?,00000000,00000000,00000000,00000000,00000002,00000000,00000000,00000000), ref: 006D7FBF
LeaveCriticalSection.KERNEL32(?), ref: 006D81E7

Strings

Failed to get numeric., xrefs: 006D81B9
Failed to get string., xrefs: 006D81B2
Failed to write variable name., xrefs: 006D81CE
Failed to write included flag., xrefs: 006D81D5
Failed to write literal flag., xrefs: 006D81C0
feclient.dll, xrefs: 006D809A, 006D80F0, 006D8131
Failed to write variable value as number., xrefs: 006D8191
Failed to get version., xrefs: 006D8198
Failed to write variable count., xrefs: 006D7FDA
Failed to write variable value type., xrefs: 006D81C7
Failed to write variable value as string., xrefs: 006D81AB
Unsupported variable type., xrefs: 006D81A4

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: Failed to get numeric.$Failed to get string.$Failed to get version.$Failed to write included flag.$Failed to write literal flag.$Failed to write variable count.$Failed to write variable name.$Failed to write variable value as number.$Failed to write variable value as string.$Failed to write variable value type.$Unsupported variable type.$feclient.dll
API String ID: 3168844106-2118673349
Opcode ID: 84ea9e236cc3cd4280e8221870b329529224e3b1cca6dd5ce4c37586d3460948
Instruction ID: 95ec0c87a1951ecec4775c23ec93467bffcdea879395ba0da1279235fc59d279
Opcode Fuzzy Hash: 84ea9e236cc3cd4280e8221870b329529224e3b1cca6dd5ce4c37586d3460948
Instruction Fuzzy Hash: 0C719271D0061AEFCB22DE68CD49AEE7BA6BB04310F114163F911A7391DB34DD5A9B90

Function 006D4936 Relevance: 21.1, APIs: 6, Strings: 6, Instructions: 129memorysynchronizationCOMMON

Download Yara Rule

APIs

TlsAlloc.KERNEL32(?,00000001,00000001,00000000,00000000,?,?,?,006D54A3,?,?,?,?), ref: 006D4967
GetLastError.KERNEL32(?,?,?,006D54A3,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 006D4978
ReleaseMutex.KERNEL32(?,?,00000000,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,?), ref: 006D4AB5
CloseHandle.KERNEL32(?,?,?,?,006D54A3,?,?,?,?,?,?,?,?,?,?,?), ref: 006D4ABE

Strings

Failed to create the message window., xrefs: 006D4A13
Failed to allocate thread local storage for logging., xrefs: 006D49A6
c:\agent\_work\79\s\src\burn\engine\engine.cpp, xrefs: 006D499C, 006D49E5
Failed to connect to unelevated process., xrefs: 006D495D
Failed to set elevated pipe into thread local storage for logging., xrefs: 006D49EF
Failed to pump messages from parent process., xrefs: 006D4A89

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: AllocCloseErrorHandleLastMutexRelease
String ID: Failed to allocate thread local storage for logging.$Failed to connect to unelevated process.$Failed to create the message window.$Failed to pump messages from parent process.$Failed to set elevated pipe into thread local storage for logging.$c:\agent\_work\79\s\src\burn\engine\engine.cpp
API String ID: 687263955-2314437895
Opcode ID: 6932d60e10eb92befea0076a80e897f150017326d797e543a1c2fa777977ad8f
Instruction ID: d9ccbf52120279d791641b28dc976626be16fb3ed3e7e4b48df318929f3a644e
Opcode Fuzzy Hash: 6932d60e10eb92befea0076a80e897f150017326d797e543a1c2fa777977ad8f
Instruction Fuzzy Hash: 3741F473E40629BBD7119BA98C45EDFB76EBF04710F054227FA05A6280DF74AD5087E4

Function 006E96A5 Relevance: 21.1, APIs: 3, Strings: 9, Instructions: 123fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,80000000,00000005,00000000,00000003,08000000,00000000,?,00000000,?,006EA739,?,00000000,00000000,00000000,?), ref: 006E96C0
GetLastError.KERNEL32(?,006EA739,?,00000000,00000000,00000000,?,?,00000000,00000000,00000000), ref: 006E96D0

Part of subcall function 00714385: Sleep.KERNEL32(?,00000000,?,006E84E4,?,?,00000001,00000003,000007D0,?,?,?,?,?,?,006D4DFD), ref: 0071439C

CloseHandle.KERNEL32(00000000,?,00000001,00000003,000007D0,00000000,00000000), ref: 006E97DC

Strings

%ls payload from working path '%ls' to path '%ls', xrefs: 006E9787
Failed to verify payload signature: %ls, xrefs: 006E972B
Failed to open payload in working path: %ls, xrefs: 006E96FF
c:\agent\_work\79\s\src\burn\engine\cache.cpp, xrefs: 006E96F4
Failed to copy %ls to %ls, xrefs: 006E97CA
Moving, xrefs: 006E9772
Failed to move %ls to %ls, xrefs: 006E97B4
Failed to verify payload hash: %ls, xrefs: 006E9768
Copying, xrefs: 006E977B, 006E9786

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: CloseCreateErrorFileHandleLastSleep
String ID: %ls payload from working path '%ls' to path '%ls'$Copying$Failed to copy %ls to %ls$Failed to move %ls to %ls$Failed to open payload in working path: %ls$Failed to verify payload hash: %ls$Failed to verify payload signature: %ls$Moving$c:\agent\_work\79\s\src\burn\engine\cache.cpp
API String ID: 1275171361-1089431899
Opcode ID: dffeffda9e8ce996081c39f502aac2700da268fddffcafe0eb2f583a2d5b69b0
Instruction ID: ac9ca9739d51ae126b9d80b76c428c8e3c917335e9ac06e7b819a595db6e726c
Opcode Fuzzy Hash: dffeffda9e8ce996081c39f502aac2700da268fddffcafe0eb2f583a2d5b69b0
Instruction Fuzzy Hash: 2E31E4B29527B5BBDB221A1A9C4AFEB3A2E9F51F60F010119FD007B381D6689D40C6F5

Function 006D65DC Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 117COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000000), ref: 006D6618

Part of subcall function 00710DDC: GetModuleHandleW.KERNEL32(kernel32,IsWow64Process,?,?,?,006D5EE0,00000000), ref: 00710DF0
Part of subcall function 00710DDC: GetProcAddress.KERNEL32(00000000), ref: 00710DF7
Part of subcall function 00710DDC: GetLastError.KERNEL32(?,?,?,006D5EE0,00000000), ref: 00710E0E

GetSystemDirectoryW.KERNEL32(?,00000104), ref: 006D6644
GetLastError.KERNEL32 ref: 006D6652
GetSystemWow64DirectoryW.KERNEL32(?,00000104,00000000), ref: 006D668A
GetLastError.KERNEL32 ref: 006D6694
GetSystemDirectoryW.KERNEL32(?,00000104), ref: 006D66D7
GetLastError.KERNEL32 ref: 006D66E1

Strings

Failed to get 64-bit system folder., xrefs: 006D6680
c:\agent\_work\79\s\src\burn\engine\variable.cpp, xrefs: 006D6676, 006D66B8
Failed to backslash terminate system folder., xrefs: 006D6724
Failed to set system folder variant value., xrefs: 006D6740
Failed to get 32-bit system folder., xrefs: 006D66C2

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: ErrorLast$DirectorySystem$AddressCurrentHandleModuleProcProcessWow64
String ID: Failed to backslash terminate system folder.$Failed to get 32-bit system folder.$Failed to get 64-bit system folder.$Failed to set system folder variant value.$c:\agent\_work\79\s\src\burn\engine\variable.cpp
API String ID: 325818893-2857900824
Opcode ID: 610a6cbb148deeab0a91131947ac56e6cd3bb320c24be708859a5aa2eb209c84
Instruction ID: 2dd25d31f19bbcc78db6dac73eac2a8b4cd8f699fd7fe743c6d87663635d544e
Opcode Fuzzy Hash: 610a6cbb148deeab0a91131947ac56e6cd3bb320c24be708859a5aa2eb209c84
Instruction Fuzzy Hash: AE31F6B2D41239A7D7305798CC4DBDA7669AF04754F01816AFD04B73C1E778ED808AE5

Function 006E3F1F Relevance: 19.7, APIs: 1, Strings: 12, Instructions: 225sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 006E3A29: RegCloseKey.ADVAPI32(00000000,SOFTWARE\Policies\Microsoft\Windows\Installer,00020019,00000000,?,?,?,?,006E3F39,feclient.dll,?,00000000,?,?,?,006D4B57), ref: 006E3ACA

Sleep.KERNEL32(000007D0,00000001,feclient.dll,?,00000000,?,?,?,006D4B57,?,?,0071B488,?,00000001,00000000,00000000), ref: 006E3FD0

Strings

msasn1.dll, xrefs: 006E40EC, 006E412D
Failed to copy full log path to prefix., xrefs: 006E4139
log, xrefs: 006E3F77
Failed to copy log extension to extension., xrefs: 006E411B
clbcatq.dll, xrefs: 006E410F
Failed to get non-session specific TEMP folder., xrefs: 006E407E
feclient.dll, xrefs: 006E3F33, 006E3FE0
Failed to open log: %ls, xrefs: 006E4048
Failed to get current directory., xrefs: 006E3FB2
Failed to copy log path to prefix., xrefs: 006E40F8
Setup, xrefs: 006E3F7D
crypt32.dll, xrefs: 006E3F76, 006E3FDB, 006E3FE3, 006E4046, 006E4088, 006E40CB, 006E40EA, 006E4128, 006E4152

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: CloseSleep
String ID: Failed to copy full log path to prefix.$Failed to copy log extension to extension.$Failed to copy log path to prefix.$Failed to get current directory.$Failed to get non-session specific TEMP folder.$Failed to open log: %ls$Setup$clbcatq.dll$crypt32.dll$feclient.dll$log$msasn1.dll
API String ID: 2834455192-2673269691
Opcode ID: 0e38aeea6a8395cdd075d056e2b4e21ff510dfbbcd3dcec0685ca1f233ca32cc
Instruction ID: 830892e4c4bbbf5a78ae2fb651dc0b3ee6760f51492dabc428d68e6be586c15f
Opcode Fuzzy Hash: 0e38aeea6a8395cdd075d056e2b4e21ff510dfbbcd3dcec0685ca1f233ca32cc
Instruction Fuzzy Hash: F161D671A013A6BFDF159B76C845BB677BAEF10340B048529F901DB380EB74EE9087A1

Function 00708BE4 Relevance: 19.6, APIs: 13, Instructions: 114COMMONLIBRARYCODE

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 00708C28

Part of subcall function 0070874B: _free.LIBCMT ref: 00708768
Part of subcall function 0070874B: _free.LIBCMT ref: 0070877A
Part of subcall function 0070874B: _free.LIBCMT ref: 0070878C
Part of subcall function 0070874B: _free.LIBCMT ref: 0070879E
Part of subcall function 0070874B: _free.LIBCMT ref: 007087B0
Part of subcall function 0070874B: _free.LIBCMT ref: 007087C2
Part of subcall function 0070874B: _free.LIBCMT ref: 007087D4
Part of subcall function 0070874B: _free.LIBCMT ref: 007087E6
Part of subcall function 0070874B: _free.LIBCMT ref: 007087F8
Part of subcall function 0070874B: _free.LIBCMT ref: 0070880A
Part of subcall function 0070874B: _free.LIBCMT ref: 0070881C
Part of subcall function 0070874B: _free.LIBCMT ref: 0070882E
Part of subcall function 0070874B: _free.LIBCMT ref: 00708840

_free.LIBCMT ref: 00708C1D

Part of subcall function 00705F5F: HeapFree.KERNEL32(00000000,00000000,?,007088DC,?,00000000,?,00000000,?,00708903,?,00000007,?,?,00708D7D,?), ref: 00705F75
Part of subcall function 00705F5F: GetLastError.KERNEL32(?,?,007088DC,?,00000000,?,00000000,?,00708903,?,00000007,?,?,00708D7D,?,?), ref: 00705F87

_free.LIBCMT ref: 00708C3F
_free.LIBCMT ref: 00708C54
_free.LIBCMT ref: 00708C5F
_free.LIBCMT ref: 00708C81
_free.LIBCMT ref: 00708C94
_free.LIBCMT ref: 00708CA2
_free.LIBCMT ref: 00708CAD
_free.LIBCMT ref: 00708CE5
_free.LIBCMT ref: 00708CEC
_free.LIBCMT ref: 00708D09
_free.LIBCMT ref: 00708D21

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID:
API String ID: 161543041-0
Opcode ID: 4d186880d5021a66c786a451b800d982fb7df1b23f8f533c187f1f528a824f77
Instruction ID: bd333bfbaa638d85e5e23c97ec112916ae19c30ebb401e4229f75b2021279784
Opcode Fuzzy Hash: 4d186880d5021a66c786a451b800d982fb7df1b23f8f533c187f1f528a824f77
Instruction Fuzzy Hash: F7315E71604605DFEB60AA38D849B5773E9EF00310F1446A9E599D72E2DF7CFD448A31

Function 006E2C12 Relevance: 19.5, APIs: 1, Strings: 10, Instructions: 298COMMON

Download Yara Rule

APIs

CompareStringW.KERNEL32(00000000,00000001,006C0064,000000FF,00007070,000000FF,?,00000000,?,wininet.dll,?,crypt32.dll,?,?,?,00000000), ref: 006E2C80

Strings

Failed to check for remaining dependents during planning., xrefs: 006E2E26
Failed to add dependents ignored from command-line., xrefs: 006E2D35
Failed to add self-dependent to ignore dependents., xrefs: 006E2D04
Failed to add registration action for self dependent., xrefs: 006E2F4D
Failed to add registration action for dependent related bundle., xrefs: 006E2F82
Failed to create the string dictionary., xrefs: 006E2CB9
wininet.dll, xrefs: 006E2ECD
Failed to allocate registration action., xrefs: 006E2CE9
crypt32.dll, xrefs: 006E2CCB, 006E2DC5, 006E2EBA, 006E2F2F
Failed to add dependent bundle provider key to ignore dependents., xrefs: 006E2DEA

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: CompareString
String ID: Failed to add dependent bundle provider key to ignore dependents.$Failed to add dependents ignored from command-line.$Failed to add registration action for dependent related bundle.$Failed to add registration action for self dependent.$Failed to add self-dependent to ignore dependents.$Failed to allocate registration action.$Failed to check for remaining dependents during planning.$Failed to create the string dictionary.$crypt32.dll$wininet.dll
API String ID: 1825529933-1705955799
Opcode ID: 2759e980d10aefca88651232fef0f70ef94ab9ad03cda45cee20e30c734b58d2
Instruction ID: 013c7b06330e1b534bac0ee80110d04930922d59e61bf469d90d14f89287782a
Opcode Fuzzy Hash: 2759e980d10aefca88651232fef0f70ef94ab9ad03cda45cee20e30c734b58d2
Instruction Fuzzy Hash: 79B19D70A4136BEBCF258F56C851AAE7BBBBF04710F108169F915AA251D330DDA1CB90

Function 006D4B2A Relevance: 19.4, APIs: 2, Strings: 9, Instructions: 143windowCOMMON

Download Yara Rule

APIs

IsWindow.USER32(?), ref: 006D4CA9
PostMessageW.USER32(?,00000010,00000000,00000000), ref: 006D4CBA

Strings

WixBundleLayoutDirectory, xrefs: 006D4C3A
Failed to open log., xrefs: 006D4B5D
Failed to set registration variables., xrefs: 006D4C23
Failed while running , xrefs: 006D4C6F
Failed to create the message window., xrefs: 006D4BDD
Failed to set layout directory variable to value provided from command-line., xrefs: 006D4C4B
Failed to check global conditions, xrefs: 006D4B8E
Failed to query registration., xrefs: 006D4BF3
Failed to set action variables., xrefs: 006D4C09

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: MessagePostWindow
String ID: Failed to check global conditions$Failed to create the message window.$Failed to open log.$Failed to query registration.$Failed to set action variables.$Failed to set layout directory variable to value provided from command-line.$Failed to set registration variables.$Failed while running $WixBundleLayoutDirectory
API String ID: 3618638489-3051724725
Opcode ID: abbc8452d89749d027c323147c4641dbe44d4b0a3eb5a2d90fe9228f2d5e8f47
Instruction ID: 97df58fc373d94bb6f8dd624889eb97010d922ed92f67300b6def5ea7c63d3c6
Opcode Fuzzy Hash: abbc8452d89749d027c323147c4641dbe44d4b0a3eb5a2d90fe9228f2d5e8f47
Instruction Fuzzy Hash: 8241E271E02A26BBDB265A24CC45FFAB66EBF04750F00422BF905A6390DF70ED5487D4

Function 006EEEBE Relevance: 19.4, APIs: 5, Strings: 6, Instructions: 124COMMON

Download Yara Rule

APIs

Part of subcall function 006D39DF: GetProcessHeap.KERNEL32(?,000001C7,?,006D237C,?,00000001,80004005,8007139F,?,?,0071058B,8007139F,?,00000000,00000000,8007139F), ref: 006D39F0
Part of subcall function 006D39DF: RtlAllocateHeap.NTDLL(00000000,?,006D237C,?,00000001,80004005,8007139F,?,?,0071058B,8007139F,?,00000000,00000000,8007139F), ref: 006D39F7

EnterCriticalSection.KERNEL32(?,00000014,00000001), ref: 006EEEDB
LeaveCriticalSection.KERNEL32(?), ref: 006EF008

Strings

Engine is active, cannot change engine state., xrefs: 006EEEF6
Failed to post launch approved exe message., xrefs: 006EEFF3
Failed to copy the arguments., xrefs: 006EEF9A
Failed to copy the id., xrefs: 006EEF6D
UX requested unknown approved exe with id: %ls, xrefs: 006EEF3B
c:\agent\_work\79\s\src\burn\engine\engineforapplication.cpp, xrefs: 006EEFE9

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: CriticalHeapSection$AllocateEnterLeaveProcess
String ID: Engine is active, cannot change engine state.$Failed to copy the arguments.$Failed to copy the id.$Failed to post launch approved exe message.$UX requested unknown approved exe with id: %ls$c:\agent\_work\79\s\src\burn\engine\engineforapplication.cpp
API String ID: 1367039788-1366309959
Opcode ID: a04f24bc1140579cd0e3571770f489c00bb37481fb1223737727e757c3d0fd7a
Instruction ID: 7c377c215a9ac15e89a16ad509a030dbbb20cd671b1a23ae4468976dbc00115f
Opcode Fuzzy Hash: a04f24bc1140579cd0e3571770f489c00bb37481fb1223737727e757c3d0fd7a
Instruction Fuzzy Hash: 4B31F772A51365BFD7219F69DC09E9A37AAEF00720B018565FC04EB391E776DD008794

Function 006E9590 Relevance: 19.4, APIs: 3, Strings: 8, Instructions: 102fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,80000000,00000005,00000000,00000003,08000000,00000000,?,00000000,?,006EA6CC,?,00000000,00000000,00000000,?), ref: 006E95AB
GetLastError.KERNEL32(?,006EA6CC,?,00000000,00000000,00000000,?,?,00000000,00000000,00000000), ref: 006E95B9

Part of subcall function 00714385: Sleep.KERNEL32(?,00000000,?,006E84E4,?,?,00000001,00000003,000007D0,?,?,?,?,?,?,006D4DFD), ref: 0071439C

CloseHandle.KERNEL32(00000000,?,00000001,00000003,000007D0,00000000,00000000), ref: 006E9697

Strings

Failed to open container in working path: %ls, xrefs: 006E95E8
%ls container from working path '%ls' to path '%ls', xrefs: 006E9642
Failed to verify container hash: %ls, xrefs: 006E961A
c:\agent\_work\79\s\src\burn\engine\cache.cpp, xrefs: 006E95DD
Failed to copy %ls to %ls, xrefs: 006E9685
Moving, xrefs: 006E962D
Failed to move %ls to %ls, xrefs: 006E966F
Copying, xrefs: 006E9636, 006E9641

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: CloseCreateErrorFileHandleLastSleep
String ID: %ls container from working path '%ls' to path '%ls'$Copying$Failed to copy %ls to %ls$Failed to move %ls to %ls$Failed to open container in working path: %ls$Failed to verify container hash: %ls$Moving$c:\agent\_work\79\s\src\burn\engine\cache.cpp
API String ID: 1275171361-3053955464
Opcode ID: 4fbc612fb35142e3b696a374d20d8f34ad04efaac564d5f244030e3d5264d737
Instruction ID: 1c8621dd267a2348626df0141464a127a5d4962e328771b94d95f0d52f351a86
Opcode Fuzzy Hash: 4fbc612fb35142e3b696a374d20d8f34ad04efaac564d5f244030e3d5264d737
Instruction Fuzzy Hash: 1C213A72A4277477E3221A2A9C4AFEF271EDF11B60F014015FD057A3C0E6A89D51C5F5

Function 006E4174 Relevance: 19.3, APIs: 4, Strings: 7, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 00710841: EnterCriticalSection.KERNEL32(0073C6EC,00000000,?,?,?,006E418F,00000000,Setup,_Failed,txt,00000000,00000000,00000000,00000001,006D5537,?), ref: 00710851
Part of subcall function 00710841: LeaveCriticalSection.KERNEL32(0073C6EC,?,?,0073C6E4,?,006E418F,00000000,Setup,_Failed,txt,00000000,00000000,00000000,00000001,006D5537,?), ref: 00710998

OpenEventLogW.ADVAPI32(00000000,Application), ref: 006E419A
GetLastError.KERNEL32(?,?,?,?,?,?,?,00000000,?,?,?,?,?,?), ref: 006E41A6
ReportEventW.ADVAPI32(00000000,00000001,00000001,00000001,00000000,00000001,00000000,H<r,00000000), ref: 006E41F3
CloseEventLog.ADVAPI32(00000000), ref: 006E41FA

Strings

H<r, xrefs: 006E41E4
Application, xrefs: 006E4194
c:\agent\_work\79\s\src\burn\engine\logging.cpp, xrefs: 006E41CA
_Failed, xrefs: 006E417F
txt, xrefs: 006E417A
Setup, xrefs: 006E4184
Failed to open Application event log, xrefs: 006E41D4

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: Event$CriticalSection$CloseEnterErrorLastLeaveOpenReport
String ID: Application$Failed to open Application event log$H<r$Setup$_Failed$c:\agent\_work\79\s\src\burn\engine\logging.cpp$txt
API String ID: 1844635321-3199939508
Opcode ID: 3db3ceef04f8cb3687d22d39eb0d5997dca0712a4fb452826bf286b6a81d8ae9
Instruction ID: 648eef33bc80bce183b75883a623ce8d8e86c2f66b7268d7255e7efc708f3bfe
Opcode Fuzzy Hash: 3db3ceef04f8cb3687d22d39eb0d5997dca0712a4fb452826bf286b6a81d8ae9
Instruction Fuzzy Hash: C8F08172B423717A6721222B6D0DDFB587EDA86F617014018FD10F62C0EA4C9A4185F5

Function 006D6F94 Relevance: 18.2, APIs: 2, Strings: 10, Instructions: 226COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(00000000,?,00000000,?,00000000,?,?,?,00000000,?,?,?,?,?,?,00000000), ref: 006D6FC1
LeaveCriticalSection.KERNEL32(?), ref: 006D71CD

Strings

Failed to read variable count., xrefs: 006D6FE1
Failed to read variable value type., xrefs: 006D71AF
Failed to read variable value as string., xrefs: 006D719A
Failed to set variable value., xrefs: 006D7180
Failed to read variable literal flag., xrefs: 006D71A8
Failed to read variable included flag., xrefs: 006D71BD
Failed to set variable., xrefs: 006D71A1
Failed to read variable value as number., xrefs: 006D7187
Failed to read variable name., xrefs: 006D71B6
Unsupported variable type., xrefs: 006D7193

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: Failed to read variable count.$Failed to read variable included flag.$Failed to read variable literal flag.$Failed to read variable name.$Failed to read variable value as number.$Failed to read variable value as string.$Failed to read variable value type.$Failed to set variable value.$Failed to set variable.$Unsupported variable type.
API String ID: 3168844106-528957463
Opcode ID: 5cbbcc5acfcb38e2108a832081bd024451a5814a2b6aa28d36e98d8406550fb1
Instruction ID: 06ec06b3498ff16e60ffa57f138846800764a66af9c37283f34e7fbc870b1a2a
Opcode Fuzzy Hash: 5cbbcc5acfcb38e2108a832081bd024451a5814a2b6aa28d36e98d8406550fb1
Instruction Fuzzy Hash: 0F717071D0421EFBDB21DEA4CC45EEEBBBAEF00710F144226F900A6290E774DE459BA1

Function 00714753 Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 251fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,80000000,00000005,00000000,00000003,08000080,00000000,?,?,00000000,?,00000000,?,?,?), ref: 007147D0
GetLastError.KERNEL32 ref: 007147E6
GetFileSizeEx.KERNEL32(00000000,?), ref: 00714836
GetLastError.KERNEL32 ref: 00714840
SetFilePointer.KERNEL32(00000000,?,?,00000001), ref: 00714894
GetLastError.KERNEL32 ref: 0071489F
ReadFile.KERNEL32(?,?,?,?,00000000,?,00000000,?,?,00000001), ref: 0071498E
CloseHandle.KERNEL32(?), ref: 00714A01

Strings

c:\agent\_work\79\s\src\libs\dutil\fileutil.cpp, xrefs: 00714773, 0071481F, 00714860, 007149E4

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: File$ErrorLast$CloseCreateHandlePointerReadSize
String ID: c:\agent\_work\79\s\src\libs\dutil\fileutil.cpp
API String ID: 3286166115-3405085980
Opcode ID: fb6c6aedb1247eee6eca69368c1bbb535b71e175ae3b395bf85b38cdb2c590a0
Instruction ID: d1a9e3f76a3232e5db6fb314d9100701c5126a22e8b218481a268fe55bf2d2ac
Opcode Fuzzy Hash: fb6c6aedb1247eee6eca69368c1bbb535b71e175ae3b395bf85b38cdb2c590a0
Instruction Fuzzy Hash: C9810672A40266EBDB318E6D8C45BEB66A8AF40720F11412AFD54EF2C0D77CDD80D699

Function 006D2EBC Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 202sleepfiletimeCOMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(00000104,?,00000000,00000000,00000000), ref: 006D2F5C
GetLastError.KERNEL32 ref: 006D2F66
GetLocalTime.KERNEL32(?,?,?,?,?,?), ref: 006D3006
CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000001,00000080,00000000), ref: 006D3093
GetLastError.KERNEL32 ref: 006D30A0
Sleep.KERNEL32(00000064), ref: 006D30B4
CloseHandle.KERNEL32(?), ref: 006D311C

Strings

%ls_%04u%02u%02u%02u%02u%02u%ls%ls%ls, xrefs: 006D3063
7Um, xrefs: 006D2EBC
c:\agent\_work\79\s\src\libs\dutil\pathutil.cpp, xrefs: 006D2F8A

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: ErrorLast$CloseCreateFileHandleLocalPathSleepTempTime
String ID: %ls_%04u%02u%02u%02u%02u%02u%ls%ls%ls$7Um$c:\agent\_work\79\s\src\libs\dutil\pathutil.cpp
API String ID: 3480017824-1046398564
Opcode ID: c94cd2c2324fe158776e07fc24717e2d11f2cc92f5f6e897438bc3e5f7be5250
Instruction ID: 988fa732f96875ed7a1af75d654ed5af073611b52447ebc29702e1766bef13ac
Opcode Fuzzy Hash: c94cd2c2324fe158776e07fc24717e2d11f2cc92f5f6e897438bc3e5f7be5250
Instruction Fuzzy Hash: F171A572D41239ABDB709B68DD49BEEB3BAAB18710F004196F904E7390D7349E81CF55

Function 006E4D17 Relevance: 17.6, APIs: 4, Strings: 6, Instructions: 121COMMON

Download Yara Rule

APIs

UuidCreate.RPCRT4(?), ref: 006E4D4A
StringFromGUID2.OLE32(?,?,00000027), ref: 006E4D79
UuidCreate.RPCRT4(?), ref: 006E4DC4
StringFromGUID2.OLE32(?,?,00000027), ref: 006E4DF0

Strings

Failed to allocate pipe secret., xrefs: 006E4E19
Failed to allocate pipe name., xrefs: 006E4DB9
Failed to create pipe guid., xrefs: 006E4D57
c:\agent\_work\79\s\src\burn\engine\pipe.cpp, xrefs: 006E4D8A, 006E4DD7
BurnPipe.%s, xrefs: 006E4DA5
Failed to convert pipe guid into string., xrefs: 006E4D96

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: CreateFromStringUuid
String ID: BurnPipe.%s$Failed to allocate pipe name.$Failed to allocate pipe secret.$Failed to convert pipe guid into string.$Failed to create pipe guid.$c:\agent\_work\79\s\src\burn\engine\pipe.cpp
API String ID: 4041566446-1432765067
Opcode ID: 19fc2fd176944c6dd90245f1db7347767a71c9dbd846bc1be78c735ac1ca40a2
Instruction ID: 9451711c4d7033b2c2a637a1cf734c4dfaca302f94431ea0fdca03cc310253d3
Opcode Fuzzy Hash: 19fc2fd176944c6dd90245f1db7347767a71c9dbd846bc1be78c735ac1ca40a2
Instruction Fuzzy Hash: 4141BD72D01358EBDB50DBF6DC45EDEB7BAAF44710F20412AE905FB290DA789A05CB90

Function 006EE8F3 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 100threadCOMMON

Download Yara Rule

APIs

CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,?,00000000,?,?,006D54CB,?,?), ref: 006EE913
GetLastError.KERNEL32(?,006D54CB,?,?), ref: 006EE920
CreateThread.KERNEL32(00000000,00000000,006EE631,?,00000000,00000000), ref: 006EE979
GetLastError.KERNEL32(?,006D54CB,?,?), ref: 006EE986
WaitForMultipleObjects.KERNEL32(00000002,?,00000000,000000FF,?,006D54CB,?,?), ref: 006EE9C1
CloseHandle.KERNEL32(00000000,?,006D54CB,?,?), ref: 006EE9E0
CloseHandle.KERNEL32(?,?,006D54CB,?,?), ref: 006EE9ED

Strings

Failed to create initialization event., xrefs: 006EE94B
Failed to create the UI thread., xrefs: 006EE9B1
c:\agent\_work\79\s\src\burn\engine\uithread.cpp, xrefs: 006EE941, 006EE9A7

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: CloseCreateErrorHandleLast$EventMultipleObjectsThreadWait
String ID: Failed to create initialization event.$Failed to create the UI thread.$c:\agent\_work\79\s\src\burn\engine\uithread.cpp
API String ID: 2351989216-563379454
Opcode ID: da31a17baa6503b0435744bb06d38aeed9d55437a9c31d9e0ebff90b2d8a957f
Instruction ID: 7bd2dd37057a8e423cf43db80aff1939eb61dcafa0ef7577a0cf652a47d551bf
Opcode Fuzzy Hash: da31a17baa6503b0435744bb06d38aeed9d55437a9c31d9e0ebff90b2d8a957f
Instruction Fuzzy Hash: DC31B576D01329BBD7119F9E8C85ADFBAF9BF04750F11402AF904F7281D7359E008AA1

Function 006EE4C6 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 96threadCOMMON

Download Yara Rule

APIs

CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,?,00000000,00000000,?,?,006D54CB,?,?), ref: 006EE4E7
GetLastError.KERNEL32(?,?,006D54CB,?,?), ref: 006EE4F4
CreateThread.KERNEL32(00000000,00000000,006EE24B,00000000,00000000,00000000), ref: 006EE553
GetLastError.KERNEL32(?,?,006D54CB,?,?), ref: 006EE560
WaitForMultipleObjects.KERNEL32(00000002,?,00000000,000000FF,?,?,006D54CB,?,?), ref: 006EE59B
CloseHandle.KERNEL32(?,?,?,006D54CB,?,?), ref: 006EE5AF
CloseHandle.KERNEL32(?,?,?,006D54CB,?,?), ref: 006EE5BC

Strings

c:\agent\_work\79\s\src\burn\engine\splashscreen.cpp, xrefs: 006EE515, 006EE581
Failed to create modal event., xrefs: 006EE51F
Failed to create UI thread., xrefs: 006EE58B

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: CloseCreateErrorHandleLast$EventMultipleObjectsThreadWait
String ID: Failed to create UI thread.$Failed to create modal event.$c:\agent\_work\79\s\src\burn\engine\splashscreen.cpp
API String ID: 2351989216-3353660416
Opcode ID: 057c96808a7a254a9f283d73424fda3d9778117ac45c570be87eb9b62b856e39
Instruction ID: 7a45d77908d10bc025d5a76a7f91baaa7fe148797b9e8845be7d54fc009f54c6
Opcode Fuzzy Hash: 057c96808a7a254a9f283d73424fda3d9778117ac45c570be87eb9b62b856e39
Instruction Fuzzy Hash: 9131D376D01329BBD7208F9A8C04DEFBBB9AB44710F10812AFD10F7290F7399A008A91

Function 006F12AB Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 87threadCOMMON

Download Yara Rule

APIs

WaitForMultipleObjects.KERNEL32(00000002,?,00000000,000000FF,75922F60,?,?), ref: 006F12CF
GetLastError.KERNEL32 ref: 006F12E2
GetExitCodeThread.KERNEL32(0071B488,00000000), ref: 006F1324
GetLastError.KERNEL32 ref: 006F1332
ResetEvent.KERNEL32(0071B460), ref: 006F136D
GetLastError.KERNEL32 ref: 006F1377

Strings

Failed to reset operation complete event., xrefs: 006F13A8
c:\agent\_work\79\s\src\burn\engine\cabextract.cpp, xrefs: 006F1309, 006F1359, 006F139E
Failed to wait for operation complete event., xrefs: 006F1313
Failed to get extraction thread exit code., xrefs: 006F1363

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: ErrorLast$CodeEventExitMultipleObjectsResetThreadWait
String ID: Failed to get extraction thread exit code.$Failed to reset operation complete event.$Failed to wait for operation complete event.$c:\agent\_work\79\s\src\burn\engine\cabextract.cpp
API String ID: 2979751695-503364381
Opcode ID: 1537d86cb17768e1ab09e60642b59c63b441ec6c4d73a58c93b754052983a899
Instruction ID: 9730ef98efdbbab5507005b5f66cf5c448e5c4dfdeb30f1f52475d25a13cd447
Opcode Fuzzy Hash: 1537d86cb17768e1ab09e60642b59c63b441ec6c4d73a58c93b754052983a899
Instruction Fuzzy Hash: 4C31B471B4031AFBE700DB698D05BFE76E9AB05741F108119FA05EE6A0E778DA009B55

Function 006F13C5 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 82synchronizationCOMMON

Download Yara Rule

APIs

SetEvent.KERNEL32(0071B478,?,00000000,?,006DC198,?,006D53FA,00000000,?,006E7753,?,006D56AA,006D54B6,006D54B6,00000000,?), ref: 006F13E2
GetLastError.KERNEL32(?,006DC198,?,006D53FA,00000000,?,006E7753,?,006D56AA,006D54B6,006D54B6,00000000,?,006D54C6,FFF9E89D,006D54C6), ref: 006F13EC
WaitForSingleObject.KERNEL32(0071B488,000000FF,?,006DC198,?,006D53FA,00000000,?,006E7753,?,006D56AA,006D54B6,006D54B6,00000000,?,006D54C6), ref: 006F1426
GetLastError.KERNEL32(?,006DC198,?,006D53FA,00000000,?,006E7753,?,006D56AA,006D54B6,006D54B6,00000000,?,006D54C6,FFF9E89D,006D54C6), ref: 006F1430
CloseHandle.KERNEL32(00000000,006D54C6,?,00000000,?,006DC198,?,006D53FA,00000000,?,006E7753,?,006D56AA,006D54B6,006D54B6,00000000), ref: 006F147B
CloseHandle.KERNEL32(00000000,006D54C6,?,00000000,?,006DC198,?,006D53FA,00000000,?,006E7753,?,006D56AA,006D54B6,006D54B6,00000000), ref: 006F148A
CloseHandle.KERNEL32(00000000,006D54C6,?,00000000,?,006DC198,?,006D53FA,00000000,?,006E7753,?,006D56AA,006D54B6,006D54B6,00000000), ref: 006F1499

Strings

c:\agent\_work\79\s\src\burn\engine\cabextract.cpp, xrefs: 006F1410, 006F1454
Failed to wait for thread to terminate., xrefs: 006F145E
Failed to set begin operation event., xrefs: 006F141A

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: CloseHandle$ErrorLast$EventObjectSingleWait
String ID: Failed to set begin operation event.$Failed to wait for thread to terminate.$c:\agent\_work\79\s\src\burn\engine\cabextract.cpp
API String ID: 1206859064-1896208893
Opcode ID: 942d87d4b0ee4ab4a38ab3da56405e24be48aedf9697c4d60b40d4b083179132
Instruction ID: 374e772430b7b2fd899bdbd5176c7abfb3c24726b695cd4c2045609df88cff21
Opcode Fuzzy Hash: 942d87d4b0ee4ab4a38ab3da56405e24be48aedf9697c4d60b40d4b083179132
Instruction Fuzzy Hash: 1F210C33A0053AF7D3215B65DC457A6F6E2BF45762F014215EA0869ED0D37CE850CAD9

Function 006E92E0 Relevance: 16.7, APIs: 2, Strings: 9, Instructions: 232COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(000007D0,000007D0,00000000,00000000,?,00000000,00000000,00000003,00000000,00000000), ref: 006E9393
GetLastError.KERNEL32(000007D0,000007D0,00000000,00000000,000007D0,00000001), ref: 006E93BB

Strings

Could not close verify handle., xrefs: 006E954A
Failed to allocate memory, xrefs: 006E9351
Failed to allocate string., xrefs: 006E9429
Failed to encode file hash., xrefs: 006E9446
c:\agent\_work\79\s\src\burn\engine\cache.cpp, xrefs: 006E93DB, 006E94EF, 006E9540
0, xrefs: 006E9453
Failed to get file hash., xrefs: 006E93E5
$, xrefs: 006E9492
Could not verify file %ls., xrefs: 006E94FC

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: ErrorLast
String ID: $$0$Could not close verify handle.$Could not verify file %ls.$Failed to allocate memory$Failed to allocate string.$Failed to encode file hash.$Failed to get file hash.$c:\agent\_work\79\s\src\burn\engine\cache.cpp
API String ID: 1452528299-3673993098
Opcode ID: da0c2925484da48d19acd65fc4c6d2878c6630c9e8193967b9fa96b8b681e258
Instruction ID: 4c36057aedadc5500127c402b45961b60d2fa4da1172df6eb12f707a77c7e950
Opcode Fuzzy Hash: da0c2925484da48d19acd65fc4c6d2878c6630c9e8193967b9fa96b8b681e258
Instruction Fuzzy Hash: 6B81A372D01369ABDB21DBA5C845BEEB7F5AF08710F10012AF914BB380E7389D41CBA1

Function 006EE3ED Relevance: 16.6, APIs: 11, Instructions: 86windowCOMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EB), ref: 006EE3F8
DefWindowProcW.USER32(?,00000082,?,?), ref: 006EE436
SetWindowLongW.USER32(?,000000EB,00000000), ref: 006EE443
SetWindowLongW.USER32(?,000000EB,?), ref: 006EE452
DefWindowProcW.USER32(?,?,?,?), ref: 006EE460
CreateCompatibleDC.GDI32(?), ref: 006EE46C
SelectObject.GDI32(00000000,00000000), ref: 006EE47D
StretchBlt.GDI32(?,00000000,00000000,?,?,00000000,00000000,00000000,?,?,00CC0020), ref: 006EE49F
SelectObject.GDI32(00000000,00000000), ref: 006EE4A7
DeleteDC.GDI32(00000000), ref: 006EE4AA
PostQuitMessage.USER32(00000000), ref: 006EE4B8

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: Window$Long$ObjectProcSelect$CompatibleCreateDeleteMessagePostQuitStretch
String ID:
API String ID: 409979828-0
Opcode ID: d30a611c408b3c302a21419b7df27156f2a84d2e843d0c0a85bfa86c4c6b92bb
Instruction ID: 54606895cbcc250debf72bc63e9812cee4bb842d55d3b65d6ce1f8b54663895d
Opcode Fuzzy Hash: d30a611c408b3c302a21419b7df27156f2a84d2e843d0c0a85bfa86c4c6b92bb
Instruction Fuzzy Hash: AA217A32100244FFDB155F699C0CEAB3BAAEB49720B15C618F626961E0C73698109B64

Function 006EA021 Relevance: 16.0, APIs: 1, Strings: 8, Instructions: 226COMMON

Download Yara Rule

Strings

WixBundleLayoutDirectory, xrefs: 006EA15E
Failed to get current process directory., xrefs: 006EA0E4
WixBundleOriginalSource, xrefs: 006EA0A5
Failed to get bundle layout directory property., xrefs: 006EA179
Failed to combine layout source with source., xrefs: 006EA198
WixBundleLastUsedSource, xrefs: 006EA08A
Failed to copy source path., xrefs: 006EA212
Failed to combine last source with source., xrefs: 006EA103

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: Find$CloseFileFirstlstrlen
String ID: Failed to combine last source with source.$Failed to combine layout source with source.$Failed to copy source path.$Failed to get bundle layout directory property.$Failed to get current process directory.$WixBundleLastUsedSource$WixBundleLayoutDirectory$WixBundleOriginalSource
API String ID: 2767606509-3003062821
Opcode ID: 9657b9b85b6d67bb736cd700cb9ffa9580dd1b9a723240af3b7f4af1118800d8
Instruction ID: 14d793386a48c1f76e96cf88c89fc08e5ce1675b1cfc1ff380f667f7b10c0879
Opcode Fuzzy Hash: 9657b9b85b6d67bb736cd700cb9ffa9580dd1b9a723240af3b7f4af1118800d8
Instruction Fuzzy Hash: DA814E71D01369AFDF11DFD9D8419EEBBB6AF08710F14412AE910B7350D735AE018B96

Function 006DCB82 Relevance: 15.9, APIs: 1, Strings: 8, Instructions: 143COMMON

Download Yara Rule

APIs

CompareStringW.KERNEL32(0000007F,00000000,FFFEB88D,000000FF,00000001,000000FF,?,00000001,006D53FA,00000000,006D54C6,006D5482,WixBundleUILevel,840F01E8,?,00000001), ref: 006DCBD9

Strings

Failed to find embedded payload: %ls, xrefs: 006DCC05
Failed to extract file., xrefs: 006DCCA4
Failed to ensure directory exists, xrefs: 006DCCAB
c:\agent\_work\79\s\src\burn\engine\payload.cpp, xrefs: 006DCCDA
Failed to concat file paths., xrefs: 006DCCB9
Failed to get next stream., xrefs: 006DCCC0
Payload was not found in container: %ls, xrefs: 006DCCE6
Failed to get directory portion of local file path, xrefs: 006DCCB2

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: CompareString
String ID: Failed to concat file paths.$Failed to ensure directory exists$Failed to extract file.$Failed to find embedded payload: %ls$Failed to get directory portion of local file path$Failed to get next stream.$Payload was not found in container: %ls$c:\agent\_work\79\s\src\burn\engine\payload.cpp
API String ID: 1825529933-1810486150
Opcode ID: b7c82e65bd6f49b35ff8fd7f50b38c990480bfe370949ec596815cff3618fdd5
Instruction ID: e2b732b6295cd50bcedad330883d85073f3414042f718e485b9129776550b43e
Opcode Fuzzy Hash: b7c82e65bd6f49b35ff8fd7f50b38c990480bfe370949ec596815cff3618fdd5
Instruction Fuzzy Hash: CE41C131D1122AEBCF259F48CD41AAEBB77AF40720B10816BE915AB391C6749D41DB90

Function 006D47DF Relevance: 15.9, APIs: 3, Strings: 6, Instructions: 127windowthreadCOMMON

Download Yara Rule

APIs

PeekMessageW.USER32(00000000,00000000,00000400,00000400,00000000), ref: 006D4804
GetCurrentThreadId.KERNEL32 ref: 006D480A
GetMessageW.USER32(00000000,00000000,00000000,00000000), ref: 006D4898

Strings

Failed to load UX., xrefs: 006D484D
Failed to create engine for UX., xrefs: 006D4824
wininet.dll, xrefs: 006D4837
c:\agent\_work\79\s\src\burn\engine\engine.cpp, xrefs: 006D48E4
Unexpected return value from message pump., xrefs: 006D48EE
Failed to start bootstrapper application., xrefs: 006D4866

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: Message$CurrentPeekThread
String ID: Failed to create engine for UX.$Failed to load UX.$Failed to start bootstrapper application.$Unexpected return value from message pump.$c:\agent\_work\79\s\src\burn\engine\engine.cpp$wininet.dll
API String ID: 673430819-3694138465
Opcode ID: c07ecee2bcc0a557796b82f0e464ff72494624b344fb089e078450f5a5753da7
Instruction ID: 24c0e1ca20ef364c665fa9d8311d589572506ff711fd93d296d0e1caddbbed49
Opcode Fuzzy Hash: c07ecee2bcc0a557796b82f0e464ff72494624b344fb089e078450f5a5753da7
Instruction Fuzzy Hash: F541EFB1E00255BBEB109BA8CC85EFA736EEF08754F10412AF905EB390DB34ED4597A4

Function 006F99D6 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 127COMMON

Download Yara Rule

APIs

SetFileAttributesW.KERNEL32(00000000,00000000,00000000,00000000,?,?,?,00000000,00000000,00000000,?,?,006FAD5B,?,00000001,00000000), ref: 006F9A61
GetLastError.KERNEL32(?,?,?,00000000,00000000,00000000,?,?,006FAD5B,?,00000001,00000000,00000000,00000000,00000001,00000000), ref: 006F9A6B
CopyFileExW.KERNEL32(00000000,00000000,006F98AF,?,?,00000000,00000000,00000000,?,?,?,00000000,00000000,00000000), ref: 006F9AB9
GetLastError.KERNEL32(?,?,?,00000000,00000000,00000000,?,?,006FAD5B,?,00000001,00000000,00000000,00000000,00000001,00000000), ref: 006F9AE8

Strings

c:\agent\_work\79\s\src\burn\engine\apply.cpp, xrefs: 006F9A8F, 006F9AD3, 006F9B0C
Failed attempt to copy payload from: '%ls' to: %ls., xrefs: 006F9B1A
BA aborted copy of payload from: '%ls' to: %ls., xrefs: 006F9AE1
Failed to clear readonly bit on payload destination path: %ls, xrefs: 006F9A9A
copy, xrefs: 006F9A2F

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: ErrorFileLast$AttributesCopy
String ID: BA aborted copy of payload from: '%ls' to: %ls.$Failed attempt to copy payload from: '%ls' to: %ls.$Failed to clear readonly bit on payload destination path: %ls$c:\agent\_work\79\s\src\burn\engine\apply.cpp$copy
API String ID: 1969131206-1952161024
Opcode ID: 7afcb66d406fb5248085973d058c1cf31b86b4e17d6be302efc7d9fe97455df5
Instruction ID: a3c5ee1216c4e36b047a17c98966758406ab12d12aa1a2ac4ca04805ecc20682
Opcode Fuzzy Hash: 7afcb66d406fb5248085973d058c1cf31b86b4e17d6be302efc7d9fe97455df5
Instruction Fuzzy Hash: 5D311772B4112AF7EB204A5A9C45FFB776BEF41B50B158129FE05EB391E238CD0186B0

Function 006E8DA4 Relevance: 15.9, APIs: 2, Strings: 7, Instructions: 125COMMON

Download Yara Rule

APIs

LocalFree.KERNEL32(00000000,?,00000001,80000005,?,00000000,00000000,00000000,00000003,000007D0), ref: 006E8EEF

Strings

Failed to create ACL to secure cache path: %ls, xrefs: 006E8EA3
Failed to allocate access for SYSTEM group to path: %ls, xrefs: 006E8E18
Failed to allocate access for Administrators group to path: %ls, xrefs: 006E8DF7
Failed to allocate access for Everyone group to path: %ls, xrefs: 006E8E39
Failed to secure cache path: %ls, xrefs: 006E8ED2
Failed to allocate access for Users group to path: %ls, xrefs: 006E8E5A
c:\agent\_work\79\s\src\burn\engine\cache.cpp, xrefs: 006E8E98

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: FreeLocal
String ID: Failed to allocate access for Administrators group to path: %ls$Failed to allocate access for Everyone group to path: %ls$Failed to allocate access for SYSTEM group to path: %ls$Failed to allocate access for Users group to path: %ls$Failed to create ACL to secure cache path: %ls$Failed to secure cache path: %ls$c:\agent\_work\79\s\src\burn\engine\cache.cpp
API String ID: 2826327444-3744430260
Opcode ID: 3d836ff3e60b6e1cfd1e27b1d8ec02e1e060c162cf210610956d96341eaa602d
Instruction ID: ac7a1ac4f5cd4bb21d4ee549de52aff94d3d0c30c25bf2dddf3fb35883b873d5
Opcode Fuzzy Hash: 3d836ff3e60b6e1cfd1e27b1d8ec02e1e060c162cf210610956d96341eaa602d
Instruction Fuzzy Hash: BA311972A42379BFDB3197569C06FEF766AAB40B10F104055FA08BB2C0DE74AD45C794

Function 00716E58 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 113COMMON

Download Yara Rule

APIs

CompareStringW.KERNEL32(0000007F,00000000,00000000,000000FF,name,000000FF,00000000,00000000,00000000,?,7591DFD0), ref: 00716EB7
CompareStringW.KERNEL32(0000007F,00000000,00000000,000000FF,email,000000FF), ref: 00716ED4
SysFreeString.OLEAUT32(00000000), ref: 00716F12
SysFreeString.OLEAUT32(00000000), ref: 00716F56

Strings

`)u, xrefs: 00716F12, 00716F56
email, xrefs: 00716EC6
name, xrefs: 00716EA9
uri, xrefs: 00716EE2

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: String$CompareFree
String ID: `)u$email$name$uri
API String ID: 3589242889-2762311025
Opcode ID: 49acfb09ee6af75da6f59f1c623af638d85e058404df84ef45ee61414bffd7e2
Instruction ID: 1d5b25508ca9790fa9b473157503f0fd30b0565d48d61442f8c2c45a537ba057
Opcode Fuzzy Hash: 49acfb09ee6af75da6f59f1c623af638d85e058404df84ef45ee61414bffd7e2
Instruction Fuzzy Hash: C7416D75905219FBCF21DB98DC45FEEBB78AF00721F2042A4E921AA1E1C7389E85DB50

Function 006DF3F6 Relevance: 15.9, APIs: 2, Strings: 7, Instructions: 108stringCOMMON

Download Yara Rule

APIs

_MREFOpen@16.MSPDB140-MSVCRT ref: 006DF42F

Part of subcall function 006D415F: CreateDirectoryW.KERNELBASE(?,840F01E8,00000000,00000000,?,006E9FD1,00000000,00000000,?,00000000,006D53FA,00000000,?,?,006DD561,?), ref: 006D416D
Part of subcall function 006D415F: GetLastError.KERNEL32(?,006E9FD1,00000000,00000000,?,00000000,006D53FA,00000000,?,?,006DD561,?,00000000,00000000), ref: 006D417B

lstrlenA.KERNEL32(002E0032,00000000,00000094,00000000,00000094,crypt32.dll,crypt32.dll,006E0455,swidtag,00000094,0071B500,00330074,006E0455,00000000,crypt32.dll,00000000), ref: 006DF482

Part of subcall function 0071501B: CreateFileW.KERNEL32(002E0032,40000000,00000001,00000000,00000002,00000080,00000000,006E0455,00000000,?,006DF499,0071B500,00000080,002E0032,00000000), ref: 00715033
Part of subcall function 0071501B: GetLastError.KERNEL32(?,006DF499,0071B500,00000080,002E0032,00000000,?,006E0455,crypt32.dll,00000094,?,?,?,?,?,00000000), ref: 00715040

Strings

swidtag, xrefs: 006DF442
Failed to allocate regid file path., xrefs: 006DF4DA
Failed to allocate regid folder path., xrefs: 006DF4E1
Failed to write tag xml to file: %ls, xrefs: 006DF4C0
Failed to format tag folder path., xrefs: 006DF4E8
Failed to create regid folder: %ls, xrefs: 006DF4CA
crypt32.dll, xrefs: 006DF41F, 006DF45C, 006DF45D

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: CreateErrorLast$DirectoryFileOpen@16lstrlen
String ID: Failed to allocate regid file path.$Failed to allocate regid folder path.$Failed to create regid folder: %ls$Failed to format tag folder path.$Failed to write tag xml to file: %ls$crypt32.dll$swidtag
API String ID: 904508749-2959304021
Opcode ID: efadb26d20a0019620b07a51e43f94cb80e4c9f7fb760dbc3604c0665e6c7cdd
Instruction ID: 34a58859ee2418930bd390dd015e6738b9b967638353e3d9543c1acc4a44ad1f
Opcode Fuzzy Hash: efadb26d20a0019620b07a51e43f94cb80e4c9f7fb760dbc3604c0665e6c7cdd
Instruction Fuzzy Hash: 9531AE72D00229FBCB519F94DC41B9EBBF6BF04710F108176F815AA352D7759A419B90

Function 006EE134 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 103windowCOMMON

Download Yara Rule

APIs

LoadBitmapW.USER32(?,00000001), ref: 006EE16A
GetLastError.KERNEL32 ref: 006EE176
GetObjectW.GDI32(00000000,00000018,?), ref: 006EE1BD
GetCursorPos.USER32(?), ref: 006EE1DE
MonitorFromPoint.USER32(?,?,00000002), ref: 006EE1F0
GetMonitorInfoW.USER32(00000000,?), ref: 006EE206

Strings

c:\agent\_work\79\s\src\burn\engine\splashscreen.cpp, xrefs: 006EE19A
Failed to load splash screen bitmap., xrefs: 006EE1A4
(, xrefs: 006EE1FD

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: Monitor$BitmapCursorErrorFromInfoLastLoadObjectPoint
String ID: ($Failed to load splash screen bitmap.$c:\agent\_work\79\s\src\burn\engine\splashscreen.cpp
API String ID: 2342928100-2146028690
Opcode ID: 17177862e0b13b31a786d4e3b05de94df5f2caef62ee73349a8778c1d11e0989
Instruction ID: 60cf43503f6f00ef5528e85bcd0059e99c144242be4bce808c408de5732404e3
Opcode Fuzzy Hash: 17177862e0b13b31a786d4e3b05de94df5f2caef62ee73349a8778c1d11e0989
Instruction Fuzzy Hash: 49314371A013159FDB10CFB9D949ADEBBB5EF08710F04C115E914EB280D774E9008B94

Function 006E5050 Relevance: 15.8, APIs: 3, Strings: 6, Instructions: 83COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(?,00000000,?,?,0071B500), ref: 006E5059
GetProcessId.KERNEL32(000000FF,?,?,open,00000000,00000000,?,000000FF,?,?), ref: 006E50F7
CloseHandle.KERNEL32(00000000), ref: 006E5110

Strings

open, xrefs: 006E50C1, 006E50CF
burn.elevated, xrefs: 006E5079
runas, xrefs: 006E50B7
-q -%ls %ls %ls %u, xrefs: 006E507E
Failed to launch elevated child process: %ls, xrefs: 006E50E4
Failed to allocate parameters for elevated process., xrefs: 006E5092

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: Process$CloseCurrentHandle
String ID: -q -%ls %ls %ls %u$Failed to allocate parameters for elevated process.$Failed to launch elevated child process: %ls$burn.elevated$open$runas
API String ID: 2815245435-1352204306
Opcode ID: d55f45d8eece0cb0e88eeda5f69966134792d6006f05fb913e71313f22464446
Instruction ID: a131a36c5eca25f9b6483a7b37cd9f492744bedcb422aba84f0bebbf51bb4a6a
Opcode Fuzzy Hash: d55f45d8eece0cb0e88eeda5f69966134792d6006f05fb913e71313f22464446
Instruction Fuzzy Hash: D021BCB1D01619FFCB119F99DC858EEBBB9EF04318B00806AF812A2250D7389E50DFD0

Function 006D6898 Relevance: 15.8, APIs: 3, Strings: 6, Instructions: 74libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(msi,DllGetVersion), ref: 006D68C2
GetProcAddress.KERNEL32(00000000), ref: 006D68C9
GetLastError.KERNEL32 ref: 006D68D3

Strings

DllGetVersion, xrefs: 006D68B4
Failed to get msi.dll version info., xrefs: 006D691B
c:\agent\_work\79\s\src\burn\engine\variable.cpp, xrefs: 006D68F7
Failed to set variant value., xrefs: 006D693F
msi, xrefs: 006D68B9
Failed to find DllGetVersion entry point in msi.dll., xrefs: 006D6901

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: AddressErrorHandleLastModuleProc
String ID: DllGetVersion$Failed to find DllGetVersion entry point in msi.dll.$Failed to get msi.dll version info.$Failed to set variant value.$c:\agent\_work\79\s\src\burn\engine\variable.cpp$msi
API String ID: 4275029093-2015055865
Opcode ID: b4109ae8fc626efc696345b0d11f48b00ebc436a01acce8c63a0a0034080cce6
Instruction ID: b7af79fbb1f9db21ecbb99df8b26b2f0f4c8e6a94d962bb59fff465ff42aeeff
Opcode Fuzzy Hash: b4109ae8fc626efc696345b0d11f48b00ebc436a01acce8c63a0a0034080cce6
Instruction Fuzzy Hash: F711DA72E40736A6D720A76CCC56AFF76A5EB08B10B014519FE01FA3C1D678ED4485E5

Function 006DD673 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 65libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,00000000,00000008,00000000,?,006D4847,00000000,00000000,wininet.dll,?,00000000,00000000,?,?,006D54CB,?), ref: 006DD684
GetLastError.KERNEL32(?,006D4847,00000000,00000000,wininet.dll,?,00000000,00000000,?,?,006D54CB,?,?), ref: 006DD691
GetProcAddress.KERNEL32(00000000,BootstrapperApplicationCreate), ref: 006DD6C9
GetLastError.KERNEL32(?,006D4847,00000000,00000000,wininet.dll,?,00000000,00000000,?,?,006D54CB,?,?), ref: 006DD6D5

Strings

c:\agent\_work\79\s\src\burn\engine\userexperience.cpp, xrefs: 006DD6B2, 006DD6F6
Failed to get BootstrapperApplicationCreate entry-point, xrefs: 006DD700
Failed to load UX DLL., xrefs: 006DD6BC
BootstrapperApplicationCreate, xrefs: 006DD6C3
Failed to create UX., xrefs: 006DD719

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: ErrorLast$AddressLibraryLoadProc
String ID: BootstrapperApplicationCreate$Failed to create UX.$Failed to get BootstrapperApplicationCreate entry-point$Failed to load UX DLL.$c:\agent\_work\79\s\src\burn\engine\userexperience.cpp
API String ID: 1866314245-53642260
Opcode ID: ca0c6021032edb978c9361583ad8151bc8af08b185fc1c0aca9404dbb908f873
Instruction ID: 32fa38ba778d278a4aa68347578891c9a7540f91c9e966d3d094224fa93cb48d
Opcode Fuzzy Hash: ca0c6021032edb978c9361583ad8151bc8af08b185fc1c0aca9404dbb908f873
Instruction Fuzzy Hash: CE112773E40736ABD7212A989C05F9F2A966B04B60F02811AFE04FB3C1D668DC004AE4

Function 006D1173 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 52libraryloadermemoryCOMMON

Download Yara Rule

APIs

HeapSetInformation.KERNEL32(00000000,00000001,00000000,00000000,?,?,?,?,?,006D111A,cabinet.dll,00000009,?,?,00000000), ref: 006D1184
GetModuleHandleW.KERNEL32(kernel32,?,?,?,?,?,006D111A,cabinet.dll,00000009,?,?,00000000), ref: 006D118F
GetProcAddress.KERNEL32(00000000,SetDefaultDllDirectories), ref: 006D119D
GetLastError.KERNEL32(?,?,?,?,?,006D111A,cabinet.dll,00000009,?,?,00000000), ref: 006D11B8
GetProcAddress.KERNEL32(00000000,SetDllDirectoryW), ref: 006D11C0
GetLastError.KERNEL32(?,?,?,?,?,006D111A,cabinet.dll,00000009,?,?,00000000), ref: 006D11D5

Strings

kernel32, xrefs: 006D118A
SetDefaultDllDirectories, xrefs: 006D1197
SetDllDirectoryW, xrefs: 006D11BA

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: AddressErrorLastProc$HandleHeapInformationModule
String ID: SetDefaultDllDirectories$SetDllDirectoryW$kernel32
API String ID: 3104334766-1824683568
Opcode ID: 1f5864f9bd8a19d96dff5428d36270c4a4ab4886e4c838e56ebe85b75c874748
Instruction ID: d9784480a08a188a0b80832abf9954ab00178132b70829dd06033328d9f93d11
Opcode Fuzzy Hash: 1f5864f9bd8a19d96dff5428d36270c4a4ab4886e4c838e56ebe85b75c874748
Instruction Fuzzy Hash: 7E01D471700316BB97106BAA9C49DEF3B6EFF857607008016FA15A6390E7B4DA458BB4

Function 006EF49B Relevance: 15.2, APIs: 2, Strings: 8, Instructions: 154COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 006EF4B0
LeaveCriticalSection.KERNEL32(?), ref: 006EF62B

Strings

UX requested unknown container with id: %ls, xrefs: 006EF555
Engine is active, cannot change engine state., xrefs: 006EF4CA
Failed to set download password., xrefs: 006EF5D9
Failed to set download user., xrefs: 006EF5B3
UX did not provide container or payload id., xrefs: 006EF61A
UX requested unknown payload with id: %ls, xrefs: 006EF505
UX denied while trying to set download URL on embedded payload: %ls, xrefs: 006EF51B
Failed to set download URL., xrefs: 006EF58A

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: Engine is active, cannot change engine state.$Failed to set download URL.$Failed to set download password.$Failed to set download user.$UX denied while trying to set download URL on embedded payload: %ls$UX did not provide container or payload id.$UX requested unknown container with id: %ls$UX requested unknown payload with id: %ls
API String ID: 3168844106-2615595102
Opcode ID: 55f0666d443ad2c36b6f470166a1f199ab1ff63055d80a2c234f4bc4044343b7
Instruction ID: 9403cc381ef34e3edb58b6d902c23eac3ff851d69af7618d362b48e8dcaf39b2
Opcode Fuzzy Hash: 55f0666d443ad2c36b6f470166a1f199ab1ff63055d80a2c234f4bc4044343b7
Instruction Fuzzy Hash: 5B41F771902352ABDB619F26D805EAA73BAEF20710F15813AF804E7390EB75DE50C7A4

Function 00705983 Relevance: 15.1, APIs: 10, Instructions: 70COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00705999

Part of subcall function 00705F5F: HeapFree.KERNEL32(00000000,00000000,?,007088DC,?,00000000,?,00000000,?,00708903,?,00000007,?,?,00708D7D,?), ref: 00705F75
Part of subcall function 00705F5F: GetLastError.KERNEL32(?,?,007088DC,?,00000000,?,00000000,?,00708903,?,00000007,?,?,00708D7D,?,?), ref: 00705F87

_free.LIBCMT ref: 007059A5
_free.LIBCMT ref: 007059B0
_free.LIBCMT ref: 007059BB
_free.LIBCMT ref: 007059C6
_free.LIBCMT ref: 007059D1
_free.LIBCMT ref: 007059DC
_free.LIBCMT ref: 007059E7
_free.LIBCMT ref: 007059F2
_free.LIBCMT ref: 00705A00

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: e4e6257df5d1c872b8fd693512697b340bc4af56c364618bab52e279dbc8defa
Instruction ID: 46887731c79c465bd74949b320425a65e2101dd9659f2f7a83c639e08cdf5e1f
Opcode Fuzzy Hash: e4e6257df5d1c872b8fd693512697b340bc4af56c364618bab52e279dbc8defa
Instruction Fuzzy Hash: EA21A9B6900509EFCB01EF94C885DDE7BBAAF08350F0142A5B6199B162DB79EB548F80

Function 00715CA5 Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 195filememoryCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(000000FF,C0000000,00000004,00000000,00000004,00000080,00000000,00000000,00000000,00000000,00000078,00000410,000000FF,?,00000000,00000000), ref: 00715CE2
GetLastError.KERNEL32 ref: 00715CF0
VirtualAlloc.KERNEL32(00000000,00010000,00003000,00000004), ref: 00715D31
GetLastError.KERNEL32 ref: 00715D3E
VirtualFree.KERNEL32(?,00000000,00008000), ref: 00715EB1
CloseHandle.KERNEL32(?), ref: 00715EC0

Strings

GET, xrefs: 00715DE5
c:\agent\_work\79\s\src\libs\dutil\dlutil.cpp, xrefs: 00715D14

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: ErrorLastVirtual$AllocCloseCreateFileFreeHandle
String ID: GET$c:\agent\_work\79\s\src\libs\dutil\dlutil.cpp
API String ID: 2028584396-1081731170
Opcode ID: 17d129ae5fe09a85e9c6900bbd9b5fad49ab949aef7537ea311ad75cfe22311f
Instruction ID: c9093d2eef0990943651ddd6b194251a48c8f9547c4d50365690b73f25d78d80
Opcode Fuzzy Hash: 17d129ae5fe09a85e9c6900bbd9b5fad49ab949aef7537ea311ad75cfe22311f
Instruction Fuzzy Hash: 0E617071E0061AEBDB25CFA8CC85BEE7BB5AF88750F114119FD14AB290D738D9809B94

Function 006E0BE4 Relevance: 14.2, APIs: 2, Strings: 6, Instructions: 182COMMON

Download Yara Rule

APIs

Part of subcall function 006E0FB0: CompareStringW.KERNEL32(00000000,00000000,feclient.dll,000000FF,00000000,000000FF,00000000,00000000,?,?,006E0C03,?,00000000,?,00000000,00000000), ref: 006E0FDF

CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,?,00000000,?,00000000,?,00000000,00000001,?,?,00000000,?,00000000), ref: 006E0D87
GetLastError.KERNEL32 ref: 006E0D94

Strings

Failed to create syncpoint event., xrefs: 006E0DC2
c:\agent\_work\79\s\src\burn\engine\plan.cpp, xrefs: 006E0DB8
Failed to append package start action., xrefs: 006E0C29
Failed to append payload cache action., xrefs: 006E0D3E
Failed to append rollback cache action., xrefs: 006E0C63
Failed to append cache action., xrefs: 006E0CDE

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: CompareCreateErrorEventLastString
String ID: Failed to append cache action.$Failed to append package start action.$Failed to append payload cache action.$Failed to append rollback cache action.$Failed to create syncpoint event.$c:\agent\_work\79\s\src\burn\engine\plan.cpp
API String ID: 801187047-1222730087
Opcode ID: b698f9e57b8be2a40ac22d11a689589b03ff747ec2bad24813d7eb1d28d35737
Instruction ID: d7ff84107707843b60d377a61515c38f73a7da7467be4562a4554b923ce95523
Opcode Fuzzy Hash: b698f9e57b8be2a40ac22d11a689589b03ff747ec2bad24813d7eb1d28d35737
Instruction Fuzzy Hash: 8961AFB5501744EFDB01DF55C880AAABBFAFF88310F218459E9059B302EB71EE82DB50

Function 0071712A Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 158COMMON

Download Yara Rule

APIs

CompareStringW.KERNEL32(0000007F,00000000,7591DFD0,000000FF,type,000000FF,?,7591DFD0,7591DFD0,7591DFD0), ref: 00717180
SysFreeString.OLEAUT32(00000000), ref: 007171CB
SysFreeString.OLEAUT32(00000000), ref: 00717247
SysFreeString.OLEAUT32(00000000), ref: 00717293

Strings

type, xrefs: 00717172
`)u, xrefs: 007171CB, 00717247, 00717293
url, xrefs: 00717193

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: String$Free$Compare
String ID: `)u$type$url
API String ID: 1324494773-3139739812
Opcode ID: 20cb0a1b34923922e0378ba942ffc88be4b89f03593d5c6c261b057821366d62
Instruction ID: 8ba615b51546525e8578ee9705631de03931fea78cb753a2dd0358e0152e293d
Opcode Fuzzy Hash: 20cb0a1b34923922e0378ba942ffc88be4b89f03593d5c6c261b057821366d62
Instruction Fuzzy Hash: 3F514C75905219FBCF19DB98C849EEEBBB8BF04721F144299F811EB1A0D7399E80DB50

Function 006D9E89 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 146COMMON

Download Yara Rule

APIs

_MREFOpen@16.MSPDB140-MSVCRT ref: 006D9EAF
_MREFOpen@16.MSPDB140-MSVCRT ref: 006D9ED4

Strings

MsiComponentSearch failed: ID '%ls', HRESULT 0x%x, xrefs: 006D9FC8
Failed to format component id string., xrefs: 006D9EBA
Failed to get component path: %d, xrefs: 006D9F38
Failed to set variable., xrefs: 006D9FB8
Failed to format product code string., xrefs: 006D9EDF

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: Open@16
String ID: Failed to format component id string.$Failed to format product code string.$Failed to get component path: %d$Failed to set variable.$MsiComponentSearch failed: ID '%ls', HRESULT 0x%x
API String ID: 3613110473-1671347822
Opcode ID: b761029f2e26ff36abd552245bde1d8ba6bc6b7277589e6c3b79d9c1ddf36b5a
Instruction ID: ea6d8afbcb1a9dab7ab5fcc815377443ccbe66f5dfba6b4b72de3b110d142f37
Opcode Fuzzy Hash: b761029f2e26ff36abd552245bde1d8ba6bc6b7277589e6c3b79d9c1ddf36b5a
Instruction Fuzzy Hash: 6D41E272D04205BACB259BAC8D46FFEB67BAF04310F244657F500E23D1E7319A90DBA1

Function 006E48B6 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 116fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(00000000,00000001,00000008,?,00000000,?,00000000,00000000,00000001,00000000,?,?,?,00000000,crypt32.dll,00000000), ref: 006E48E1
GetLastError.KERNEL32 ref: 006E48EE
ReadFile.KERNEL32(?,00000000,?,?,00000000,?,00000000), ref: 006E4999
GetLastError.KERNEL32 ref: 006E49A3

Strings

Failed to read data for message., xrefs: 006E49D1
c:\agent\_work\79\s\src\burn\engine\pipe.cpp, xrefs: 006E494D, 006E4964, 006E49C7
Failed to read message from pipe., xrefs: 006E496E
Failed to allocate data for message., xrefs: 006E4957

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: ErrorFileLastRead
String ID: Failed to allocate data for message.$Failed to read data for message.$Failed to read message from pipe.$c:\agent\_work\79\s\src\burn\engine\pipe.cpp
API String ID: 1948546556-2758242248
Opcode ID: fefd358366d30dfdd985aeb57bd9156f7b0a3657f8c211f4beb08d55e7bbfae0
Instruction ID: fcb8361b397415f00d487b757aa6505e7311a73277fb05e0e78be7b802e922fc
Opcode Fuzzy Hash: fefd358366d30dfdd985aeb57bd9156f7b0a3657f8c211f4beb08d55e7bbfae0
Instruction Fuzzy Hash: CD31C672D4133ABBD7109A769C05BAFB76AAB04711F11812AFC41B6381DB789E00CBD5

Function 00711881 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 116stringregistryCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,?,00000000,00000000,BundleUpgradeCode), ref: 007118BD
lstrlenW.KERNEL32(?,00000002,00000001,?,00000002,00000001,00000000,00000000,BundleUpgradeCode), ref: 0071191F
lstrlenW.KERNEL32(?), ref: 0071192B
RegSetValueExW.ADVAPI32(?,?,00000000,00000007,?,?,00000001,?,?,00000002,00000001,00000000,00000000,BundleUpgradeCode), ref: 0071196E

Strings

c:\agent\_work\79\s\src\libs\dutil\regutil.cpp, xrefs: 00711996
,ms, xrefs: 0071189B
,ms, xrefs: 007118FF, 00711916
BundleUpgradeCode, xrefs: 0071188A

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: lstrlen$Value
String ID: ,ms$,ms$BundleUpgradeCode$c:\agent\_work\79\s\src\libs\dutil\regutil.cpp
API String ID: 198323757-1301082760
Opcode ID: 336d3c133693c3f8fbd08dbaeac484fe51e51a46c5fcd4334d1dbc6f74be3de1
Instruction ID: 8bebc9a4b6bcea893f8070598b54814f4395fada94fe09a013df798593a54610
Opcode Fuzzy Hash: 336d3c133693c3f8fbd08dbaeac484fe51e51a46c5fcd4334d1dbc6f74be3de1
Instruction Fuzzy Hash: 6231C172D00229AFCB119F9898819DEBBB9EB40750F454069FE50AF250C734ED519BE0

Function 006E5362 Relevance: 14.1, APIs: 2, Strings: 6, Instructions: 90synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,0002BF20,?,F0000003,00000000,00000000,?,00000000,00000000,00000000,006D54CB,00000000,00000000,?,00000000), ref: 006E540B
GetLastError.KERNEL32(?,?,?,006D4CA6,?,?,00000000,?,?,?,?,?,?,0071B4A0,?,?), ref: 006E5416

Strings

Failed to post terminate message to child process cache thread., xrefs: 006E53DA
Failed to wait for child process exit., xrefs: 006E5444
c:\agent\_work\79\s\src\burn\engine\pipe.cpp, xrefs: 006E543A
Failed to post terminate message to child process., xrefs: 006E53F6
Failed to write exit code to message buffer., xrefs: 006E5386
Failed to write restart to message buffer., xrefs: 006E53AE

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: ErrorLastObjectSingleWait
String ID: Failed to post terminate message to child process cache thread.$Failed to post terminate message to child process.$Failed to wait for child process exit.$Failed to write exit code to message buffer.$Failed to write restart to message buffer.$c:\agent\_work\79\s\src\burn\engine\pipe.cpp
API String ID: 1211598281-2106699056
Opcode ID: d999d7cafaf0aeaab78bd946fe5c552e99905fed8fcf7eb3411dea9bc33c1ca8
Instruction ID: 1bc992a81961f1f17770ba44dcb49c407263424a8ba3316953ef82655eb0ab41
Opcode Fuzzy Hash: d999d7cafaf0aeaab78bd946fe5c552e99905fed8fcf7eb3411dea9bc33c1ca8
Instruction Fuzzy Hash: 93214873802B79FBCB124A55DC05EDE77AAEF00325F114211F901B61D0E778EE409AD0

Function 006E8F7E Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 89fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,80000000,00000005,00000000,00000003,08000000,00000000,00000000,00000101,?,006E9DED,00000003,000007D0,00000003,?,000007D0), ref: 006E8F98
GetLastError.KERNEL32(?,006E9DED,00000003,000007D0,00000003,?,000007D0,?,000007D0,00000000,00000003,00000000,00000003,000007D0,00000001,?), ref: 006E8FA5
CloseHandle.KERNEL32(00000000,?,006E9DED,00000003,000007D0,00000003,?,000007D0,?,000007D0,00000000,00000003,00000000,00000003,000007D0,00000001), ref: 006E906D

Strings

Failed to verify signature of payload: %ls, xrefs: 006E9015
Failed to open payload at path: %ls, xrefs: 006E8FE9
Failed to verify catalog signature of payload: %ls, xrefs: 006E9034
c:\agent\_work\79\s\src\burn\engine\cache.cpp, xrefs: 006E8FDC
Failed to verify hash of payload: %ls, xrefs: 006E9058

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: CloseCreateErrorFileHandleLast
String ID: Failed to open payload at path: %ls$Failed to verify catalog signature of payload: %ls$Failed to verify hash of payload: %ls$Failed to verify signature of payload: %ls$c:\agent\_work\79\s\src\burn\engine\cache.cpp
API String ID: 2528220319-954720915
Opcode ID: e22a731cd1b7f3e9f77f7ee81ff0f663cd19c16fae5e8a66b074202380890b32
Instruction ID: 1fced8f016732e1dc7d6b4b2ef2dbdc8560c42a42c9615504f516b1b4bfc0a21
Opcode Fuzzy Hash: e22a731cd1b7f3e9f77f7ee81ff0f663cd19c16fae5e8a66b074202380890b32
Instruction Fuzzy Hash: E3214932942775BBDB331A6A9C49FDB7A1BBF007B0F104219FC10262D093359DA0DAE4

Function 006D6B30 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 87COMMON

Download Yara Rule

APIs

GetWindowsDirectoryW.KERNEL32(?,00000104), ref: 006D6B7B
GetLastError.KERNEL32 ref: 006D6B85
GetVolumePathNameW.KERNEL32(?,?,00000104), ref: 006D6BC9
GetLastError.KERNEL32 ref: 006D6BD3

Strings

Failed to get volume path name., xrefs: 006D6C01
c:\agent\_work\79\s\src\burn\engine\variable.cpp, xrefs: 006D6BA9, 006D6BF7
Failed to set variant value., xrefs: 006D6C1D
Failed to get windows directory., xrefs: 006D6BB3

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: ErrorLast$DirectoryNamePathVolumeWindows
String ID: Failed to get volume path name.$Failed to get windows directory.$Failed to set variant value.$c:\agent\_work\79\s\src\burn\engine\variable.cpp
API String ID: 124030351-1828470348
Opcode ID: e2e3b19970559746c743036c6ae91dfc6b104f2b268ef2a0470fd6902101736e
Instruction ID: 207cafc7f39b36b197698fc9af54755ddccb0fa495cb085449e4969e34ae53e1
Opcode Fuzzy Hash: e2e3b19970559746c743036c6ae91dfc6b104f2b268ef2a0470fd6902101736e
Instruction Fuzzy Hash: A921EAB3E4123973D73096588C05FDB766D9F44B10F01816BFE04F7381EA38AE4046A9

Function 006D9C2D Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 82COMMON

Download Yara Rule

APIs

_MREFOpen@16.MSPDB140-MSVCRT ref: 006D9C46
GetFileAttributesW.KERNEL32(00000000,000002C0,?,00000000,00000000,000002C0,00000100,000002C0,?,006DA86A,00000100,000002C0,000002C0,?,000002C0,00000100), ref: 006D9C5E
GetLastError.KERNEL32(?,006DA86A,00000100,000002C0,000002C0,?,000002C0,00000100,000002C0,000002C0,00000100), ref: 006D9C6B

Strings

c:\agent\_work\79\s\src\burn\engine\search.cpp, xrefs: 006D9C9B
Failed get to file attributes. '%ls', xrefs: 006D9CA8
Failed to format variable string., xrefs: 006D9C51
File search: %ls, did not find path: %ls, xrefs: 006D9CBD
Failed to set variable., xrefs: 006D9CF4

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: AttributesErrorFileLastOpen@16
String ID: Failed get to file attributes. '%ls'$Failed to format variable string.$Failed to set variable.$File search: %ls, did not find path: %ls$c:\agent\_work\79\s\src\burn\engine\search.cpp
API String ID: 1811509786-1797638888
Opcode ID: add57fca6f8e5df1a548561b7b35578e198829a30e913fc2888c5e76288b9342
Instruction ID: e05555f2abe0f8a79f90375e916abbd217fe42f17be0baa3575267110ed127ea
Opcode Fuzzy Hash: add57fca6f8e5df1a548561b7b35578e198829a30e913fc2888c5e76288b9342
Instruction Fuzzy Hash: 56212933E50121F7DB1166688D0BFDEB6A7AF00720F114126FD01A73D0E7759D50A6E5

Function 006EAC27 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 64COMMON

Download Yara Rule

APIs

TlsSetValue.KERNEL32(?,?), ref: 006EAC3E
GetLastError.KERNEL32 ref: 006EAC48
CoInitializeEx.OLE32(00000000,00000000), ref: 006EAC87
CoUninitialize.OLE32(?,006EC5DF,?,?), ref: 006EACC4

Strings

Failed to set elevated cache pipe into thread local storage for logging., xrefs: 006EAC76
c:\agent\_work\79\s\src\burn\engine\elevation.cpp, xrefs: 006EAC6C
Failed to initialize COM., xrefs: 006EAC93
Failed to pump messages in child process., xrefs: 006EACB2

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: ErrorInitializeLastUninitializeValue
String ID: Failed to initialize COM.$Failed to pump messages in child process.$Failed to set elevated cache pipe into thread local storage for logging.$c:\agent\_work\79\s\src\burn\engine\elevation.cpp
API String ID: 876858697-3953973340
Opcode ID: d3ba049e5b418075aed07953f8c33e533fb5009289da65b6925be4f362254c04
Instruction ID: b21a3b54ab5ceb9853d0b97f8dabf1e80b475c5ca519c0886d618a7df36554b2
Opcode Fuzzy Hash: d3ba049e5b418075aed07953f8c33e533fb5009289da65b6925be4f362254c04
Instruction Fuzzy Hash: 6E113673942371BB9711179A9D099CBBE6AEF04F207224119FD01B7280EB68BE00C6D5

Function 006D5D14 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 53registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32(00000000,?,00000000,CommonFilesDir,?,80000002,SOFTWARE\Microsoft\Windows\CurrentVersion,00020119,00000000), ref: 006D5D9A

Part of subcall function 007113B0: RegQueryValueExW.ADVAPI32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000002,00000001,00000000,00000000,00000000,00000000,00000000), ref: 00711426
Part of subcall function 007113B0: RegQueryValueExW.ADVAPI32(?,00000000,00000000,?,00000000,00000000,00000000,?), ref: 0071145E

Strings

SOFTWARE\Microsoft\Windows\CurrentVersion, xrefs: 006D5D37
+, xrefs: 006D5D1C
Failed to ensure path was backslash terminated., xrefs: 006D5D84
CommonFilesDir, xrefs: 006D5D22, 006D5D56, 006D5D65
ProgramFilesDir, xrefs: 006D5D29
Failed to read folder path for '%ls'., xrefs: 006D5D66
Failed to open Windows folder key., xrefs: 006D5D4C

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: QueryValue$Close
String ID: +$CommonFilesDir$Failed to ensure path was backslash terminated.$Failed to open Windows folder key.$Failed to read folder path for '%ls'.$ProgramFilesDir$SOFTWARE\Microsoft\Windows\CurrentVersion
API String ID: 1979452859-3209209246
Opcode ID: 461d2a402d6449e2973bec2c3271918a125bcff18ea62e85ab17574f16c5ec09
Instruction ID: f82b0ae5b4b46799ddc366ed5ff87dd1c8b0c5ff5c07ab41ca0870554624f947
Opcode Fuzzy Hash: 461d2a402d6449e2973bec2c3271918a125bcff18ea62e85ab17574f16c5ec09
Instruction Fuzzy Hash: 84019672D00538FBCB325A5C9C0AEDE766ADF11760F114116F90676390D6B88E80DAE8

Function 0070C5B2 Relevance: 12.6, APIs: 6, Strings: 1, Instructions: 319fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleCP.KERNEL32(Y[p,00000000,00000000), ref: 0070C5FA
__fassign.LIBCMT ref: 0070C7D9
__fassign.LIBCMT ref: 0070C7F6
WriteFile.KERNEL32(?,00000000,00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,00000000), ref: 0070C83E
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 0070C87E
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000), ref: 0070C92A

Strings

Y[p, xrefs: 0070C5DA

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: FileWrite__fassign$ConsoleErrorLast
String ID: Y[p
API String ID: 4031098158-2506504590
Opcode ID: 62e3adf0c990c643839127ca8af2b0b0a50d22fdcd40e7bcc47ed8b43fb700c6
Instruction ID: 0c466c0f959ae98ebe0d9895a2e5f40bf33210f5bb3bbfbc364ee0c3f7526c88
Opcode Fuzzy Hash: 62e3adf0c990c643839127ca8af2b0b0a50d22fdcd40e7bcc47ed8b43fb700c6
Instruction Fuzzy Hash: 48D18A71D00258DFDB16CFA8C8809EDBBF5FF48314F28426AE855BB282D735A946CB54

Function 006F9FC5 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 173COMMON

Download Yara Rule

APIs

SetFileAttributesW.KERNEL32(?,00000000,?,00000000,?,?,?,00000000,00000000,?), ref: 006FA092
GetLastError.KERNEL32(?,?,?,00000000,00000000,?), ref: 006FA09C

Strings

c:\agent\_work\79\s\src\burn\engine\apply.cpp, xrefs: 006FA0C0
:, xrefs: 006FA115
Failed to clear readonly bit on payload destination path: %ls, xrefs: 006FA0CB
download, xrefs: 006FA05C
Failed attempt to download URL: '%ls' to: '%ls', xrefs: 006FA179

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: AttributesErrorFileLast
String ID: :$Failed attempt to download URL: '%ls' to: '%ls'$Failed to clear readonly bit on payload destination path: %ls$c:\agent\_work\79\s\src\burn\engine\apply.cpp$download
API String ID: 1799206407-2052441727
Opcode ID: 711b52cc839f243402373a28dc64f27f76579fba3b9120ff9ece5642f8d2dad2
Instruction ID: 3b2fdeb16460c8b40fcd16f0e600b4c2475b286192e50eee9e20644f79fbcd81
Opcode Fuzzy Hash: 711b52cc839f243402373a28dc64f27f76579fba3b9120ff9ece5642f8d2dad2
Instruction Fuzzy Hash: 4B519EB1A0021DABDB10DFA8C841AFEB7B6FF14714F118169EA09EB350E775DA41CB91

Function 007186DE Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 157COMMON

Download Yara Rule

APIs

Part of subcall function 006D39DF: GetProcessHeap.KERNEL32(?,000001C7,?,006D237C,?,00000001,80004005,8007139F,?,?,0071058B,8007139F,?,00000000,00000000,8007139F), ref: 006D39F0
Part of subcall function 006D39DF: RtlAllocateHeap.NTDLL(00000000,?,006D237C,?,00000001,80004005,8007139F,?,?,0071058B,8007139F,?,00000000,00000000,8007139F), ref: 006D39F7

CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,http://appsyndication.org/2006/appsyn,000000FF,00000010,00000001,00000000,00000000,00000410,?,?,006F8DC0,000002C0,00000100), ref: 0071870C
CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,application,000000FF,?,?,006F8DC0,000002C0,00000100,000002C0,000002C0,00000100,000002C0,00000410), ref: 00718727

Strings

type, xrefs: 0071874E
c:\agent\_work\79\s\src\libs\dutil\apuputil.cpp, xrefs: 007187C2
application, xrefs: 00718719
http://appsyndication.org/2006/appsyn, xrefs: 007186FF

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: CompareHeapString$AllocateProcess
String ID: application$c:\agent\_work\79\s\src\libs\dutil\apuputil.cpp$http://appsyndication.org/2006/appsyn$type
API String ID: 2664528157-1835457522
Opcode ID: 753ff7dd8732e624208a9945a4c5bdfd6fc3b61bfa46045e5f000fc776bf0ef7
Instruction ID: 11b0a02175c1fcb8969a45efa33b7bb317443d879baeac4e21ed436221406186
Opcode Fuzzy Hash: 753ff7dd8732e624208a9945a4c5bdfd6fc3b61bfa46045e5f000fc776bf0ef7
Instruction Fuzzy Hash: D451E671A40301ABEBA49F5CCC82F9A77A5AF00770F248119F965AB3D5DB78ED80CB15

Function 007166F4 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 153fileCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00716750
DeleteFileW.KERNEL32(00000410,00000000,00000000,?,?,00000078,000000FF,00000410,?,?,?,00000078,000000FF,?,?,00000078), ref: 00716847
CloseHandle.KERNEL32(000000FF,00000000,00000000,?,?,00000078,000000FF,00000410,?,?,?,00000078,000000FF,?,?,00000078), ref: 00716856

Strings

DownloadTimeout, xrefs: 00716789
c:\agent\_work\79\s\src\libs\dutil\dlutil.cpp, xrefs: 00716774
WiX\Burn, xrefs: 0071678E
Burn, xrefs: 0071673F

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: CloseDeleteErrorFileHandleLast
String ID: Burn$DownloadTimeout$WiX\Burn$c:\agent\_work\79\s\src\libs\dutil\dlutil.cpp
API String ID: 3522763407-926787482
Opcode ID: 444bad2607c462988550bd859c89b9893a3b394cbee352e82543c4670dd65c77
Instruction ID: ce189c33792b96f19e7e704e73c153940d41b55f4f45094cb0c857426cc906d2
Opcode Fuzzy Hash: 444bad2607c462988550bd859c89b9893a3b394cbee352e82543c4670dd65c77
Instruction Fuzzy Hash: C151FE76D00219FFDF119FE88D45EEEBBB9AF08710F008155FA14E6190E7399A519BA0

Function 006E916B Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 138COMMON

Download Yara Rule

APIs

_memcmp.LIBVCRUNTIME ref: 006E91F9

Part of subcall function 00715922: GetLastError.KERNEL32(?,?,006E921E,62206465,00000003,006D54C6,?), ref: 00715941

_memcmp.LIBVCRUNTIME ref: 006E9233
GetLastError.KERNEL32 ref: 006E92AB

Strings

Failed to read certificate thumbprint., xrefs: 006E929F
Failed to get certificate public key identifier., xrefs: 006E92D9
c:\agent\_work\79\s\src\burn\engine\cache.cpp, xrefs: 006E92CF
Failed to find expected public key in certificate chain., xrefs: 006E926E

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: ErrorLast_memcmp
String ID: Failed to find expected public key in certificate chain.$Failed to get certificate public key identifier.$Failed to read certificate thumbprint.$c:\agent\_work\79\s\src\burn\engine\cache.cpp
API String ID: 3428363238-3586228532
Opcode ID: 0de1b138009e9526a7bec69f615939c1cc4b52227cbcc4eef0a7e943a6f8c03f
Instruction ID: 1c840a0edebe8a67a20eebd9943289971ba9e86de28dbcee2fe87681313f09ac
Opcode Fuzzy Hash: 0de1b138009e9526a7bec69f615939c1cc4b52227cbcc4eef0a7e943a6f8c03f
Instruction Fuzzy Hash: 47413D72E11315AFDB10DAA9C841AEAB7BABF08710F014169EA05BB341D674EE40CBA4

Function 006E0536 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 132registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32(00000000,00000001,00000000,00000001,00000000,?,?,00020006,00000000,?,00000001,00000000,?), ref: 006E0667
RegCloseKey.ADVAPI32(00000000,00000001,00000000,00000001,00000000,?,?,00020006,00000000,?,00000001,00000000,?), ref: 006E0676

Part of subcall function 00710EF7: RegCreateKeyExW.ADVAPI32(00000001,00000000,00000000,00000000,00000000,00000001,00000000,?,00000000,00000001,?,?,006E05AE,?,00000000,00020006), ref: 00710F1C

Strings

Failed to delete registration key: %ls, xrefs: 006E0615
%ls.RebootRequired, xrefs: 006E0584
Failed to open registration key., xrefs: 006E06AC
Failed to update resume mode., xrefs: 006E064B
Failed to write volatile reboot required registry key., xrefs: 006E05B2

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: Close$Create
String ID: %ls.RebootRequired$Failed to delete registration key: %ls$Failed to open registration key.$Failed to update resume mode.$Failed to write volatile reboot required registry key.
API String ID: 359002179-2517785395
Opcode ID: 4954f07efaf1c0a7d74a726ba945afcff118b312d13ee5598cc7238a02410aee
Instruction ID: bd2dc299ec82a0372cbf3955608f9289f7aedfc07a97084334df69cc6012ab1f
Opcode Fuzzy Hash: 4954f07efaf1c0a7d74a726ba945afcff118b312d13ee5598cc7238a02410aee
Instruction Fuzzy Hash: AF41B271801354FBEF22AFA6DC06EAF7BBBAF90700F104019F50162151D7B59AA0DF51

Function 00710618 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 122COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(00000000,?,00000104,00000000,00000000,00000000), ref: 0071065C
GetComputerNameW.KERNEL32(?,?), ref: 007106B4

Strings

Executable: %ls v%d.%d.%d.%d, xrefs: 00710710
=== Logging started: %ls ===, xrefs: 007106DF
--- logging level: %hs ---, xrefs: 00710774
js, xrefs: 0071076D
Computer : %ls, xrefs: 00710722

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: Name$ComputerFileModule
String ID: --- logging level: %hs ---$=== Logging started: %ls ===$Computer : %ls$Executable: %ls v%d.%d.%d.%d$js
API String ID: 2577110986-4168519870
Opcode ID: 84947d56feaa3627d54eb481b744860c8564059ff9fdfc02d5c800dc59dfad39
Instruction ID: 921a728ca3adfae0bb52206e204ad9899d804b8ed33b05ac4b7b3dd25847f396
Opcode Fuzzy Hash: 84947d56feaa3627d54eb481b744860c8564059ff9fdfc02d5c800dc59dfad39
Instruction Fuzzy Hash: 2A4156F590011CABDF109B68DD49AEA77BCEB44340F4481A9F605E3192D778AEC48FE8

Function 006DF7B1 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 116registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32(?,?,?,00000001,?,?,?,00000001,00000000,?,00000000,?,?,?,00000000,?), ref: 006DF8E1
RegCloseKey.ADVAPI32(00000000,?,?,00000001,?,?,?,00000001,00000000,?,00000000,?,?,?,00000000,?), ref: 006DF8EE

Strings

Resume, xrefs: 006DF855
%ls.RebootRequired, xrefs: 006DF7CE
Failed to open registration key., xrefs: 006DF84A
Failed to format pending restart registry key to read., xrefs: 006DF7E5
Failed to read Resume value., xrefs: 006DF877

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: Close
String ID: %ls.RebootRequired$Failed to format pending restart registry key to read.$Failed to open registration key.$Failed to read Resume value.$Resume
API String ID: 3535843008-3890505273
Opcode ID: 02cd87363c8ff18bcf9233421383201a3bf8832eff2b04a38de120a496e5b5cd
Instruction ID: edb597a519c04a6643406214bed39ca260568a7a8b6ae6fca3be17b60c85f531
Opcode Fuzzy Hash: 02cd87363c8ff18bcf9233421383201a3bf8832eff2b04a38de120a496e5b5cd
Instruction Fuzzy Hash: E8413871D04219FFDB119F98D881AE9BBB6FF04314F158177E812AB350C375AE81AB82

Function 00710841 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 116fileCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(0073C6EC,00000000,?,?,?,006E418F,00000000,Setup,_Failed,txt,00000000,00000000,00000000,00000001,006D5537,?), ref: 00710851
CreateFileW.KERNEL32(40000000,00000001,00000000,00000000,00000080,00000000,?,00000000,?,?,?,0073C6E4,?,006E418F,00000000,Setup), ref: 007108F5
GetLastError.KERNEL32(?,006E418F,00000000,Setup,_Failed,txt,00000000,00000000,00000000,00000001,006D5537,?,?,?), ref: 00710905
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002,?,006E418F,00000000,Setup,_Failed,txt,00000000,00000000,00000000,00000001,006D5537,?), ref: 0071093F

Part of subcall function 006D2EBC: GetLocalTime.KERNEL32(?,?,?,?,?,?), ref: 006D3006

LeaveCriticalSection.KERNEL32(0073C6EC,?,?,0073C6E4,?,006E418F,00000000,Setup,_Failed,txt,00000000,00000000,00000000,00000001,006D5537,?), ref: 00710998

Strings

7Um, xrefs: 0071086E
c:\agent\_work\79\s\src\libs\dutil\logutil.cpp, xrefs: 00710924

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: CriticalFileSection$CreateEnterErrorLastLeaveLocalPointerTime
String ID: 7Um$c:\agent\_work\79\s\src\libs\dutil\logutil.cpp
API String ID: 4111229724-3527942410
Opcode ID: 78b70ab5eda178fed53a6adb9fcf3def70030c79339bb51516e30534f5e644f7
Instruction ID: 8bbaa066de2ed3218c90e68c517aacff52b7a326ffa07c6bf64a5ff2d306d50d
Opcode Fuzzy Hash: 78b70ab5eda178fed53a6adb9fcf3def70030c79339bb51516e30534f5e644f7
Instruction Fuzzy Hash: 6331B672900229EFFB125FB89D66AEE3669AB00751F00D126F900F6292D7B9DDC097D4

Function 006F374C Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 111COMMON

Download Yara Rule

APIs

_MREFOpen@16.MSPDB140-MSVCRT ref: 006F37B3

Strings

Failed to escape string., xrefs: 006F3835
feclient.dll, xrefs: 006F378E, 006F37AF
Failed to format property value., xrefs: 006F383C
Failed to append property string part., xrefs: 006F3827
Failed to format property string part., xrefs: 006F382E
%s%="%s", xrefs: 006F37E6

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: Open@16
String ID: %s%="%s"$Failed to append property string part.$Failed to escape string.$Failed to format property string part.$Failed to format property value.$feclient.dll
API String ID: 3613110473-656185529
Opcode ID: 0ce8ee4a139df5ee80f4b9208944a5783f3729ae2bda3521a2aebbb3c80526fd
Instruction ID: 4a6eedb92a4c88dae52f4a7b3836cfd9fc329669e787f1c3a227e17749816d08
Opcode Fuzzy Hash: 0ce8ee4a139df5ee80f4b9208944a5783f3729ae2bda3521a2aebbb3c80526fd
Instruction Fuzzy Hash: 9E31B0B1D0023AFBDB15AE94DC41EAEBB7AAF00750F10016AFA1166351E774EF10DB94

Function 006EA8F2 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 110COMMON

Download Yara Rule

Strings

Failed to determine length of relative path., xrefs: 006EA93F
Failed to determine length of source path., xrefs: 006EA922
WixBundleLastUsedSource, xrefs: 006EA991, 006EA997, 006EA9D3
Failed to set last source., xrefs: 006EA9E2
Failed to trim source folder., xrefs: 006EA987

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID:
String ID: Failed to determine length of relative path.$Failed to determine length of source path.$Failed to set last source.$Failed to trim source folder.$WixBundleLastUsedSource
API String ID: 0-660234312
Opcode ID: f9fd11d62cdb5f17b246476a44d42522b50553e1e12cc66c1d83f75dbfaad40f
Instruction ID: e8dcf4ee407b9c691d3345d7c520dd9b75a7a7f373fa418b3f384c4f0b3b80b7
Opcode Fuzzy Hash: f9fd11d62cdb5f17b246476a44d42522b50553e1e12cc66c1d83f75dbfaad40f
Instruction Fuzzy Hash: A931EA31D51369BBCF229BD9CC41E9E7BBBEB00720F214226F410B72D2D670AE41C691

Function 006FD593 Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 105comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(007311A0,00000000,00000017,007311B0,?,?,00000000,00000000,?,?,?,?,?,006FDBB9,00000000,00000000), ref: 006FD5CB

Strings

Failed to create BITS job., xrefs: 006FD605
Failed to create IBackgroundCopyManager., xrefs: 006FD5D7
WixBurn, xrefs: 006FD5F6
Failed to set BITS job to foreground., xrefs: 006FD64C
Failed to set progress timeout., xrefs: 006FD635
Failed to set notification flags for BITS job., xrefs: 006FD61D

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: CreateInstance
String ID: Failed to create BITS job.$Failed to create IBackgroundCopyManager.$Failed to set BITS job to foreground.$Failed to set notification flags for BITS job.$Failed to set progress timeout.$WixBurn
API String ID: 542301482-468763447
Opcode ID: b385613da50c594002ace1562ed58eb0b3d0a38c913c8a47656995add99feea1
Instruction ID: 9806d5be02a93ca37cbffb20452c95d781bdc3274a61524ef9c84f05923a3354
Opcode Fuzzy Hash: b385613da50c594002ace1562ed58eb0b3d0a38c913c8a47656995add99feea1
Instruction Fuzzy Hash: 153182B1A0021DAFD715DBA8C845EBFBBB6AF48714F104159FA05EB391CA34EC028B90

Function 00715FF1 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 99fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,C0000000,00000004,00000000,00000004,00000080,00000000,00000000,?,?,?,?,?,WiX\Burn,DownloadTimeout,00000078), ref: 0071603B
GetLastError.KERNEL32 ref: 00716048
ReadFile.KERNEL32(00000000,00000008,00000008,?,00000000), ref: 0071608F
GetLastError.KERNEL32 ref: 007160C3
CloseHandle.KERNEL32(00000000,c:\agent\_work\79\s\src\libs\dutil\dlutil.cpp,000000C8,00000000), ref: 007160F7

Strings

%ls.R, xrefs: 0071600F
c:\agent\_work\79\s\src\libs\dutil\dlutil.cpp, xrefs: 0071606C, 007160E7

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: ErrorFileLast$CloseCreateHandleRead
String ID: %ls.R$c:\agent\_work\79\s\src\libs\dutil\dlutil.cpp
API String ID: 3160720760-1867622455
Opcode ID: 9b5d141a3ac1c6346132c2aeacd5db032a0969ab67b0306a3b8654e8720f4c1b
Instruction ID: 3ce52b3836cf96ee789f306b3936369a9d18ddbdaf3777f8a966d8db09ee544f
Opcode Fuzzy Hash: 9b5d141a3ac1c6346132c2aeacd5db032a0969ab67b0306a3b8654e8720f4c1b
Instruction Fuzzy Hash: 2431FB72941225ABE7208F5CCC45FEE7AA4AF09721F118259FE10EB2C1D7789D40D6A5

Function 006DC8A5 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 97fileCOMMON

Download Yara Rule

APIs

Part of subcall function 006DCD19: CompareStringW.KERNEL32(0000007F,00000000,00000000,000000FF,006DE3EA,000000FF,00000000,00000000,006DE3EA,?,?,006DDB91,?,?,?,?), ref: 006DCD44

CreateFileW.KERNEL32(E90071BA,80000000,00000005,00000000,00000003,08000000,00000000,006D5402,?,00000000,840F01E8,E0680A79,00000001,006D53FA,00000000,006D54C6), ref: 006DC915
GetLastError.KERNEL32(?,?,?,006E770F,006D56AA,006D54B6,006D54B6,00000000,?,006D54C6,FFF9E89D,006D54C6,006D54FA,006D5482,?,006D5482), ref: 006DC95A

Strings

c:\agent\_work\79\s\src\burn\engine\catalog.cpp, xrefs: 006DC97B
Failed to open catalog in working path: %ls, xrefs: 006DC988
Failed to find payload for catalog file., xrefs: 006DC99F
Failed to verify catalog signature: %ls, xrefs: 006DC953
Failed to get catalog local file path, xrefs: 006DC998

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: CompareCreateErrorFileLastString
String ID: Failed to find payload for catalog file.$Failed to get catalog local file path$Failed to open catalog in working path: %ls$Failed to verify catalog signature: %ls$c:\agent\_work\79\s\src\burn\engine\catalog.cpp
API String ID: 1774366664-2195853170
Opcode ID: b1950cb864911289c1873d850e12312f570c89d9e2e3cd840d0b121152e9c34b
Instruction ID: c42f898f3905c5f19d019265b7b9c81a2e63a1c607f7980c8a62d7f150cc1abd
Opcode Fuzzy Hash: b1950cb864911289c1873d850e12312f570c89d9e2e3cd840d0b121152e9c34b
Instruction Fuzzy Hash: 9F31D572D0062ABFD7219B68CC15F9ABB66AF04760F118226F904FF380E674E950CBD4

Function 00710C53 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 91processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNEL32(00000001,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,?,?,?,?,00000000,00000000), ref: 00710CC3
GetLastError.KERNEL32(?,?,?,?,00000000,00000000,00000000), ref: 00710CCD
CloseHandle.KERNEL32(?,?,?,?,?,00000000,00000000,00000000), ref: 00710D16
CloseHandle.KERNEL32(00000000,?,?,?,?,00000000,00000000,00000000), ref: 00710D23

Strings

D, xrefs: 00710CAB
c:\agent\_work\79\s\src\libs\dutil\procutil.cpp, xrefs: 00710CF1
"%ls" %ls, xrefs: 00710C8C

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: CloseHandle$CreateErrorLastProcess
String ID: "%ls" %ls$D$c:\agent\_work\79\s\src\libs\dutil\procutil.cpp
API String ID: 161867955-3306605438
Opcode ID: 63d4cbdab2c7d86d1485df107da2ee568a2740adba72ca1661bd28c7b9485d67
Instruction ID: 4213415908b78aacbbfe22b4df34abab77fe9c817342af646f5dd33148f7fbc3
Opcode Fuzzy Hash: 63d4cbdab2c7d86d1485df107da2ee568a2740adba72ca1661bd28c7b9485d67
Instruction Fuzzy Hash: 14214F71D0021EABDB119FE8DD419EEBBB9EF04710F11402AEA01B6290D7B49E809BE5

Function 006FD038 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 86synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF,759230B0,00000000,?,?,?,006FD334,?), ref: 006FD057
ReleaseMutex.KERNEL32(?,?,?,006FD334,?), ref: 006FD06B
WaitForSingleObject.KERNEL32(?,000000FF), ref: 006FD0B0
ReleaseMutex.KERNEL32(?), ref: 006FD0C3
SetEvent.KERNEL32(?), ref: 006FD0CC

Strings

Failed to get message from netfx chainer., xrefs: 006FD0ED
Failed to send files in use message from netfx chainer., xrefs: 006FD110

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: MutexObjectReleaseSingleWait$Event
String ID: Failed to get message from netfx chainer.$Failed to send files in use message from netfx chainer.
API String ID: 2608678126-3424578679
Opcode ID: 12ec05b0e71cae7b5008aad377088aad2771ad892bf2261fb36e40baf3b59421
Instruction ID: 47cb0d7916f24c86896a9c9af6316f8d26eab1b16ef581bd6e8d04e76677a6d4
Opcode Fuzzy Hash: 12ec05b0e71cae7b5008aad377088aad2771ad892bf2261fb36e40baf3b59421
Instruction Fuzzy Hash: AC31E87290011EBFCB018F68CC45EFDBBBABF15324F148265F514A2291CB74E9549B90

Function 006D9B5C Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 74COMMON

Download Yara Rule

APIs

_MREFOpen@16.MSPDB140-MSVCRT ref: 006D9B75
GetFileAttributesW.KERNEL32(00000000,000002C0,?,00000000,00000000,000002C0,00000100,00000000,?,006DA880,00000100,000002C0,000002C0,00000100), ref: 006D9B95
GetLastError.KERNEL32(?,006DA880,00000100,000002C0,000002C0,00000100), ref: 006D9BA0

Strings

Failed to format variable string., xrefs: 006D9B80
Failed while searching directory search: %ls, for path: %ls, xrefs: 006D9BF6
Directory search: %ls, did not find path: %ls, reason: 0x%x, xrefs: 006D9C0C
Failed to set directory search path variable., xrefs: 006D9BD1

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: AttributesErrorFileLastOpen@16
String ID: Directory search: %ls, did not find path: %ls, reason: 0x%x$Failed to format variable string.$Failed to set directory search path variable.$Failed while searching directory search: %ls, for path: %ls
API String ID: 1811509786-2966038646
Opcode ID: f97e183a922998eb6e99d9ec62289a70a610adab0babeda08a6261239ed7aa7b
Instruction ID: 42c463ed276d263d0477af4c83bab34c74770d7222eeac396198020ee33d7614
Opcode Fuzzy Hash: f97e183a922998eb6e99d9ec62289a70a610adab0babeda08a6261239ed7aa7b
Instruction Fuzzy Hash: 40112632C40125F7CB121A8C9D06FDEBA67AF00320F224213FC05763A0D7299E90AAE5

Function 006D9D11 Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 71COMMON

Download Yara Rule

APIs

_MREFOpen@16.MSPDB140-MSVCRT ref: 006D9D2A
GetFileAttributesW.KERNEL32(00000000,000002C0,?,00000000,00000000,000002C0,00000100,000002C0,?,006DA858,00000100,000002C0,000002C0,?,000002C0,00000100), ref: 006D9D4A
GetLastError.KERNEL32(?,006DA858,00000100,000002C0,000002C0,?,000002C0,00000100,000002C0,000002C0,00000100), ref: 006D9D55

Strings

Failed to format variable string., xrefs: 006D9D35
Failed to set variable to file search path., xrefs: 006D9DAD
File search: %ls, did not find path: %ls, xrefs: 006D9DB9
Failed while searching file search: %ls, for path: %ls, xrefs: 006D9D83

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: AttributesErrorFileLastOpen@16
String ID: Failed to format variable string.$Failed to set variable to file search path.$Failed while searching file search: %ls, for path: %ls$File search: %ls, did not find path: %ls
API String ID: 1811509786-3425311760
Opcode ID: c84efeb0fec47aa7e1cc9042a5acecf0dfcd0fce9f190c63cbe7d679020a4e1f
Instruction ID: 7b07c72ef7218e72cf96f44f7fe01011c601dd76efbcb330bc3b6e3f4b5c8975
Opcode Fuzzy Hash: c84efeb0fec47aa7e1cc9042a5acecf0dfcd0fce9f190c63cbe7d679020a4e1f
Instruction Fuzzy Hash: 1E11E433D40925FBDB226A988C06BDDBA37AF15720F214113FC00B63A1D7759E50ABE5

Function 006D9A0E Relevance: 12.3, APIs: 1, Strings: 6, Instructions: 56COMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32(00000000), ref: 006D9A85

Strings

Failed to get Condition inner text., xrefs: 006D9A55
Condition, xrefs: 006D9A20
`)u, xrefs: 006D9A85
Failed to select condition node., xrefs: 006D9A3C
Failed to copy condition string from BSTR, xrefs: 006D9A6F
BTm, xrefs: 006D9A0E

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: FreeString
String ID: BTm$Condition$Failed to copy condition string from BSTR$Failed to get Condition inner text.$Failed to select condition node.$`)u
API String ID: 3341692771-3360982573
Opcode ID: a1142484d0ad95f14dbf7bdef5f047944199f9a61b4a376e83acff4514a99f56
Instruction ID: 51dfdca9864e3df68f9cdb92e264218e0697d8ec56978c0b5a49c936b01e2257
Opcode Fuzzy Hash: a1142484d0ad95f14dbf7bdef5f047944199f9a61b4a376e83acff4514a99f56
Instruction Fuzzy Hash: 8511A572E40224FBDB25A798DC06BEE7B769F00710F150156F801B6394D7759F409BA0

Function 006ECDDD Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 54synchronizationthreadCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000493E0,00000000,?,?,006ED204,00000000,?,?,006EC687,?,?,?,?,?,006D54A3), ref: 006ECDEF
GetLastError.KERNEL32(?,?,006ED204,00000000,?,?,006EC687,?,?,?,?,?,006D54A3,?,?,?), ref: 006ECDF9
GetExitCodeThread.KERNEL32(?,?,?,?,006ED204,00000000,?,?,006EC687,?,?,?,?,?,006D54A3,?), ref: 006ECE35
GetLastError.KERNEL32(?,?,006ED204,00000000,?,?,006EC687,?,?,?,?,?,006D54A3,?,?,?), ref: 006ECE3F

Strings

Failed to get cache thread exit code., xrefs: 006ECE6D
c:\agent\_work\79\s\src\burn\engine\elevation.cpp, xrefs: 006ECE1D, 006ECE63
Failed to wait for cache thread to terminate., xrefs: 006ECE27

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: ErrorLast$CodeExitObjectSingleThreadWait
String ID: Failed to get cache thread exit code.$Failed to wait for cache thread to terminate.$c:\agent\_work\79\s\src\burn\engine\elevation.cpp
API String ID: 3686190907-4103082216
Opcode ID: 2739f0c5e8c791f28389a8ca877597ae8a74db7af90ccd7f1052722fbed4a216
Instruction ID: 75cca603a3e8abfc23c40fa21e2d71eb84af9dfcf08c424b0a4102f557e6647e
Opcode Fuzzy Hash: 2739f0c5e8c791f28389a8ca877597ae8a74db7af90ccd7f1052722fbed4a216
Instruction Fuzzy Hash: 9A01F5B3E42371A3E220575A5D0AB9F7956BF04BA1B028125FD01BB2C0E76CDD1195E9

Function 006E68AB Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 53synchronizationthreadCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(00000001,000000FF,00000000,?,006E6DE6,?,?,00000000,crypt32.dll,00000000,00000001), ref: 006E68B8
GetLastError.KERNEL32(?,006E6DE6,?,?,00000000,crypt32.dll,00000000,00000001), ref: 006E68C2
GetExitCodeThread.KERNEL32(00000001,00000000,?,006E6DE6,?,?,00000000,crypt32.dll,00000000,00000001), ref: 006E6901
GetLastError.KERNEL32(?,006E6DE6,?,?,00000000,crypt32.dll,00000000,00000001), ref: 006E690B

Strings

Failed to get cache thread exit code., xrefs: 006E693C
Failed to wait for cache thread to terminate., xrefs: 006E68F3
c:\agent\_work\79\s\src\burn\engine\core.cpp, xrefs: 006E68E9, 006E6932

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: ErrorLast$CodeExitObjectSingleThreadWait
String ID: Failed to get cache thread exit code.$Failed to wait for cache thread to terminate.$c:\agent\_work\79\s\src\burn\engine\core.cpp
API String ID: 3686190907-2215413561
Opcode ID: 084b19a2c9f0886cd09877d58a6334ac8b28eb76310bf332b7f3ad6871273e9b
Instruction ID: b0dbca513a78b2b08ffab41dc0083a3a73f32f5224da85465ddd516de1d5df7b
Opcode Fuzzy Hash: 084b19a2c9f0886cd09877d58a6334ac8b28eb76310bf332b7f3ad6871273e9b
Instruction Fuzzy Hash: 3C11CC7074135BFBE700DF66DD06BAF36AAAB20750F108069F800DA291DB7DDA009B68

Function 006EAA8E Relevance: 12.1, APIs: 2, Strings: 6, Instructions: 131COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(006D54C6,000000FF,006D5482,006E770F,006D53FA,00000000,?), ref: 006EAB7F
GetLastError.KERNEL32(00000000,00000000,00000000,00000000,006D54C6,000000FF,006D5482,006E770F,006D53FA,00000000,?), ref: 006EABC3

Part of subcall function 006E916B: _memcmp.LIBVCRUNTIME ref: 006E91F9
Part of subcall function 006E916B: _memcmp.LIBVCRUNTIME ref: 006E9233

Strings

Failed to verify expected payload against actual certificate chain., xrefs: 006EAC07
Failed to get signer chain from authenticode certificate., xrefs: 006EABF1
Failed authenticode verification of payload: %ls, xrefs: 006EAB60
Failed to get provider state from authenticode certificate., xrefs: 006EABAD
c:\agent\_work\79\s\src\burn\engine\cache.cpp, xrefs: 006EAB55, 006EABA3, 006EABE7
0, xrefs: 006EAAFB

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: ErrorLast_memcmp
String ID: 0$Failed authenticode verification of payload: %ls$Failed to get provider state from authenticode certificate.$Failed to get signer chain from authenticode certificate.$Failed to verify expected payload against actual certificate chain.$c:\agent\_work\79\s\src\burn\engine\cache.cpp
API String ID: 3428363238-2984648607
Opcode ID: ce3ff0c62f4e70ce17e8d4622688e23509475027b204e341149b590524b9b3ea
Instruction ID: db05a900e62d95dea2b2044c5cabda9792f35667e54e72515a00a65c4b9c0aaa
Opcode Fuzzy Hash: ce3ff0c62f4e70ce17e8d4622688e23509475027b204e341149b590524b9b3ea
Instruction Fuzzy Hash: 8841C7B2D013699BDB14DBD5D945ADEBBB9AF04710F11422EF801BB380E778AD048BE5

Function 006EF639 Relevance: 12.1, APIs: 2, Strings: 6, Instructions: 117COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 006EF64E
LeaveCriticalSection.KERNEL32(?), ref: 006EF75B

Strings

UX requested unknown container with id: %ls, xrefs: 006EF71A
Engine is active, cannot change engine state., xrefs: 006EF668
Failed to set source path for payload., xrefs: 006EF6EA
UX denied while trying to set source on embedded payload: %ls, xrefs: 006EF6D0
UX requested unknown payload with id: %ls, xrefs: 006EF6BA
Failed to set source path for container., xrefs: 006EF740

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: Engine is active, cannot change engine state.$Failed to set source path for container.$Failed to set source path for payload.$UX denied while trying to set source on embedded payload: %ls$UX requested unknown container with id: %ls$UX requested unknown payload with id: %ls
API String ID: 3168844106-4121889706
Opcode ID: 1885716cb879abb7284a4b2a3e13cd14feb0dab8aa8b75532b5a57059dc36b34
Instruction ID: bfd9483979bc7e456723e17c0e8c498fadfe0983f407eb98f2e409e4e4936bd4
Opcode Fuzzy Hash: 1885716cb879abb7284a4b2a3e13cd14feb0dab8aa8b75532b5a57059dc36b34
Instruction Fuzzy Hash: 663137729013A5BBCF119F5AEC45D9B73BE9F14720715802AF804E7340DB74ED418794

Function 006D720A Relevance: 12.1, APIs: 1, Strings: 7, Instructions: 98stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(00000000), ref: 006D721D

Strings

Failed to format escape sequence., xrefs: 006D72B7
Failed to append escape sequence., xrefs: 006D72B0
Failed to append characters., xrefs: 006D72A9
Failed to allocate buffer for escaped string., xrefs: 006D7234
[]{}, xrefs: 006D7247
[\%c], xrefs: 006D727C
Failed to copy string., xrefs: 006D72D1

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: lstrlen
String ID: Failed to allocate buffer for escaped string.$Failed to append characters.$Failed to append escape sequence.$Failed to copy string.$Failed to format escape sequence.$[\%c]$[]{}
API String ID: 1659193697-3250950999
Opcode ID: e04e5c54d062d032aac467feea57925bb67484b5affe70a3dc309cafe53ab241
Instruction ID: 5432c4b3188accd6508d66a7f01e1408a3d1823a72ccb502f5370e8b34f0cd33
Opcode Fuzzy Hash: e04e5c54d062d032aac467feea57925bb67484b5affe70a3dc309cafe53ab241
Instruction Fuzzy Hash: 12210C72D08255F6DB3196988C46FEE77AA9F14760F200117F800B6380FB78AF4196D9

Function 006F5979 Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 206COMMON

Download Yara Rule

APIs

CompareStringW.KERNEL32(00000000,00000000,0071B500,000000FF,feclient.dll,000000FF,00000000,00000000,?,?,?,006F656D,?,00000001,?,00000000), ref: 006F59E2

Strings

Failed grow array of ordered patches., xrefs: 006F5A7B
Failed to copy target product code., xrefs: 006F5B13
feclient.dll, xrefs: 006F59D8, 006F5B00
Failed to insert execute action., xrefs: 006F5A37
Failed to plan action for target product., xrefs: 006F5A8D

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: CompareString
String ID: Failed grow array of ordered patches.$Failed to copy target product code.$Failed to insert execute action.$Failed to plan action for target product.$feclient.dll
API String ID: 1825529933-3477540455
Opcode ID: f6c7ada922889857e12327347b8e36fd82f0bbadfc2da4fd248e823c96377b7f
Instruction ID: cbaeeacb9a5a9496568c3e7b049476a4684999e8b355fcfb64a905155599346c
Opcode Fuzzy Hash: f6c7ada922889857e12327347b8e36fd82f0bbadfc2da4fd248e823c96377b7f
Instruction Fuzzy Hash: 688116B560475ADFCB14CF58C880AAA77A6FF08324B118669FE169B352D770EC61CF90

Function 006ED2D2 Relevance: 10.6, APIs: 1, Strings: 6, Instructions: 122COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(00000000,?,?,00000001,0071B500,?,00000001,000000FF,?,?,00000000,00000000,00000001,00000000,?,006E73CB), ref: 006ED408

Strings

Failed to elevate., xrefs: 006ED3EA
Failed to connect to elevated child process., xrefs: 006ED3F1
UX aborted elevation requirement., xrefs: 006ED310
c:\agent\_work\79\s\src\burn\engine\elevation.cpp, xrefs: 006ED306
Failed to create pipe and cache pipe., xrefs: 006ED358
Failed to create pipe name and client token., xrefs: 006ED33C

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: CloseHandle
String ID: Failed to connect to elevated child process.$Failed to create pipe and cache pipe.$Failed to create pipe name and client token.$Failed to elevate.$UX aborted elevation requirement.$c:\agent\_work\79\s\src\burn\engine\elevation.cpp
API String ID: 2962429428-1168911150
Opcode ID: ba804d241910e56f1090b889061a64d07b189878e34b9ba2d7ce762030b0d660
Instruction ID: a28928953313fd4a66e78a7c363e4d614a0869945efafe19d5846b7afb961e65
Opcode Fuzzy Hash: ba804d241910e56f1090b889061a64d07b189878e34b9ba2d7ce762030b0d660
Instruction Fuzzy Hash: 17315D72A467B1BBE7256261DC46FEF625FEF01720F20420AF905B72C1DB75AD0086D6

Function 007196CA Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 118registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00711275: RegOpenKeyExW.KERNELBASE(00000000,00000000,00000000,00000000,00000001,0073BB7C,00000000,?,00715A32,80000002,00000000,00020019,00000000,SOFTWARE\Policies\,00000000,00000000), ref: 00711289

RegCloseKey.ADVAPI32(00000001,00000001,crypt32.dll,00000000,00000001,0071B500,00000000,00000001,00000000,00020019,00000001,00000000,00000000,00020019,00000000,00000001), ref: 007197A2
RegCloseKey.ADVAPI32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000001,crypt32.dll,00000000,00000001,0071B500,00000000,00000001,00000000,00020019), ref: 007197DD
RegCloseKey.ADVAPI32(00000001,00000001,00020019,00000000,00000000,00000000,00000000,00000000,crypt32.dll), ref: 007197F9
RegCloseKey.ADVAPI32(00000000,00000001,00020019,00000000,00000000,00000000,00000000,00000000,crypt32.dll), ref: 00719806
RegCloseKey.ADVAPI32(00000000,00000001,00020019,00000000,00000000,00000000,00000000,00000000,crypt32.dll), ref: 00719813

Part of subcall function 007112D8: RegQueryInfoKeyW.ADVAPI32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,0071978F,00000001), ref: 007112F0

Strings

crypt32.dll, xrefs: 00719786

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: Close$InfoOpenQuery
String ID: crypt32.dll
API String ID: 796878624-1661610138
Opcode ID: 39832066080d09919c6ac9abf4bb1cf61dda055288d01e11aaa78797bd51e3c5
Instruction ID: aa5e108ca9cac88707d7f0715f0d054355d82b2f9e75d5f65cbb532549e679ef
Opcode Fuzzy Hash: 39832066080d09919c6ac9abf4bb1cf61dda055288d01e11aaa78797bd51e3c5
Instruction Fuzzy Hash: 47413872C0012DFFCF21AFD898918EDFA79FF04754F25416AEA10761A0D3394E81AA90

Function 006ED0FC Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 109threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32(00000000,00000000,006EAC27,00000001,00000000,00000000), ref: 006ED188
GetLastError.KERNEL32(?,?,?,006D54A3,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 006ED194

Part of subcall function 006ECDDD: WaitForSingleObject.KERNEL32(?,000493E0,00000000,?,?,006ED204,00000000,?,?,006EC687,?,?,?,?,?,006D54A3), ref: 006ECDEF
Part of subcall function 006ECDDD: GetLastError.KERNEL32(?,?,006ED204,00000000,?,?,006EC687,?,?,?,?,?,006D54A3,?,?,?), ref: 006ECDF9

CloseHandle.KERNEL32(00000000,00000000,?,?,006EC687,?,?,?,?,?,006D54A3,?,?,?,?), ref: 006ED215

Strings

c:\agent\_work\79\s\src\burn\engine\elevation.cpp, xrefs: 006ED1B8
Failed to create elevated cache thread., xrefs: 006ED1C2
Failed to pump messages in child process., xrefs: 006ED1EC

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: ErrorLast$CloseCreateHandleObjectSingleThreadWait
String ID: Failed to create elevated cache thread.$Failed to pump messages in child process.$c:\agent\_work\79\s\src\burn\engine\elevation.cpp
API String ID: 3606931770-1134900366
Opcode ID: 0a08a02116e6351e5c0f96f9541b6d940a9fe09ff68bac2d9c8bd1216fa9dc31
Instruction ID: fc5b33d29ca47ecb9b543977278339097e978d36dd7139ff16336012af789590
Opcode Fuzzy Hash: 0a08a02116e6351e5c0f96f9541b6d940a9fe09ff68bac2d9c8bd1216fa9dc31
Instruction Fuzzy Hash: AF4107B6D01219AF8B41DFA9D8819DEBBF5BF0C710F11812AF908E7340E73499418FA4

Function 00717C31 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 104COMMON

Download Yara Rule

APIs

Part of subcall function 006D39DF: GetProcessHeap.KERNEL32(?,000001C7,?,006D237C,?,00000001,80004005,8007139F,?,?,0071058B,8007139F,?,00000000,00000000,8007139F), ref: 006D39F0
Part of subcall function 006D39DF: RtlAllocateHeap.NTDLL(00000000,?,006D237C,?,00000001,80004005,8007139F,?,?,0071058B,8007139F,?,00000000,00000000,8007139F), ref: 006D39F7

SysFreeString.OLEAUT32(00000000), ref: 00717D14
SysFreeString.OLEAUT32(?), ref: 00717D1F
SysFreeString.OLEAUT32(00000000), ref: 00717D2A

Strings

c:\agent\_work\79\s\src\libs\dutil\atomutil.cpp, xrefs: 00717C5E
`)u, xrefs: 00717D09
6~q, xrefs: 00717D27, 00717CEC, 00717CDA, 00717CC8

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: FreeString$Heap$AllocateProcess
String ID: 6~q$`)u$c:\agent\_work\79\s\src\libs\dutil\atomutil.cpp
API String ID: 2724874077-996679331
Opcode ID: e46a49e66cdb6cf903d57a08555e3ae9501df90546955c4e66b4764cf53bb163
Instruction ID: 5deb9684562bfc8f836def73ed93219dd9a50d7453007da1024ac03a0140e475
Opcode Fuzzy Hash: e46a49e66cdb6cf903d57a08555e3ae9501df90546955c4e66b4764cf53bb163
Instruction Fuzzy Hash: 3731C432D0412ABBDB259F58C855BDEBB79AF40B20F114155FD00BB290D7789E84DBE0

Function 006D7337 Relevance: 10.6, APIs: 2, Strings: 5, Instructions: 91COMMONLIBRARYCODE

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(00000000,00000000,00000000,?,?,?,006D5966,00000100,00000100,00000000,?,00000001,00000000,00000100), ref: 006D7349
LeaveCriticalSection.KERNEL32(00000000,00000000,00000100,00000000,?,?,?,006D5966,00000100,00000100,00000000,?,00000001,00000000,00000100), ref: 006D7428

Strings

Failed to get value as string for variable: %ls, xrefs: 006D7417
Failed to get variable: %ls, xrefs: 006D738A
Failed to format value '%ls' of variable: %ls, xrefs: 006D73F2
Failed to get unformatted string., xrefs: 006D73B9
*****, xrefs: 006D73E4, 006D73F1

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: *****$Failed to format value '%ls' of variable: %ls$Failed to get unformatted string.$Failed to get value as string for variable: %ls$Failed to get variable: %ls
API String ID: 3168844106-2873099529
Opcode ID: b5c9799d51cacf04c701bc418e8e5ee914c6eccef370be304858c836a2c103e2
Instruction ID: 430a0ff3db01e7c1c099fe6187b6cb48a6aef809bdf128b45a0b045aebd35456
Opcode Fuzzy Hash: b5c9799d51cacf04c701bc418e8e5ee914c6eccef370be304858c836a2c103e2
Instruction Fuzzy Hash: 5B31CF32C44519FBDF235A94CC0AFEEBAA6AF10324F114156F804A6390E375DAA1DBC5

Function 00708F2D Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 78COMMONLIBRARYCODE

Download Yara Rule

Strings

api-ms-, xrefs: 00708F84
ext-ms-, xrefs: 00708F98

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID:
String ID: api-ms-$ext-ms-
API String ID: 0-537541572
Opcode ID: f9658eeabd799c804d2bca3fb544110e83a31d6deae600caa35d9f2e24f0f559
Instruction ID: 5b6567c81733dae4685f92028e6431183a192170506b260e4fc379c87d739730
Opcode Fuzzy Hash: f9658eeabd799c804d2bca3fb544110e83a31d6deae600caa35d9f2e24f0f559
Instruction Fuzzy Hash: F3210831A01216E7D7619A389C44A6B77DAAF11760F254310FD85E72D0DF78FD0086D2

Function 006E8CD6 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 77COMMON

Download Yara Rule

APIs

InitializeAcl.ADVAPI32(?,00000008,00000002,0000001A,?,?,00000000,00000000,?,?,?), ref: 006E8D21
GetLastError.KERNEL32 ref: 006E8D2B
SetFileAttributesW.KERNEL32(?,00000080,?,00000001,20000004,00000000,00000000,?,00000000,00000003,000007D0,?,00000000,00000000,?,?), ref: 006E8D8B

Strings

c:\agent\_work\79\s\src\burn\engine\cache.cpp, xrefs: 006E8D4F
Failed to initialize ACL., xrefs: 006E8D59
Failed to allocate administrator SID., xrefs: 006E8D07

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: AttributesErrorFileInitializeLast
String ID: Failed to allocate administrator SID.$Failed to initialize ACL.$c:\agent\_work\79\s\src\burn\engine\cache.cpp
API String ID: 669721577-2446333966
Opcode ID: f850ef1ee43bf72a96e8360d66464d7c78792be88e14cf7d53b15f537322f942
Instruction ID: 459eb174658741b2b0352f83abc83e40748e537c899a475ebcf156c5b3e5db0f
Opcode Fuzzy Hash: f850ef1ee43bf72a96e8360d66464d7c78792be88e14cf7d53b15f537322f942
Instruction Fuzzy Hash: 7C21DD76E41324BFDB215BDA9C85FDEB77AAF50710F114029F908BB2C0EA749E019694

Function 006D4263 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 76COMMON

Download Yara Rule

APIs

GetCurrentDirectoryW.KERNEL32(00000000,00000000,?,00000000,crypt32.dll,?,?,006E3FAC,00000001,feclient.dll,?,00000000,?,?,?,006D4B57), ref: 006D429E
GetLastError.KERNEL32(?,?,006E3FAC,00000001,feclient.dll,?,00000000,?,?,?,006D4B57,?,?,0071B488,?,00000001), ref: 006D42AA
GetCurrentDirectoryW.KERNEL32(00000000,?,?,00000000,?,?,006E3FAC,00000001,feclient.dll,?,00000000,?,?,?,006D4B57,?), ref: 006D42E5
GetLastError.KERNEL32(?,?,006E3FAC,00000001,feclient.dll,?,00000000,?,?,?,006D4B57,?,?,0071B488,?,00000001), ref: 006D42EF

Strings

c:\agent\_work\79\s\src\libs\dutil\dirutil.cpp, xrefs: 006D4313
crypt32.dll, xrefs: 006D4267

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: CurrentDirectoryErrorLast
String ID: c:\agent\_work\79\s\src\libs\dutil\dirutil.cpp$crypt32.dll
API String ID: 152501406-585930255
Opcode ID: d68584ad2e8ecc4ad5894a9bc7e89db846cc966581d2f547f7cfc195db5f08ef
Instruction ID: 78942fd3e6b2ddcc5f5ebbedb4d2bafa554e22fbe260efd177d315d4b93475d2
Opcode Fuzzy Hash: d68584ad2e8ecc4ad5894a9bc7e89db846cc966581d2f547f7cfc195db5f08ef
Instruction Fuzzy Hash: 9B11D673E01636AB97214ADE4844A9FB6999F05754B13413BFD00FB340EF74DD008AE4

Function 006F095C Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 74fileCOMMON

Download Yara Rule

APIs

_memcpy_s.LIBCMT ref: 006F09AC
WriteFile.KERNEL32(?,?,?,?,00000000), ref: 006F09CB
GetLastError.KERNEL32 ref: 006F09D5

Strings

c:\agent\_work\79\s\src\burn\engine\cabextract.cpp, xrefs: 006F09F9
Unexpected call to CabWrite()., xrefs: 006F098F
Failed to write during cabinet extraction., xrefs: 006F0A03

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: ErrorFileLastWrite_memcpy_s
String ID: Failed to write during cabinet extraction.$Unexpected call to CabWrite().$c:\agent\_work\79\s\src\burn\engine\cabextract.cpp
API String ID: 1970631241-1882036103
Opcode ID: b0b3e12927a71d498163afe98e04c52a528217cb89ca6d6c2ab570bbc4a01a10
Instruction ID: ac05e1c381c0e4390ee751964ee4b9aa0c5c3ce6cffad212342ea402e8f7f194
Opcode Fuzzy Hash: b0b3e12927a71d498163afe98e04c52a528217cb89ca6d6c2ab570bbc4a01a10
Instruction Fuzzy Hash: E221D1B6600209ABEB00CF6CD985DAA77AAFF84724B114059FB04D7357E775D900CB64

Function 00713503 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 72memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(0071B4E8), ref: 00713516
VariantInit.OLEAUT32(?), ref: 00713522
VariantClear.OLEAUT32(?), ref: 00713596
SysFreeString.OLEAUT32(00000000), ref: 007135A1

Part of subcall function 0071374E: SysAllocString.OLEAUT32(?), ref: 00713763

Strings

msasn1.dll, xrefs: 00713512
`)u, xrefs: 007135A1

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: String$AllocVariant$ClearFreeInit
String ID: `)u$msasn1.dll
API String ID: 347726874-2799367386
Opcode ID: cd95cb4c05cc7191c5ebf1a8ca16c73b29115d32ecb971c52567e8ad97cc9d9f
Instruction ID: f3251b1f28c1938e3e11fabba7d49322b49cda856e461b77ae4f5dac5e4d3e8d
Opcode Fuzzy Hash: cd95cb4c05cc7191c5ebf1a8ca16c73b29115d32ecb971c52567e8ad97cc9d9f
Instruction Fuzzy Hash: 62217F71901219EFCB10DFA8C849EEEBBB9EF44B16F004158E801A72A0D734DF54CB90

Function 006D9A9F Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 72COMMON

Download Yara Rule

APIs

_MREFOpen@16.MSPDB140-MSVCRT ref: 006D9AB8
GetFileAttributesW.KERNEL32(00000000,000002C0,?,00000000,00000000,000002C0,00000100,00000000,?,006DA889,00000100,000002C0,000002C0,00000100), ref: 006D9ACD
GetLastError.KERNEL32(?,006DA889,00000100,000002C0,000002C0,00000100), ref: 006D9ADA

Strings

Failed to format variable string., xrefs: 006D9AC3
Failed while searching directory search: %ls, for path: %ls, xrefs: 006D9B1A
Failed to set variable., xrefs: 006D9B3F

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: AttributesErrorFileLastOpen@16
String ID: Failed to format variable string.$Failed to set variable.$Failed while searching directory search: %ls, for path: %ls
API String ID: 1811509786-402580132
Opcode ID: 834241a07d76b72f8d14cd640405508c3b4979ff943dff2c5091e813148e83d0
Instruction ID: 98b79b880b2573d98773698582f8782ce315aea5d160e90240a580d3d8603c71
Opcode Fuzzy Hash: 834241a07d76b72f8d14cd640405508c3b4979ff943dff2c5091e813148e83d0
Instruction Fuzzy Hash: 6E113633E00021BBCB226668DC06FEFB667AF05320F224217FC01A63D0D7759E50AAE1

Function 006F0A23 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 69timeCOMMON

Download Yara Rule

APIs

DosDateTimeToFileTime.KERNEL32(?,?,?), ref: 006F0A90
LocalFileTimeToFileTime.KERNEL32(?,?), ref: 006F0AA2
SetFileTime.KERNEL32(?,?,?,?), ref: 006F0AB5
CloseHandle.KERNEL32(000000FF,?,?,?,?,?,?,?,?,?,?,?,?,006F0685,?,?), ref: 006F0AC4

Strings

Invalid operation for this state., xrefs: 006F0A69
c:\agent\_work\79\s\src\burn\engine\cabextract.cpp, xrefs: 006F0A5F

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: Time$File$CloseDateHandleLocal
String ID: Invalid operation for this state.$c:\agent\_work\79\s\src\burn\engine\cabextract.cpp
API String ID: 609741386-1590348330
Opcode ID: 81933422f810ca69065a1e332db8304a41d753460f3204f2951905b785ee58ca
Instruction ID: bd864c2375e3bd3b6bfd325c11c36ff19d4a21eb884ec05b9d38358cf7c51392
Opcode Fuzzy Hash: 81933422f810ca69065a1e332db8304a41d753460f3204f2951905b785ee58ca
Instruction Fuzzy Hash: BF21817280061EBB9710DFAC89088FA7BAEFE04710754C216F511E66D2D778D951CB90

Function 00718B5F Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 69timeCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00718BA3
SystemTimeToFileTime.KERNEL32(?,00000000), ref: 00718BCB
GetLastError.KERNEL32 ref: 00718BD5

Strings

gq, xrefs: 00718B5F
feclient.dll, xrefs: 00718B71
c:\agent\_work\79\s\src\libs\dutil\inetutil.cpp, xrefs: 00718BF6

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: ErrorLastTime$FileSystem
String ID: c:\agent\_work\79\s\src\libs\dutil\inetutil.cpp$feclient.dll$gq
API String ID: 1528435940-2721692173
Opcode ID: c3e624c1643137027bc64e566157d93c4dd086f2fc71490afa1cf36a5aeac2cf
Instruction ID: 81caf46c98340183c9e4ea451aae309cb6d86d7bf2ee477d4e4c21afb92a0f15
Opcode Fuzzy Hash: c3e624c1643137027bc64e566157d93c4dd086f2fc71490afa1cf36a5aeac2cf
Instruction Fuzzy Hash: 2A11B9B7E05139A7E7709BAD8D45BEFBBA8AF04750F014519EE01F7280EA389D0486E5

Function 007088EA Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 007088B2: _free.LIBCMT ref: 007088D7

_free.LIBCMT ref: 00708938

Part of subcall function 00705F5F: HeapFree.KERNEL32(00000000,00000000,?,007088DC,?,00000000,?,00000000,?,00708903,?,00000007,?,?,00708D7D,?), ref: 00705F75
Part of subcall function 00705F5F: GetLastError.KERNEL32(?,?,007088DC,?,00000000,?,00000000,?,00708903,?,00000007,?,?,00708D7D,?,?), ref: 00705F87

_free.LIBCMT ref: 00708943
_free.LIBCMT ref: 0070894E
_free.LIBCMT ref: 007089A2
_free.LIBCMT ref: 007089AD
_free.LIBCMT ref: 007089B8
_free.LIBCMT ref: 007089C3

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 168201354b2e5533fa0f7f046aa2c7ffc8fc0175796946e774c258da5b176dd2
Instruction ID: 6c46bfc879dcba4ad8a208c433133a4ea4f15bc782dc44a4dfb06992122a1d48
Opcode Fuzzy Hash: 168201354b2e5533fa0f7f046aa2c7ffc8fc0175796946e774c258da5b176dd2
Instruction Fuzzy Hash: A8112C71551B04EAE660BBB0CC0BFCB77DC5F40700F808E15B39E662E2DB6DB5455A51

Function 006E45CB Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 64COMMON

Download Yara Rule

APIs

Part of subcall function 006D39DF: GetProcessHeap.KERNEL32(?,000001C7,?,006D237C,?,00000001,80004005,8007139F,?,?,0071058B,8007139F,?,00000000,00000000,8007139F), ref: 006D39F0
Part of subcall function 006D39DF: RtlAllocateHeap.NTDLL(00000000,?,006D237C,?,00000001,80004005,8007139F,?,?,0071058B,8007139F,?,00000000,00000000,8007139F), ref: 006D39F7

_memcpy_s.LIBCMT ref: 006E461C
_memcpy_s.LIBCMT ref: 006E462F
_memcpy_s.LIBCMT ref: 006E464A

Strings

c:\agent\_work\79\s\src\burn\engine\pipe.cpp, xrefs: 006E45FB
Failed to allocate memory for message., xrefs: 006E4605
crypt32.dll, xrefs: 006E4626, 006E4645

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: _memcpy_s$Heap$AllocateProcess
String ID: Failed to allocate memory for message.$c:\agent\_work\79\s\src\burn\engine\pipe.cpp$crypt32.dll
API String ID: 886498622-720575634
Opcode ID: 733d510fb016d657a28302c264319f0c3eda9b43273d71405e1eca8b904ecbc1
Instruction ID: dad85bbeb66c338ace190286f6a5ec290d6946f127235dcff39702193f07ac4c
Opcode Fuzzy Hash: 733d510fb016d657a28302c264319f0c3eda9b43273d71405e1eca8b904ecbc1
Instruction Fuzzy Hash: B41182B2941319ABDB01DEA4CC82CDB73ADAF15710B00451BFA14DB241DA74D65487E5

Function 00713F19 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 61COMMON

Download Yara Rule

APIs

ShellExecuteExW.SHELL32(?), ref: 00713F6D
GetLastError.KERNEL32 ref: 00713F77
CloseHandle.KERNEL32(?), ref: 00713FAA

Strings

<, xrefs: 00713F5F
c:\agent\_work\79\s\src\libs\dutil\shelutil.cpp, xrefs: 00713F98
PDGu, xrefs: 00713F6D

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: CloseErrorExecuteHandleLastShell
String ID: <$PDGu$c:\agent\_work\79\s\src\libs\dutil\shelutil.cpp
API String ID: 3023784893-2524152726
Opcode ID: 0bbbfe6826f29f837398f5099aa473f4de5d0d7971b6c6a4fdddf507535342c5
Instruction ID: 3b3d8b896285dfcfc8a299ee2ffdf547b1bf62ff24c4de67c9733f6f1705f0a7
Opcode Fuzzy Hash: 0bbbfe6826f29f837398f5099aa473f4de5d0d7971b6c6a4fdddf507535342c5
Instruction Fuzzy Hash: 9921A5B5E11229ABDB10CF99D944ADEBBF8AB08750F10805AF915F7340D7789A418B94

Function 00710D3E Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 53synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(000000FF,?,00000000,?,006D4F5D,?,000000FF,?,?,?,?,?,00000000,?,?,?), ref: 00710D4A
GetLastError.KERNEL32(?,006D4F5D,?,000000FF,?,?,?,?,?,00000000,?,?,?,?,?,?), ref: 00710D58
GetExitCodeProcess.KERNEL32(000000FF,?), ref: 00710D9D
GetLastError.KERNEL32(?,006D4F5D,?,000000FF,?,?,?,?,?,00000000,?,?,?,?,?,?), ref: 00710DA7

Strings

c:\agent\_work\79\s\src\libs\dutil\procutil.cpp, xrefs: 00710D7C
]Om, xrefs: 00710DCD

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: ErrorLast$CodeExitObjectProcessSingleWait
String ID: ]Om$c:\agent\_work\79\s\src\libs\dutil\procutil.cpp
API String ID: 590199018-3738807459
Opcode ID: a2eb40a7468822f1cb041bfc0bbdd7dd11121653d663de342fcea99f67e6b53f
Instruction ID: cb39a6f46840e7aae8387d98943bab9c539b7c69b344ab38d0c4d34563744a5b
Opcode Fuzzy Hash: a2eb40a7468822f1cb041bfc0bbdd7dd11121653d663de342fcea99f67e6b53f
Instruction Fuzzy Hash: 7501A136B00535A7C7205ADDAD08ADB7A55AF08770F028115FD94AB2D0E7BCECC09AD4

Function 00710DDC Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 40libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32,IsWow64Process,?,?,?,006D5EE0,00000000), ref: 00710DF0
GetProcAddress.KERNEL32(00000000), ref: 00710DF7
GetLastError.KERNEL32(?,?,?,006D5EE0,00000000), ref: 00710E0E

Strings

kernel32, xrefs: 00710DE8
IsWow64Process, xrefs: 00710DE1
c:\agent\_work\79\s\src\libs\dutil\procutil.cpp, xrefs: 00710E2F

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: AddressErrorHandleLastModuleProc
String ID: IsWow64Process$c:\agent\_work\79\s\src\libs\dutil\procutil.cpp$kernel32
API String ID: 4275029093-2315433296
Opcode ID: 92f411aa091047acee663a87e6b164bed412c19783d7626530a723ebdeb4df4a
Instruction ID: db6eac0dbb78637991fbfe8a1680e5a333042c75e64ac940e2b43f1c4f718e09
Opcode Fuzzy Hash: 92f411aa091047acee663a87e6b164bed412c19783d7626530a723ebdeb4df4a
Instruction Fuzzy Hash: A4F06D72A00235B7D7205BAADD059DF7A54DB05B50B018515BD05AB2C0E7BCDE84D6D4

Function 00704455 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 31libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,0070444A,?,?,00704412,00000000,80004004,?), ref: 0070446A
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 0070447D
FreeLibrary.KERNEL32(00000000,?,?,0070444A,?,?,00704412,00000000,80004004,?), ref: 007044A0

Strings

mscoree.dll, xrefs: 00704463
Xo, xrefs: 0070448E
CorExitProcess, xrefs: 00704475

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$Xo$mscoree.dll
API String ID: 4061214504-3349585267
Opcode ID: d156e17b3c60746fa98aca33fb07dd1e55aaeeccd9de24d4c95c023834c003dd
Instruction ID: c0cc503c5796e3104b30df58d04520a3a712a945fd6cc630378125f310283135
Opcode Fuzzy Hash: d156e17b3c60746fa98aca33fb07dd1e55aaeeccd9de24d4c95c023834c003dd
Instruction Fuzzy Hash: ECF08271940318FBDB119B94DC09BDE7BA8EB00762F41C150FD09A21E0CB798E10EB94

Function 006E8B98 Relevance: 9.1, APIs: 1, Strings: 5, Instructions: 121sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000007D0,00000000,00000000), ref: 006E8C04

Strings

Failed to get %hs package cache root directory., xrefs: 006E8C64
per-user, xrefs: 006E8C5E, 006E8C63, 006E8C9E, 006E8CA3
Failed to get old %hs package cache root directory., xrefs: 006E8CA4
Failed to calculate cache path., xrefs: 006E8BC1
per-machine, xrefs: 006E8C55, 006E8C95

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: Sleep
String ID: Failed to calculate cache path.$Failed to get %hs package cache root directory.$Failed to get old %hs package cache root directory.$per-machine$per-user
API String ID: 3472027048-398165853
Opcode ID: fec62723ab92e657ca726cefd22f2b7ddb8b2df8b76b8dc6095d27a2dbc10a10
Instruction ID: 5fdd5208e2ec27dce86e46f609357dcc64ec4e7ede3442756712a19bbe4b0da0
Opcode Fuzzy Hash: fec62723ab92e657ca726cefd22f2b7ddb8b2df8b76b8dc6095d27a2dbc10a10
Instruction Fuzzy Hash: 3B312472D027A4BFEB12A7A58D82FBF626E9B01F10F200025FD09F7351EA748E4056B5

Function 006EE7CC Relevance: 9.1, APIs: 6, Instructions: 85windowCOMMON

Download Yara Rule

APIs

DefWindowProcW.USER32(?,00000082,?,?), ref: 006EE7FB
SetWindowLongW.USER32(?,000000EB,00000000), ref: 006EE80A
SetWindowLongW.USER32(?,000000EB,?), ref: 006EE81E
DefWindowProcW.USER32(?,?,?,?), ref: 006EE82E
GetWindowLongW.USER32(?,000000EB), ref: 006EE848
PostQuitMessage.USER32(00000000), ref: 006EE8A7

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: Window$Long$Proc$MessagePostQuit
String ID:
API String ID: 3812958022-0
Opcode ID: cd0bfd2be9d5b661baf40dc05db85f8f71195560a2ad507e46c8672b9ad8066c
Instruction ID: 0012072dc91a5c3b53366e0312cfd110afbc28c5d3d64bf72c5a31239ec9577c
Opcode Fuzzy Hash: cd0bfd2be9d5b661baf40dc05db85f8f71195560a2ad507e46c8672b9ad8066c
Instruction Fuzzy Hash: 2B218E35105214BFDB155F68DC49EAA3B66EF49710F14C228F91A9A2B0D732DD20DB60

Function 0070CE1F Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 178fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0070C5B2: GetConsoleCP.KERNEL32(Y[p,00000000,00000000), ref: 0070C5FA

WriteFile.KERNEL32(?,00000000,00000000,Lp,00000000,?,00000000,00000000), ref: 0070CF70
GetLastError.KERNEL32 ref: 0070CF7A
__dosmaperr.LIBCMT ref: 0070CFBF

Strings

Lp, xrefs: 0070CF67, 0070CF6A
Y[p, xrefs: 0070CEAD, 0070CF86, 0070CF99, 0070CFBE

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: ConsoleErrorFileLastWrite__dosmaperr
String ID: Y[p$Lp
API String ID: 251514795-1849395628
Opcode ID: df52c4f5409747b8fc32e03b73347e2cf94692876c10b2d92ffb7470626cab18
Instruction ID: 160f7cb70f3e13b209548d0696d040dbcc91cf853c04e3338e76395b6240d092
Opcode Fuzzy Hash: df52c4f5409747b8fc32e03b73347e2cf94692876c10b2d92ffb7470626cab18
Instruction Fuzzy Hash: 85518172A0020AEFDB129FA8CC49BEEBBF9EF05354F144751E500BB2D1D778AA418761

Function 006EC687 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 164synchronizationCOMMON

Download Yara Rule

APIs

ReleaseMutex.KERNEL32(?), ref: 006EC6CF
CloseHandle.KERNEL32(?), ref: 006EC6D7

Strings

Unexpected elevated message sent to child process, msg: %u, xrefs: 006EC882
c:\agent\_work\79\s\src\burn\engine\elevation.cpp, xrefs: 006EC876
Failed to save state., xrefs: 006EC74F

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: CloseHandleMutexRelease
String ID: Failed to save state.$Unexpected elevated message sent to child process, msg: %u$c:\agent\_work\79\s\src\burn\engine\elevation.cpp
API String ID: 4207627910-2854340866
Opcode ID: 9b9eed3ae81c3b5da05e111ced593c8e2a4fe40d04916b1fbe1485e6fedec312
Instruction ID: 4a65806dc2418569505b350fc98ad72c247577560bdfb515c63f11f7d9a0cb47
Opcode Fuzzy Hash: 9b9eed3ae81c3b5da05e111ced593c8e2a4fe40d04916b1fbe1485e6fedec312
Instruction Fuzzy Hash: 1D61C67A111A54EFCB165F86CA01C56BFE3FF08720715C499FA995A632C732E922EF40

Function 00717D34 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 161COMMON

Download Yara Rule

APIs

Part of subcall function 006D39DF: GetProcessHeap.KERNEL32(?,000001C7,?,006D237C,?,00000001,80004005,8007139F,?,?,0071058B,8007139F,?,00000000,00000000,8007139F), ref: 006D39F0
Part of subcall function 006D39DF: RtlAllocateHeap.NTDLL(00000000,?,006D237C,?,00000001,80004005,8007139F,?,?,0071058B,8007139F,?,00000000,00000000,8007139F), ref: 006D39F7

SysFreeString.OLEAUT32(00000000), ref: 00717E91
SysFreeString.OLEAUT32(00000000), ref: 00717E9C
SysFreeString.OLEAUT32(00000000), ref: 00717EA7

Strings

c:\agent\_work\79\s\src\libs\dutil\atomutil.cpp, xrefs: 00717D67
`)u, xrefs: 00717E86

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: FreeString$Heap$AllocateProcess
String ID: `)u$c:\agent\_work\79\s\src\libs\dutil\atomutil.cpp
API String ID: 2724874077-3437990411
Opcode ID: 65ec4553b8618a4a0b259f9752fd8e54cffd5499a73af4ce8308a0839e998a67
Instruction ID: 1ea13f92e54f3078a3e7d88a709153be7ad7c4826b178f458d0ef9c1965445a2
Opcode Fuzzy Hash: 65ec4553b8618a4a0b259f9752fd8e54cffd5499a73af4ce8308a0839e998a67
Instruction Fuzzy Hash: 6F519471A0422AEFDF25DB68C884EEEB7B8AF44750F114198E901AF290D774DE44DBE0

Function 006F8FCB Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 149COMMON

Download Yara Rule

APIs

CompareStringW.KERNEL32(00000000,00000001,?,000000FF,?,000000FF,00000000,00000100,00000000,?,?,?,006E7007,000000B8,0000001C,00000100), ref: 006F8FF6
CompareStringW.KERNEL32(00000000,00000001,?,000000FF,0071B4B8,000000FF,?,?,?,006E7007,000000B8,0000001C,00000100,00000100,00000100,000000B0), ref: 006F9080

Strings

c:\agent\_work\79\s\src\burn\engine\detect.cpp, xrefs: 006F90E0
Failed to initialize update bundle., xrefs: 006F9123
BA aborted detect forward compatible bundle., xrefs: 006F90EA

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: CompareString
String ID: BA aborted detect forward compatible bundle.$Failed to initialize update bundle.$c:\agent\_work\79\s\src\burn\engine\detect.cpp
API String ID: 1825529933-2802616466
Opcode ID: 02f9619d9e45bc8eed9cd69c2f7b0c41e95d35b40959997b16ba83ca9125c9e2
Instruction ID: 6d32a4ac25f4062aa0b051fadaf0cd6d7dfc1c39f696feac81a3d652c29f4a24
Opcode Fuzzy Hash: 02f9619d9e45bc8eed9cd69c2f7b0c41e95d35b40959997b16ba83ca9125c9e2
Instruction Fuzzy Hash: 2E51B070600219BBDF659F64CC85FAAB76BFF05310F104268FA149A3A5CB72D960DBA0

Function 00711506 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 147registrystringCOMMON

Download Yara Rule

APIs

RegQueryValueExW.ADVAPI32(00000000,000002C0,00000000,000002C0,00000000,00000000,000002C0,BundleUpgradeCode,00000410,000002C0,00000000,00000000,00000000,00000100,00000000), ref: 0071152E
RegQueryValueExW.ADVAPI32(?,00000000,00000000,?,?,?,?,?,?,006E6FDC,00000100,000000B0,00000088,00000410,000002C0), ref: 00711565
lstrlenW.KERNEL32(?,?,?,00000000,?,-00000001,00000004,00000000), ref: 00711657

Strings

c:\agent\_work\79\s\src\libs\dutil\regutil.cpp, xrefs: 007115A8
BundleUpgradeCode, xrefs: 0071150D

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: QueryValue$lstrlen
String ID: BundleUpgradeCode$c:\agent\_work\79\s\src\libs\dutil\regutil.cpp
API String ID: 3790715954-4078672395
Opcode ID: 441cf973d690c19310182d5506416e5f989822003df96f2f541d2e62cbdeb2a5
Instruction ID: 10fb19db42dc14eb78d0bd082dd2c52d36c8938cb5d1dde40d6c55fd29623599
Opcode Fuzzy Hash: 441cf973d690c19310182d5506416e5f989822003df96f2f541d2e62cbdeb2a5
Instruction Fuzzy Hash: 2F41A431E0121AAFDB21CF99C8509EE77BAEF44710F594069FA01AF290DA39DE50DB94

Function 00716596 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 129fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00714B80: SetFilePointerEx.KERNELBASE(?,?,?,?,?,00000000,?,?,?,006E8664,00000000,00000000,00000000,00000000,00000000), ref: 00714B98
Part of subcall function 00714B80: GetLastError.KERNEL32(?,?,?,006E8664,00000000,00000000,00000000,00000000,00000000), ref: 00714BA2

WriteFile.KERNEL32(?,?,00000000,?,00000000,?,00715E50,?,?,?,?,?,?,?,00010000,?), ref: 007165FF
WriteFile.KERNEL32(000000FF,00000008,00000008,?,00000000,000000FF,00000000,00000000,00000000,00000000,?,00715E50,?,?,?,?), ref: 00716651
GetLastError.KERNEL32(?,00715E50,?,?,?,?,?,?,?,00010000,?,00000001,?,GET,?,?), ref: 00716697
GetLastError.KERNEL32(?,00715E50,?,?,?,?,?,?,?,00010000,?,00000001,?,GET,?,?), ref: 007166BD

Strings

c:\agent\_work\79\s\src\libs\dutil\dlutil.cpp, xrefs: 007166E1

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: ErrorFileLast$Write$Pointer
String ID: c:\agent\_work\79\s\src\libs\dutil\dlutil.cpp
API String ID: 133221148-1613074858
Opcode ID: 1ccd0955f54a7e493cb82ac0a743124cdfb2b4fa08072a7c4f0859b53c78bfa0
Instruction ID: 025544986a720576608fe6e3a6f55cbd97761be9eed9e5eb2bed61b8e80a885d
Opcode Fuzzy Hash: 1ccd0955f54a7e493cb82ac0a743124cdfb2b4fa08072a7c4f0859b53c78bfa0
Instruction Fuzzy Hash: 2741707290021AFFEB218E98CD45BEA7B69FF04764F154125FE00A61D0E779DDA0DBA0

Function 006D252E Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 120COMMONLIBRARYCODE

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(?,00000000,00710319,?,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00710319,006F1099,?,00000000), ref: 006D2574
GetLastError.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00710319,006F1099,?,00000000,0000FDE9,?,006F1099), ref: 006D2580

Part of subcall function 006D3C5F: GetProcessHeap.KERNEL32(00000000,000001C7,?,006D22D5,000001C7,80004005,8007139F,?,?,0071058B,8007139F,?,00000000,00000000,8007139F), ref: 006D3C67
Part of subcall function 006D3C5F: HeapSize.KERNEL32(00000000,?,006D22D5,000001C7,80004005,8007139F,?,?,0071058B,8007139F,?,00000000,00000000,8007139F), ref: 006D3C6E

Strings

c:\agent\_work\79\s\src\libs\dutil\strutil.cpp, xrefs: 006D25A4

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: Heap$ByteCharErrorLastMultiProcessSizeWide
String ID: c:\agent\_work\79\s\src\libs\dutil\strutil.cpp
API String ID: 3662877508-2901571208
Opcode ID: 038b8bd08732a0b75d9bf664bbae4906eb87bf53652c52675e771ec32dc7c409
Instruction ID: 3de4f4adcac389594ba8d0f4c5bbbb56cf03d35b6c88eac73996a0a3dcdc9578
Opcode Fuzzy Hash: 038b8bd08732a0b75d9bf664bbae4906eb87bf53652c52675e771ec32dc7c409
Instruction Fuzzy Hash: AC311671A0035BAFE7109F259CF0EB6379BAB64768B10822BFD109B390EB71DC119760

Function 00714466 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 108COMMON

Download Yara Rule

APIs

MoveFileExW.KERNEL32(00000003,00000001,00000000,00000000,00000101,?,007145B4,00000003,00000001,00000001,000007D0,00000003,00000000,?,006E9F4C,00000001), ref: 00714484
GetLastError.KERNEL32(00000002,?,007145B4,00000003,00000001,00000001,000007D0,00000003,00000000,?,006E9F4C,00000001,000007D0,00000001,00000001,00000003), ref: 00714493
MoveFileExW.KERNEL32(00000003,00000001,00000000,00000001,00000000,?,007145B4,00000003,00000001,00000001,000007D0,00000003,00000000,?,006E9F4C,00000001), ref: 0071452C
GetLastError.KERNEL32(?,007145B4,00000003,00000001,00000001,000007D0,00000003,00000000,?,006E9F4C,00000001,000007D0,00000001,00000001,00000003,000007D0), ref: 00714536

Part of subcall function 007146C4: FindFirstFileW.KERNEL32(006F8F8D,?,00000100,00000000,00000000), ref: 007146FF
Part of subcall function 007146C4: FindClose.KERNEL32(00000000), ref: 0071470B

Strings

c:\agent\_work\79\s\src\libs\dutil\fileutil.cpp, xrefs: 00714555

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: File$ErrorFindLastMove$CloseFirst
String ID: c:\agent\_work\79\s\src\libs\dutil\fileutil.cpp
API String ID: 3479031965-3405085980
Opcode ID: 783ea7e158708f93e38ebb2e6a53604cc1dee0c8e12461e7a6c52e006470b9e4
Instruction ID: 5b76e428ef73bf2f4cdd71e6fa16523bff1008b72f92597e1313a9589f731631
Opcode Fuzzy Hash: 783ea7e158708f93e38ebb2e6a53604cc1dee0c8e12461e7a6c52e006470b9e4
Instruction Fuzzy Hash: E731B536A40225A7DB214E5C9C40BFB7666BF40BA1F164136FD049B2D0D778CED192E4

Function 006FAA63 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 106COMMON

Download Yara Rule

APIs

CompareStringW.KERNEL32(0000007F,00000000,00000000,000000FF,?,000000FF,?,00000000,?,?,?,00000000,00000000,?,?,00000000), ref: 006FAAD2

Strings

Failed to extract all payloads from container: %ls, xrefs: 006FAB16
Failed to skip the extraction of payload: %ls from container: %ls, xrefs: 006FAB67
Failed to extract payload: %ls from container: %ls, xrefs: 006FAB5B
Failed to open container: %ls., xrefs: 006FAAA4

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: CompareString
String ID: Failed to extract all payloads from container: %ls$Failed to extract payload: %ls from container: %ls$Failed to open container: %ls.$Failed to skip the extraction of payload: %ls from container: %ls
API String ID: 1825529933-3891707333
Opcode ID: 6912901cafe12d55ad81734298c489fb63a78f47f7ba6932515f0cf160f43c07
Instruction ID: 108b385e71933aac4423394db96c122791f09b965007979f5280cf6b5f469ab2
Opcode Fuzzy Hash: 6912901cafe12d55ad81734298c489fb63a78f47f7ba6932515f0cf160f43c07
Instruction Fuzzy Hash: 8131C3B2C0012EFBCF129AD4CD46EEE77BAAF04720F100225FA15A6291E7749A55DB91

Function 007145C3 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 94registryCOMMON

Download Yara Rule

APIs

Part of subcall function 007146C4: FindFirstFileW.KERNEL32(006F8F8D,?,00000100,00000000,00000000), ref: 007146FF
Part of subcall function 007146C4: FindClose.KERNEL32(00000000), ref: 0071470B

RegCloseKey.ADVAPI32(?,00000000,?,00000000,?,00000000,?,00000000,?,wininet.dll,?,crypt32.dll,?,?,?,00000000), ref: 007146B6

Part of subcall function 00711275: RegOpenKeyExW.KERNELBASE(00000000,00000000,00000000,00000000,00000001,0073BB7C,00000000,?,00715A32,80000002,00000000,00020019,00000000,SOFTWARE\Policies\,00000000,00000000), ref: 00711289

Part of subcall function 00711506: RegQueryValueExW.ADVAPI32(00000000,000002C0,00000000,000002C0,00000000,00000000,000002C0,BundleUpgradeCode,00000410,000002C0,00000000,00000000,00000000,00000100,00000000), ref: 0071152E
Part of subcall function 00711506: RegQueryValueExW.ADVAPI32(?,00000000,00000000,?,?,?,?,?,?,006E6FDC,00000100,000000B0,00000088,00000410,000002C0), ref: 00711565

Strings

\, xrefs: 0071463F
PendingFileRenameOperations, xrefs: 00714621
SYSTEM\CurrentControlSet\Control\Session Manager, xrefs: 007145F5
crypt32.dll, xrefs: 007145EE

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: CloseFindQueryValue$FileFirstOpen
String ID: PendingFileRenameOperations$SYSTEM\CurrentControlSet\Control\Session Manager$\$crypt32.dll
API String ID: 3397690329-3978359083
Opcode ID: cd403ca3453984b3ac27c2da57768d38647cccea70bc52a7a207c52d7bb03690
Instruction ID: fb74241dfba77c80cac3b4ffd98799c257cebc06f992235cf7368ed91ed040d5
Opcode Fuzzy Hash: cd403ca3453984b3ac27c2da57768d38647cccea70bc52a7a207c52d7bb03690
Instruction Fuzzy Hash: F031C071A00219FEDF21AF98CC419EEB7B5FF11759F1481BAE504AA1D1E3799AC0CB10

Function 006DEFB4 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 94registryCOMMON

Download Yara Rule

APIs

CompareStringW.KERNEL32(0000007F,00000000,00000001,000000FF,?,000000FF,00000001,PackageVersion,00000001,?,006E05E8,00000001,00000001,00000001,006E05E8,00000000), ref: 006DF02C
RegCloseKey.ADVAPI32(00000000,00000001,PackageVersion,00000001,?,006E05E8,00000001,00000001,00000001,006E05E8,00000000,00000001,00000000,?,006E05E8,00000001), ref: 006DF049

Strings

PackageVersion, xrefs: 006DF00D
Failed to format key for update registration., xrefs: 006DEFE2
Failed to remove update registration key: %ls, xrefs: 006DF074

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: CloseCompareString
String ID: Failed to format key for update registration.$Failed to remove update registration key: %ls$PackageVersion
API String ID: 446873843-3222553582
Opcode ID: 5cbce19c9d1eccbff0551a950b27abaa9627b54ba501e6ef8ae016207c8990ea
Instruction ID: 718342228baeba178fcb6f5dc5a918c3cee756e22ebb0f630f8f760393f34af0
Opcode Fuzzy Hash: 5cbce19c9d1eccbff0551a950b27abaa9627b54ba501e6ef8ae016207c8990ea
Instruction Fuzzy Hash: EE21A731D00124FACB21ABA9CC09BEEBFB9EF14750F108276F911A7291E7749A41C690

Function 00714295 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 92fileCOMMON

Download Yara Rule

APIs

CopyFileW.KERNEL32(00000000,006D4DFD,00000000,?,?,00000000,?,007143B0,00000000,006D4DFD,00000000,00000000,?,006E84E4,?,?), ref: 007142AF
GetLastError.KERNEL32(?,007143B0,00000000,006D4DFD,00000000,00000000,?,006E84E4,?,?,00000001,00000003,000007D0,?,?,?), ref: 007142BD
CopyFileW.KERNEL32(00000000,006D4DFD,00000000,006D4DFD,00000000,?,007143B0,00000000,006D4DFD,00000000,00000000,?,006E84E4,?,?,00000001), ref: 0071432F
GetLastError.KERNEL32(?,007143B0,00000000,006D4DFD,00000000,00000000,?,006E84E4,?,?,00000001,00000003,000007D0,?,?,?), ref: 00714339

Strings

c:\agent\_work\79\s\src\libs\dutil\fileutil.cpp, xrefs: 00714358

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: CopyErrorFileLast
String ID: c:\agent\_work\79\s\src\libs\dutil\fileutil.cpp
API String ID: 374144340-3405085980
Opcode ID: ebfa006dfa80607de85bfd491940eb5619de6c10bc02e8d5fad58d1742562c88
Instruction ID: 3676b4e57e397c5841145b7e2e1dd6312cc4f924195af743726571935ef9119c
Opcode Fuzzy Hash: ebfa006dfa80607de85bfd491940eb5619de6c10bc02e8d5fad58d1742562c88
Instruction Fuzzy Hash: 6D21D632B4027297AB211AAD4C40BFB6698BF5ABA1B114025FD50EB2D1D76CCCC192E4

Function 006DEECC Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 87COMMON

Download Yara Rule

APIs

_MREFOpen@16.MSPDB140-MSVCRT ref: 006DEF07

Part of subcall function 007143D6: SetFileAttributesW.KERNEL32(006F8F8D,00000080,00000000,006F8F8D,000000FF,00000000,?,?,006F8F8D), ref: 00714405
Part of subcall function 007143D6: GetLastError.KERNEL32(?,?,006F8F8D), ref: 0071440F

Part of subcall function 006D3CF7: RemoveDirectoryW.KERNEL32(00000001,00000000,00000000,00000000,?,?,006DEF52,00000001,00000000,00000095,00000001,006E05F7,00000095,00000000,swidtag,00000001), ref: 006D3D14

Strings

swidtag, xrefs: 006DEF16
Failed to allocate regid file path., xrefs: 006DEF66
Failed to allocate regid folder path., xrefs: 006DEF6D
Failed to format tag folder path., xrefs: 006DEF74

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: AttributesDirectoryErrorFileLastOpen@16Remove
String ID: Failed to allocate regid file path.$Failed to allocate regid folder path.$Failed to format tag folder path.$swidtag
API String ID: 1428973842-4170906717
Opcode ID: b442c7da0bb991499b9ca25c4c015b4d87f0e282131d886f1555d42f5cfce8bb
Instruction ID: a61468d1e9d9c52c770869e04fd6ea9e175b1222e17efdcb9a75b4e6c2a79db9
Opcode Fuzzy Hash: b442c7da0bb991499b9ca25c4c015b4d87f0e282131d886f1555d42f5cfce8bb
Instruction Fuzzy Hash: 35218B31D00228FBCB15EF99CC41A9DBBB6EF44710F1180AAF418AA361D7329E41DB80

Function 006F8B14 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 85registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00711275: RegOpenKeyExW.KERNELBASE(00000000,00000000,00000000,00000000,00000001,0073BB7C,00000000,?,00715A32,80000002,00000000,00020019,00000000,SOFTWARE\Policies\,00000000,00000000), ref: 00711289

CompareStringW.KERNEL32(00000000,00000001,00000000,000000FF,?,000000FF,00000000,00000000,00000000,-80000001,SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall,00020019,00000000,00000100,00000100,000001B4), ref: 006F8B98
RegCloseKey.ADVAPI32(00000000,-80000001,SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall,00020019,00000000,00000100,00000100,000001B4,?,?,?,006DF77F,00000001,00000100,000001B4,00000000), ref: 006F8BE6

Strings

Failed to enumerate uninstall key for related bundles., xrefs: 006F8BF5
Failed to open uninstall registry key., xrefs: 006F8B5B
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall, xrefs: 006F8B35

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: CloseCompareOpenString
String ID: Failed to enumerate uninstall key for related bundles.$Failed to open uninstall registry key.$SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
API String ID: 2817536665-2531018330
Opcode ID: c5dedd7f1958f785a4efdfa32ded76f9bc1683fd021dad2ce8c83f90c9c02d56
Instruction ID: 5fdee1b952659ca1d3e14f93d519fb87bfcaebcd1a56dc92017659fee0cb3951
Opcode Fuzzy Hash: c5dedd7f1958f785a4efdfa32ded76f9bc1683fd021dad2ce8c83f90c9c02d56
Instruction Fuzzy Hash: 6D21B57690012CFFDF119A94CC49FEEBA7AEB01761F1442A4F610771A0DB794E909694

Function 006FCF55 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 79synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 006D39DF: GetProcessHeap.KERNEL32(?,000001C7,?,006D237C,?,00000001,80004005,8007139F,?,?,0071058B,8007139F,?,00000000,00000000,8007139F), ref: 006D39F0
Part of subcall function 006D39DF: RtlAllocateHeap.NTDLL(00000000,?,006D237C,?,00000001,80004005,8007139F,?,?,0071058B,8007139F,?,00000000,00000000,8007139F), ref: 006D39F7

WaitForSingleObject.KERNEL32(?,000000FF), ref: 006FCFEA
ReleaseMutex.KERNEL32(?), ref: 006FD018
SetEvent.KERNEL32(?), ref: 006FD021

Strings

c:\agent\_work\79\s\src\burn\engine\netfxchainer.cpp, xrefs: 006FCF8F
Failed to allocate buffer., xrefs: 006FCF99

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: Heap$AllocateEventMutexObjectProcessReleaseSingleWait
String ID: Failed to allocate buffer.$c:\agent\_work\79\s\src\burn\engine\netfxchainer.cpp
API String ID: 944053411-523563896
Opcode ID: e88b429614e7e9d855002352353d10a5fffe33db3a8496a7c1042d75a76b8e98
Instruction ID: aa9880ec1c36eb1f45e15734b6c13ce8e2144d91d14c697c8dcd40e5a163f6c0
Opcode Fuzzy Hash: e88b429614e7e9d855002352353d10a5fffe33db3a8496a7c1042d75a76b8e98
Instruction Fuzzy Hash: FC21E5B160030ABFE7009F2CC845AA9FBF6FF48324F108569F955A7392C775A951CB50

Function 00715B52 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

QueryServiceConfigW.ADVAPI32(00000000,00000000,00000000,?,00000001,00000000,?,?,006F689E,00000000,?), ref: 00715B68
GetLastError.KERNEL32(?,?,006F689E,00000000,?,?,?,?,?,?,?,?,?,006F6CAE,?,?), ref: 00715B76

Part of subcall function 006D39DF: GetProcessHeap.KERNEL32(?,000001C7,?,006D237C,?,00000001,80004005,8007139F,?,?,0071058B,8007139F,?,00000000,00000000,8007139F), ref: 006D39F0
Part of subcall function 006D39DF: RtlAllocateHeap.NTDLL(00000000,?,006D237C,?,00000001,80004005,8007139F,?,?,0071058B,8007139F,?,00000000,00000000,8007139F), ref: 006D39F7

QueryServiceConfigW.ADVAPI32(00000000,00000000,?,?,?,00000001,?,?,006F689E,00000000,?), ref: 00715BB0
GetLastError.KERNEL32(?,?,006F689E,00000000,?,?,?,?,?,?,?,?,?,006F6CAE,?,?), ref: 00715BBA

Strings

c:\agent\_work\79\s\src\libs\dutil\svcutil.cpp, xrefs: 00715B99, 00715BDB

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: ConfigErrorHeapLastQueryService$AllocateProcess
String ID: c:\agent\_work\79\s\src\libs\dutil\svcutil.cpp
API String ID: 355237494-331149447
Opcode ID: bf1372857e97d42c865191564ed74d3bed7ef1d94a88546c55e5dd696c2b0719
Instruction ID: e2a5f2f9da6c9121e4369149ee019222fc23817ba44f51a90cfdabf89209183b
Opcode Fuzzy Hash: bf1372857e97d42c865191564ed74d3bed7ef1d94a88546c55e5dd696c2b0719
Instruction Fuzzy Hash: 5621F6BA904A36E7D7345E4D8D05BDB69699FC1B60F118015BD00AB280E76CCE40A3F5

Function 00713275 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 75COMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32(?), ref: 007132DC
SysFreeString.OLEAUT32(?), ref: 007132F7
SysFreeString.OLEAUT32(?), ref: 00713306

Strings

t:q, xrefs: 0071327C, 00713288, 007132A2, 007132B0, 007132BE, 007132CC, 007132E7
t:q, xrefs: 0071327F, 0071329E, 007132AC, 007132BA, 00713283, 007132A1, 007132AF, 007132BD

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: FreeString
String ID: t:q$t:q
API String ID: 3341692771-2585502148
Opcode ID: 4d23391ab5a9357d07e40fe39240ff2fbd38e84a81b621fbd45e3db07fffba40
Instruction ID: d986c8c4f13ff6a8fe8cc264dfcebef26b625cbbfe3940bccb27d8bd8b7750a0
Opcode Fuzzy Hash: 4d23391ab5a9357d07e40fe39240ff2fbd38e84a81b621fbd45e3db07fffba40
Instruction Fuzzy Hash: 4F216571A01118EF9B25DF9AC985CEEBBBCFF44704B20019EE504A7164E774EB40EB24

Function 006D97FE Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 70COMMON

Download Yara Rule

APIs

_memcpy_s.LIBCMT ref: 006D988D

Strings

Failed to find variable., xrefs: 006D987A
Failed to read next symbol., xrefs: 006D98A9
Failed to parse condition '%ls' at position: %u, xrefs: 006D983F
c:\agent\_work\79\s\src\burn\engine\condition.cpp, xrefs: 006D982F, 006D9870

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: _memcpy_s
String ID: Failed to find variable.$Failed to parse condition '%ls' at position: %u$Failed to read next symbol.$c:\agent\_work\79\s\src\burn\engine\condition.cpp
API String ID: 2001391462-2654771825
Opcode ID: 3e098ae277e1505d0ca8a13c82a981818d6e193642037cac1dc9a4d1e000ea29
Instruction ID: e7c0e254208548b878354478775836735779b33476796950d8e4c85568557184
Opcode Fuzzy Hash: 3e098ae277e1505d0ca8a13c82a981818d6e193642037cac1dc9a4d1e000ea29
Instruction Fuzzy Hash: C311EB73D402207AEB692D6C9C4ADD73A17EB16B11F000516FD046E3D2CA66DD50AAF5

Function 00715F48 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 69timeCOMMON

Download Yara Rule

APIs

Part of subcall function 00716106: lstrlenW.KERNEL32(?), ref: 007161D3
Part of subcall function 00716106: lstrlenW.KERNEL32(00000000), ref: 007161EB

Part of subcall function 00718C13: GetLastError.KERNEL32(?,?,gq,00715F98,feclient.dll,clbcatq.dll,0071B518,0071B500,HEAD,00000000,0071B4E8,gq,00000000,?,?,00000000), ref: 00718C3D

GetSystemTimeAsFileTime.KERNEL32(0071B488,feclient.dll,0071B488,feclient.dll,clbcatq.dll,0071B518,0071B500,HEAD,00000000,0071B4E8,gq,00000000,?,?,00000000,00000000), ref: 00715FC8

Strings

HEAD, xrefs: 00715F75
clbcatq.dll, xrefs: 00715F91
gq, xrefs: 00715F6B
feclient.dll, xrefs: 00715F92, 00715FB4, 00715FDA

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: Timelstrlen$ErrorFileLastSystem
String ID: HEAD$clbcatq.dll$feclient.dll$gq
API String ID: 451455982-2463469780
Opcode ID: 50a31818d64a0764bfc6703f4ca387cee0531017a4d82a33f9b9ebae8621bdbc
Instruction ID: d7eaa2e41592b385c961570e449df25a441ffaa0d3ec2670914c27275b6fbc64
Opcode Fuzzy Hash: 50a31818d64a0764bfc6703f4ca387cee0531017a4d82a33f9b9ebae8621bdbc
Instruction Fuzzy Hash: 082149B290021DEFDB119F98CD808EEBBB9FF88354F104169F804A3250D734DE51ABA0

Function 006E49FC Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 67fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,0071B500,00000000,00000000,00000000,00000001,00000000,00000000,00000000,?,006E531F), ref: 006E4A48

Strings

Failed to write message type to pipe., xrefs: 006E4A8A
c:\agent\_work\79\s\src\burn\engine\pipe.cpp, xrefs: 006E4A80
Failed to allocate message to write., xrefs: 006E4A27

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: FileWrite
String ID: Failed to allocate message to write.$Failed to write message type to pipe.$c:\agent\_work\79\s\src\burn\engine\pipe.cpp
API String ID: 3934441357-1737657238
Opcode ID: 5fe35eb46224fb63693de7ed7a77f529fb44ddc3dba38d7a1e13b9f235c1b798
Instruction ID: 910e10c45023882d33d58180282123d285dcf1ea7b34388c0542f68f30e9b757
Opcode Fuzzy Hash: 5fe35eb46224fb63693de7ed7a77f529fb44ddc3dba38d7a1e13b9f235c1b798
Instruction Fuzzy Hash: FC11E772981269FBCB11DFAADD09EDF7E7AEF40360F114065F800B6254DB309E00DAA8

Function 006D9DDA Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 67COMMON

Download Yara Rule

APIs

_MREFOpen@16.MSPDB140-MSVCRT ref: 006D9DFC

Strings

Failed to format path string., xrefs: 006D9E07
File search: %ls, did not find path: %ls, xrefs: 006D9E67
Failed get file version., xrefs: 006D9E3C
Failed to set variable., xrefs: 006D9E5B

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: Open@16
String ID: Failed get file version.$Failed to format path string.$Failed to set variable.$File search: %ls, did not find path: %ls
API String ID: 3613110473-2458530209
Opcode ID: f31c96e21bb6aabd0510226e61bad34d714a647aae3993c1d8efe910b7758f90
Instruction ID: 3ba2b82a9b159c1904a9551ba52918c636ff8c217a45d589e5c08895a00d9774
Opcode Fuzzy Hash: f31c96e21bb6aabd0510226e61bad34d714a647aae3993c1d8efe910b7758f90
Instruction Fuzzy Hash: 5A119072D00129FACF12AE98CD42CEEBB7AEF14750B104166F801A6351D6759E90ABE1

Function 006E8109 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 65COMMON

Download Yara Rule

APIs

Part of subcall function 006D39DF: GetProcessHeap.KERNEL32(?,000001C7,?,006D237C,?,00000001,80004005,8007139F,?,?,0071058B,8007139F,?,00000000,00000000,8007139F), ref: 006D39F0
Part of subcall function 006D39DF: RtlAllocateHeap.NTDLL(00000000,?,006D237C,?,00000001,80004005,8007139F,?,?,0071058B,8007139F,?,00000000,00000000,8007139F), ref: 006D39F7

CreateWellKnownSid.ADVAPI32(00000000,00000000,00000000,00000000,00000044,00000001,00000000,00000000,?,?,006E8D01,0000001A,?,?,00000000,00000000), ref: 006E8152
GetLastError.KERNEL32(?,?,006E8D01,0000001A,?,?,00000000,00000000,?,?,?), ref: 006E815C

Strings

c:\agent\_work\79\s\src\burn\engine\cache.cpp, xrefs: 006E8130, 006E8180
Failed to allocate memory for well known SID., xrefs: 006E813A
Failed to create well known SID., xrefs: 006E818A

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: Heap$AllocateCreateErrorKnownLastProcessWell
String ID: Failed to allocate memory for well known SID.$Failed to create well known SID.$c:\agent\_work\79\s\src\burn\engine\cache.cpp
API String ID: 2186923214-3348081855
Opcode ID: 253a4c0d24da13f13b2c3e79390155ca5d10e1ef27c18d1daeea57bae324bee4
Instruction ID: 0dbc7a80cf2e0aa7429c749ae1da39fbf48d86e85125617da47a2598594a0163
Opcode Fuzzy Hash: 253a4c0d24da13f13b2c3e79390155ca5d10e1ef27c18d1daeea57bae324bee4
Instruction Fuzzy Hash: 9D014C73642332BFE32066569D06EDF595E8F41B60B11401EFD08AF380EEA89E4285E4

Function 006FDA74 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 64windowCOMMON

Download Yara Rule

APIs

MsgWaitForMultipleObjects.USER32(00000001,?,00000000,000003E8,000004FF), ref: 006FDAA2
PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 006FDACC
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,006FDC9A,00000000,?,?,?,00000000,00000000), ref: 006FDAD4

Strings

c:\agent\_work\79\s\src\burn\engine\bitsengine.cpp, xrefs: 006FDAF8
Failed while waiting for download., xrefs: 006FDB02

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: ErrorLastMessageMultipleObjectsPeekWait
String ID: Failed while waiting for download.$c:\agent\_work\79\s\src\burn\engine\bitsengine.cpp
API String ID: 435350009-4248891713
Opcode ID: 03614ed5510e1a6854cabcfd47ebb5ba343e3676f013143d71196ac4d3028667
Instruction ID: ae1f8bd4af1fe578042a5304761734ee3e4ba0eccdb1ec919c41804b98d8e2bd
Opcode Fuzzy Hash: 03614ed5510e1a6854cabcfd47ebb5ba343e3676f013143d71196ac4d3028667
Instruction Fuzzy Hash: 49012973A4523977D7205AAC8C49EEF7B5AEB04720F014025FB04E62C5D6A8A90081E9

Function 006D5F5A Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 58COMMON

Download Yara Rule

APIs

GetComputerNameW.KERNEL32(?,00000010), ref: 006D5F88
GetLastError.KERNEL32 ref: 006D5F92

Strings

c:\agent\_work\79\s\src\burn\engine\variable.cpp, xrefs: 006D5FB6
Failed to set variant value., xrefs: 006D5FD9
Failed to get computer name., xrefs: 006D5FC0

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: ComputerErrorLastName
String ID: Failed to get computer name.$Failed to set variant value.$c:\agent\_work\79\s\src\burn\engine\variable.cpp
API String ID: 3560734967-1556572959
Opcode ID: ba7b340ff89234a30652bf20fd3956be34056d237a6f188bc72673b83f5e8cab
Instruction ID: 55f5869ff75e911d3a331db8fb3b2af04a4ad9a8ed0bda67968be22e58b5a406
Opcode Fuzzy Hash: ba7b340ff89234a30652bf20fd3956be34056d237a6f188bc72673b83f5e8cab
Instruction Fuzzy Hash: 0C018672E41628A7D71197989905ADE77E9AB08710F114126F901FB380DA78AE444AE5

Function 006D67C2 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 55COMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(00000104,?), ref: 006D67FB
GetLastError.KERNEL32 ref: 006D6805

Strings

Failed to get temp path., xrefs: 006D6833
c:\agent\_work\79\s\src\burn\engine\variable.cpp, xrefs: 006D6829
Failed to set variant value., xrefs: 006D684F

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: ErrorLastPathTemp
String ID: Failed to get temp path.$Failed to set variant value.$c:\agent\_work\79\s\src\burn\engine\variable.cpp
API String ID: 1238063741-3129921647
Opcode ID: b1792c58088f1063b0e1430d8e03c161282b32f6cf35a066d2e1aff76fcee239
Instruction ID: 2bc3aa10ddafdacf698b1a4ce2638f6be936b4f556a6d2b89a4bb8bf748580b0
Opcode Fuzzy Hash: b1792c58088f1063b0e1430d8e03c161282b32f6cf35a066d2e1aff76fcee239
Instruction Fuzzy Hash: 8801FE72E4133977D720A7589C06FEE77A95F04710F11416AFE04FB3C1EA68AD4446E9

Function 006D5EC2 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 55COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?), ref: 006D5ED4

Part of subcall function 00710DDC: GetModuleHandleW.KERNEL32(kernel32,IsWow64Process,?,?,?,006D5EE0,00000000), ref: 00710DF0
Part of subcall function 00710DDC: GetProcAddress.KERNEL32(00000000), ref: 00710DF7
Part of subcall function 00710DDC: GetLastError.KERNEL32(?,?,?,006D5EE0,00000000), ref: 00710E0E

Part of subcall function 00713FCA: SHGetFolderPathW.SHELL32(00000000,?,00000000,00000000,?), ref: 00713FF7

Strings

Failed to get shell folder., xrefs: 006D5F08
c:\agent\_work\79\s\src\burn\engine\variable.cpp, xrefs: 006D5EFE
Failed to get 64-bit folder., xrefs: 006D5F1E
Failed to set variant value., xrefs: 006D5F38

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: AddressCurrentErrorFolderHandleLastModulePathProcProcess
String ID: Failed to get 64-bit folder.$Failed to get shell folder.$Failed to set variant value.$c:\agent\_work\79\s\src\burn\engine\variable.cpp
API String ID: 2084161155-3711669023
Opcode ID: 02570604fcca7447bf0e6ecb99e675b4012fbe92777fcc6cac0ce7b43f8ca5bc
Instruction ID: 98272a443df82ee298b1da17badb056c7e3237cfc5c8532d0c64e917b7427893
Opcode Fuzzy Hash: 02570604fcca7447bf0e6ecb99e675b4012fbe92777fcc6cac0ce7b43f8ca5bc
Instruction Fuzzy Hash: 4B01C871D54629F6DF22A794CC0AFDD3A7ADF00750F108056F801BA3C0DB789E809B95

Function 007143D6 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 53fileCOMMON

Download Yara Rule

APIs

Part of subcall function 007146C4: FindFirstFileW.KERNEL32(006F8F8D,?,00000100,00000000,00000000), ref: 007146FF
Part of subcall function 007146C4: FindClose.KERNEL32(00000000), ref: 0071470B

SetFileAttributesW.KERNEL32(006F8F8D,00000080,00000000,006F8F8D,000000FF,00000000,?,?,006F8F8D), ref: 00714405
GetLastError.KERNEL32(?,?,006F8F8D), ref: 0071440F
DeleteFileW.KERNEL32(006F8F8D,00000000,006F8F8D,000000FF,00000000,?,?,006F8F8D), ref: 0071442F
GetLastError.KERNEL32(?,?,006F8F8D), ref: 00714439

Strings

c:\agent\_work\79\s\src\libs\dutil\fileutil.cpp, xrefs: 00714454

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: File$ErrorFindLast$AttributesCloseDeleteFirst
String ID: c:\agent\_work\79\s\src\libs\dutil\fileutil.cpp
API String ID: 3967264933-3405085980
Opcode ID: 85c03647aa0bcb3c2a199d898def9ce8b1cce0cb11a4a0b1c18c59bc565a4841
Instruction ID: 3473ff620ffebccfbcdc45c74feb3a7dd784db4205c0252b74dbff268e3b14d0
Opcode Fuzzy Hash: 85c03647aa0bcb3c2a199d898def9ce8b1cce0cb11a4a0b1c18c59bc565a4841
Instruction Fuzzy Hash: 7A01D232A0167AA7DB315BAD9D05FDB7EA8AF047A1F028220FD54EA2D1D328CD4095D4

Function 006FD6E4 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 50COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 006FD6F9
LeaveCriticalSection.KERNEL32(?), ref: 006FD73E
SetEvent.KERNEL32(?,?,?,?), ref: 006FD752

Strings

Failure while sending progress during BITS job modification., xrefs: 006FD72D
Failed to get state during job modification., xrefs: 006FD712

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: CriticalSection$EnterEventLeave
String ID: Failed to get state during job modification.$Failure while sending progress during BITS job modification.
API String ID: 3094578987-1258544340
Opcode ID: 2e2210c84c06619e95c34defcee54329c7cb54f4e920a90d6233d70c50fd0960
Instruction ID: 685f1f62955721b1635dae57e0bf688a8c54b987241054197154ea4b922c742b
Opcode Fuzzy Hash: 2e2210c84c06619e95c34defcee54329c7cb54f4e920a90d6233d70c50fd0960
Instruction Fuzzy Hash: 7E01D472A01629FBCB01EB59C89AEAEB7AEFF14725B008115F505DB280D778F904CBD4

Function 006FD4CC Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 49COMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(00000008,00000000,00000000,?,006FDC24,?,?,?,?,?,00000000,00000000,?), ref: 006FD4E6
CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,?,006FDC24,?,?,?,?,?,00000000,00000000,?), ref: 006FD4F1
GetLastError.KERNEL32(?,006FDC24,?,?,?,?,?,00000000,00000000,?), ref: 006FD4FE

Strings

Failed to create BITS job complete event., xrefs: 006FD52C
c:\agent\_work\79\s\src\burn\engine\bitsengine.cpp, xrefs: 006FD522

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: CreateCriticalErrorEventInitializeLastSection
String ID: Failed to create BITS job complete event.$c:\agent\_work\79\s\src\burn\engine\bitsengine.cpp
API String ID: 3069647169-3888958423
Opcode ID: c57692b296d16f80e91473d72639659e70988e806c8f8a1f868e63ed8ae689fb
Instruction ID: 4d7843a8addccf30505f5ae8ba8d7c16c7c0976b68907a160fab6c49486f5055
Opcode Fuzzy Hash: c57692b296d16f80e91473d72639659e70988e806c8f8a1f868e63ed8ae689fb
Instruction Fuzzy Hash: 2F01D4B6601636BBD3109F5AD805A8ABFAAFF09720F018116FE08D7740D774E810CBE8

Function 006FD956 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 49COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(00000008,?,00000000,00000000,00000000,?,006FDAC2), ref: 006FD96A
LeaveCriticalSection.KERNEL32(00000008,?,006FDAC2), ref: 006FD9AF
SetEvent.KERNEL32(?,?,006FDAC2), ref: 006FD9C3

Strings

Failed to get BITS job state., xrefs: 006FD983
Failure while sending progress., xrefs: 006FD99E

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: CriticalSection$EnterEventLeave
String ID: Failed to get BITS job state.$Failure while sending progress.
API String ID: 3094578987-2876445054
Opcode ID: ae4d2ac7ddbb2f36626cf85cfdddbf8d0103ecfde61a6925df02da0f989ed5c4
Instruction ID: ec03413c98490925374ab47c8d44f22203a37601f8bba31f680dbcc1135dce4b
Opcode Fuzzy Hash: ae4d2ac7ddbb2f36626cf85cfdddbf8d0103ecfde61a6925df02da0f989ed5c4
Instruction Fuzzy Hash: 2801D472A01629FFC712AB99C859EAEB7AAFF04721B004115F605D3690D7B4F904CBD9

Function 00713C5B Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(?), ref: 00713CA0
SysFreeString.OLEAUT32(00000000), ref: 00713CD3

Strings

`)u, xrefs: 00713CD3
c:\agent\_work\79\s\src\libs\dutil\xmlutil.cpp, xrefs: 00713C71, 00713CB7
BTm, xrefs: 00713C5B

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: String$AllocFree
String ID: BTm$`)u$c:\agent\_work\79\s\src\libs\dutil\xmlutil.cpp
API String ID: 344208780-3106803351
Opcode ID: 225a90b4ddcef7302b50963f356cc599ba46dd5fb498424e7a50b3028a0c630b
Instruction ID: 92afdba932c04ff229e21542e8956796638f246d27c0112b8feea18e8c41f36b
Opcode Fuzzy Hash: 225a90b4ddcef7302b50963f356cc599ba46dd5fb498424e7a50b3028a0c630b
Instruction Fuzzy Hash: 23016239A40226B7E7205E6D9C08EFA3699DF55B60F114429FC04AB3D0D7BCCE4456E5

Function 00711F63 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 44libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(SRSetRestorePointW,srclient.dll), ref: 00711F8E
GetLastError.KERNEL32(?,006D4A21,00000001,?,?,006D459E,?,?,?,?,006D54A3,?,?,?,?), ref: 00711F9D

Strings

srclient.dll, xrefs: 00711F6C
SRSetRestorePointW, xrefs: 00711F83
c:\agent\_work\79\s\src\libs\dutil\srputil.cpp, xrefs: 00711FBE

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: AddressErrorLastProc
String ID: SRSetRestorePointW$c:\agent\_work\79\s\src\libs\dutil\srputil.cpp$srclient.dll
API String ID: 199729137-3932515841
Opcode ID: cc500cae948b0bba82814eccfce136b08d8a233855d0d2c9d7c989b69a35ec23
Instruction ID: d4a727bc71038a920ae23def44296c4cd2b8509bab795e43c965c44f64156718
Opcode Fuzzy Hash: cc500cae948b0bba82814eccfce136b08d8a233855d0d2c9d7c989b69a35ec23
Instruction Fuzzy Hash: 4301D672E43676A3E732179D58097D629589B00761F428225FF00BE3D1E76CCC8596D9

Function 00716106 Relevance: 7.7, APIs: 3, Strings: 2, Instructions: 162stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?), ref: 007161D3
lstrlenW.KERNEL32(00000000), ref: 007161EB

Strings

gq, xrefs: 00716106
c:\agent\_work\79\s\src\libs\dutil\dlutil.cpp, xrefs: 00716274

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: lstrlen
String ID: c:\agent\_work\79\s\src\libs\dutil\dlutil.cpp$gq
API String ID: 1659193697-2307428812
Opcode ID: d49b17667246f87d30474e66b0627c4508812c3fb76c786aeed971afefe5f8ac
Instruction ID: a01127e7c0fb92e4f3935aa29dde723387ac7119580f179e0af81db900eb8f75
Opcode Fuzzy Hash: d49b17667246f87d30474e66b0627c4508812c3fb76c786aeed971afefe5f8ac
Instruction Fuzzy Hash: 20517372900229BBDB219FE88C449EF7BB9AF48750F158114FE00A7290D738DD80ABA0

Function 007047D7 Relevance: 7.6, APIs: 5, Instructions: 120COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00704845
_free.LIBCMT ref: 00704865
__crt_fast_encode_pointer.LIBVCRUNTIME ref: 007048C6
__crt_fast_encode_pointer.LIBVCRUNTIME ref: 007048D8
__crt_fast_encode_pointer.LIBVCRUNTIME ref: 007048E5

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: __crt_fast_encode_pointer$_free
String ID:
API String ID: 366466260-0
Opcode ID: 57f3d6c164571e5cdc956557e43ed34fefb1a93909b2667a5726a71bda369834
Instruction ID: 8b32fcdf324c8064be422e26fddc86a895ce415463de17f23853930dcc2940cb
Opcode Fuzzy Hash: 57f3d6c164571e5cdc956557e43ed34fefb1a93909b2667a5726a71bda369834
Instruction Fuzzy Hash: E241E572A00214DFDB10DF68C881A59B7E6EF84710B1586A9E615EB3D1EB35AD01CB80

Function 006D22B5 Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 118COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(8007139F,00000000,?,?,00000000,00000000,80004005,8007139F,?,?,0071058B,8007139F,?,00000000,00000000,8007139F), ref: 006D22FB
GetLastError.KERNEL32(?,00000000,00000000,80004005,8007139F,?,?,0071058B,8007139F,?,00000000,00000000,8007139F), ref: 006D2307

Part of subcall function 006D3C5F: GetProcessHeap.KERNEL32(00000000,000001C7,?,006D22D5,000001C7,80004005,8007139F,?,?,0071058B,8007139F,?,00000000,00000000,8007139F), ref: 006D3C67
Part of subcall function 006D3C5F: HeapSize.KERNEL32(00000000,?,006D22D5,000001C7,80004005,8007139F,?,?,0071058B,8007139F,?,00000000,00000000,8007139F), ref: 006D3C6E

Strings

c:\agent\_work\79\s\src\libs\dutil\strutil.cpp, xrefs: 006D232B

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: Heap$ByteCharErrorLastMultiProcessSizeWide
String ID: c:\agent\_work\79\s\src\libs\dutil\strutil.cpp
API String ID: 3662877508-2901571208
Opcode ID: 1b9b5996eb40c509aa3abfe5001081cf7da5a58ede7e1935c7cf955fbc16e1ec
Instruction ID: 567b774a418683f2c19fa4df5e44ac24a09b70f7473eec8f88c8532c7f8a22a9
Opcode Fuzzy Hash: 1b9b5996eb40c509aa3abfe5001081cf7da5a58ede7e1935c7cf955fbc16e1ec
Instruction Fuzzy Hash: 24312A32E00227EBC7208E65CCA4AAA3B97AF65764B134266FC10DB390E739CC01D7D0

Function 006D89E8 Relevance: 7.6, APIs: 5, Instructions: 117stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,?,00000000,00000000,?,?,006D8BA7,006D96F4,?,006D96F4,?,?,006D96F4,?,?), ref: 006D8A08
lstrlenW.KERNEL32(?,?,00000000,00000000,?,?,006D8BA7,006D96F4,?,006D96F4,?,?,006D96F4,?,?), ref: 006D8A10
CompareStringW.KERNEL32(0000007F,?,?,?,?,00000000,?,00000000,00000000,?,?,006D8BA7,006D96F4,?,006D96F4,?), ref: 006D8A5F
CompareStringW.KERNEL32(0000007F,?,?,00000000,?,00000000,?,00000000,00000000,?,?,006D8BA7,006D96F4,?,006D96F4,?), ref: 006D8AC1
CompareStringW.KERNEL32(0000007F,?,?,00000000,?,00000000,?,00000000,00000000,?,?,006D8BA7,006D96F4,?,006D96F4,?), ref: 006D8AEE

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: CompareString$lstrlen
String ID:
API String ID: 1657112622-0
Opcode ID: 10952c0d1c0fc1f799ff07b55bcbfc9cf63db0c80f0e93510f12eee53b4df5bb
Instruction ID: bcbbc1ac2feecf1574940b476591e133d8a1fda95434a7ac4189f1a67e690ed8
Opcode Fuzzy Hash: 10952c0d1c0fc1f799ff07b55bcbfc9cf63db0c80f0e93510f12eee53b4df5bb
Instruction Fuzzy Hash: DD313D72E00158BFCB258F58CC889EE3F6BEB49390F198417F9199B350CA759991DBA0

Function 006D74BE Relevance: 7.5, APIs: 2, Strings: 3, Instructions: 45COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(006D53FA,WixBundleOriginalSource,?,?,006EA51F,840F01E8,WixBundleOriginalSource,?,0073BB6C,?,00000000,006D5482,00000001,?,?,006D5482), ref: 006D74CA
LeaveCriticalSection.KERNEL32(006D53FA,006D53FA,00000000,00000000,?,?,006EA51F,840F01E8,WixBundleOriginalSource,?,0073BB6C,?,00000000,006D5482,00000001,?), ref: 006D7531

Strings

Failed to get value as string for variable: %ls, xrefs: 006D7520
WixBundleOriginalSource, xrefs: 006D74C6
Failed to get value of variable: %ls, xrefs: 006D7504

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: Failed to get value as string for variable: %ls$Failed to get value of variable: %ls$WixBundleOriginalSource
API String ID: 3168844106-30613933
Opcode ID: 95da46dab2672d001db683966d8e4f9adf51919e6e51f46ae998001fcfeec69b
Instruction ID: a4cefed42aac9e701107ce6f56f0cb79843648b90283ab381e996a192dff89af
Opcode Fuzzy Hash: 95da46dab2672d001db683966d8e4f9adf51919e6e51f46ae998001fcfeec69b
Instruction Fuzzy Hash: 4101B176D44128FBCF225F58DC0AEDE7A66AF00324F118015FC04AA360E7399E6097D6

Function 006FCE4E Relevance: 7.5, APIs: 5, Instructions: 41fileCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?,00000000,?,00000000,?,006FCE46,00000000), ref: 006FCE69
CloseHandle.KERNEL32(00000000,00000000,?,00000000,?,006FCE46,00000000), ref: 006FCE75
CloseHandle.KERNEL32(0071B518,00000000,?,00000000,?,006FCE46,00000000), ref: 006FCE82
CloseHandle.KERNEL32(00000000,00000000,?,00000000,?,006FCE46,00000000), ref: 006FCE8F
UnmapViewOfFile.KERNEL32(0071B4E8,00000000,?,006FCE46,00000000), ref: 006FCE9E

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: CloseHandle$FileUnmapView
String ID:
API String ID: 260491571-0
Opcode ID: dee77ed27108b7a33aeab690f3637df7b88a60e76c32d8d0a6ac5049973a0551
Instruction ID: 8077ff43a2867e6f0595524b7034ead36cbe0f84b0509bd7661c0499ed0bdd90
Opcode Fuzzy Hash: dee77ed27108b7a33aeab690f3637df7b88a60e76c32d8d0a6ac5049973a0551
Instruction Fuzzy Hash: E601F632501B19DFCB306F66D9808ABF7EABF50725315C93EE2A652A20C371A850DF40

Function 00708849 Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00708861

Part of subcall function 00705F5F: HeapFree.KERNEL32(00000000,00000000,?,007088DC,?,00000000,?,00000000,?,00708903,?,00000007,?,?,00708D7D,?), ref: 00705F75
Part of subcall function 00705F5F: GetLastError.KERNEL32(?,?,007088DC,?,00000000,?,00000000,?,00708903,?,00000007,?,?,00708D7D,?,?), ref: 00705F87

_free.LIBCMT ref: 00708873
_free.LIBCMT ref: 00708885
_free.LIBCMT ref: 00708897
_free.LIBCMT ref: 007088A9

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 92f0717e06c8f9c76af39b74e6be3e7caa1f19de1012340d1be7df30677e33fd
Instruction ID: 29015fe6fe716493dd240939be892879d3b46441542a893b9c5e73db1ac2ef61
Opcode Fuzzy Hash: 92f0717e06c8f9c76af39b74e6be3e7caa1f19de1012340d1be7df30677e33fd
Instruction Fuzzy Hash: FEF09672514600EBD660EB54FC85C1773E9EA803107949A56F38DD76D1CF3CFC804A55

Function 00718929 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 137timeCOMMON

Download Yara Rule

APIs

SystemTimeToFileTime.KERNEL32(?,00000000,00000000,clbcatq.dll,00000000,clbcatq.dll,00000000,00000000,00000000), ref: 00718A36
GetLastError.KERNEL32 ref: 00718A40

Strings

clbcatq.dll, xrefs: 00718947, 00718952
c:\agent\_work\79\s\src\libs\dutil\timeutil.cpp, xrefs: 00718A64

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: Time$ErrorFileLastSystem
String ID: c:\agent\_work\79\s\src\libs\dutil\timeutil.cpp$clbcatq.dll
API String ID: 2781989572-3809602037
Opcode ID: 5504e1c3e35f1d4b31476908c9bbadd4f509cabe4925568e215f8d2717f938be
Instruction ID: 5d33c058d3bac8f769b643a9911fb63a05277f369345c1dba5dee1137447c49b
Opcode Fuzzy Hash: 5504e1c3e35f1d4b31476908c9bbadd4f509cabe4925568e215f8d2717f938be
Instruction Fuzzy Hash: E641C361F50206A7D7649BBC8D59AFFB669AF50700F14C21AF601B72C4DA3DDE8083A2

Function 00703C7F Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 122COMMON

Download Yara Rule

Strings

C:\Users\user\Desktop\jlK7Q70gbN.exe, xrefs: 00703CBD, 00703CC4, 00703CF8

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID:
String ID: C:\Users\user\Desktop\jlK7Q70gbN.exe
API String ID: 0-2518045702
Opcode ID: 757a67f6576bf045b26193bd356e066e27e305dfcb751a5543bf4461df5a5086
Instruction ID: 1e7fc2f9a1ad12a5c02fa33188f568e6d6e0d2c990c1c248c61df5556469fde7
Opcode Fuzzy Hash: 757a67f6576bf045b26193bd356e066e27e305dfcb751a5543bf4461df5a5086
Instruction Fuzzy Hash: 9041AF71B00614EBDB21DF99DC859AFBBFCEB85310B104266F804E7291E7789B00CB60

Function 0071397E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 121memoryCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(000002C0), ref: 00713998
SysAllocString.OLEAUT32(?), ref: 007139A8
VariantClear.OLEAUT32(?), ref: 00713A87

Strings

c:\agent\_work\79\s\src\libs\dutil\xmlutil.cpp, xrefs: 007139C0

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: Variant$AllocClearInitString
String ID: c:\agent\_work\79\s\src\libs\dutil\xmlutil.cpp
API String ID: 2213243845-812302861
Opcode ID: 0fc2d0d333c4620e455be8bd1fab1642df7ec26de1b66a281fbe47cc1f8e83dc
Instruction ID: b54aba5a17c4772816bc8d9ebef6aa1fbf0115e360da4baece95e07246e21db8
Opcode Fuzzy Hash: 0fc2d0d333c4620e455be8bd1fab1642df7ec26de1b66a281fbe47cc1f8e83dc
Instruction Fuzzy Hash: 7D418B75D00225ABCB109F68C889EDFBBB8AF05721F0581A5FC51EB291D778DE40CB90

Function 007008D0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 117COMMON

Download Yara Rule

APIs

___except_validate_context_record.LIBVCRUNTIME ref: 00700903
__IsNonwritableInCurrentImage.LIBCMT ref: 007009BC

Strings

csm, xrefs: 007009A6
Xo, xrefs: 007009D5

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: CurrentImageNonwritable___except_validate_context_record
String ID: Xo$csm
API String ID: 3480331319-2364393460
Opcode ID: 1c447ceda0ea552e3a4abb51ed71d649c2372299b1f7861beabcc2163529c2cf
Instruction ID: 684809e1b37de12f39275a5cd0545da52cffaef722d44d0672407114cb76b6c6
Opcode Fuzzy Hash: 1c447ceda0ea552e3a4abb51ed71d649c2372299b1f7861beabcc2163529c2cf
Instruction Fuzzy Hash: 67418E34A10208DBDB10DF68C889B9FBBE5BF45334F148255E818AB3D2D739AA15CBD1

Function 0071115A Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 115registryCOMMON

Download Yara Rule

APIs

RegEnumKeyExW.ADVAPI32(00000000,000002C0,00000410,00000002,00000000,00000000,00000000,00000000,00000410,00000002,00000100,00000000,00000000,?,?,006F8B79), ref: 007111B5
RegQueryInfoKeyW.ADVAPI32(00000000,00000000,00000000,00000000,00000000,00000002,00000000,00000000,00000000,00000000,00000000,00000000,?,?,006F8B79,00000000), ref: 007111D3
RegEnumKeyExW.ADVAPI32(00000000,000002C0,00000410,00000002,00000000,00000000,00000000,00000000,00000410,00000003,?,?,006F8B79,00000000,00000000,00000000), ref: 00711229

Strings

c:\agent\_work\79\s\src\libs\dutil\regutil.cpp, xrefs: 007111F9

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: Enum$InfoQuery
String ID: c:\agent\_work\79\s\src\libs\dutil\regutil.cpp
API String ID: 73471667-1128744096
Opcode ID: f0d19f0a5e7b598fc523bb1db73eeb3c2f1577d6d42cada98a56a694d37996a7
Instruction ID: bb20f3e7204ae427acaac8919681c9393c32b078cf1235aa9fa38312afd044e3
Opcode Fuzzy Hash: f0d19f0a5e7b598fc523bb1db73eeb3c2f1577d6d42cada98a56a694d37996a7
Instruction Fuzzy Hash: 8631A776E01129FBEB119AC88C44EEFB66DEF057A4F514066BF00FF190D3398E50A6A0

Function 0071956F Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 102registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0071904C: lstrlenW.KERNEL32(00000100,?,?,?,007193EC,000002C0,00000100,00000100,00000100,?,?,?,006F7AF5,?,?,000001BC), ref: 00719071

RegCloseKey.ADVAPI32(00000000,00000000,crypt32.dll,00000000,00000000,00000000,00000000,crypt32.dll), ref: 00719654
RegCloseKey.ADVAPI32(00000001,00000000,crypt32.dll,00000000,00000000,00000000,00000000,crypt32.dll), ref: 0071966E

Part of subcall function 00710EF7: RegCreateKeyExW.ADVAPI32(00000001,00000000,00000000,00000000,00000000,00000001,00000000,?,00000000,00000001,?,?,006E05AE,?,00000000,00020006), ref: 00710F1C

Part of subcall function 007117D9: RegSetValueExW.ADVAPI32(00020006,00720F38,00000000,00000001,?,00000000,?,000000FF,00000000,00000000,?,?,006DF2DC,00000000,?,00020006), ref: 0071180C

Part of subcall function 007117D9: RegDeleteValueW.ADVAPI32(00020006,00720F38,00000000,?,?,006DF2DC,00000000,?,00020006,?,00720F38,00020006,00000000,?,?,?), ref: 0071183C

Part of subcall function 0071178B: RegSetValueExW.ADVAPI32(?,00000005,00000000,00000004,?,00000004,00000001,?,006DF234,00720F38,Resume,00000005,?,00000000,00000000,00000000), ref: 007117A0

Strings

%ls\%ls, xrefs: 007195D0
crypt32.dll, xrefs: 0071957D

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: Value$Close$CreateDeletelstrlen
String ID: %ls\%ls$crypt32.dll
API String ID: 3924016894-1754266218
Opcode ID: 81796a39905de8daac2bc45a9bd9ffc67ead209bbd5d083d9f3f74feb781f14d
Instruction ID: a12a632766707ec81010ad0fda314bcf56e86dbd5ad9fd7969f2cc81f4ec06dc
Opcode Fuzzy Hash: 81796a39905de8daac2bc45a9bd9ffc67ead209bbd5d083d9f3f74feb781f14d
Instruction Fuzzy Hash: C5311D72C0016EFF8F229FD9CC918DEBBBAEB04350B454166EA0066160D3359E51ABA4

Function 006F8879 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 75registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00711275: RegOpenKeyExW.KERNELBASE(00000000,00000000,00000000,00000000,00000001,0073BB7C,00000000,?,00715A32,80000002,00000000,00020019,00000000,SOFTWARE\Policies\,00000000,00000000), ref: 00711289

RegCloseKey.ADVAPI32(00000000,00000000,00000088,00000000,000002C0,00000410,00020019,00000000,000002C0,00000000,?,?,?,006F8BB5,00000000,00000000), ref: 006F8936

Strings

Failed to open uninstall key for potential related bundle: %ls, xrefs: 006F88A5
Failed to ensure there is space for related bundles., xrefs: 006F88E9
Failed to initialize package from related bundle id: %ls, xrefs: 006F891C

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: CloseOpen
String ID: Failed to ensure there is space for related bundles.$Failed to initialize package from related bundle id: %ls$Failed to open uninstall key for potential related bundle: %ls
API String ID: 47109696-1717420724
Opcode ID: 407a99bc7817699c1fd60934cd9a7ab105f1633cfad4666bd117489f346c4cd5
Instruction ID: 9e04bbb27dfc51dc7f369da20e744a2a54f4193d80f6b68390556cd4a2d2799d
Opcode Fuzzy Hash: 407a99bc7817699c1fd60934cd9a7ab105f1633cfad4666bd117489f346c4cd5
Instruction Fuzzy Hash: 9921837290021EFFDF129E48DC06FFE7A7AEF04750F104095FA10A6190DB79AA60EB95

Function 006D3BA1 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 74memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000000,80004005,00000000,00000000,00000100,?,006D146A,00000000,80004005,00000000,80004005,00000000,000001C7,?,006D13B0), ref: 006D3BBF
HeapReAlloc.KERNEL32(00000000,?,006D146A,00000000,80004005,00000000,80004005,00000000,000001C7,?,006D13B0,000001C7,00000100,?,80004005,00000000), ref: 006D3BC6

Part of subcall function 006D39DF: GetProcessHeap.KERNEL32(?,000001C7,?,006D237C,?,00000001,80004005,8007139F,?,?,0071058B,8007139F,?,00000000,00000000,8007139F), ref: 006D39F0
Part of subcall function 006D39DF: RtlAllocateHeap.NTDLL(00000000,?,006D237C,?,00000001,80004005,8007139F,?,?,0071058B,8007139F,?,00000000,00000000,8007139F), ref: 006D39F7

Part of subcall function 006D3C5F: GetProcessHeap.KERNEL32(00000000,000001C7,?,006D22D5,000001C7,80004005,8007139F,?,?,0071058B,8007139F,?,00000000,00000000,8007139F), ref: 006D3C67
Part of subcall function 006D3C5F: HeapSize.KERNEL32(00000000,?,006D22D5,000001C7,80004005,8007139F,?,?,0071058B,8007139F,?,00000000,00000000,8007139F), ref: 006D3C6E

_memcpy_s.LIBCMT ref: 006D3C12

Strings

c:\agent\_work\79\s\src\libs\dutil\memutil.cpp, xrefs: 006D3C53

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: Heap$Process$AllocAllocateSize_memcpy_s
String ID: c:\agent\_work\79\s\src\libs\dutil\memutil.cpp
API String ID: 3406509257-3949461043
Opcode ID: 931e408f60c8492a52e3f0b5306f78a03efd830e3ff627ccf95e1ba4463fb224
Instruction ID: 1d6e2237414e60fcdce72794262baa58c7e86c84a3c2068696e0111639f39c03
Opcode Fuzzy Hash: 931e408f60c8492a52e3f0b5306f78a03efd830e3ff627ccf95e1ba4463fb224
Instruction Fuzzy Hash: 7C115432E10179ABCB216F689D418EE3A0B9F40760B048217F804AB351C736CF109396

Function 00710A80 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62filestringCOMMONLIBRARYCODE

Download Yara Rule

APIs

lstrlenA.KERNEL32(006F1099,00000000,00000000,?,?,?,0071033D,006F1099,006F1099,?,00000000,0000FDE9,?,006F1099,8007139F,Invalid operation for this state.), ref: 00710A92
WriteFile.KERNEL32(FFFFFFFF,00000000,00000000,?,00000000,?,?,0071033D,006F1099,006F1099,?,00000000,0000FDE9,?,006F1099,8007139F), ref: 00710ACE
GetLastError.KERNEL32(?,?,0071033D,006F1099,006F1099,?,00000000,0000FDE9,?,006F1099,8007139F,Invalid operation for this state.,c:\agent\_work\79\s\src\burn\engine\cabextract.cpp,000001C7,8007139F), ref: 00710AD8

Strings

c:\agent\_work\79\s\src\libs\dutil\logutil.cpp, xrefs: 00710B09

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: ErrorFileLastWritelstrlen
String ID: c:\agent\_work\79\s\src\libs\dutil\logutil.cpp
API String ID: 606256338-2833595300
Opcode ID: 1591bb96c457eb4d85356dbbc62d8dd3cc1b461601bed00643051e38800a48e3
Instruction ID: 287464386499044ee6e3daf7b359a709b8c4c000992e065a34113743768d24ef
Opcode Fuzzy Hash: 1591bb96c457eb4d85356dbbc62d8dd3cc1b461601bed00643051e38800a48e3
Instruction Fuzzy Hash: 58110AB2A01228B793308A6DDD44EDF7A6DAB44BA0B01C215FD01E72C1E7B8DDC082E0

Function 006D1206 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 61COMMON

Download Yara Rule

APIs

CommandLineToArgvW.SHELL32(00000000,00000000,00000000,00000000,00000000,00000000,ignored ,00000000,?,00000000,?,?,?,006D527C,00000000,?), ref: 006D1244
GetLastError.KERNEL32(?,?,?,006D527C,00000000,?,?,00000003,00000000,00000000,?,?,?,?,?,?), ref: 006D124E

Strings

c:\agent\_work\79\s\src\libs\dutil\apputil.cpp, xrefs: 006D126F
ignored , xrefs: 006D1213

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: ArgvCommandErrorLastLine
String ID: c:\agent\_work\79\s\src\libs\dutil\apputil.cpp$ignored
API String ID: 3459693003-3369145366
Opcode ID: a64169ed29b8e56899317a23beded7fe49ad5efe53c02f769f102b5fae340c78
Instruction ID: f1b2ab1e856d60a2dfce5b60b85b0c7407f30c2c62d684f1649de20a74146d45
Opcode Fuzzy Hash: a64169ed29b8e56899317a23beded7fe49ad5efe53c02f769f102b5fae340c78
Instruction Fuzzy Hash: BD119D76D00129BB8B21DB98D805DDEBBAAAF45B50B01405AF800EB340E7B19F40CAA0

Function 0071014F Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 59windowCOMMON

Download Yara Rule

APIs

FormatMessageW.KERNEL32(00000900,?,?,00000000,00000000,00000000,?,00000000,?,?,00710812,?,?,?,?,00000001), ref: 0071016E
GetLastError.KERNEL32(?,00710812,?,?,?,?,00000001,?,006D5651,?,?,00000000,?,?,006D53D2,00000002), ref: 0071017A
LocalFree.KERNEL32(00000000,?,?,00000000,?,?,00710812,?,?,?,?,00000001,?,006D5651,?,?), ref: 007101E3

Strings

c:\agent\_work\79\s\src\libs\dutil\logutil.cpp, xrefs: 00710199

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: ErrorFormatFreeLastLocalMessage
String ID: c:\agent\_work\79\s\src\libs\dutil\logutil.cpp
API String ID: 1365068426-2833595300
Opcode ID: a0bf34c1bff2bb976051f704e1041236d8c47d058025b38735d51dc1214d70eb
Instruction ID: 1bfdd7a395ac48ad6abc4f1ecc53f05f70dcc0cea1904be72b5d841229df4da3
Opcode Fuzzy Hash: a0bf34c1bff2bb976051f704e1041236d8c47d058025b38735d51dc1214d70eb
Instruction Fuzzy Hash: C4118C32601129FBDB219F998E45EEF7A69EF54720F018019FD01A61A0D7B89ED0E6E0

Function 006FCEAF Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 58synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF,00000000,759230D0,?,?,006FD0E4,00000000,00000000,00000000,00000000), ref: 006FCEBF
ReleaseMutex.KERNEL32(?,?,006FD0E4,00000000,00000000,00000000,00000000), ref: 006FCF46

Part of subcall function 006D39DF: GetProcessHeap.KERNEL32(?,000001C7,?,006D237C,?,00000001,80004005,8007139F,?,?,0071058B,8007139F,?,00000000,00000000,8007139F), ref: 006D39F0
Part of subcall function 006D39DF: RtlAllocateHeap.NTDLL(00000000,?,006D237C,?,00000001,80004005,8007139F,?,?,0071058B,8007139F,?,00000000,00000000,8007139F), ref: 006D39F7

Strings

c:\agent\_work\79\s\src\burn\engine\netfxchainer.cpp, xrefs: 006FCF04
Failed to allocate memory for message data, xrefs: 006FCF0E

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: Heap$AllocateMutexObjectProcessReleaseSingleWait
String ID: Failed to allocate memory for message data$c:\agent\_work\79\s\src\burn\engine\netfxchainer.cpp
API String ID: 2993511968-1329786970
Opcode ID: 127f19faa16769bf8c85fc2fdd35b849ff7db9120592c29fc85baff1266227fd
Instruction ID: eb61d6b72b59f37be5c386b02dfe44f734f2e22c8563864a68d50cad868c8700
Opcode Fuzzy Hash: 127f19faa16769bf8c85fc2fdd35b849ff7db9120592c29fc85baff1266227fd
Instruction Fuzzy Hash: F81191B1300219EFD7159F28D895EAABBB6FF49720F104169F9149B3A1C775AC10CB98

Function 0071501B Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 50fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(002E0032,40000000,00000001,00000000,00000002,00000080,00000000,006E0455,00000000,?,006DF499,0071B500,00000080,002E0032,00000000), ref: 00715033
GetLastError.KERNEL32(?,006DF499,0071B500,00000080,002E0032,00000000,?,006E0455,crypt32.dll,00000094,?,?,?,?,?,00000000), ref: 00715040
CloseHandle.KERNEL32(00000000,00000000,0071B500,006DF499,?,006DF499,0071B500,00000080,002E0032,00000000,?,006E0455,crypt32.dll,00000094), ref: 00715094

Strings

c:\agent\_work\79\s\src\libs\dutil\fileutil.cpp, xrefs: 00715064

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: CloseCreateErrorFileHandleLast
String ID: c:\agent\_work\79\s\src\libs\dutil\fileutil.cpp
API String ID: 2528220319-3405085980
Opcode ID: 15b02fd6f015df3fd653360816e1b6eadc5304e142957f2e4300b1d4b1bb143b
Instruction ID: 94b04253af6dad4e000e341565ca25e5246515958d45c60d0f23e153cf498a75
Opcode Fuzzy Hash: 15b02fd6f015df3fd653360816e1b6eadc5304e142957f2e4300b1d4b1bb143b
Instruction Fuzzy Hash: 5B01D833641A25ABD7354ABD4C05FDE3A15AB88B70F014211FE256B1D0D7798C40A6E4

Function 006E06B3 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 49registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00711275: RegOpenKeyExW.KERNELBASE(00000000,00000000,00000000,00000000,00000001,0073BB7C,00000000,?,00715A32,80000002,00000000,00020019,00000000,SOFTWARE\Policies\,00000000,00000000), ref: 00711289

RegCloseKey.ADVAPI32(00000000,00000001,00000000,00000000,00000001,00000000,00000001,00000000,?,?,00020006,00000000,00000001,00000000), ref: 006E0723

Strings

Failed to open registration key., xrefs: 006E06DA
Failed to update resume mode., xrefs: 006E06F4
Failed to update name and publisher., xrefs: 006E070D

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: CloseOpen
String ID: Failed to open registration key.$Failed to update name and publisher.$Failed to update resume mode.
API String ID: 47109696-1865096027
Opcode ID: 3ded7cb1e11b4f37b5516fb223c97c6213aca0a075dfbe909ada2cda2ca70327
Instruction ID: ea40dde6d45f5dff8dcee067b3e113213e093c246211fb0d18674c024419b976
Opcode Fuzzy Hash: 3ded7cb1e11b4f37b5516fb223c97c6213aca0a075dfbe909ada2cda2ca70327
Instruction Fuzzy Hash: 8501B132A41368F7EF125A95DC42FDEB77AAB20B50F104015F500B6291D7B4AE91AB84

Function 00714BEB Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 49fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,00000080,00000001,00000000,00000003,00000080,00000000,000002C0,00000000,?,006F89D6,00000000,00000088,000002C0,BundleCachePath,00000000), ref: 00714C1F
GetLastError.KERNEL32(?,006F89D6,00000000,00000088,000002C0,BundleCachePath,00000000,000002C0,BundleVersion,000000B8,000002C0,EngineVersion,000002C0,000000B0), ref: 00714C2C

Strings

c:\agent\_work\79\s\src\libs\dutil\fileutil.cpp, xrefs: 00714C00, 00714C50

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: CreateErrorFileLast
String ID: c:\agent\_work\79\s\src\libs\dutil\fileutil.cpp
API String ID: 1214770103-3405085980
Opcode ID: 3b2e2a5175650329249af2bdf610f574a55677e3f9b7b51b4b067e0a9241f86d
Instruction ID: bc68ac73752028990f0a14ade93df221d9fdf2c7e3e11fd3fa401db39b18532e
Opcode Fuzzy Hash: 3b2e2a5175650329249af2bdf610f574a55677e3f9b7b51b4b067e0a9241f86d
Instruction Fuzzy Hash: 5B01D673642235B7E7311A9C5D0AFEE26199B44B70F01C125FE54BF2D0D6AC4D40A2F9

Function 006F6976 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 48serviceCOMMON

Download Yara Rule

APIs

ControlService.ADVAPI32(006F688A,00000001,?,00000001,00000000,?,?,?,?,?,?,006F688A,00000000), ref: 006F699E
GetLastError.KERNEL32(?,?,?,?,?,?,006F688A,00000000), ref: 006F69A8

Strings

c:\agent\_work\79\s\src\burn\engine\msuengine.cpp, xrefs: 006F69CC
Failed to stop wusa service., xrefs: 006F69D6

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: ControlErrorLastService
String ID: Failed to stop wusa service.$c:\agent\_work\79\s\src\burn\engine\msuengine.cpp
API String ID: 4114567744-864945257
Opcode ID: 1161a31003362ee7f0b296385afeddfbab57deb012c33b9cb797f9527afb6729
Instruction ID: 381b59ee6298f373184284859c5e3e977c10ac090696ff3f9efa8952e30d49b9
Opcode Fuzzy Hash: 1161a31003362ee7f0b296385afeddfbab57deb012c33b9cb797f9527afb6729
Instruction Fuzzy Hash: 3901A773A4023967D72097699D46AEF76A5AB08B10F114129FE15BB280DA789D0445E8

Function 00713BD5 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(0071B594), ref: 00713C1A
SysFreeString.OLEAUT32(00000000), ref: 00713C4D

Strings

`)u, xrefs: 00713C4D
c:\agent\_work\79\s\src\libs\dutil\xmlutil.cpp, xrefs: 00713BEB, 00713C31

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: String$AllocFree
String ID: `)u$c:\agent\_work\79\s\src\libs\dutil\xmlutil.cpp
API String ID: 344208780-2301883107
Opcode ID: d77660bac03425815d62b5815b85bbc71999be2bc9420e536aed904f259fdf20
Instruction ID: dd95202dbde6a6e60e39e990464a302934501ee65035e8db6028162e01958e9b
Opcode Fuzzy Hash: d77660bac03425815d62b5815b85bbc71999be2bc9420e536aed904f259fdf20
Instruction Fuzzy Hash: 20018F75644266A7EB201A5D8C04EFA76999F41B60F00803AFD00BB3C0C67CCE9456A5

Function 00716AE3 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 45COMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32(?), ref: 00716B42

Part of subcall function 00718929: SystemTimeToFileTime.KERNEL32(?,00000000,00000000,clbcatq.dll,00000000,clbcatq.dll,00000000,00000000,00000000), ref: 00718A36
Part of subcall function 00718929: GetLastError.KERNEL32 ref: 00718A40

Strings

c:\agent\_work\79\s\src\libs\dutil\atomutil.cpp, xrefs: 00716B30
`)u, xrefs: 00716B42
clbcatq.dll, xrefs: 00716B0F

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: Time$ErrorFileFreeLastStringSystem
String ID: `)u$c:\agent\_work\79\s\src\libs\dutil\atomutil.cpp$clbcatq.dll
API String ID: 211557998-3562644932
Opcode ID: c54b0f57ab918dc2e65bf2de7d1d9d79af5a7ddf619ef659bb57174db1780f17
Instruction ID: 108e9f84553abaed2a1243c1fcd98b3ab7a58804839d2b6fac8a3c4e52736a83
Opcode Fuzzy Hash: c54b0f57ab918dc2e65bf2de7d1d9d79af5a7ddf619ef659bb57174db1780f17
Instruction Fuzzy Hash: 630162F2905116FB8B305F8998418DAFAA9EB14764B71817AE905A7190C3789E50D790

Function 006EEB38 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 39threadwindowCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(?,00009002,00000000,?), ref: 006EEB60
GetLastError.KERNEL32 ref: 006EEB6A

Strings

Failed to post elevate message., xrefs: 006EEB98
c:\agent\_work\79\s\src\burn\engine\engineforapplication.cpp, xrefs: 006EEB8E

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: ErrorLastMessagePostThread
String ID: Failed to post elevate message.$c:\agent\_work\79\s\src\burn\engine\engineforapplication.cpp
API String ID: 2609174426-737417110
Opcode ID: 842cb0f400d587a087357c36e5374ef18e73345c5e99f713621e8d3bbae05d98
Instruction ID: 4da50e241077844e48dafd39e100ff9d8b53a09ad0b3d0e1550f086059b1c7f8
Opcode Fuzzy Hash: 842cb0f400d587a087357c36e5374ef18e73345c5e99f713621e8d3bbae05d98
Instruction Fuzzy Hash: 8FF0F633642371ABD72056999D09DD77796AB00B30F118229FE19BF2C0D72A9C0287D9

Function 006DD884 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 37libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(?,BootstrapperApplicationDestroy), ref: 006DD8AB
FreeLibrary.KERNEL32(?,?,006D4920,00000000,?,?,006D54CB,?,?), ref: 006DD8BA
GetLastError.KERNEL32(?,006D4920,00000000,?,?,006D54CB,?,?), ref: 006DD8C4

Strings

BootstrapperApplicationDestroy, xrefs: 006DD8A3

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: AddressErrorFreeLastLibraryProc
String ID: BootstrapperApplicationDestroy
API String ID: 1144718084-3186005537
Opcode ID: b05791f4b78a9cda4718842dd0596ecac4803f32f5db8db42831dde333b2dd2a
Instruction ID: 1b7691f25b8c473c02a39e0380d0cd34fc8f823cc86231e429e6abfb1ae09022
Opcode Fuzzy Hash: b05791f4b78a9cda4718842dd0596ecac4803f32f5db8db42831dde333b2dd2a
Instruction Fuzzy Hash: 68F06832A00725ABC3116BA9DC04E56F7A5BF54762705C22BE815D6651C724EC50ABD4

Function 007134A9 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 35memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(?), ref: 007134BE
SysFreeString.OLEAUT32(00000000), ref: 007134EE

Strings

`)u, xrefs: 007134EE
c:\agent\_work\79\s\src\libs\dutil\xmlutil.cpp, xrefs: 007134D2

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: String$AllocFree
String ID: `)u$c:\agent\_work\79\s\src\libs\dutil\xmlutil.cpp
API String ID: 344208780-2301883107
Opcode ID: 7cefb188d2fea481aad694aa26b87067f79d2c1a7b61c336946056c8e6264d94
Instruction ID: b27f2840ade5e8faebb8559583cf42f0f01db435d71ee3eef8cf9aea10d75443
Opcode Fuzzy Hash: 7cefb188d2fea481aad694aa26b87067f79d2c1a7b61c336946056c8e6264d94
Instruction Fuzzy Hash: AFF0B4391415A5E7C7321F4C9C09FFB77A9EB40B60F188029FC186B390C7798E9096D4

Function 0071374E Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 35memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(?), ref: 00713763
SysFreeString.OLEAUT32(00000000), ref: 00713793

Strings

`)u, xrefs: 00713793
c:\agent\_work\79\s\src\libs\dutil\xmlutil.cpp, xrefs: 0071377A

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: String$AllocFree
String ID: `)u$c:\agent\_work\79\s\src\libs\dutil\xmlutil.cpp
API String ID: 344208780-2301883107
Opcode ID: 2935de0485f625d72ab323db96712946dd3199137876d0a70e73d3d462d717c8
Instruction ID: 114bddfe9568de5dfea403a11dac78d391e31e78fb085b328f6c8703473a4901
Opcode Fuzzy Hash: 2935de0485f625d72ab323db96712946dd3199137876d0a70e73d3d462d717c8
Instruction Fuzzy Hash: DEF0B4B9141225A7D7211E599C48EDA7769EB41B70F148119FC185B2D0C778CE5097D4

Function 006EF142 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 34threadwindowCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(?,00009001,00000000,?), ref: 006EF157
GetLastError.KERNEL32 ref: 006EF161

Strings

Failed to post plan message., xrefs: 006EF18F
c:\agent\_work\79\s\src\burn\engine\engineforapplication.cpp, xrefs: 006EF185

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: ErrorLastMessagePostThread
String ID: Failed to post plan message.$c:\agent\_work\79\s\src\burn\engine\engineforapplication.cpp
API String ID: 2609174426-33280340
Opcode ID: e2f30f735845bca6c7c66831c80326ad7c42c855f78d8d434ab6fdf367d9214e
Instruction ID: 7f7c646c5aaab47253a2a48635a71f7b5212de7593830b8a876d17734c485eb6
Opcode Fuzzy Hash: e2f30f735845bca6c7c66831c80326ad7c42c855f78d8d434ab6fdf367d9214e
Instruction Fuzzy Hash: 08F0A733741335BBD231279A9C09DCB7E95EF06BB0B024025FD08AA2D1D6199C0086E5

Function 006EF250 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 34threadwindowCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(?,00009005,?,00000000), ref: 006EF265
GetLastError.KERNEL32 ref: 006EF26F

Strings

Failed to post shutdown message., xrefs: 006EF29D
c:\agent\_work\79\s\src\burn\engine\engineforapplication.cpp, xrefs: 006EF293

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: ErrorLastMessagePostThread
String ID: Failed to post shutdown message.$c:\agent\_work\79\s\src\burn\engine\engineforapplication.cpp
API String ID: 2609174426-3784301040
Opcode ID: 2cd3fa5664dd353711ce21abeee7135d2758af828e00ba5ff890f400ddd6322b
Instruction ID: 97a603b648ad44753cc10e5d98d1bc5886a9d3a896af0e9a7efcbb62e72b8527
Opcode Fuzzy Hash: 2cd3fa5664dd353711ce21abeee7135d2758af828e00ba5ff890f400ddd6322b
Instruction Fuzzy Hash: 16F0A737A42335BB92211ADA6C09ECB7A95AF05B60B024025FE08AA280E6189D0086E5

Function 006F0589 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

SetEvent.KERNEL32(0071B478,00000000,?,006F14DE,?,00000000,BTm,006DC24A,?,BTm,?,006E74AB,?,?,006D5442,?), ref: 006F0593
GetLastError.KERNEL32(?,006F14DE,?,00000000,BTm,006DC24A,?,BTm,?,006E74AB,?,?,006D5442,?,006D5482,00000001), ref: 006F059D

Strings

c:\agent\_work\79\s\src\burn\engine\cabextract.cpp, xrefs: 006F05C1
Failed to set begin operation event., xrefs: 006F05CB

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: ErrorEventLast
String ID: Failed to set begin operation event.$c:\agent\_work\79\s\src\burn\engine\cabextract.cpp
API String ID: 3848097054-176682265
Opcode ID: fbf31bb23756833e5743c58070c02eb2dfeabc6ad9aa7dd726658571a921190d
Instruction ID: 86b951c3dbf8dfd93c29fcfe8b4dd7ac5741a0cce1a162932f0555ee7349b369
Opcode Fuzzy Hash: fbf31bb23756833e5743c58070c02eb2dfeabc6ad9aa7dd726658571a921190d
Instruction Fuzzy Hash: 8FF0EC73E4163967632112995D06ADF769A9F04B617024029FF05FB382E69CAD014AD9

Function 006EEA3E Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 34threadwindowCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(?,00009003,00000000,?), ref: 006EEA53
GetLastError.KERNEL32 ref: 006EEA5D

Strings

Failed to post apply message., xrefs: 006EEA8B
c:\agent\_work\79\s\src\burn\engine\engineforapplication.cpp, xrefs: 006EEA81

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: ErrorLastMessagePostThread
String ID: Failed to post apply message.$c:\agent\_work\79\s\src\burn\engine\engineforapplication.cpp
API String ID: 2609174426-2978962975
Opcode ID: afb12192ee9c2d671d067210e31cfff6011acbe783fa8eb072be51b0fedd994b
Instruction ID: 5bd045a5c69d656363ae7adc3ff13f843b46d6f3d7e758ceef2ac4ae3b70c7a7
Opcode Fuzzy Hash: afb12192ee9c2d671d067210e31cfff6011acbe783fa8eb072be51b0fedd994b
Instruction Fuzzy Hash: DFF0A733642335BB9631569E6C09DCB7F95BF05BA0B024129FD08AA2D1E61A9D0086E5

Function 006EEACF Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 34threadwindowCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(?,00009000,00000000,?), ref: 006EEAE4
GetLastError.KERNEL32 ref: 006EEAEE

Strings

Failed to post detect message., xrefs: 006EEB1C
c:\agent\_work\79\s\src\burn\engine\engineforapplication.cpp, xrefs: 006EEB12

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: ErrorLastMessagePostThread
String ID: Failed to post detect message.$c:\agent\_work\79\s\src\burn\engine\engineforapplication.cpp
API String ID: 2609174426-1769289380
Opcode ID: fae12d112bc4a3560abaf6f7f496299a9429c0ab5706eaea5509aee7d7267f5c
Instruction ID: e4fa043b1d2d252efcd30846189ae2afc1fef022e10c8ad62ee156449835932f
Opcode Fuzzy Hash: fae12d112bc4a3560abaf6f7f496299a9429c0ab5706eaea5509aee7d7267f5c
Instruction Fuzzy Hash: 8AF0A733A42331B79230169A5D0DEC77F95EF04B60F024015FD08AB290E629AC00C5E9

Function 007091B8 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 26COMMON

Download Yara Rule

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(?,?,007071E1), ref: 007091F8

Strings

qp, xrefs: 007091DD
Xo, xrefs: 007091E8
InitializeCriticalSectionEx, xrefs: 007091BE, 007091C8

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: CountCriticalInitializeSectionSpin
String ID: InitializeCriticalSectionEx$Xo$qp
API String ID: 2593887523-1069613082
Opcode ID: 9904fad6b024464cfcc33ed7572e80553c8c110e431be2990ab2abfa8c83a915
Instruction ID: 8521b8e358e182b86d121d70f5623921dbd08d0496f430bd4cec6b8fa1777c1d
Opcode Fuzzy Hash: 9904fad6b024464cfcc33ed7572e80553c8c110e431be2990ab2abfa8c83a915
Instruction Fuzzy Hash: 64E0123164022DF7DB212F95DC09DDF7F56EB44B60F40C110FE18651A3DB7A8961AAD4

Function 00700F2C Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 22COMMON

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 00700F41

Strings

FlsAlloc, xrefs: 00700F30, 00700F3A
$pBp, xrefs: 00700F4F
Xo, xrefs: 00700F54

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: try_get_function
String ID: $pBp$FlsAlloc$Xo
API String ID: 2742660187-2837434512
Opcode ID: e332d005e3733c72d54e52c2d6abd1df301bec3cfd59151bdd9006fc94f17451
Instruction ID: 337f66f7e6351cbfc6ef2c91071f330762d147a6a2a0d98ed03ea212dfaf8e3a
Opcode Fuzzy Hash: e332d005e3733c72d54e52c2d6abd1df301bec3cfd59151bdd9006fc94f17451
Instruction Fuzzy Hash: 95D01231785378A7D5103694AC06BD97B44D700FB2F848571FA0C652D3DAAD591056C5

Function 00706692 Relevance: 6.3, APIs: 4, Instructions: 321COMMONLIBRARYCODE

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 00706719

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: 373c3dc5cdb8866e1b63ba812093d7a657cc68dd37946afcad785b652a2611bc
Instruction ID: c687e95c030e219239ba75339e7af18ebe3c50869524b70b7a6547227bfe1561
Opcode Fuzzy Hash: 373c3dc5cdb8866e1b63ba812093d7a657cc68dd37946afcad785b652a2611bc
Instruction Fuzzy Hash: B4B13532910245DFDB11CF28C861BBEBBE5EF55354F1882AAE845DB3C1E638AD51CB60

Function 006D4FE1 Relevance: 6.1, APIs: 4, Instructions: 110COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?,?,?,00000000,?,006D558F,?,?,?,?,?,?), ref: 006D503B
DeleteCriticalSection.KERNEL32(?,?,?,00000000,?,006D558F,?,?,?,?,?,?), ref: 006D504F
TlsFree.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,006D558F,?,?), ref: 006D513E
DeleteCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,006D558F,?,?), ref: 006D5145

Part of subcall function 006D115F: LocalFree.KERNEL32(?,?,006D4FF8,?,00000000,?,006D558F,?,?,?,?,?,?), ref: 006D1169

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: CriticalDeleteFreeSection$CloseHandleLocal
String ID:
API String ID: 3671900028-0
Opcode ID: 4cb0bfdd8ac4ce4d1748590e0bb76dea238584d767571de80c5fcf87682adf5f
Instruction ID: ba337eb3cb84c980c17abd161cb76602d5d053db6629992dd99bc88318c21be7
Opcode Fuzzy Hash: 4cb0bfdd8ac4ce4d1748590e0bb76dea238584d767571de80c5fcf87682adf5f
Instruction Fuzzy Hash: D641FD71900B05ABDAA0EBB5C889BDB73EEAF14701F44481FB2AAD3251DB34E5448768

Function 007162A6 Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 106COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00716211,00000000,00000000,00000001), ref: 00716325
GetLastError.KERNEL32(?,?,00716211,00000000,00000000,00000001), ref: 00716374

Strings

c:\agent\_work\79\s\src\libs\dutil\dlutil.cpp, xrefs: 00716349, 00716398
xrs, xrefs: 00716309

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: ErrorLast
String ID: c:\agent\_work\79\s\src\libs\dutil\dlutil.cpp$xrs
API String ID: 1452528299-4222975862
Opcode ID: fba1896cf15a8268e321f0c3831d95020c26f6a981f734990d14698ee6d1ab7d
Instruction ID: 2466b7a24a917c54532c5249c6c2fc103696d8b61c9df762acbfe83a9adf00c1
Opcode Fuzzy Hash: fba1896cf15a8268e321f0c3831d95020c26f6a981f734990d14698ee6d1ab7d
Instruction Fuzzy Hash: C831FD72900226FBEB219F9C8D44EDF76A9AF01760B114119FD20EB2C1E73CDD40A6E0

Function 00705A9D Relevance: 6.1, APIs: 4, Instructions: 72COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,00000000,?,00701309,00000000,80004004,00000100,?,00701641,00000000,80004004,00000000,00000000), ref: 00705AA2
_free.LIBCMT ref: 00705AFF
_free.LIBCMT ref: 00705B35
SetLastError.KERNEL32(00000000,00000006,000000FF,?,00701641,00000000,80004004,00000000,00000000), ref: 00705B40

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: ErrorLast_free
String ID:
API String ID: 2283115069-0
Opcode ID: 85fdca5f374f55b2bface471762024ea8c6e6e780642a06b8c4f616da76e664c
Instruction ID: 1d4d5a78a1e1c9e8696e65c34947c3b2138005c0ced10142de5661080a1b4751
Opcode Fuzzy Hash: 85fdca5f374f55b2bface471762024ea8c6e6e780642a06b8c4f616da76e664c
Instruction Fuzzy Hash: E511C6B2704E0AEAD71567755CCDE2B39E9DBC43B5B248324F725961E2EF2D9C009A20

Function 00705BF4 Relevance: 6.1, APIs: 4, Instructions: 69COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,00000100,00000000,00703A1A,006D3CE2,80004005,00000000,?,c:\agent\_work\79\s\src\burn\engine\cabextract.cpp,000001C7), ref: 00705BF9
_free.LIBCMT ref: 00705C56
_free.LIBCMT ref: 00705C8C
SetLastError.KERNEL32(00000000,00000006,000000FF), ref: 00705C97

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: ErrorLast_free
String ID:
API String ID: 2283115069-0
Opcode ID: c661009c46eb9c1b3ad100eb08794456fd513110528163e15cf343c7a0df211a
Instruction ID: 45173dfefb5423b08d1f0df156e69ddc460163442d3daac1b24f16afd305bf9c
Opcode Fuzzy Hash: c661009c46eb9c1b3ad100eb08794456fd513110528163e15cf343c7a0df211a
Instruction Fuzzy Hash: 4611E971304B0BEAF61567795DCDE2B26E9EBC53B1B254324F725921E3EF2D8C018A24

Function 006D4CC9 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 67COMMON

Download Yara Rule

APIs

Part of subcall function 006DF909: RegCloseKey.ADVAPI32(00000000,?,?,00000001,00000000,00000000,?,?,006D4CE8,?,?,00000001), ref: 006DF959

CloseHandle.KERNEL32(?,?,?,?,?,?,00000000,?,?,00000001,00000000,?,?,?), ref: 006D4D4F

Strings

Unable to get resume command line from the registry, xrefs: 006D4CEE
Failed to get current process path., xrefs: 006D4D0D
Failed to re-launch bundle process after RunOnce: %ls, xrefs: 006D4D39

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: Close$Handle
String ID: Failed to get current process path.$Failed to re-launch bundle process after RunOnce: %ls$Unable to get resume command line from the registry
API String ID: 187904097-642631345
Opcode ID: d0095cd9d5c9ba58c4576989da34dcd8443c91af613f1f12f6092b05738ddd67
Instruction ID: c7744be309bb78392a919798d22af400be109168a56900b772b53d1d5a93f1cb
Opcode Fuzzy Hash: d0095cd9d5c9ba58c4576989da34dcd8443c91af613f1f12f6092b05738ddd67
Instruction Fuzzy Hash: CC115E71D01618FB8F22AB99DC058EEBBBAEF54710B108167F901B6351EB748F909B90

Function 006D743E Relevance: 6.0, APIs: 2, Strings: 2, Instructions: 45COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 006D744A
LeaveCriticalSection.KERNEL32(?,?,?,00000000), ref: 006D74B1

Strings

Failed to get value of variable: %ls, xrefs: 006D7484
Failed to get value as numeric for variable: %ls, xrefs: 006D74A0

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: Failed to get value as numeric for variable: %ls$Failed to get value of variable: %ls
API String ID: 3168844106-4270472870
Opcode ID: ba3c9b89693ff58e24491dd8217af66e7255f4e68476cba44b986192acc8998a
Instruction ID: 3764a8e496316f5e4e2b6ec10be34f8a84eb0cd656c97fffe2eabb327b0ce44f
Opcode Fuzzy Hash: ba3c9b89693ff58e24491dd8217af66e7255f4e68476cba44b986192acc8998a
Instruction Fuzzy Hash: 10019A72D44128BBCF125E58CC0AECE7EA6AF10724F118126FD00AA260E3399A509AD5

Function 006D75AD Relevance: 6.0, APIs: 2, Strings: 2, Instructions: 45COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 006D75B9
LeaveCriticalSection.KERNEL32(?,?,?,00000000), ref: 006D7620

Strings

Failed to get value of variable: %ls, xrefs: 006D75F3
Failed to get value as version for variable: %ls, xrefs: 006D760F

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: Failed to get value as version for variable: %ls$Failed to get value of variable: %ls
API String ID: 3168844106-1851729331
Opcode ID: 05b725a243e6fe4214469a53cf68d46c0242e2b81639443ee53b089a685e25f6
Instruction ID: 0f915144a474f93f6c58cabb885504190fbacabad0006cfd22e9e4354c491399
Opcode Fuzzy Hash: 05b725a243e6fe4214469a53cf68d46c0242e2b81639443ee53b089a685e25f6
Instruction Fuzzy Hash: D6017172D44528BBCF125B48CC09ADE7B66AF10724F118052FD05A6361E739DA509BD6

Function 006DD461 Relevance: 6.0, APIs: 2, Strings: 2, Instructions: 44COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(000000D0,?,000000B8,00000000,?,006E6F34,000000B8,00000000,?,00000000,75A8B390), ref: 006DD470
LeaveCriticalSection.KERNEL32(000000D0,?,006E6F34,000000B8,00000000,?,00000000,75A8B390), ref: 006DD493

Strings

c:\agent\_work\79\s\src\burn\engine\userexperience.cpp, xrefs: 006DD4AC
Engine active cannot be changed because it was already in that state., xrefs: 006DD4B6

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: Engine active cannot be changed because it was already in that state.$c:\agent\_work\79\s\src\burn\engine\userexperience.cpp
API String ID: 3168844106-2856732556
Opcode ID: 78a838033f725dc7f49d740eea54e7f203115e16e349ff453ac8a5e7b97ba897
Instruction ID: c6a159bc8f931737cac09985b59d168e9dbc3ed9b79a3ccecff26d2580ea1e2d
Opcode Fuzzy Hash: 78a838033f725dc7f49d740eea54e7f203115e16e349ff453ac8a5e7b97ba897
Instruction Fuzzy Hash: ADF0A4323402156F9711AEAEAC98D9773EEBF95751701803AF505C7780DA75F90586A0

Function 006D753E Relevance: 6.0, APIs: 2, Strings: 2, Instructions: 39COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(00000000,00000000,00000006,?,006D985C,00000000,?,00000000,00000000,00000000,?,006D969D,00000000,?,00000000,00000000), ref: 006D754A
LeaveCriticalSection.KERNEL32(00000000,00000000,00000000,00000000,?,006D985C,00000000,?,00000000,00000000,00000000,?,006D969D,00000000,?,00000000), ref: 006D75A0

Strings

Failed to get value of variable: %ls, xrefs: 006D7570
Failed to copy value of variable: %ls, xrefs: 006D758F

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: Failed to copy value of variable: %ls$Failed to get value of variable: %ls
API String ID: 3168844106-2936390398
Opcode ID: 5f4f05c465b0f24f4c319c3f02935dbc3a24eac5f97540b60d1cb642b22fed94
Instruction ID: 380cab6c4cc31eae0fe46dd23497651417fb00e7f090fb3aaadb022385e2a1ad
Opcode Fuzzy Hash: 5f4f05c465b0f24f4c319c3f02935dbc3a24eac5f97540b60d1cb642b22fed94
Instruction Fuzzy Hash: 7FF04FB2D54228FBCF026F98DC09DDE7F6AEF14364F018051FC05A62A0D739DA50AB95

Function 006D7F3B Relevance: 6.0, APIs: 2, Strings: 2, Instructions: 37COMMONLIBRARYCODE

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(00000000,7591DFD0,?,BTm,006E5C55,0071B4A0,BTm,?,BTm,00000000,00000000,006D53FA,00000000), ref: 006D7F47
LeaveCriticalSection.KERNEL32(00000000,00000000,006D53FA,00000000,?,BTm,006E5C55,0071B4A0,BTm,?,BTm,00000000,00000000,006D53FA,00000000), ref: 006D7F95

Strings

Failed to get visibility of variable: %ls, xrefs: 006D7F77
BTm, xrefs: 006D7F3B

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: BTm$Failed to get visibility of variable: %ls
API String ID: 3168844106-2377321778
Opcode ID: 6c1421193a70e6afd1502955c6e7b3f2638d1f89d1e3f19a234eb019b118c108
Instruction ID: cab050041f670975e6286517a7e3f4515fdb598a5dcc926973688d4c329aa473
Opcode Fuzzy Hash: 6c1421193a70e6afd1502955c6e7b3f2638d1f89d1e3f19a234eb019b118c108
Instruction Fuzzy Hash: B0F06976904128FFCB129F44CC09ADE7B76EF15350F018051FC019B360D3359E10AB95

Function 0070EB96 Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,?,00000000,00000000,00000000,?,0070D785,00000000,00000001,00000000,00000000,?,0070C989,00000000,Y[p,00000000), ref: 0070EBAD
GetLastError.KERNEL32(?,0070D785,00000000,00000001,00000000,00000000,?,0070C989,00000000,Y[p,00000000,00000000,00000000,?,0070CEDD,00000000), ref: 0070EBB9

Part of subcall function 0070EB7F: CloseHandle.KERNEL32(FFFFFFFE,0070EBC9,?,0070D785,00000000,00000001,00000000,00000000,?,0070C989,00000000,Y[p,00000000,00000000,00000000), ref: 0070EB8F

___initconout.LIBCMT ref: 0070EBC9

Part of subcall function 0070EB41: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,0070EB70,0070D772,00000000,?,0070C989,00000000,Y[p,00000000,00000000), ref: 0070EB54

WriteConsoleW.KERNEL32(00000000,?,00000000,00000000,?,0070D785,00000000,00000001,00000000,00000000,?,0070C989,00000000,Y[p,00000000,00000000), ref: 0070EBDE

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 7cbaf7bd5f5a76027e60c0ea3a6301630fc0b58c02ffe6e87c58ce9ceeca1158
Instruction ID: f61a6ce6179a5c6357bb7e74ab81a243e4398882b9f0df6f9c5559c8c21b5426
Opcode Fuzzy Hash: 7cbaf7bd5f5a76027e60c0ea3a6301630fc0b58c02ffe6e87c58ce9ceeca1158
Instruction Fuzzy Hash: 56F01C36500128FBCF222FA9DC09DDE3FA6FB083B5B048510FA1985170C736C860DB94

Function 00704B00 Relevance: 6.0, APIs: 4, Instructions: 19COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00704B09

Part of subcall function 00705F5F: HeapFree.KERNEL32(00000000,00000000,?,007088DC,?,00000000,?,00000000,?,00708903,?,00000007,?,?,00708D7D,?), ref: 00705F75
Part of subcall function 00705F5F: GetLastError.KERNEL32(?,?,007088DC,?,00000000,?,00000000,?,00708903,?,00000007,?,?,00708D7D,?,?), ref: 00705F87

_free.LIBCMT ref: 00704B1C
_free.LIBCMT ref: 00704B2D
_free.LIBCMT ref: 00704B3E

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: c54f44d31aaa7fa7996fb804441fc72c6099c14d46190db7055407cef2f546fb
Instruction ID: 583413283c00344b86d856f5248b1333bffefe2212bddefc6f0cb8d1bf3ba426
Opcode Fuzzy Hash: c54f44d31aaa7fa7996fb804441fc72c6099c14d46190db7055407cef2f546fb
Instruction Fuzzy Hash: 9DE046B1800971DAE6132F58BC1541B3FA5B7047423128246F6083A272C73D12229FCA

Function 0070E643 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 148COMMONLIBRARYCODE

Download Yara Rule

APIs

DecodePointer.KERNEL32(?,?,?,?,?,?,?,?,?,0070DFAF), ref: 0070E65C

Strings

t_s, xrefs: 0070E7F1
Xo, xrefs: 0070E726, 0070E7D0, 0070E816

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: DecodePointer
String ID: Xo$t_s
API String ID: 3527080286-2533328523
Opcode ID: 6d8e97b27284d96e3c44a12d0acce980e21d276739ed45e09d21cbe97d457c93
Instruction ID: 50f3304db8e867c51d58692a90031e91ca1e23ecbdcd68783e4af2d72ebb5573
Opcode Fuzzy Hash: 6d8e97b27284d96e3c44a12d0acce980e21d276739ed45e09d21cbe97d457c93
Instruction Fuzzy Hash: 7D51A974900A0ACBEF108FA8E84C1ADBBF4FF45300F549B55E491AB2E4CB7D8A25CB45

Function 00710F69 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 143registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32(00000000), ref: 007110E4

Strings

c:\agent\_work\79\s\src\libs\dutil\regutil.cpp, xrefs: 007110D1

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: Close
String ID: c:\agent\_work\79\s\src\libs\dutil\regutil.cpp
API String ID: 3535843008-1128744096
Opcode ID: c5ef35a07fb4eebeb9785555dd4001f844b45cd07af04423aeef87dc725d699b
Instruction ID: 37c28a180fa33a8b4d0f7566d4bf59491a9f9d0eaca139d0b6465fc71a8d7b1b
Opcode Fuzzy Hash: c5ef35a07fb4eebeb9785555dd4001f844b45cd07af04423aeef87dc725d699b
Instruction Fuzzy Hash: 65411332D0016AEBDF318A5CCC057EE76A5AB08761F548165EA04AF2E0D73DCDC1ABC0

Function 00714A10 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 135registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00711275: RegOpenKeyExW.KERNELBASE(00000000,00000000,00000000,00000000,00000001,0073BB7C,00000000,?,00715A32,80000002,00000000,00020019,00000000,SOFTWARE\Policies\,00000000,00000000), ref: 00711289

RegCloseKey.ADVAPI32(00000000,80000002,SYSTEM\CurrentControlSet\Control\Session Manager,00000003,?,?,00000000,00000101), ref: 00714B71

Strings

PendingFileRenameOperations, xrefs: 00714A61, 00714B49
SYSTEM\CurrentControlSet\Control\Session Manager, xrefs: 00714A21

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: CloseOpen
String ID: PendingFileRenameOperations$SYSTEM\CurrentControlSet\Control\Session Manager
API String ID: 47109696-3023217399
Opcode ID: ca46ae221627bc34ef666e491c8321e268badfa6a750bc386e64503534404990
Instruction ID: e8880e74dd2cf4485b48dc2f3adf60beeb07c2d23b793c433de0c2cab2e2e69c
Opcode Fuzzy Hash: ca46ae221627bc34ef666e491c8321e268badfa6a750bc386e64503534404990
Instruction Fuzzy Hash: C94160B1E00219EFCB30DF98C985AEEBBB9EF54751F164069E510AB291D738DE80DB50

Function 007113B0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 126registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.ADVAPI32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000002,00000001,00000000,00000000,00000000,00000000,00000000), ref: 00711426
RegQueryValueExW.ADVAPI32(?,00000000,00000000,?,00000000,00000000,00000000,?), ref: 0071145E

Strings

c:\agent\_work\79\s\src\libs\dutil\regutil.cpp, xrefs: 0071149A

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: QueryValue
String ID: c:\agent\_work\79\s\src\libs\dutil\regutil.cpp
API String ID: 3660427363-1128744096
Opcode ID: 034a6847bedcd6f82dce60173ee77e96c7c82319bebad9ce03a49be75b97494b
Instruction ID: 71f07286b896f2b712aad9b3e7c6a5c60f649f88b633425da38787bd3c8c78ed
Opcode Fuzzy Hash: 034a6847bedcd6f82dce60173ee77e96c7c82319bebad9ce03a49be75b97494b
Instruction Fuzzy Hash: 8B41B931D0016AFBDB119F9CC8419EEBBBAEF40B54F50816AEE10AF250D7359E40DB90

Function 0071915B Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 108registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0071904C: lstrlenW.KERNEL32(00000100,?,?,?,007193EC,000002C0,00000100,00000100,00000100,?,?,?,006F7AF5,?,?,000001BC), ref: 00719071

RegCloseKey.ADVAPI32(00000000,?,?,00000000,?,00000000,?,?,?,00000000,wininet.dll,?,0071B500,wininet.dll,?), ref: 0071925B
RegCloseKey.ADVAPI32(?,?,?,00000000,?,00000000,?,?,?,00000000,wininet.dll,?,0071B500,wininet.dll,?), ref: 00719268

Part of subcall function 00711275: RegOpenKeyExW.KERNELBASE(00000000,00000000,00000000,00000000,00000001,0073BB7C,00000000,?,00715A32,80000002,00000000,00020019,00000000,SOFTWARE\Policies\,00000000,00000000), ref: 00711289

Part of subcall function 0071115A: RegEnumKeyExW.ADVAPI32(00000000,000002C0,00000410,00000002,00000000,00000000,00000000,00000000,00000410,00000002,00000100,00000000,00000000,?,?,006F8B79), ref: 007111B5
Part of subcall function 0071115A: RegQueryInfoKeyW.ADVAPI32(00000000,00000000,00000000,00000000,00000000,00000002,00000000,00000000,00000000,00000000,00000000,00000000,?,?,006F8B79,00000000), ref: 007111D3

Strings

wininet.dll, xrefs: 007191D0, 0071921D

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: Close$EnumInfoOpenQuerylstrlen
String ID: wininet.dll
API String ID: 2680864210-3354682871
Opcode ID: d0e11caa43bd86557224b9ce2341c80743615fbee702468515931ae29d244bd3
Instruction ID: ec97d46847d11d087bc702941d49ec9657ed0706bcb6113a644d640c37a42629
Opcode Fuzzy Hash: d0e11caa43bd86557224b9ce2341c80743615fbee702468515931ae29d244bd3
Instruction Fuzzy Hash: F8311A32C0012EFBCF11AF98CD919EEBAB9FF14710B554169EA0076261C7399F91AB90

Function 0070CC03 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 105fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

WriteFile.KERNEL32(?,?,00000000,?,00000000,0070CF44,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 0070CCEC
GetLastError.KERNEL32(0070CF44,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 0070CD1C

Strings

Y[p, xrefs: 0070CC39

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: Y[p
API String ID: 442123175-2506504590
Opcode ID: 6b4e2332a11148421fd904efa07836df1d60c8d7d955cb4be677608260f41b0a
Instruction ID: 26e5a26f4b7257a88824cb33cf7c5fe4dafc40badf78b06cf7491d47b54e256c
Opcode Fuzzy Hash: 6b4e2332a11148421fd904efa07836df1d60c8d7d955cb4be677608260f41b0a
Instruction Fuzzy Hash: 58319471B00219EFDB25CF69DC81AEA77F5EB44310F1442B9E909D7390E734AD818B64

Function 0070CB18 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 83fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

WriteFile.KERNEL32(?,?,?,?,00000000,Y[p,00000000,00000000,?,0070CF34,00000000,00000000,00000000,00000000,?,00000000), ref: 0070CBC2
GetLastError.KERNEL32(?,0070CF34,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 0070CBE8

Strings

Y[p, xrefs: 0070CB4E

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: Y[p
API String ID: 442123175-2506504590
Opcode ID: 7b31349228ac03f9518421e29e87db45e58a19c34053ead2b8300ebe37746242
Instruction ID: 98b3c96b2d219bd25dbd4533b0f6a73e5f072984065a0c21ea0cc6ff35eed468
Opcode Fuzzy Hash: 7b31349228ac03f9518421e29e87db45e58a19c34053ead2b8300ebe37746242
Instruction Fuzzy Hash: 8B31A271A0021CDBCB15CF29DC819EAB3F9FF48311F1486A9E909E72A1E7349D81CB94

Function 0070CA3B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 81fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

WriteFile.KERNEL32(?,?,?,?,00000000,Y[p,00000000,00000000,?,0070CF54,00000000,00000000,00000000,00000000,?,00000000), ref: 0070CAD7
GetLastError.KERNEL32(?,0070CF54,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 0070CAFD

Strings

Y[p, xrefs: 0070CA71

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: Y[p
API String ID: 442123175-2506504590
Opcode ID: b81fe2f38a275c376182358153e1c2f422d61693dc98bce4a848578a13338b76
Instruction ID: 77b440d1210a0c0b194f206417c5a7aace2100556571dbd104ddf810ae492e92
Opcode Fuzzy Hash: b81fe2f38a275c376182358153e1c2f422d61693dc98bce4a848578a13338b76
Instruction Fuzzy Hash: 0E21B470A0021DDFCB16CF29DC809E9B7F9EB48311F2082AAE906D7252E7349D46CF64

Function 006D3ADB Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 69COMMON

Download Yara Rule

APIs

_memcpy_s.LIBCMT ref: 006D3B3E

Strings

wininet.dll, xrefs: 006D3AFC
crypt32.dll, xrefs: 006D3AFB, 006D3B3A, 006D3B3C

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: _memcpy_s
String ID: crypt32.dll$wininet.dll
API String ID: 2001391462-82500532
Opcode ID: 3acd12551d8af57428b3f6e5983e566ec212ccbbec8f150e6a88dae48337b01d
Instruction ID: 015ecf89f0b13aaf3fd205effc378a8de29ea8b80cd7b0a14bbc13ccfd807a54
Opcode Fuzzy Hash: 3acd12551d8af57428b3f6e5983e566ec212ccbbec8f150e6a88dae48337b01d
Instruction Fuzzy Hash: 1C114F71A00219ABCF08DF19CC959AF7F6AEF95294B14802AED058B311D631EA118AA0

Function 006E3A29 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 68registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00711275: RegOpenKeyExW.KERNELBASE(00000000,00000000,00000000,00000000,00000001,0073BB7C,00000000,?,00715A32,80000002,00000000,00020019,00000000,SOFTWARE\Policies\,00000000,00000000), ref: 00711289

RegCloseKey.ADVAPI32(00000000,SOFTWARE\Policies\Microsoft\Windows\Installer,00020019,00000000,?,?,?,?,006E3F39,feclient.dll,?,00000000,?,?,?,006D4B57), ref: 006E3ACA

Part of subcall function 007113B0: RegQueryValueExW.ADVAPI32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000002,00000001,00000000,00000000,00000000,00000000,00000000), ref: 00711426
Part of subcall function 007113B0: RegQueryValueExW.ADVAPI32(?,00000000,00000000,?,00000000,00000000,00000000,?), ref: 0071145E

Strings

Logging, xrefs: 006E3A57
SOFTWARE\Policies\Microsoft\Windows\Installer, xrefs: 006E3A40

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: QueryValue$CloseOpen
String ID: Logging$SOFTWARE\Policies\Microsoft\Windows\Installer
API String ID: 1586453840-387823766
Opcode ID: 19a81aff4feaaac50e4ce117fe4e5a707f1f0f3c141eaa53a42f13a1ac223493
Instruction ID: 57926c2fa6ca92330d2121ecb896231db3cb9191d0ff4087c0138dec504e9520
Opcode Fuzzy Hash: 19a81aff4feaaac50e4ce117fe4e5a707f1f0f3c141eaa53a42f13a1ac223493
Instruction Fuzzy Hash: BB113876602379BBEB24DA49C90EBFAB765AB00740F904065E982EB3C0D7749FC18754

Function 007117D9 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62registryCOMMON

Download Yara Rule

APIs

RegSetValueExW.ADVAPI32(00020006,00720F38,00000000,00000001,?,00000000,?,000000FF,00000000,00000000,?,?,006DF2DC,00000000,?,00020006), ref: 0071180C
RegDeleteValueW.ADVAPI32(00020006,00720F38,00000000,?,?,006DF2DC,00000000,?,00020006,?,00720F38,00020006,00000000,?,?,?), ref: 0071183C

Strings

c:\agent\_work\79\s\src\libs\dutil\regutil.cpp, xrefs: 00711870

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: Value$Delete
String ID: c:\agent\_work\79\s\src\libs\dutil\regutil.cpp
API String ID: 1738766685-1128744096
Opcode ID: d925331a60f1e4c8b8701ef184535e4d1663bec65726590aaa4f113d2d2b743e
Instruction ID: 32cca3a175da19056fd6678d4e1d8585a7ecbc0104053ef29dbdcfde9d3563bd
Opcode Fuzzy Hash: d925331a60f1e4c8b8701ef184535e4d1663bec65726590aaa4f113d2d2b743e
Instruction Fuzzy Hash: 98119E36D00136BBEB224A998C05BDABA65EB00B70F59C125FF00BE1D0D629DD80A7E4

Function 006DDD53 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 60COMMON

Download Yara Rule

APIs

CompareStringW.KERNEL32(00000000,00000000,00000000,000000FF,?,000000FF,IGNOREDEPENDENCIES,00000000,?,?,006F740F,00000000,IGNOREDEPENDENCIES,00000000,?,0071B518), ref: 006DDDA4

Strings

Failed to copy the property value., xrefs: 006DDDD8
IGNOREDEPENDENCIES, xrefs: 006DDD5B

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: CompareString
String ID: Failed to copy the property value.$IGNOREDEPENDENCIES
API String ID: 1825529933-1412343224
Opcode ID: 95e4f898256ee07f8bbef229a34e0f3438dc3066db10356ff65062c384ffbcf3
Instruction ID: 76f3d6900459799ae5cc76319ecdad1434f577149956c4e6161220c68b42f042
Opcode Fuzzy Hash: 95e4f898256ee07f8bbef229a34e0f3438dc3066db10356ff65062c384ffbcf3
Instruction Fuzzy Hash: 8F118636A04215AFDF116F98CC85FA9B7A7AF04724F254177FA199B3A1C7709850C790

Function 006D1578 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 53COMMON

Download Yara Rule

APIs

LCMapStringW.KERNEL32(0000007F,00000000,00000000,006E6FDC,00000000,006E6FDC,00000000,00000000,006E6FDC,00000000,00000000,00000000,?,006D2420,00000000,00000000), ref: 006D15BC
GetLastError.KERNEL32(?,006D2420,00000000,00000000,006E6FDC,00000200,?,0071550E,00000000,006E6FDC,00000000,006E6FDC,00000000,00000000,00000000), ref: 006D15C6

Strings

c:\agent\_work\79\s\src\libs\dutil\strutil.cpp, xrefs: 006D15EA

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: ErrorLastString
String ID: c:\agent\_work\79\s\src\libs\dutil\strutil.cpp
API String ID: 3728238275-2901571208
Opcode ID: 8833932470a32e104a0b04c76617d073c0b8c52e8d37c5b2c3c9a8027887310e
Instruction ID: 9f62ecc5ff48df5af5d66e4b01883a484d048be01719f4d6f12378f57f4c6685
Opcode Fuzzy Hash: 8833932470a32e104a0b04c76617d073c0b8c52e8d37c5b2c3c9a8027887310e
Instruction Fuzzy Hash: C401F573D40236778B218A999C44E9B7A6AEF86B70B020216FE20AF341D668DC1087E0

Function 006E5739 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 53COMMON

Download Yara Rule

APIs

CoInitializeEx.OLE32(00000000,00000000), ref: 006E5756
CoUninitialize.OLE32(?,00000000,?,?,?,?,?,?,?), ref: 006E57AF

Strings

Failed to initialize COM on cache thread., xrefs: 006E576B

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: InitializeUninitialize
String ID: Failed to initialize COM on cache thread.
API String ID: 3442037557-3629645316
Opcode ID: 99f5319f94ebed7e343b160d85726d776c6d771e41c4f85edb6e9b945e546990
Instruction ID: a609b9313e0d1212fb7f3e180e0d9196be833d0c328b5f83dde548f450ad9a76
Opcode Fuzzy Hash: 99f5319f94ebed7e343b160d85726d776c6d771e41c4f85edb6e9b945e546990
Instruction Fuzzy Hash: B2019672601619FFDB059FA9DC84DDAFBADFF08354B008129F50997220D770AE508B94

Function 00715894 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 53sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(20000004,00000000,00000000,00000000,00000000,00000000,?,?,006E8D81,?,00000001,20000004,00000000,00000000,?,00000000), ref: 007158C3
SetNamedSecurityInfoW.ADVAPI32(00000000,?,000007D0,00000003,00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,?,?,006E8D81,?), ref: 007158DE

Strings

c:\agent\_work\79\s\src\libs\dutil\aclutil.cpp, xrefs: 00715902

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: InfoNamedSecuritySleep
String ID: c:\agent\_work\79\s\src\libs\dutil\aclutil.cpp
API String ID: 2352087905-4212656368
Opcode ID: 38b3d90aa104e522adaeb722d3e5f21a720176759eb84e86a3e1839b38826051
Instruction ID: d5610b0f5171fa8d51b77ae0dbb853e9e0a03d3a410b0c5411a7dfc30f9a5b04
Opcode Fuzzy Hash: 38b3d90aa104e522adaeb722d3e5f21a720176759eb84e86a3e1839b38826051
Instruction Fuzzy Hash: 7D018E33800629FBCF225E88CD05ACE7F75EF88760F024115FD0466260C2799E60ABD5

Function 006D5160 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(burn.clean.room,?,?,?,?,006D1104,?,?,00000000), ref: 006D517F
CompareStringW.KERNEL32(0000007F,00000001,?,0000000F,burn.clean.room,0000000F,?,?,?,?,006D1104,?,?,00000000), ref: 006D51AF

Strings

burn.clean.room, xrefs: 006D516C, 006D5179, 006D51A6

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: CompareStringlstrlen
String ID: burn.clean.room
API String ID: 1433953587-3055529264
Opcode ID: 7aa01f19f4c2e606beb32de724cb8681ea5924da3157412909c3ebf6a1f17389
Instruction ID: 4b4e7486cdba006de2e601bae739346fbcf0ca51aca8fde5127652f3b274ba10
Opcode Fuzzy Hash: 7aa01f19f4c2e606beb32de724cb8681ea5924da3157412909c3ebf6a1f17389
Instruction Fuzzy Hash: 9701A9B69006686B97204B4DAC84EF3FBAEEB5D7517108127F606C7B14D765AC40C7A4

Function 00713E9A Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 46registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00711275: RegOpenKeyExW.KERNELBASE(00000000,00000000,00000000,00000000,00000001,0073BB7C,00000000,?,00715A32,80000002,00000000,00020019,00000000,SOFTWARE\Policies\,00000000,00000000), ref: 00711289

RegCloseKey.ADVAPI32(00000000,80000002,SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,00020019,00000000,?,?,?,?,?,00713D3A,?), ref: 00713F0B

Strings

EnableLUA, xrefs: 00713EDD
SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System, xrefs: 00713EB5

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: CloseOpen
String ID: EnableLUA$SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
API String ID: 47109696-3551287084
Opcode ID: 4f4dc171cafce71edaef9fb073188ff354df2b6fe8454f00d0e92eb37b332ca8
Instruction ID: 9ee4264b4bc9666d2874af31f16c4386355f368bad92c71fdbb6712c74fa0d0f
Opcode Fuzzy Hash: 4f4dc171cafce71edaef9fb073188ff354df2b6fe8454f00d0e92eb37b332ca8
Instruction Fuzzy Hash: 05018F76D10228FFDB109AA8DC0ABDEFABCAB04761F204065E901B7091D37C9F90D7A0

Function 00716B51 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 45COMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32(00000000), ref: 00716BB6

Strings

c:\agent\_work\79\s\src\libs\dutil\atomutil.cpp, xrefs: 00716B72
`)u, xrefs: 00716BB6

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: FreeString
String ID: `)u$c:\agent\_work\79\s\src\libs\dutil\atomutil.cpp
API String ID: 3341692771-3437990411
Opcode ID: 15147dd0d15aa74039cc33b993abf39ed6d5271b146ec0e8baf4d67f6ab13e7e
Instruction ID: d3fca9a117e29de7101835345186200ea93c06ec10a0badeac06c05de72b5743
Opcode Fuzzy Hash: 15147dd0d15aa74039cc33b993abf39ed6d5271b146ec0e8baf4d67f6ab13e7e
Instruction Fuzzy Hash: CA0162B2904115FBDB729A8C8D45FDEB6699F40F60F344159B800B61D0D77C8E90E694

Function 006D34C4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,?,00000104,?,00000104,?,?,?,?,006D10DD,?,00000000), ref: 006D34E5
GetLastError.KERNEL32(?,?,?,?,006D10DD,?,00000000), ref: 006D34FC

Strings

c:\agent\_work\79\s\src\libs\dutil\pathutil.cpp, xrefs: 006D3520

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: ErrorFileLastModuleName
String ID: c:\agent\_work\79\s\src\libs\dutil\pathutil.cpp
API String ID: 2776309574-1445327374
Opcode ID: ef54f4fcbb3ee4762e53ae251aeb000b9f5b95f3283c03940a5bbb4ab7ce81dc
Instruction ID: e9bb6a47471542399e44d6046a7db6ef4bd91eff5f9a42f1526e9fc7372c6d69
Opcode Fuzzy Hash: ef54f4fcbb3ee4762e53ae251aeb000b9f5b95f3283c03940a5bbb4ab7ce81dc
Instruction Fuzzy Hash: 92F0FC73E4053177877256995C45ECBFB9AEB41BA0B064127FD04EF340D769DE0182E2

Function 006D6540 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 44COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?), ref: 006D6552

Part of subcall function 00710DDC: GetModuleHandleW.KERNEL32(kernel32,IsWow64Process,?,?,?,006D5EE0,00000000), ref: 00710DF0
Part of subcall function 00710DDC: GetProcAddress.KERNEL32(00000000), ref: 00710DF7
Part of subcall function 00710DDC: GetLastError.KERNEL32(?,?,?,006D5EE0,00000000), ref: 00710E0E

Part of subcall function 006D5D14: RegCloseKey.ADVAPI32(00000000,?,00000000,CommonFilesDir,?,80000002,SOFTWARE\Microsoft\Windows\CurrentVersion,00020119,00000000), ref: 006D5D9A

Strings

Failed to get 64-bit folder., xrefs: 006D6575
Failed to set variant value., xrefs: 006D658F

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: AddressCloseCurrentErrorHandleLastModuleProcProcess
String ID: Failed to get 64-bit folder.$Failed to set variant value.
API String ID: 3109562764-2681622189
Opcode ID: ea443471b7d7f9e4334f86eaa3fa983b1d769d350e7c672248d8126110e137b0
Instruction ID: 32c38f758d03cdf74015d6b1f53edf5adb15e631c25406dbf2046fa1a22dd08b
Opcode Fuzzy Hash: ea443471b7d7f9e4334f86eaa3fa983b1d769d350e7c672248d8126110e137b0
Instruction Fuzzy Hash: CA016272D00228FBCF11A794DC06DDE7A7AAF04B21F108056F900B6295D775AF80DBD4

Function 006FDFFF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBVCRUNTIME ref: 006FE922

Part of subcall function 00700AF1: RaiseException.KERNEL32(?,?,?,Do,?,00000000,00000000,?,?,?,?,?,006FE944,?,00738338), ref: 00700B51

__CxxThrowException@8.LIBVCRUNTIME ref: 006FE93F

Strings

Unknown exception, xrefs: 006FE94C

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: Exception@8Throw$ExceptionRaise
String ID: Unknown exception
API String ID: 3476068407-410509341
Opcode ID: 6a2087ecde39b5c825ede140e130435bbe105988391711b9c3e7bd1db7cf6e44
Instruction ID: 565a18eda9da87e2e61eb969d76ae99221c64b87c4db4164c64be6e26c2234a8
Opcode Fuzzy Hash: 6a2087ecde39b5c825ede140e130435bbe105988391711b9c3e7bd1db7cf6e44
Instruction Fuzzy Hash: D1F0287490030CF6CB14BAA4DC199BC3BAD9A00760F504235FB28851E2EFF6EA1681D4

Function 00714C76 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 39COMMON

Download Yara Rule

APIs

GetFileSizeEx.KERNEL32(00000000,00000000,00000000,759234C0,?,?,?,006DB9EC,?,?,?,00000000,00000000), ref: 00714C8E
GetLastError.KERNEL32(?,?,?,006DB9EC,?,?,?,00000000,00000000,?,?,?,00000000,76EDC3F0,00000000), ref: 00714C98

Strings

c:\agent\_work\79\s\src\libs\dutil\fileutil.cpp, xrefs: 00714CBC

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: ErrorFileLastSize
String ID: c:\agent\_work\79\s\src\libs\dutil\fileutil.cpp
API String ID: 464720113-3405085980
Opcode ID: 80fe198c4ca5e5326a662cf9389124e654b00320da0af2f65263b52a42bf3b8b
Instruction ID: 5853bd6531a93ea76ac627983daba090d74ad0e802111276a4af46ca26b79cd6
Opcode Fuzzy Hash: 80fe198c4ca5e5326a662cf9389124e654b00320da0af2f65263b52a42bf3b8b
Instruction Fuzzy Hash: 8EF0C8B3A01136AB97109F4DC90599BFBACEF44B60B014119FD04AB380E374AD00C7E4

Function 00714029 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 35comCOMMON

Download Yara Rule

APIs

CLSIDFromProgID.OLE32(Microsoft.Update.AutoUpdate,006D54A3,?,00000000,006D54A3,?,?,?), ref: 00714050
CoCreateInstance.OLE32(00000000,00000000,00000001,00737AAC,?), ref: 00714068

Strings

Microsoft.Update.AutoUpdate, xrefs: 0071404B

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: CreateFromInstanceProg
String ID: Microsoft.Update.AutoUpdate
API String ID: 2151042543-675569418
Opcode ID: 25df04f95ac6fb54f0318af3d805882d0fc11eb33595b9b5f7cb49b8ae16cfe7
Instruction ID: e23579a99682505ef4519897fa3c910291cdf86e0a0c464b26d5669ad1982bfa
Opcode Fuzzy Hash: 25df04f95ac6fb54f0318af3d805882d0fc11eb33595b9b5f7cb49b8ae16cfe7
Instruction Fuzzy Hash: 12F03AB1610208BBEB00DBADDD46AEFB7B9EB48710F404065AA01E6190D674AA0486A6

Function 00713703 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 29COMMON

Download Yara Rule

APIs

Part of subcall function 00713503: SysAllocString.OLEAUT32(0071B4E8), ref: 00713516
Part of subcall function 00713503: VariantInit.OLEAUT32(?), ref: 00713522
Part of subcall function 00713503: VariantClear.OLEAUT32(?), ref: 00713596
Part of subcall function 00713503: SysFreeString.OLEAUT32(00000000), ref: 007135A1

SysFreeString.OLEAUT32(00000000), ref: 00713741

Strings

msasn1.dll, xrefs: 0071370E
`)u, xrefs: 00713741

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: String$FreeVariant$AllocClearInit
String ID: `)u$msasn1.dll
API String ID: 3379191133-2799367386
Opcode ID: 818d1191bf3905e7c13fc67ca94454f4b71ae31e54a9bfcbc4a6f6923c29ceb9
Instruction ID: 931297f573b07b94f527ae21ae2e91565512761f8982be9683fb6fd33d1829f8
Opcode Fuzzy Hash: 818d1191bf3905e7c13fc67ca94454f4b71ae31e54a9bfcbc4a6f6923c29ceb9
Instruction Fuzzy Hash: B5F058B5500108FBCF029F58CD4ABDE7BB6EB80315F104024F901AA1E0D77A9F64EB10

Function 007090B9 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 22memoryCOMMON

Download Yara Rule

APIs

TlsAlloc.KERNEL32 ref: 007090ED

Strings

Xo, xrefs: 007090E3
FlsAlloc, xrefs: 007090BF, 007090C9

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: Alloc
String ID: FlsAlloc$Xo
API String ID: 2773662609-581224058
Opcode ID: 4a7dfcea4fba90fc20990881b69bd32472f9cac1636a416ee7c21f378a46470b
Instruction ID: 4fcbd371f22746589c506b6263f7ced56a76cb555ef5f944391a28920db946c3
Opcode Fuzzy Hash: 4a7dfcea4fba90fc20990881b69bd32472f9cac1636a416ee7c21f378a46470b
Instruction Fuzzy Hash: F0E0C23268072EB7E23122655C0AE9E7D44DB50FA1F448210FE08611D3DAAE6B1182D9

Function 00711112 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(RegDeleteKeyExW,AdvApi32.dll), ref: 00711133

Strings

RegDeleteKeyExW, xrefs: 00711128
AdvApi32.dll, xrefs: 00711118

Memory Dump Source

Source File: 00000000.00000002.3297131584.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.3297054372.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297303299.000000000071B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297418481.000000000073B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3297471275.000000000073E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_jlK7Q70gbN.jbxd

Similarity

API ID: AddressProc
String ID: AdvApi32.dll$RegDeleteKeyExW
API String ID: 190572456-850864035
Opcode ID: 9b8df60fd459cbb1f0e0e92f607c67e2d100132d490b14e952a01c632a68c40c
Instruction ID: 6efc4710e295bac2d0c51c8c208bf995bf7a2512aa707c6bf5b2c10083b42aef
Opcode Fuzzy Hash: 9b8df60fd459cbb1f0e0e92f607c67e2d100132d490b14e952a01c632a68c40c
Instruction Fuzzy Hash: 92E0EC71941235ABF3625F5CBC057817AA0E701B57F00C125EA04BE2A1D37D4884AF99

Analysis Process: EMA3D.exePID: 4564, Parent PID: 6180COMMON

Executed Functions

Function 00A11070 Relevance: 21.1, APIs: 2, Strings: 10, Instructions: 77fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00A134C4: GetModuleFileNameW.KERNEL32(?,?,00000104,?,00000104,?,?,?,?,00A110DD,?,00000000), ref: 00A134E5

CreateFileW.KERNELBASE(?,80000000,00000005,00000000,00000003,00000080,00000000,?,00000000), ref: 00A110F6

Part of subcall function 00A11173: HeapSetInformation.KERNEL32(00000000,00000001,00000000,00000000,?,?,?,?,?,00A1111A,cabinet.dll,00000009,?,?,00000000), ref: 00A11184
Part of subcall function 00A11173: GetModuleHandleW.KERNEL32(kernel32,?,?,?,?,?,00A1111A,cabinet.dll,00000009,?,?,00000000), ref: 00A1118F
Part of subcall function 00A11173: GetProcAddress.KERNEL32(00000000,SetDefaultDllDirectories), ref: 00A1119D
Part of subcall function 00A11173: GetLastError.KERNEL32(?,?,?,?,?,00A1111A,cabinet.dll,00000009,?,?,00000000), ref: 00A111B8
Part of subcall function 00A11173: GetProcAddress.KERNEL32(00000000,SetDllDirectoryW), ref: 00A111C0
Part of subcall function 00A11173: GetLastError.KERNEL32(?,?,?,?,?,00A1111A,cabinet.dll,00000009,?,?,00000000), ref: 00A111D5

CloseHandle.KERNEL32(?,?,?,?,00A5B4D0,?,cabinet.dll,00000009,?,?,00000000), ref: 00A11131

Strings

version.dll, xrefs: 00A110A7
cabinet.dll, xrefs: 00A11099, 00A11114
msasn1.dll, xrefs: 00A110C3
crypt32.dll, xrefs: 00A110CA
_`AB, xrefs: 00A11076
feclient.dll, xrefs: 00A110D1
comres.dll, xrefs: 00A110B5
wininet.dll, xrefs: 00A110AE
msi.dll, xrefs: 00A110A0
clbcatq.dll, xrefs: 00A110BC

Memory Dump Source

Source File: 00000003.00000002.3297635874.0000000000A11000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00A10000, based on PE: true

Associated: 00000003.00000002.3297603093.0000000000A10000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.3297783757.0000000000A5B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.3297848804.0000000000A7B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.3297905107.0000000000A7E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_a10000_EMA3D.jbxd

Similarity

API ID: AddressErrorFileHandleLastModuleProc$CloseCreateHeapInformationName
String ID: _`AB$cabinet.dll$clbcatq.dll$comres.dll$crypt32.dll$feclient.dll$msasn1.dll$msi.dll$version.dll$wininet.dll
API String ID: 3687706282-3885576073
Opcode ID: c61e65747dd96a81d662dca215d0e80ab46f05b6f81d91ae928b9a77abe97cb6
Instruction ID: 1794e86379388f91cee2f633ca03daeff645f939dc9ed4cab86ebbc5269f8a3e
Opcode Fuzzy Hash: c61e65747dd96a81d662dca215d0e80ab46f05b6f81d91ae928b9a77abe97cb6
Instruction Fuzzy Hash: F3216D7191021CBBDB10DFA4DD49BEFBBB8BB48716F504219FA11B6281D77099488BB4

Function 00A1F97E Relevance: 114.2, APIs: 3, Strings: 62, Instructions: 445
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

DisplayVersion, xrefs: 00A1FB3E
ExecutableName, xrefs: 00A1FA8F
UpdateUrl, xrefs: 00A1FBF7
Failed to get @ParentDisplayName., xrefs: 00A1FC33
Failed to get @Department., xrefs: 00A1FE29
Failed to get @ExecutableName., xrefs: 00A1FAA2
Failed to get @Name., xrefs: 00A1FE6F
Publisher, xrefs: 00A1FB63
Failed to get @DisplayVersion., xrefs: 00A1FB55
Failed to get @DisableModify., xrefs: 00A1FD53
Register, xrefs: 00A1FAF8
DisplayName, xrefs: 00A1FB19
PerMachine, xrefs: 00A1FAAD
Name, xrefs: 00A1FE5C
ProductFamily, xrefs: 00A1FE37
Tag, xrefs: 00A1F9F2
Failed to select Update node., xrefs: 00A1FDD7
Registration, xrefs: 00A1F998
Failed to get @Id., xrefs: 00A1F9E4
HelpLink, xrefs: 00A1FB88
Failed to get @DisplayName., xrefs: 00A1FB30
DisableRemove, xrefs: 00A1FD64
yes, xrefs: 00A1FCD1
Update, xrefs: 00A1FDB9
button, xrefs: 00A1FCB0
Failed to get @PerMachine., xrefs: 00A1FAC0
HelpTelephone, xrefs: 00A1FBAD
Failed to parse @Version: %ls, xrefs: 00A1FA60
Failed to get @Comments., xrefs: 00A1FC5B
Failed to get @UpdateUrl., xrefs: 00A1FC0E
Failed to select ARP node., xrefs: 00A1FAEA
ProviderKey, xrefs: 00A1FA6E
Classification, xrefs: 00A1FE7D
Failed to get @Tag., xrefs: 00A1FA05
Version, xrefs: 00A1FA2C
Failed to get @ProviderKey., xrefs: 00A1FA81
DisableModify, xrefs: 00A1FC91
Failed to get @Contact., xrefs: 00A1FC83
Department, xrefs: 00A1FE12
Failed to get @Classification., xrefs: 00A1FE90
Failed to parse related bundles, xrefs: 00A1FA1E
=, xrefs: 00A1FE7C
Failed to select registration node., xrefs: 00A1F9B7
Failed to set registration paths., xrefs: 00A1FEA3
Failed to get @Publisher., xrefs: 00A1FB7A
Failed to get @DisableRemove., xrefs: 00A1FD7B
Failed to parse software tag., xrefs: 00A1FDAB
Invalid modify disabled type: %ls, xrefs: 00A1FD2F
c:\agent\_work\79\s\src\burn\engine\registration.cpp, xrefs: 00A1FD22
Failed to get @Version., xrefs: 00A1FA3F
Failed to get @HelpTelephone., xrefs: 00A1FBC4
Manufacturer, xrefs: 00A1FDEE
ParentDisplayName, xrefs: 00A1FC1C
Failed to get @Manufacturer., xrefs: 00A1FE01
Comments, xrefs: 00A1FC44
Failed to get @Register., xrefs: 00A1FB0B
Failed to get @AboutUrl., xrefs: 00A1FBE9
Contact, xrefs: 00A1FC6C
Failed to get @ProductFamily., xrefs: 00A1FE4E
AboutUrl, xrefs: 00A1FBD2
Arp, xrefs: 00A1FACE
Failed to get @HelpLink., xrefs: 00A1FB9F

Memory Dump Source

Source File: 00000003.00000002.3297635874.0000000000A11000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00A10000, based on PE: true

Associated: 00000003.00000002.3297603093.0000000000A10000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.3297783757.0000000000A5B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.3297848804.0000000000A7B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.3297905107.0000000000A7E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_a10000_EMA3D.jbxd

Similarity

API ID: StringVariant$AllocClearFreeInit
String ID: AboutUrl$Arp$Classification$Comments$Contact$Department$DisableModify$DisableRemove$DisplayName$DisplayVersion$ExecutableName$Failed to get @AboutUrl.$Failed to get @Classification.$Failed to get @Comments.$Failed to get @Contact.$Failed to get @Department.$Failed to get @DisableModify.$Failed to get @DisableRemove.$Failed to get @DisplayName.$Failed to get @DisplayVersion.$Failed to get @ExecutableName.$Failed to get @HelpLink.$Failed to get @HelpTelephone.$Failed to get @Id.$Failed to get @Manufacturer.$Failed to get @Name.$Failed to get @ParentDisplayName.$Failed to get @PerMachine.$Failed to get @ProductFamily.$Failed to get @ProviderKey.$Failed to get @Publisher.$Failed to get @Register.$Failed to get @Tag.$Failed to get @UpdateUrl.$Failed to get @Version.$Failed to parse @Version: %ls$Failed to parse related bundles$Failed to parse software tag.$Failed to select ARP node.$Failed to select Update node.$Failed to select registration node.$Failed to set registration paths.$HelpLink$HelpTelephone$Invalid modify disabled type: %ls$Manufacturer$Name$ParentDisplayName$PerMachine$ProductFamily$ProviderKey$Publisher$Register$Registration$Tag$Update$UpdateUrl$Version$button$c:\agent\_work\79\s\src\burn\engine\registration.cpp$yes$=
API String ID: 760788290-1495693619
Opcode ID: cb43c3b280abe434056baf53f2b67b68355bce2ed0b6470f2a44220e5eccbc24
Instruction ID: 101a300ab260cc90ef00a76eae6f06b4b19666cbef3f90565dcf0a67a12d7f40
Opcode Fuzzy Hash: cb43c3b280abe434056baf53f2b67b68355bce2ed0b6470f2a44220e5eccbc24
Instruction Fuzzy Hash: 50E1E233E446A5BECF22A664CD42EFEBA74BB00751F190A31FC11F72A1D7709E956680

Function 00A1B45A Relevance: 93.3, APIs: 24, Strings: 29, Instructions: 577
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32(?,?,?,00000000,76EDC3F0,00000000), ref: 00A1B4D1
SetFilePointerEx.KERNELBASE(000000FF,00000000,00000000,00000000,00000000,?,?,?,00000000,76EDC3F0,00000000), ref: 00A1B51F
GetLastError.KERNEL32(?,?,?,00000000,76EDC3F0,00000000), ref: 00A1B525
ReadFile.KERNELBASE(00000000,00A144B0,00000040,?,00000000,?,?,?,00000000,76EDC3F0,00000000), ref: 00A1B56D
GetLastError.KERNEL32(?,?,?,00000000,76EDC3F0,00000000), ref: 00A1B573
SetFilePointerEx.KERNELBASE(00000000,00000000,?,00000000,00000000,?,?,?,00000000,76EDC3F0,00000000), ref: 00A1B5D0
GetLastError.KERNEL32(?,00000000,00000000,?,?,?,00000000,76EDC3F0,00000000), ref: 00A1B5D6
ReadFile.KERNELBASE(00000000,?,00000018,00000040,00000000,?,00000000,00000000,?,?,?,00000000,76EDC3F0,00000000), ref: 00A1B61F
GetLastError.KERNEL32(?,00000000,00000000,?,?,?,00000000,76EDC3F0,00000000), ref: 00A1B625
SetFilePointerEx.KERNELBASE(00000000,-00000098,00000000,00000000,00000000,?,00000000,00000000,?,?,?,00000000,76EDC3F0,00000000), ref: 00A1B696
GetLastError.KERNEL32(?,00000000,00000000,?,?,?,00000000,76EDC3F0,00000000), ref: 00A1B69C
ReadFile.KERNEL32(00000000,?,00000004,00000018,00000000,?,00000000,00000000,?,?,?,00000000,76EDC3F0,00000000), ref: 00A1B6E5
GetLastError.KERNEL32(?,00000000,00000000,?,?,?,00000000,76EDC3F0,00000000), ref: 00A1B6EB
ReadFile.KERNEL32(00000000,?,00000004,00000018,00000000,?,00000000,00000000,?,?,?,00000000,76EDC3F0,00000000), ref: 00A1B734
GetLastError.KERNEL32(?,00000000,00000000,?,?,?,00000000,76EDC3F0,00000000), ref: 00A1B73A
SetFilePointerEx.KERNELBASE(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,?,?,?,00000000,76EDC3F0,00000000), ref: 00A1B786
GetLastError.KERNEL32(?,00000000,00000000,?,?,?,00000000,76EDC3F0,00000000), ref: 00A1B78C

Part of subcall function 00A139DF: GetProcessHeap.KERNEL32(?,?,?,00A1237C,?,00000001,75A8B390,8000FFFF,?,?,00A5058B,?,?,00000000,00000000,8000FFFF), ref: 00A139F0
Part of subcall function 00A139DF: RtlAllocateHeap.NTDLL(00000000,?,00A1237C,?,00000001,75A8B390,8000FFFF,?,?,00A5058B,?,?,00000000,00000000,8000FFFF), ref: 00A139F7

ReadFile.KERNEL32(00000000,?,00000028,00000018,00000000,?,00000000,00000000,?,?,?,00000000,76EDC3F0,00000000), ref: 00A1B7DF
ReadFile.KERNEL32(00000000,?,00000028,00000028,00000000,?,00000000,00000000,?,?,?,00000000,76EDC3F0,00000000), ref: 00A1B841
SetFilePointerEx.KERNELBASE(00000000,?,00000000,00000000,00000000,00000034,00000001,?,00000000,00000000,?,?,?,00000000,76EDC3F0,00000000), ref: 00A1B8CB
GetLastError.KERNEL32(?,00000000,00000000,?,?,?,00000000,76EDC3F0,00000000), ref: 00A1B8D5

Strings

(, xrefs: 00A1B7EC
Failed to seek past optional headers., xrefs: 00A1B7BA
Failed to get total size of bundle., xrefs: 00A1B9F2
Failed to read DOS header., xrefs: 00A1B59E
Failed to read complete image section header, index: %u, xrefs: 00A1BB44
Failed to find valid NT image header in buffer., xrefs: 00A1BB9F
Failed to read complete section info., xrefs: 00A1B994
Failed to seek to start of file., xrefs: 00A1B550
Failed to seek to section info., xrefs: 00A1B6C7, 00A1B903
Failed to open handle to engine process path., xrefs: 00A1B4FC
c:\agent\_work\79\s\src\burn\engine\section.cpp, xrefs: 00A1B4F2, 00A1B546, 00A1B594, 00A1B5F7, 00A1B646, 00A1B6BD, 00A1B70C, 00A1B75B, 00A1B7B0, 00A1B867, 00A1B8A7, 00A1B8F9, 00A1B95E, 00A1B988, 00A1B9AF, 00A1BA96, 00A1BAD6, 00A1BAF5, 00A1BB32, 00A1BB70, 00A1BB93, 00A1BBAE
PE Header from file didn't match PE Header in memory., xrefs: 00A1BAE0
Failed to allocate buffer for section info., xrefs: 00A1B8B3
_`AB, xrefs: 00A1B463
PE, xrefs: 00A1B667
Failed to read signature offset., xrefs: 00A1B716
burn, xrefs: 00A1B807
Failed to find valid DOS image header in buffer., xrefs: 00A1BBBA
Failed to allocate memory for container sizes., xrefs: 00A1BAA2
Failed to read section info., xrefs: 00A1B968
Failed to read image section header, index: %u, xrefs: 00A1BB7B
.wix, xrefs: 00A1B7FF
Failed to read section info, unsupported version: %08x, xrefs: 00A1B9C4
Failed to read NT header., xrefs: 00A1B650
Failed to seek to NT header., xrefs: 00A1B601
Failed to read section info, data to short: %u, xrefs: 00A1B879
Failed to find Burn section., xrefs: 00A1BB01
4, xrefs: 00A1B853
Failed to read signature size., xrefs: 00A1B765

Memory Dump Source

Source File: 00000003.00000002.3297635874.0000000000A11000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00A10000, based on PE: true

Associated: 00000003.00000002.3297603093.0000000000A10000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.3297783757.0000000000A5B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.3297848804.0000000000A7B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.3297905107.0000000000A7E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_a10000_EMA3D.jbxd

Similarity

API ID: File$ErrorLast$Read$Pointer$Heap$AllocateProcess
String ID: ($.wix$4$Failed to allocate buffer for section info.$Failed to allocate memory for container sizes.$Failed to find Burn section.$Failed to find valid DOS image header in buffer.$Failed to find valid NT image header in buffer.$Failed to get total size of bundle.$Failed to open handle to engine process path.$Failed to read DOS header.$Failed to read NT header.$Failed to read complete image section header, index: %u$Failed to read complete section info.$Failed to read image section header, index: %u$Failed to read section info, data to short: %u$Failed to read section info, unsupported version: %08x$Failed to read section info.$Failed to read signature offset.$Failed to read signature size.$Failed to seek past optional headers.$Failed to seek to NT header.$Failed to seek to section info.$Failed to seek to start of file.$PE$PE Header from file didn't match PE Header in memory.$_`AB$burn$c:\agent\_work\79\s\src\burn\engine\section.cpp
API String ID: 3411815225-3099757939
Opcode ID: 73a1ef517262cf1973cb322aecefd9f7230cf67197cf9061e6ee9a0533b24c2c
Instruction ID: 18b42ee4217bd76a9ea47734b678da8e66873919f2f867fe1a23d99857c6b08a
Opcode Fuzzy Hash: 73a1ef517262cf1973cb322aecefd9f7230cf67197cf9061e6ee9a0533b24c2c
Instruction Fuzzy Hash: B612C276A50225BBEB20DB558D46FEA7AA4BF00B12F0141A5FD05BB280E7749D84CBB1

Function 00A1CD76 Relevance: 73.9, APIs: 3, Strings: 39, Instructions: 365
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00A139DF: GetProcessHeap.KERNEL32(?,?,?,00A1237C,?,00000001,75A8B390,8000FFFF,?,?,00A5058B,?,?,00000000,00000000,8000FFFF), ref: 00A139F0
Part of subcall function 00A139DF: RtlAllocateHeap.NTDLL(00000000,?,00A1237C,?,00000001,75A8B390,8000FFFF,?,?,00A5058B,?,?,00000000,00000000,8000FFFF), ref: 00A139F7

CompareStringW.KERNEL32(0000007F,00000000,00000000,000000FF,download,000000FF,00000000,Packaging,00000000,00000000,FilePath,00A1549A,00000000,00A5CB64,00A15482,00000000), ref: 00A1CEAC

Strings

Failed to get @CertificateRootPublicKeyIdentifier., xrefs: 00A1D170
Failed to get next node., xrefs: 00A1D1DF
c:\agent\_work\79\s\src\burn\engine\payload.cpp, xrefs: 00A1CDF8
Failed to get payload node count., xrefs: 00A1CDC9
Payload, xrefs: 00A1CD91
Failed to get @Container., xrefs: 00A1D144
Packaging, xrefs: 00A1CE7F
Failed to get @Catalog., xrefs: 00A1D18C
CertificateRootThumbprint, xrefs: 00A1D033
Failed to get @DownloadUrl., xrefs: 00A1D1A1
Failed to select payload nodes., xrefs: 00A1CDA4
Failed to get @Hash., xrefs: 00A1D19A
external, xrefs: 00A1CEDA
Failed to hex decode the Payload/@Hash., xrefs: 00A1D193
FileSize, xrefs: 00A1CFBB
Failed to get @Id., xrefs: 00A1D1D8
Failed to get @Packaging., xrefs: 00A1D1CA
Failed to get @LayoutOnly., xrefs: 00A1D14E
Failed to get @FilePath., xrefs: 00A1D1D1
CertificateRootPublicKeyIdentifier, xrefs: 00A1CFF6
FilePath, xrefs: 00A1CE64
Failed to get @SourcePath., xrefs: 00A1D1A8
Failed to get @FileSize., xrefs: 00A1D162
Failed to hex decode @CertificateRootThumbprint., xrefs: 00A1D177
Failed to find catalog., xrefs: 00A1D185
Failed to parse @FileSize., xrefs: 00A1D158
Failed to to find container: %ls, xrefs: 00A1D13D
Hash, xrefs: 00A1D070
Invalid value for @Packaging: %ls, xrefs: 00A1D1B7
Failed to hex decode @CertificateRootPublicKeyIdentifier., xrefs: 00A1D169
Failed to get @CertificateRootThumbprint., xrefs: 00A1D17E
LayoutOnly, xrefs: 00A1CF46
SourcePath, xrefs: 00A1CF69
Failed to allocate memory for payload structs., xrefs: 00A1CE02
DownloadUrl, xrefs: 00A1CF92
Container, xrefs: 00A1CF04
Catalog, xrefs: 00A1D0A5
download, xrefs: 00A1CE9E
embedded, xrefs: 00A1CEBE

Memory Dump Source

Source File: 00000003.00000002.3297635874.0000000000A11000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00A10000, based on PE: true

Associated: 00000003.00000002.3297603093.0000000000A10000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.3297783757.0000000000A5B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.3297848804.0000000000A7B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.3297905107.0000000000A7E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_a10000_EMA3D.jbxd

Similarity

API ID: Heap$AllocateCompareProcessString
String ID: Catalog$CertificateRootPublicKeyIdentifier$CertificateRootThumbprint$Container$DownloadUrl$Failed to allocate memory for payload structs.$Failed to find catalog.$Failed to get @Catalog.$Failed to get @CertificateRootPublicKeyIdentifier.$Failed to get @CertificateRootThumbprint.$Failed to get @Container.$Failed to get @DownloadUrl.$Failed to get @FilePath.$Failed to get @FileSize.$Failed to get @Hash.$Failed to get @Id.$Failed to get @LayoutOnly.$Failed to get @Packaging.$Failed to get @SourcePath.$Failed to get next node.$Failed to get payload node count.$Failed to hex decode @CertificateRootPublicKeyIdentifier.$Failed to hex decode @CertificateRootThumbprint.$Failed to hex decode the Payload/@Hash.$Failed to parse @FileSize.$Failed to select payload nodes.$Failed to to find container: %ls$FilePath$FileSize$Hash$Invalid value for @Packaging: %ls$LayoutOnly$Packaging$Payload$SourcePath$c:\agent\_work\79\s\src\burn\engine\payload.cpp$download$embedded$external
API String ID: 1171520630-1473155156
Opcode ID: 2182b28b2ab26c0d27b4a148899ee17c6c1de82e3d87b4a093b96ab3c728bfd7
Instruction ID: 7079ecb20ab7e9a2cf3b30b2e8eecf008022687f932363f14ff3dab860f39a0c
Opcode Fuzzy Hash: 2182b28b2ab26c0d27b4a148899ee17c6c1de82e3d87b4a093b96ab3c728bfd7
Instruction Fuzzy Hash: 03C1C172981629BFCB11AB94CD02EEEBB75BB00B26F104675FD01BB190D770EE949790

Function 00A30AE0 Relevance: 54.6, APIs: 20, Strings: 11, Instructions: 306
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetEvent.KERNEL32(?,?,?,?,?,00A30690,?,?), ref: 00A30AEF
GetLastError.KERNEL32(?,?,?,?,00A30690,?,?), ref: 00A30AF9
WaitForSingleObject.KERNEL32(?,000000FF,?,?,?,?,00A30690,?,?), ref: 00A30B3E
GetLastError.KERNEL32(?,?,?,?,00A30690,?,?), ref: 00A30B49
ResetEvent.KERNEL32(?,?,?,?,?,00A30690,?,?), ref: 00A30B81
GetLastError.KERNEL32(?,?,?,?,00A30690,?,?), ref: 00A30B8B

Strings

Failed to set file pointer to end of file., xrefs: 00A30E19
Failed to reset begin operation event., xrefs: 00A30BB9, 00A30CF5
Invalid operation for this state., xrefs: 00A30BE7
Failed to create file: %ls, xrefs: 00A30DCB
Failed to copy stream name: %ls, xrefs: 00A30C1A
Failed to wait for begin operation event., xrefs: 00A30B77, 00A30CB0
Failed to allocate buffer for stream., xrefs: 00A30D5D
Failed to set file pointer to beginning of file., xrefs: 00A30EA2
Failed to set end of file., xrefs: 00A30E5E
c:\agent\_work\79\s\src\burn\engine\cabextract.cpp, xrefs: 00A30B1D, 00A30B6D, 00A30BAF, 00A30BDB, 00A30C5E, 00A30CA6, 00A30CEB, 00A30D53, 00A30DBE, 00A30E0F, 00A30E54, 00A30E98
Failed to set operation complete event., xrefs: 00A30B27, 00A30C68

Memory Dump Source

Source File: 00000003.00000002.3297635874.0000000000A11000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00A10000, based on PE: true

Associated: 00000003.00000002.3297603093.0000000000A10000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.3297783757.0000000000A5B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.3297848804.0000000000A7B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.3297905107.0000000000A7E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_a10000_EMA3D.jbxd

Similarity

API ID: ErrorLast$Event$ObjectResetSingleWait
String ID: Failed to allocate buffer for stream.$Failed to copy stream name: %ls$Failed to create file: %ls$Failed to reset begin operation event.$Failed to set end of file.$Failed to set file pointer to beginning of file.$Failed to set file pointer to end of file.$Failed to set operation complete event.$Failed to wait for begin operation event.$Invalid operation for this state.$c:\agent\_work\79\s\src\burn\engine\cabextract.cpp
API String ID: 1865021742-2724965156
Opcode ID: 295198a882beea9d07313b0c50733feb9643a13bf0fa34b49b8d4ce4d924fa00
Instruction ID: 5616a8b2ef049f6ca9da54aa921c17d59629b79da9e08fac6c5c561727b6f873
Opcode Fuzzy Hash: 295198a882beea9d07313b0c50733feb9643a13bf0fa34b49b8d4ce4d924fa00
Instruction Fuzzy Hash: 15912833A90736BBE3205BA99E1AF6BA964BF10B63F110610BE51BB6D0D764DC00C5E1

Function 00A151D2 Relevance: 42.3, APIs: 5, Strings: 19, Instructions: 314
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,?,?,?,?), ref: 00A15254

Part of subcall function 00A50816: InitializeCriticalSection.KERNEL32(00A7C6EC,?,00A15260,00000000,?,?,?,?,?,?), ref: 00A5082D

Part of subcall function 00A11206: CommandLineToArgvW.SHELL32(00000000,00000000,00000000,00000000,00000000,00000000,ignored ,00000000,?,00000000,?,?,?,00A1527C,00000000,?), ref: 00A11244
Part of subcall function 00A11206: GetLastError.KERNEL32(?,?,?,00A1527C,00000000,?,?,00000003,00000000,00000000,?,?,?,?,?,?), ref: 00A1124E

CoInitializeEx.COMBASE(00000000,00000000,?,?,00000000,?,?,00000003,00000000,00000000,?,?,?,?,?,?), ref: 00A152C2

Part of subcall function 00A51112: GetProcAddress.KERNEL32(RegDeleteKeyExW,AdvApi32.dll), ref: 00A51133

GetVersionExW.KERNEL32(?,?,?,?,?,?,?), ref: 00A15354
GetLastError.KERNEL32(?,?,?,?,?,?), ref: 00A1535E
CoUninitialize.OLE32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00A155CB

Strings

3.14.0.3910, xrefs: 00A153C1
Failed to initialize Cryputil., xrefs: 00A152E3
Failed to initialize XML util., xrefs: 00A15336
Failed to initialize Wiutil., xrefs: 00A1531E
Invalid run mode., xrefs: 00A15436
Failed to get OS info., xrefs: 00A1538C
Failed to run per-user mode., xrefs: 00A154D1
Failed to initialize engine state., xrefs: 00A152A9
=, xrefs: 00A15532
Failed to parse command line., xrefs: 00A15282
c:\agent\_work\79\s\src\burn\engine\engine.cpp, xrefs: 00A15382
Failed to run RunOnce mode., xrefs: 00A15459
Failed to run embedded mode., xrefs: 00A15481
Failed to initialize Regutil., xrefs: 00A15306
_`AB, xrefs: 00A151DB
Failed to run untrusted mode., xrefs: 00A154F3
Failed to initialize COM., xrefs: 00A152CE
Failed to run per-machine mode., xrefs: 00A154A9
Failed to initialize core., xrefs: 00A15400

Memory Dump Source

Source File: 00000003.00000002.3297635874.0000000000A11000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00A10000, based on PE: true

Associated: 00000003.00000002.3297603093.0000000000A10000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.3297783757.0000000000A5B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.3297848804.0000000000A7B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.3297905107.0000000000A7E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_a10000_EMA3D.jbxd

Similarity

API ID: ErrorInitializeLast$AddressArgvCommandCriticalHandleLineModuleProcSectionUninitializeVersion
String ID: 3.14.0.3910$Failed to get OS info.$Failed to initialize COM.$Failed to initialize Cryputil.$Failed to initialize Regutil.$Failed to initialize Wiutil.$Failed to initialize XML util.$Failed to initialize core.$Failed to initialize engine state.$Failed to parse command line.$Failed to run RunOnce mode.$Failed to run embedded mode.$Failed to run per-machine mode.$Failed to run per-user mode.$Failed to run untrusted mode.$Invalid run mode.$_`AB$c:\agent\_work\79\s\src\burn\engine\engine.cpp$=
API String ID: 3262001429-3747138455
Opcode ID: 7eaced785456e22062d83e0381839f78e5147a050533847a94ab5660c8469eb6
Instruction ID: 8b953a2f018df5c4d83b3638fc6d6b12de3b8d55adcdcd8f239ea0ebb34da545
Opcode Fuzzy Hash: 7eaced785456e22062d83e0381839f78e5147a050533847a94ab5660c8469eb6
Instruction Fuzzy Hash: BBB1A072D10A29EBDB21ABB8CD45BED76B9BF84752F040195FD08B6241DB709EC48F90

Function 00A519F8 Relevance: 40.6, APIs: 21, Strings: 2, Instructions: 336
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeSecurityDescriptor.ADVAPI32(?,00000001), ref: 00A51A90
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00A51A9A
CreateWellKnownSid.ADVAPI32(0000001A,00000000,?,?), ref: 00A51AE7
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00A51AED
CreateWellKnownSid.ADVAPI32(00000017,00000000,?,?), ref: 00A51B27
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00A51B2D
CreateWellKnownSid.ADVAPI32(00000018,00000000,?,?), ref: 00A51B6D
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00A51B73
CreateWellKnownSid.ADVAPI32(00000010,00000000,?,?), ref: 00A51BB3
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00A51BB9
CreateWellKnownSid.ADVAPI32(00000016,00000000,?,?), ref: 00A51BF9
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00A51BFF
SetEntriesInAclA.ADVAPI32(00000005,?,00000000,?), ref: 00A51CF0
SetSecurityDescriptorOwner.ADVAPI32(?,?,00000000), ref: 00A51D2A
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00A51D34
SetSecurityDescriptorGroup.ADVAPI32(?,?,00000000), ref: 00A51D6C
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00A51D76
SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 00A51DAF
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00A51DB9
CoInitializeSecurity.COMBASE(?,000000FF,00000000,00000000,00000006,00000002,00000000,00003000,00000000), ref: 00A51DF7
LocalFree.KERNEL32(?), ref: 00A51E0D

Strings

_`AB, xrefs: 00A51A01
c:\agent\_work\79\s\src\libs\dutil\srputil.cpp, xrefs: 00A51ABB

Memory Dump Source

Source File: 00000003.00000002.3297635874.0000000000A11000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00A10000, based on PE: true

Associated: 00000003.00000002.3297603093.0000000000A10000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.3297783757.0000000000A5B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.3297848804.0000000000A7B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.3297905107.0000000000A7E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_a10000_EMA3D.jbxd

Similarity

API ID: ErrorLast$CreateKnownSecurityWell$Descriptor$Initialize$DaclEntriesFreeGroupLocalOwner
String ID: _`AB$c:\agent\_work\79\s\src\libs\dutil\srputil.cpp
API String ID: 267631441-1440381988
Opcode ID: 575242d49372632e93f4c2cb5a89a688b79a83958b8f3b8332486ff6d68228cd
Instruction ID: 08f8a483e117c7f97d5211b1c92b9352e7db71806672542f58aa31307164d8e1
Opcode Fuzzy Hash: 575242d49372632e93f4c2cb5a89a688b79a83958b8f3b8332486ff6d68228cd
Instruction Fuzzy Hash: 9BC153B6D41239ABDB20CF958D48BEFFAB8BF44751F0141AAED04B7250E7709D448EA0

Function 00A27430 Relevance: 37.0, APIs: 1, Strings: 20, Instructions: 290
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Failed to set source process folder variable., xrefs: 00A2764B
Failed to get unique temporary folder for bootstrapper application., xrefs: 00A276D4
Failed to extract bootstrapper application payloads., xrefs: 00A276F5
Failed to get source process folder from path., xrefs: 00A2762B
Failed to set original source variable., xrefs: 00A27670
Failed to initialize variables., xrefs: 00A27477
WixBundleOriginalSource, xrefs: 00A2765F
Failed to set source process path variable., xrefs: 00A2760F
Failed to parse command line., xrefs: 00A2756D
Failed to overwrite the %ls built-in variable., xrefs: 00A275C1
Failed to open manifest stream., xrefs: 00A274B1
Failed to load catalog files., xrefs: 00A27715
WixBundleSourceProcessPath, xrefs: 00A275FE
Failed to get manifest stream from container., xrefs: 00A274D2
Failed to initialize internal cache functionality., xrefs: 00A276A5
Failed to load manifest., xrefs: 00A274EE
WixBundleElevated, xrefs: 00A275AB, 00A275BC
WixBundleUILevel, xrefs: 00A275DC, 00A275ED
WixBundleSourceProcessFolder, xrefs: 00A2763A
Failed to open attached UX container., xrefs: 00A27494

Memory Dump Source

Source File: 00000003.00000002.3297635874.0000000000A11000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00A10000, based on PE: true

Associated: 00000003.00000002.3297603093.0000000000A10000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.3297783757.0000000000A5B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.3297848804.0000000000A7B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.3297905107.0000000000A7E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_a10000_EMA3D.jbxd

Similarity

API ID: CriticalInitializeSection
String ID: Failed to extract bootstrapper application payloads.$Failed to get manifest stream from container.$Failed to get source process folder from path.$Failed to get unique temporary folder for bootstrapper application.$Failed to initialize internal cache functionality.$Failed to initialize variables.$Failed to load catalog files.$Failed to load manifest.$Failed to open attached UX container.$Failed to open manifest stream.$Failed to overwrite the %ls built-in variable.$Failed to parse command line.$Failed to set original source variable.$Failed to set source process folder variable.$Failed to set source process path variable.$WixBundleElevated$WixBundleOriginalSource$WixBundleSourceProcessFolder$WixBundleSourceProcessPath$WixBundleUILevel
API String ID: 32694325-1564579409
Opcode ID: 47bb3fd340ec927974ad5c041ee0ff2e8fd145fb1126b4a09ea754c4117e4cc1
Instruction ID: a697d1ce831efea628558621fd1a6a65f785ee2ac93b5844f68c3ce8cb040e0f
Opcode Fuzzy Hash: 47bb3fd340ec927974ad5c041ee0ff2e8fd145fb1126b4a09ea754c4117e4cc1
Instruction Fuzzy Hash: 02A17472E44A26BACB129AB8DD41EEFB77CBB14710F010636F915E7141E770EA448BA4

Function 00A24665 Relevance: 36.9, APIs: 10, Strings: 11, Instructions: 184
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcessId.KERNEL32(?,8000FFFF,feclient.dll,?,00A24B78,00A5B4E8,?,feclient.dll,00000000,?,?), ref: 00A2467C
ReadFile.KERNELBASE(feclient.dll,feclient.dll,00000004,?,00000000,?,00A24B78,00A5B4E8,?,feclient.dll,00000000,?,?), ref: 00A2469D
GetLastError.KERNEL32(?,00A24B78,00A5B4E8,?,feclient.dll,00000000,?,?), ref: 00A246A3
ReadFile.KERNELBASE(feclient.dll,00000000,00A5B518,?,00000000,00000000,00A5B519,?,00A24B78,00A5B4E8,?,feclient.dll,00000000,?,?), ref: 00A24731
GetLastError.KERNEL32(?,00A24B78,00A5B4E8,?,feclient.dll,00000000,?,?), ref: 00A24737

Strings

Failed to read verification secret from parent pipe., xrefs: 00A24765
Failed to allocate buffer for verification secret., xrefs: 00A2471A
msasn1.dll, xrefs: 00A247B4
Failed to inform parent process that child is running., xrefs: 00A24844
Verification secret from parent does not match., xrefs: 00A2479F
c:\agent\_work\79\s\src\burn\engine\pipe.cpp, xrefs: 00A246C7, 00A246F2, 00A2475B, 00A24793, 00A247E0, 00A2483A, 00A24878
Verification secret from parent is too big., xrefs: 00A246FE
Failed to read verification process id from parent pipe., xrefs: 00A247EA
feclient.dll, xrefs: 00A2466B, 00A2469B, 00A2469C, 00A24730, 00A247B5, 00A2480B
Verification process id from parent does not match., xrefs: 00A24884
Failed to read size of verification secret from parent pipe., xrefs: 00A246D1

Memory Dump Source

Source File: 00000003.00000002.3297635874.0000000000A11000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00A10000, based on PE: true

Associated: 00000003.00000002.3297603093.0000000000A10000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.3297783757.0000000000A5B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.3297848804.0000000000A7B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.3297905107.0000000000A7E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_a10000_EMA3D.jbxd

Similarity

API ID: ErrorFileLastRead$CurrentProcess
String ID: Failed to allocate buffer for verification secret.$Failed to inform parent process that child is running.$Failed to read size of verification secret from parent pipe.$Failed to read verification process id from parent pipe.$Failed to read verification secret from parent pipe.$Verification process id from parent does not match.$Verification secret from parent does not match.$Verification secret from parent is too big.$c:\agent\_work\79\s\src\burn\engine\pipe.cpp$feclient.dll$msasn1.dll
API String ID: 1233551569-195037519
Opcode ID: 09893c8d4eb92a6157903d9b02ed2248ddaf349af875867da8fe73e18f7cefce
Instruction ID: 1316e6fd882c57e54a0097e7e6d81ad88178f1ed3021af8aa9828214e0611738
Opcode Fuzzy Hash: 09893c8d4eb92a6157903d9b02ed2248ddaf349af875867da8fe73e18f7cefce
Instruction Fuzzy Hash: D151B336D90336B7E7219B99AD45FAFBA78BF09B11F110135BE20BB280D7749D0086E1

Function 00A1762D Relevance: 36.4, APIs: 1, Strings: 23, Instructions: 419
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSection.KERNEL32(00A27471,00A153FA,00000000,00A15482), ref: 00A1764D

Strings

InstallerVersion, xrefs: 00A17834
WixBundleProviderKey, xrefs: 00A17E7F
WixBundleExecutePackageCacheFolder, xrefs: 00A17D99
', xrefs: 00A178EC
Failed to add built-in variable: %ls., xrefs: 00A17F1A
WixBundleVersion, xrefs: 00A17ECF
WixBundleTag, xrefs: 00A17EAF
InstallerName, xrefs: 00A17813
0, xrefs: 00A17664
WixBundleForcedRestartPackage, xrefs: 00A17E15
WixBundleActiveParent, xrefs: 00A17E63
#, xrefs: 00A176CC
$, xrefs: 00A17D4A
WixBundleSourceProcessPath, xrefs: 00A17E8F
WixBundleInstalled, xrefs: 00A17E2B
Date, xrefs: 00A17771
LogonUser, xrefs: 00A17883
_`AB, xrefs: 00A17636
WixBundleElevated, xrefs: 00A17E47
WixBundleUILevel, xrefs: 00A17EBF
WixBundleExecutePackageAction, xrefs: 00A17DF9
WixBundleSourceProcessFolder, xrefs: 00A17E9F
WixBundleAction, xrefs: 00A17D77

Memory Dump Source

Source File: 00000003.00000002.3297635874.0000000000A11000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00A10000, based on PE: true

Associated: 00000003.00000002.3297603093.0000000000A10000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.3297783757.0000000000A5B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.3297848804.0000000000A7B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.3297905107.0000000000A7E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_a10000_EMA3D.jbxd

Similarity

API ID: CriticalInitializeSection
String ID: #$$$'$0$Date$Failed to add built-in variable: %ls.$InstallerName$InstallerVersion$LogonUser$WixBundleAction$WixBundleActiveParent$WixBundleElevated$WixBundleExecutePackageAction$WixBundleExecutePackageCacheFolder$WixBundleForcedRestartPackage$WixBundleInstalled$WixBundleProviderKey$WixBundleSourceProcessFolder$WixBundleSourceProcessPath$WixBundleTag$WixBundleUILevel$WixBundleVersion$_`AB
API String ID: 32694325-332951141
Opcode ID: 28595a1553a9701e7f3479939b9c46ebc7da9127770ce796ff451388ce5250a0
Instruction ID: b2790c9ebc78e51966f26e29dda6591b6bc468ce5f62f9e0b420fe93cda74331
Opcode Fuzzy Hash: 28595a1553a9701e7f3479939b9c46ebc7da9127770ce796ff451388ce5250a0
Instruction Fuzzy Hash: 613244B0C117699FDB61CF5AC9887CDFAB5BB48315F9081EE960CAA214D7B00B89CF45

Function 00A30EC5 Relevance: 31.7, APIs: 8, Strings: 10, Instructions: 216
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoInitializeEx.OLE32(00000000,00000000), ref: 00A30EE7
CoUninitialize.COMBASE ref: 00A31162

Strings

<the>.cab, xrefs: 00A30F87
Failed to reset begin operation event., xrefs: 00A3111A
Invalid operation for this state., xrefs: 00A31146
Failed to wait for begin operation event., xrefs: 00A310DB
_`AB, xrefs: 00A30ECB
Failed to initialize cabinet.dll., xrefs: 00A30F69
c:\agent\_work\79\s\src\burn\engine\cabextract.cpp, xrefs: 00A30F5D, 00A31084, 00A310D1, 00A31110, 00A3113C
Failed to initialize COM., xrefs: 00A30EF3
Failed to set operation complete event., xrefs: 00A3108E
Failed to extract all files from container, erf: %d:%X:%d, xrefs: 00A31043

Memory Dump Source

Source File: 00000003.00000002.3297635874.0000000000A11000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00A10000, based on PE: true

Associated: 00000003.00000002.3297603093.0000000000A10000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.3297783757.0000000000A5B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.3297848804.0000000000A7B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.3297905107.0000000000A7E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_a10000_EMA3D.jbxd

Similarity

API ID: InitializeUninitialize
String ID: <the>.cab$Failed to extract all files from container, erf: %d:%X:%d$Failed to initialize COM.$Failed to initialize cabinet.dll.$Failed to reset begin operation event.$Failed to set operation complete event.$Failed to wait for begin operation event.$Invalid operation for this state.$_`AB$c:\agent\_work\79\s\src\burn\engine\cabextract.cpp
API String ID: 3442037557-2317135288
Opcode ID: 1b80c04ba8f7ffa87f327e5ea5e0ccbac0c33d321fcdb009ad69c286a80c3475
Instruction ID: 03ad255119b81aed05c8a8c5530746d789afb1edf99343f041455cf9e983f698
Opcode Fuzzy Hash: 1b80c04ba8f7ffa87f327e5ea5e0ccbac0c33d321fcdb009ad69c286a80c3475
Instruction Fuzzy Hash: 53518D37E40262F7D73457648D05EAF7674BB41B62F220729FD01BF380D66A8D4186E2

Function 00A14326 Relevance: 28.2, APIs: 10, Strings: 6, Instructions: 157
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSection.KERNEL32(00000000,?,00000000,00000000,?,?,00A152A3,?,?,00000000,?,?), ref: 00A14352
InitializeCriticalSection.KERNEL32(000000D0,?,?,00A152A3,?,?,00000000,?,?), ref: 00A1435B
lstrlenW.KERNEL32(burn.filehandle.attached,000004B8,000004A0,?,?,00A152A3,?,?,00000000,?,?), ref: 00A143A1
lstrlenW.KERNEL32(burn.filehandle.attached,burn.filehandle.attached,00000000,?,?,00A152A3,?,?,00000000,?,?), ref: 00A143AB
CompareStringW.KERNEL32(0000007F,00000001,?,00000000,?,?,00A152A3,?,?,00000000,?,?), ref: 00A143BF
lstrlenW.KERNEL32(burn.filehandle.attached,?,?,00A152A3,?,?,00000000,?,?), ref: 00A143CF
lstrlenW.KERNEL32(burn.filehandle.self,?,?,00A152A3,?,?,00000000,?,?), ref: 00A1441F
lstrlenW.KERNEL32(burn.filehandle.self,burn.filehandle.self,00000000,?,?,00A152A3,?,?,00000000,?,?), ref: 00A14429
CompareStringW.KERNEL32(0000007F,00000001,?,00000000,?,?,00A152A3,?,?,00000000,?,?), ref: 00A1443D
lstrlenW.KERNEL32(burn.filehandle.self,?,?,00A152A3,?,?,00000000,?,?), ref: 00A1444D

Strings

Missing required parameter for switch: %ls, xrefs: 00A144F1
Failed to parse file handle: '%ls', xrefs: 00A144CF
c:\agent\_work\79\s\src\burn\engine\engine.cpp, xrefs: 00A144E2, 00A1450E
burn.filehandle.attached, xrefs: 00A1439C, 00A143A4, 00A143A9, 00A143AA, 00A143CA, 00A144EC
Failed to initialize engine section., xrefs: 00A144B6
burn.filehandle.self, xrefs: 00A1441A, 00A14422, 00A14427, 00A14428, 00A14448, 00A14518

Memory Dump Source

Source File: 00000003.00000002.3297635874.0000000000A11000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00A10000, based on PE: true

Associated: 00000003.00000002.3297603093.0000000000A10000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.3297783757.0000000000A5B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.3297848804.0000000000A7B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.3297905107.0000000000A7E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_a10000_EMA3D.jbxd

Similarity

API ID: lstrlen$CompareCriticalInitializeSectionString
String ID: Failed to initialize engine section.$Failed to parse file handle: '%ls'$Missing required parameter for switch: %ls$burn.filehandle.attached$burn.filehandle.self$c:\agent\_work\79\s\src\burn\engine\engine.cpp
API String ID: 3039292287-348208256
Opcode ID: b560785e446a679877f67cba1449cb072b8a5311653be8dbe3f50052401b2921
Instruction ID: 372143fc1f2df6a494551039e31aaaba75e90d76e5ef6a4f6b086d2ff5509d73
Opcode Fuzzy Hash: b560785e446a679877f67cba1449cb072b8a5311653be8dbe3f50052401b2921
Instruction Fuzzy Hash: 9551A071A50615BFD720ABACDC86FDA7769FB18762F004115FA18DB290D770A990CBA0

Function 00A24AAD Relevance: 28.2, APIs: 7, Strings: 9, Instructions: 157
sleepfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(00000000,C0000000,00000000,00000000,00000003,00000000,00000000,00000000,?,?), ref: 00A24B07
GetLastError.KERNEL32 ref: 00A24B15
Sleep.KERNEL32(00000064), ref: 00A24B39

Strings

Failed to allocate name of parent cache pipe., xrefs: 00A24BAE
\\.\pipe\%ls.Cache, xrefs: 00A24B9A
c:\agent\_work\79\s\src\burn\engine\pipe.cpp, xrefs: 00A24B52, 00A24C55
Failed to verify parent pipe: %ls, xrefs: 00A24B81
Failed to open parent pipe: %ls, xrefs: 00A24B5F
feclient.dll, xrefs: 00A24B6C, 00A24C07, 00A24C1B, 00A24C5F
Failed to open companion process with PID: %u, xrefs: 00A24C61
Failed to allocate name of parent pipe., xrefs: 00A24AD3
\\.\pipe\%ls, xrefs: 00A24ABF

Memory Dump Source

Source File: 00000003.00000002.3297635874.0000000000A11000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00A10000, based on PE: true

Associated: 00000003.00000002.3297603093.0000000000A10000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.3297783757.0000000000A5B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.3297848804.0000000000A7B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.3297905107.0000000000A7E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_a10000_EMA3D.jbxd

Similarity

API ID: CreateErrorFileLastSleep
String ID: Failed to allocate name of parent cache pipe.$Failed to allocate name of parent pipe.$Failed to open companion process with PID: %u$Failed to open parent pipe: %ls$Failed to verify parent pipe: %ls$\\.\pipe\%ls$\\.\pipe\%ls.Cache$c:\agent\_work\79\s\src\burn\engine\pipe.cpp$feclient.dll
API String ID: 408151869-21451366
Opcode ID: c75ccb5f7c2fe64d98a769b02b39520bff368a51186c5ed8de9ba9af86c42064
Instruction ID: f685c883a63d27a30393e26233caef874505a848625599be152f436d62690300
Opcode Fuzzy Hash: c75ccb5f7c2fe64d98a769b02b39520bff368a51186c5ed8de9ba9af86c42064
Instruction Fuzzy Hash: A841D537D81632BBE72257ACAE06F5ABA64BF08B21F114230FD00BB1D0D765DD409AE4

Function 00A2E631 Relevance: 28.1, APIs: 11, Strings: 5, Instructions: 134
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

TlsSetValue.KERNEL32(?,?), ref: 00A2E677
RegisterClassW.USER32(?), ref: 00A2E6A3
GetLastError.KERNEL32 ref: 00A2E6AE
CreateWindowExW.USER32(00000080,00A6A1B4,00000000,90000000,80000000,00000008,00000000,00000000,00000000,00000000,?,?), ref: 00A2E715
GetLastError.KERNEL32 ref: 00A2E71F
UnregisterClassW.USER32(WixBurnMessageWindow,?), ref: 00A2E7BD

Strings

Failed to register window., xrefs: 00A2E6DC
Failed to create window., xrefs: 00A2E74D
WixBurnMessageWindow, xrefs: 00A2E69C, 00A2E7B8
c:\agent\_work\79\s\src\burn\engine\uithread.cpp, xrefs: 00A2E6D2, 00A2E743
Unexpected return value from message pump., xrefs: 00A2E7A8

Memory Dump Source

Source File: 00000003.00000002.3297635874.0000000000A11000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00A10000, based on PE: true

Associated: 00000003.00000002.3297603093.0000000000A10000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.3297783757.0000000000A5B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.3297848804.0000000000A7B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.3297905107.0000000000A7E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_a10000_EMA3D.jbxd

Similarity

API ID: ClassErrorLast$CreateRegisterUnregisterValueWindow
String ID: Failed to create window.$Failed to register window.$Unexpected return value from message pump.$WixBurnMessageWindow$c:\agent\_work\79\s\src\burn\engine\uithread.cpp
API String ID: 213125376-717246376
Opcode ID: 24d89f88015acf4aee64639a69c35bfcc795e342e54680797fb2ea0b75527643
Instruction ID: 92d8d097252e25e913ba5ea23292e60148c2bcc575f36d2fbb80ff4e57d8e201
Opcode Fuzzy Hash: 24d89f88015acf4aee64639a69c35bfcc795e342e54680797fb2ea0b75527643
Instruction Fuzzy Hash: E6418276900225BBDB20CF98ED48ADEBFB8FF05762F114175F905BA250E7309985CBA1

Function 00A1C252 Relevance: 26.4, APIs: 8, Strings: 7, Instructions: 131
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNEL32(00000000,80000000,00000001,00000000,00000003,08000080,00000000,?,00000000,00000000,?,00A1C442,00A15442,?,?,00A15482), ref: 00A1C299
GetLastError.KERNEL32(?,00A1C442,00A15442,?,?,00A15482,00A15482,00000000,?,00000000), ref: 00A1C2AA
GetCurrentProcess.KERNEL32(?,00000000,00000000,00000002,?,00000000,00000000,?,00A1C442,00A15442,?,?,00A15482,00A15482,00000000,?), ref: 00A1C2F9
GetCurrentProcess.KERNEL32(000000FF,00000000,?,00A1C442,00A15442,?,?,00A15482,00A15482,00000000,?,00000000), ref: 00A1C2FF
DuplicateHandle.KERNELBASE(00000000,?,00A1C442,00A15442,?,?,00A15482,00A15482,00000000,?,00000000), ref: 00A1C302
GetLastError.KERNEL32(?,00A1C442,00A15442,?,?,00A15482,00A15482,00000000,?,00000000), ref: 00A1C30C
SetFilePointerEx.KERNELBASE(?,00000000,00000000,00000000,00000000,?,00A1C442,00A15442,?,?,00A15482,00A15482,00000000,?,00000000), ref: 00A1C35E
GetLastError.KERNEL32(?,00A1C442,00A15442,?,?,00A15482,00A15482,00000000,?,00000000), ref: 00A1C368

Strings

c:\agent\_work\79\s\src\burn\engine\container.cpp, xrefs: 00A1C2CE, 00A1C330, 00A1C38C
Failed to move file pointer to container offset., xrefs: 00A1C396
crypt32.dll, xrefs: 00A1C35A
Failed to open container., xrefs: 00A1C3B4
feclient.dll, xrefs: 00A1C35B
Failed to duplicate handle to container: %ls, xrefs: 00A1C33D
Failed to open file: %ls, xrefs: 00A1C2DB

Memory Dump Source

Source File: 00000003.00000002.3297635874.0000000000A11000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00A10000, based on PE: true

Associated: 00000003.00000002.3297603093.0000000000A10000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.3297783757.0000000000A5B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.3297848804.0000000000A7B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.3297905107.0000000000A7E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_a10000_EMA3D.jbxd

Similarity

API ID: ErrorLast$CurrentFileProcess$CreateDuplicateHandlePointer
String ID: Failed to duplicate handle to container: %ls$Failed to move file pointer to container offset.$Failed to open container.$Failed to open file: %ls$c:\agent\_work\79\s\src\burn\engine\container.cpp$crypt32.dll$feclient.dll
API String ID: 2619879409-1118363129
Opcode ID: 1f6fe04739cc0ac9c1edcfaaffaac1f78a5dfc47e52799a726ee6448cf84642d
Instruction ID: e8ad1109f28e87dcad7ac9a849a235200d3dc4abbfe805fc1d06094ff1e851ba
Opcode Fuzzy Hash: 1f6fe04739cc0ac9c1edcfaaffaac1f78a5dfc47e52799a726ee6448cf84642d
Instruction Fuzzy Hash: 2D41D736180201ABDB109F599D49E9BBBB9BBC5772F218019FD24DF281E731C841DB70

Function 00A52DBA Relevance: 26.3, APIs: 7, Strings: 8, Instructions: 78libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00A138D1: GetSystemDirectoryW.KERNEL32(?,00000104), ref: 00A13910
Part of subcall function 00A138D1: GetLastError.KERNEL32 ref: 00A1391A

Part of subcall function 00A54CDB: GetLastError.KERNEL32(?,00000000,00000000,00000000,00000000,00000001), ref: 00A54D0C

GetProcAddress.KERNEL32(MsiDeterminePatchSequenceW,00000000), ref: 00A52E04
GetProcAddress.KERNEL32(MsiDetermineApplicablePatchesW), ref: 00A52E24
GetProcAddress.KERNEL32(MsiEnumProductsExW), ref: 00A52E44
GetProcAddress.KERNEL32(MsiGetPatchInfoExW), ref: 00A52E64
GetProcAddress.KERNEL32(MsiGetProductInfoExW), ref: 00A52E84
GetProcAddress.KERNEL32(MsiSetExternalUIRecord), ref: 00A52EA4
GetProcAddress.KERNEL32(MsiSourceListAddSourceExW), ref: 00A52EC4

Strings

MsiDetermineApplicablePatchesW, xrefs: 00A52E19
MsiGetPatchInfoExW, xrefs: 00A52E59
MsiEnumProductsExW, xrefs: 00A52E39
MsiDeterminePatchSequenceW, xrefs: 00A52DF9
Msi.dll, xrefs: 00A52DCC
MsiSetExternalUIRecord, xrefs: 00A52E99
MsiSourceListAddSourceExW, xrefs: 00A52EB9
MsiGetProductInfoExW, xrefs: 00A52E79

Memory Dump Source

Source File: 00000003.00000002.3297635874.0000000000A11000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00A10000, based on PE: true

Associated: 00000003.00000002.3297603093.0000000000A10000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.3297783757.0000000000A5B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.3297848804.0000000000A7B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.3297905107.0000000000A7E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_a10000_EMA3D.jbxd

Similarity

API ID: AddressProc$ErrorLast$DirectorySystem
String ID: Msi.dll$MsiDetermineApplicablePatchesW$MsiDeterminePatchSequenceW$MsiEnumProductsExW$MsiGetPatchInfoExW$MsiGetProductInfoExW$MsiSetExternalUIRecord$MsiSourceListAddSourceExW
API String ID: 2510051996-1735120554
Opcode ID: 8e553f466df34143f11403dd08fd3d4cbf26f4859f3eaa20ae695dcf0da4644a
Instruction ID: eb25e02019bb20aabdb83923a9b7c22ae965e75e6ba0240e272a808e0a4d063b
Opcode Fuzzy Hash: 8e553f466df34143f11403dd08fd3d4cbf26f4859f3eaa20ae695dcf0da4644a
Instruction Fuzzy Hash: BE31B470940718EFDB1ADFA1EE527553BA0F715726F00C12EE80866171EB7509D6DF80

Function 00A5330F Relevance: 24.7, APIs: 8, Strings: 6, Instructions: 152libraryloadercomCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,00000000,00000000,00A538BD,00000000,?,00000000), ref: 00A53329
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,00A3BD36,?,00A15442,?,00000000,?), ref: 00A53335
GetProcAddress.KERNEL32(00000000,IsWow64Process), ref: 00A53375
GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 00A53381
GetProcAddress.KERNEL32(00000000,Wow64EnableWow64FsRedirection), ref: 00A5338C
GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 00A53396
CoCreateInstance.OLE32(00A7C7A0,00000000,00000001,00A5B878,?,?,?,?,?,?,?,?,?,?,?,00A3BD36), ref: 00A533D1
ExitProcess.KERNEL32 ref: 00A53480

Strings

IsWow64Process, xrefs: 00A5336F
Wow64RevertWow64FsRedirection, xrefs: 00A5338E
Wow64DisableWow64FsRedirection, xrefs: 00A5337B
kernel32.dll, xrefs: 00A53319
Wow64EnableWow64FsRedirection, xrefs: 00A53383
c:\agent\_work\79\s\src\libs\dutil\xmlutil.cpp, xrefs: 00A53359

Memory Dump Source

Source File: 00000003.00000002.3297635874.0000000000A11000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00A10000, based on PE: true

Associated: 00000003.00000002.3297603093.0000000000A10000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.3297783757.0000000000A5B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.3297848804.0000000000A7B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.3297905107.0000000000A7E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_a10000_EMA3D.jbxd

Similarity

API ID: AddressProc$CreateErrorExitHandleInstanceLastModuleProcess
String ID: IsWow64Process$Wow64DisableWow64FsRedirection$Wow64EnableWow64FsRedirection$Wow64RevertWow64FsRedirection$c:\agent\_work\79\s\src\libs\dutil\xmlutil.cpp$kernel32.dll
API String ID: 2124981135-2947744589
Opcode ID: faf1dce51334a0c74d75735429f0221f4529d85040a62bcedc8bcc00c6874074
Instruction ID: 007fd98891565f4ed155f1cbd84537a9cc1e7f2ab00bb7a2f2af417878669bf9
Opcode Fuzzy Hash: faf1dce51334a0c74d75735429f0221f4529d85040a62bcedc8bcc00c6874074
Instruction Fuzzy Hash: A041B536A00315ABCF22DFA8C854B6E77B4FF84793F118468ED05EB250DB71DE098A50

Function 00A14936 Relevance: 22.9, APIs: 6, Strings: 7, Instructions: 129memorysynchronizationCOMMON

Download Yara Rule

APIs

TlsAlloc.KERNEL32(?,00000001,00000001,00000000,00000000,?,?,?,00A154A3,?,?,?,?), ref: 00A14967
GetLastError.KERNEL32(?,?,?,00A154A3,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00A14978
ReleaseMutex.KERNEL32(?,?,00000000,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,?), ref: 00A14AB5
CloseHandle.KERNEL32(?,?,?,?,00A154A3,?,?,?,?,?,?,?,?,?,?,?), ref: 00A14ABE

Strings

c:\agent\_work\79\s\src\burn\engine\engine.cpp, xrefs: 00A1499C, 00A149E5
Failed to connect to unelevated process., xrefs: 00A1495D
comres.dll, xrefs: 00A14A24
Failed to allocate thread local storage for logging., xrefs: 00A149A6
Failed to create the message window., xrefs: 00A14A13
Failed to pump messages from parent process., xrefs: 00A14A89
Failed to set elevated pipe into thread local storage for logging., xrefs: 00A149EF

Memory Dump Source

Source File: 00000003.00000002.3297635874.0000000000A11000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00A10000, based on PE: true

Associated: 00000003.00000002.3297603093.0000000000A10000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.3297783757.0000000000A5B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.3297848804.0000000000A7B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.3297905107.0000000000A7E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_a10000_EMA3D.jbxd

Similarity

API ID: AllocCloseErrorHandleLastMutexRelease
String ID: Failed to allocate thread local storage for logging.$Failed to connect to unelevated process.$Failed to create the message window.$Failed to pump messages from parent process.$Failed to set elevated pipe into thread local storage for logging.$c:\agent\_work\79\s\src\burn\engine\engine.cpp$comres.dll
API String ID: 687263955-2063452256
Opcode ID: c076cd5807295c5e3dce244586800ebbf687fb6f5193a00aa9352e45433dce68
Instruction ID: 7ed66736afd6508e733a102a13d008c84ce6e22f2804a75011bb00ac2deb1a5d
Opcode Fuzzy Hash: c076cd5807295c5e3dce244586800ebbf687fb6f5193a00aa9352e45433dce68
Instruction Fuzzy Hash: 4D41D773A40626BBD711DBE8DD45EDFB66CBF08752F010226FE15E2141DB30A98487E0

Function 00A31508 Relevance: 22.9, APIs: 6, Strings: 7, Instructions: 106COMMON

Download Yara Rule

APIs

CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,wininet.dll,?,00000000,00000000,00000000,?,?,00A1C3AE,?,00000000,?,00A1C442), ref: 00A3153F
GetLastError.KERNEL32(?,00A1C3AE,?,00000000,?,00A1C442,00A15442,?,?,00A15482,00A15482,00000000,?,00000000), ref: 00A31548

Strings

Failed to create extraction thread., xrefs: 00A31608
Failed to create begin operation event., xrefs: 00A31576
Failed to wait for operation complete., xrefs: 00A3161B
Failed to create operation complete event., xrefs: 00A315BC
wininet.dll, xrefs: 00A3151E
Failed to copy file name., xrefs: 00A3152A
c:\agent\_work\79\s\src\burn\engine\cabextract.cpp, xrefs: 00A3156C, 00A315B2, 00A315FE

Memory Dump Source

Source File: 00000003.00000002.3297635874.0000000000A11000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00A10000, based on PE: true

Associated: 00000003.00000002.3297603093.0000000000A10000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.3297783757.0000000000A5B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.3297848804.0000000000A7B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.3297905107.0000000000A7E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_a10000_EMA3D.jbxd

Similarity

API ID: CreateErrorEventLast
String ID: Failed to copy file name.$Failed to create begin operation event.$Failed to create extraction thread.$Failed to create operation complete event.$Failed to wait for operation complete.$c:\agent\_work\79\s\src\burn\engine\cabextract.cpp$wininet.dll
API String ID: 545576003-3114295247
Opcode ID: e3e074b8d8e759a5595f7f335be52378f8ee2d888739f1a20b5847459a1aa7df
Instruction ID: 9cb51d3eed76170a889b783640974a2a526a7da36442ff9d91c25ff1d6c575a6
Opcode Fuzzy Hash: e3e074b8d8e759a5595f7f335be52378f8ee2d888739f1a20b5847459a1aa7df
Instruction Fuzzy Hash: F42109B3E41736B7E22157A89D46F6BA9ACBF50BA2F010111BD01BB580E768DC014AF5

Function 00A4FFDC Relevance: 22.8, APIs: 6, Strings: 7, Instructions: 76libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNELBASE(SystemFunction040,AdvApi32.dll), ref: 00A50004
GetProcAddress.KERNEL32(SystemFunction041), ref: 00A50016
GetProcAddress.KERNEL32(CryptProtectMemory,Crypt32.dll), ref: 00A50059
GetLastError.KERNEL32(?,?,?,?,?,?), ref: 00A5006D
GetProcAddress.KERNEL32(CryptUnprotectMemory), ref: 00A500A5
GetLastError.KERNEL32(?,?,?,?,?,?), ref: 00A500B9

Strings

c:\agent\_work\79\s\src\libs\dutil\cryputil.cpp, xrefs: 00A5008E
SystemFunction041, xrefs: 00A50006
CryptProtectMemory, xrefs: 00A5004E
Crypt32.dll, xrefs: 00A5003A
CryptUnprotectMemory, xrefs: 00A5009A
AdvApi32.dll, xrefs: 00A4FFE3
SystemFunction040, xrefs: 00A4FFF9

Memory Dump Source

Source File: 00000003.00000002.3297635874.0000000000A11000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00A10000, based on PE: true

Associated: 00000003.00000002.3297603093.0000000000A10000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.3297783757.0000000000A5B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.3297848804.0000000000A7B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.3297905107.0000000000A7E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_a10000_EMA3D.jbxd

Similarity

API ID: AddressProc$ErrorLast
String ID: AdvApi32.dll$Crypt32.dll$CryptProtectMemory$CryptUnprotectMemory$SystemFunction040$SystemFunction041$c:\agent\_work\79\s\src\libs\dutil\cryputil.cpp
API String ID: 4214558900-2260022107
Opcode ID: 4a4a87e55f312b51b2edc9c9384d9288f7cfe86a509a791fbbb92be262ab0d42
Instruction ID: f37fdebc80dbe0f9bea8cc2f42d0f7ff1a2c989693ab5270099be830a07ad113
Opcode Fuzzy Hash: 4a4a87e55f312b51b2edc9c9384d9288f7cfe86a509a791fbbb92be262ab0d42
Instruction Fuzzy Hash: DF219837941732A7D731EF95AD45F277960BB107B2F01E128ED08B62E0D3719C898AD0

Function 00A30696 Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 105fileCOMMON

Download Yara Rule

APIs

CompareStringA.KERNELBASE(00000000,00000000,<the>.cab,?,?), ref: 00A306C6
GetCurrentProcess.KERNEL32(?,00000000,00000000,00000000,?,?), ref: 00A306DE
GetCurrentProcess.KERNEL32(?,00000000,?,?), ref: 00A306E3
DuplicateHandle.KERNELBASE(00000000,?,?), ref: 00A306E6
GetLastError.KERNEL32(?,?), ref: 00A306F0
CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,08000080,00000000,?,?), ref: 00A3075F
GetLastError.KERNEL32(?,?), ref: 00A3076C

Strings

<the>.cab, xrefs: 00A306BF
Failed to duplicate handle to cab container., xrefs: 00A3071E
Failed to open cabinet file: %hs, xrefs: 00A3079D
Failed to add virtual file pointer for cab container., xrefs: 00A30745
c:\agent\_work\79\s\src\burn\engine\cabextract.cpp, xrefs: 00A30714, 00A30790

Memory Dump Source

Source File: 00000003.00000002.3297635874.0000000000A11000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00A10000, based on PE: true

Associated: 00000003.00000002.3297603093.0000000000A10000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.3297783757.0000000000A5B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.3297848804.0000000000A7B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.3297905107.0000000000A7E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_a10000_EMA3D.jbxd

Similarity

API ID: CurrentErrorLastProcess$CompareCreateDuplicateFileHandleString
String ID: <the>.cab$Failed to add virtual file pointer for cab container.$Failed to duplicate handle to cab container.$Failed to open cabinet file: %hs$c:\agent\_work\79\s\src\burn\engine\cabextract.cpp
API String ID: 3030546534-4222385192
Opcode ID: 59507e81a88a56ffc0e06218018900672558f71c72c5eab4c5dd5e86f6be79ac
Instruction ID: 3a5f12c6e3006c14645ff397f6613826a42d4f5412fc67e09bc084b2691f6f91
Opcode Fuzzy Hash: 59507e81a88a56ffc0e06218018900672558f71c72c5eab4c5dd5e86f6be79ac
Instruction Fuzzy Hash: 2E31CF76911A35BBD7219B988D59F8FBE68FF05762F114210FE04B7290D720AD008EF0

Function 00A2E8F3 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 100threadCOMMON

Download Yara Rule

APIs

CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,?,00000000,?,?,00A154CB,?,?), ref: 00A2E913
GetLastError.KERNEL32(?,00A154CB,?,?), ref: 00A2E920
CreateThread.KERNELBASE(00000000,00000000,Function_0001E631,?,00000000,00000000), ref: 00A2E979
GetLastError.KERNEL32(?,00A154CB,?,?), ref: 00A2E986
WaitForMultipleObjects.KERNEL32(00000002,?,00000000,000000FF,?,00A154CB,?,?), ref: 00A2E9C1
CloseHandle.KERNEL32(00000000,?,00A154CB,?,?), ref: 00A2E9E0
CloseHandle.KERNELBASE(?,?,00A154CB,?,?), ref: 00A2E9ED

Strings

Failed to create the UI thread., xrefs: 00A2E9B1
Failed to create initialization event., xrefs: 00A2E94B
c:\agent\_work\79\s\src\burn\engine\uithread.cpp, xrefs: 00A2E941, 00A2E9A7

Memory Dump Source

Source File: 00000003.00000002.3297635874.0000000000A11000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00A10000, based on PE: true

Associated: 00000003.00000002.3297603093.0000000000A10000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.3297783757.0000000000A5B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.3297848804.0000000000A7B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.3297905107.0000000000A7E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_a10000_EMA3D.jbxd

Similarity

API ID: CloseCreateErrorHandleLast$EventMultipleObjectsThreadWait
String ID: Failed to create initialization event.$Failed to create the UI thread.$c:\agent\_work\79\s\src\burn\engine\uithread.cpp
API String ID: 2351989216-563379454
Opcode ID: 16a14a8a26a85e68975f703e363dba893d85b0f7b994bc4f4b65622421c14d36
Instruction ID: d9738821e49034774b99ebb24cb904e78ed3fed561a76d1bb226599fda0c9b10
Opcode Fuzzy Hash: 16a14a8a26a85e68975f703e363dba893d85b0f7b994bc4f4b65622421c14d36
Instruction Fuzzy Hash: BD318176D01229BBEB11DF9D9D85A9FFBB8BF04751F114136F904F7280E6309E808AA1

Function 00A248B6 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 116fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(00000000,?,00000008,?,00000000,?,00000000,00000000,?,00000000), ref: 00A248E1
GetLastError.KERNEL32 ref: 00A248EE
ReadFile.KERNEL32(00000000,00000000,?,?,00000000,?,00000000), ref: 00A24999
GetLastError.KERNEL32 ref: 00A249A3

Strings

Failed to read data for message., xrefs: 00A249D1
Failed to allocate data for message., xrefs: 00A24957
c:\agent\_work\79\s\src\burn\engine\pipe.cpp, xrefs: 00A2494D, 00A24964, 00A249C7
Failed to read message from pipe., xrefs: 00A2496E

Memory Dump Source

Source File: 00000003.00000002.3297635874.0000000000A11000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00A10000, based on PE: true

Associated: 00000003.00000002.3297603093.0000000000A10000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.3297783757.0000000000A5B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.3297848804.0000000000A7B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.3297905107.0000000000A7E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_a10000_EMA3D.jbxd

Similarity

API ID: ErrorFileLastRead
String ID: Failed to allocate data for message.$Failed to read data for message.$Failed to read message from pipe.$c:\agent\_work\79\s\src\burn\engine\pipe.cpp
API String ID: 1948546556-2758242248
Opcode ID: 77cccb7f30d69481e88798246996c88ecce0dfee8ad14d8b553571d8c43e90bc
Instruction ID: a3702edcbadde57ebdc950e49d60f9a76664db9c3f229e6638417567a7f16e67
Opcode Fuzzy Hash: 77cccb7f30d69481e88798246996c88ecce0dfee8ad14d8b553571d8c43e90bc
Instruction Fuzzy Hash: 1B31F533D50236BBDB10DBA8ED05BAFBA68BF08752F118135BC45A6180D7749E80CBD0

Function 00A2AC27 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 64COMMON

Download Yara Rule

APIs

TlsSetValue.KERNEL32(?,?), ref: 00A2AC3E
GetLastError.KERNEL32 ref: 00A2AC48
CoInitializeEx.OLE32(00000000,00000000), ref: 00A2AC87
CoUninitialize.OLE32(?,00A2C5DF,?,?), ref: 00A2ACC4

Strings

Failed to set elevated cache pipe into thread local storage for logging., xrefs: 00A2AC76
Failed to pump messages in child process., xrefs: 00A2ACB2
c:\agent\_work\79\s\src\burn\engine\elevation.cpp, xrefs: 00A2AC6C
Failed to initialize COM., xrefs: 00A2AC93

Memory Dump Source

Source File: 00000003.00000002.3297635874.0000000000A11000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00A10000, based on PE: true

Associated: 00000003.00000002.3297603093.0000000000A10000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.3297783757.0000000000A5B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.3297848804.0000000000A7B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.3297905107.0000000000A7E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_a10000_EMA3D.jbxd

Similarity

API ID: ErrorInitializeLastUninitializeValue
String ID: Failed to initialize COM.$Failed to pump messages in child process.$Failed to set elevated cache pipe into thread local storage for logging.$c:\agent\_work\79\s\src\burn\engine\elevation.cpp
API String ID: 876858697-3953973340
Opcode ID: ddad89bb27ec09b3b1c31209a65fd68045b87189cbd89edf24ec8ca2425c0687
Instruction ID: f3cfbd5e06db827ebf4016436f8501d8e9b689c065dc8dc62c55c201ec2aec69
Opcode Fuzzy Hash: ddad89bb27ec09b3b1c31209a65fd68045b87189cbd89edf24ec8ca2425c0687
Instruction Fuzzy Hash: E6110273951631BB97129BDDEE0A99FBE69FF20F227014225FD05B7240EB71AD0086E1

Function 00A2D0FC Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 109threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNELBASE(00000000,00000000,Function_0001AC27,00000001,00000000,00000000), ref: 00A2D188
GetLastError.KERNEL32(?,?,?,00A154A3,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00A2D194

Part of subcall function 00A2CDDD: WaitForSingleObject.KERNEL32(?,000493E0,00000000,?,?,00A2D204,00000000,?,?,00A2C687,?,?,?,?,?,00A154A3), ref: 00A2CDEF
Part of subcall function 00A2CDDD: GetLastError.KERNEL32(?,?,00A2D204,00000000,?,?,00A2C687,?,?,?,?,?,00A154A3,?,?,?), ref: 00A2CDF9

CloseHandle.KERNEL32(00000000,00000000,?,?,00A2C687,?,?,?,?,?,00A154A3,?,?,?,?), ref: 00A2D215

Strings

Failed to create elevated cache thread., xrefs: 00A2D1C2
Failed to pump messages in child process., xrefs: 00A2D1EC
c:\agent\_work\79\s\src\burn\engine\elevation.cpp, xrefs: 00A2D1B8

Memory Dump Source

Source File: 00000003.00000002.3297635874.0000000000A11000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00A10000, based on PE: true

Associated: 00000003.00000002.3297603093.0000000000A10000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.3297783757.0000000000A5B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.3297848804.0000000000A7B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.3297905107.0000000000A7E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_a10000_EMA3D.jbxd

Similarity

API ID: ErrorLast$CloseCreateHandleObjectSingleThreadWait
String ID: Failed to create elevated cache thread.$Failed to pump messages in child process.$c:\agent\_work\79\s\src\burn\engine\elevation.cpp
API String ID: 3606931770-1134900366
Opcode ID: a47374af2234c8f7d8feaea0273d958c4aaa2e9060e5c639c45360299d9dd7fb
Instruction ID: 62ab3f175c94bf89208028ccc3acb7fa2f742525132a7a04e13a8c608f638883
Opcode Fuzzy Hash: a47374af2234c8f7d8feaea0273d958c4aaa2e9060e5c639c45360299d9dd7fb
Instruction Fuzzy Hash: 6E41D3B6D11229AF8B45DFACD9819DEBBF4BF08710F10412AF809E7340E73099418FA0

Function 00A535AF Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 83memoryCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00A535C5
SysAllocString.OLEAUT32(?), ref: 00A535E1
VariantClear.OLEAUT32(?), ref: 00A53668
SysFreeString.OLEAUT32(00000000), ref: 00A53673

Strings

`)u, xrefs: 00A53673
c:\agent\_work\79\s\src\libs\dutil\xmlutil.cpp, xrefs: 00A535F8

Memory Dump Source

Source File: 00000003.00000002.3297635874.0000000000A11000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00A10000, based on PE: true

Associated: 00000003.00000002.3297603093.0000000000A10000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.3297783757.0000000000A5B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.3297848804.0000000000A7B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.3297905107.0000000000A7E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_a10000_EMA3D.jbxd

Similarity

API ID: StringVariant$AllocClearFreeInit
String ID: `)u$c:\agent\_work\79\s\src\libs\dutil\xmlutil.cpp
API String ID: 760788290-2301883107
Opcode ID: 4b32f6e5f0cd147981e5062d1fe95b11ad6bdf8d46a6acbfccdc858d2a90d5fd
Instruction ID: 6a5215f5e66dc29f890c775430e9aaf84da4ad4d87b46b81a5c62137d83b8023
Opcode Fuzzy Hash: 4b32f6e5f0cd147981e5062d1fe95b11ad6bdf8d46a6acbfccdc858d2a90d5fd
Instruction Fuzzy Hash: A3218076900215BBCF21DBA4C848EAFBBB9BF84B62F11415CFD05AB610D7319E05CBA0

Function 00A50B93 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 72COMMON

Download Yara Rule

APIs

OpenProcessToken.ADVAPI32(?,00000008,?,?,?,?,?,?,00A28214,00000000), ref: 00A50BB1
GetLastError.KERNEL32(?,?,?,00A28214,00000000), ref: 00A50BBB
GetTokenInformation.KERNELBASE(?,00000014(TokenIntegrityLevel),?,00000004,?,?,?,?,00A28214,00000000), ref: 00A50BED
GetLastError.KERNEL32(?,?,?,00A28214,00000000), ref: 00A50C06
CloseHandle.KERNELBASE(?,?,?,?,00A28214,00000000), ref: 00A50C45

Strings

c:\agent\_work\79\s\src\libs\dutil\procutil.cpp, xrefs: 00A50C33

Memory Dump Source

Source File: 00000003.00000002.3297635874.0000000000A11000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00A10000, based on PE: true

Associated: 00000003.00000002.3297603093.0000000000A10000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.3297783757.0000000000A5B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.3297848804.0000000000A7B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.3297905107.0000000000A7E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_a10000_EMA3D.jbxd

Similarity

API ID: ErrorLastToken$CloseHandleInformationOpenProcess
String ID: c:\agent\_work\79\s\src\libs\dutil\procutil.cpp
API String ID: 4040495316-1009431558
Opcode ID: e48bc853f716c510dea47ff26394f3e1197a96e0e937e9e2f62eed222d9c56be
Instruction ID: ee7e979483c6c57dc8c9a85e2fa43af6d1ca0d2aa897dfd35ee1afb6126c90df
Opcode Fuzzy Hash: e48bc853f716c510dea47ff26394f3e1197a96e0e937e9e2f62eed222d9c56be
Instruction Fuzzy Hash: 6121A172D10629EBDB219B999D44F9EBBB8FF11713F014156ED15BB290D3708E04DAA0

Function 00A53819 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 33COMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 00A53828
InterlockedIncrement.KERNEL32(00A7C7B4), ref: 00A53845
CLSIDFromProgID.COMBASE(Msxml2.DOMDocument,00A7C7A0,?,?,?,?,?,?), ref: 00A53860
CLSIDFromProgID.OLE32(MSXML.DOMDocument,00A7C7A0,?,?,?,?,?,?), ref: 00A5386C

Strings

Msxml2.DOMDocument, xrefs: 00A5385B
MSXML.DOMDocument, xrefs: 00A53867

Memory Dump Source

Source File: 00000003.00000002.3297635874.0000000000A11000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00A10000, based on PE: true

Associated: 00000003.00000002.3297603093.0000000000A10000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.3297783757.0000000000A5B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.3297848804.0000000000A7B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.3297905107.0000000000A7E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_a10000_EMA3D.jbxd

Similarity

API ID: FromProg$IncrementInitializeInterlocked
String ID: MSXML.DOMDocument$Msxml2.DOMDocument
API String ID: 2109125048-2356320334
Opcode ID: ee18427fdeabd22b8c6f0fccb6ebe760da06667b76373081a64dbcd62982a1d1
Instruction ID: 6b87039f733e6d7ffff504cf9de6f0f8ab8ef88fdde8b5163d2504f1f9517a8b
Opcode Fuzzy Hash: ee18427fdeabd22b8c6f0fccb6ebe760da06667b76373081a64dbcd62982a1d1
Instruction Fuzzy Hash: 4FF0373274426166DB184BE5AC04B2B2995BBC1BE3F50942EFC48D5164D770D9868AB0

Function 00A54CDB Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 98memoryCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,00000000,00000000,00000000,00000000,00000001), ref: 00A54D0C
GlobalAlloc.KERNEL32(00000000,00000000,?,00000000,00000000,00000000,00000000,00000001), ref: 00A54D39
GetLastError.KERNEL32(?,00000000,?,00000000), ref: 00A54D65
GetLastError.KERNEL32(00000000,00A5B800,?,00000000,?,00000000,?,00000000), ref: 00A54DA3
GlobalFree.KERNEL32(00000000), ref: 00A54DD4

Strings

c:\agent\_work\79\s\src\libs\dutil\fileutil.cpp, xrefs: 00A54D27, 00A54D80

Memory Dump Source

Source File: 00000003.00000002.3297635874.0000000000A11000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00A10000, based on PE: true

Associated: 00000003.00000002.3297603093.0000000000A10000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.3297783757.0000000000A5B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.3297848804.0000000000A7B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.3297905107.0000000000A7E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_a10000_EMA3D.jbxd

Similarity

API ID: ErrorLast$Global$AllocFree
String ID: c:\agent\_work\79\s\src\libs\dutil\fileutil.cpp
API String ID: 1145190524-3405085980
Opcode ID: 315c7780450fca9b5614b20e2bf36dd3c32474a1f1c63d2bf6ed937c2f01b2fa
Instruction ID: 2f807254f3c4a1c11bd7fef07fbb3c8bf17ee78709fd69a0c987ab940ede35c6
Opcode Fuzzy Hash: 315c7780450fca9b5614b20e2bf36dd3c32474a1f1c63d2bf6ed937c2f01b2fa
Instruction Fuzzy Hash: B731E537900229BBDB22DB988D01EEFBAB8BF49756F114265FD04EB241E730DD4486E0

Function 00A2E7CC Relevance: 9.1, APIs: 6, Instructions: 85windowCOMMON

Download Yara Rule

APIs

DefWindowProcW.USER32(?,00000082,?,?), ref: 00A2E7FB
SetWindowLongW.USER32(?,000000EB,00000000), ref: 00A2E80A
SetWindowLongW.USER32(?,000000EB,?), ref: 00A2E81E
DefWindowProcW.USER32(?,?,?,?), ref: 00A2E82E
GetWindowLongW.USER32(?,000000EB), ref: 00A2E848
PostQuitMessage.USER32(00000000), ref: 00A2E8A7

Memory Dump Source

Source File: 00000003.00000002.3297635874.0000000000A11000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00A10000, based on PE: true

Associated: 00000003.00000002.3297603093.0000000000A10000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.3297783757.0000000000A5B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.3297848804.0000000000A7B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.3297905107.0000000000A7E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_a10000_EMA3D.jbxd

Similarity

API ID: Window$Long$Proc$MessagePostQuit
String ID:
API String ID: 3812958022-0
Opcode ID: 1e71750904c02cd5b105a84225d10152d04dd97097c95775cc5f8ac9b4050a1b
Instruction ID: f91cefc1fe5ba05ac4e24c7e3f517c6bee415f1fee7d3742707d93e3d0b947cc
Opcode Fuzzy Hash: 1e71750904c02cd5b105a84225d10152d04dd97097c95775cc5f8ac9b4050a1b
Instruction Fuzzy Hash: 9621B036100224BFDF059FA8EC48E6A3B65FF45322F148624F906AA2B0C731DD60DBA0

Function 00A30851 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 101COMMON

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?), ref: 00A308F7
GetLastError.KERNEL32(?,?,?), ref: 00A30901

Strings

Invalid seek type., xrefs: 00A3088D
c:\agent\_work\79\s\src\burn\engine\cabextract.cpp, xrefs: 00A30925
Failed to move file pointer 0x%x bytes., xrefs: 00A30932

Memory Dump Source

Source File: 00000003.00000002.3297635874.0000000000A11000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00A10000, based on PE: true

Associated: 00000003.00000002.3297603093.0000000000A10000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.3297783757.0000000000A5B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.3297848804.0000000000A7B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.3297905107.0000000000A7E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_a10000_EMA3D.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID: Failed to move file pointer 0x%x bytes.$Invalid seek type.$c:\agent\_work\79\s\src\burn\engine\cabextract.cpp
API String ID: 2976181284-3594109541
Opcode ID: 8f04636d71ea41ee731b8be0876856042fbbc7bec0ea37d9a3654a0c4c00df95
Instruction ID: 3c2440cb85a73f8585fe6f76522f8725209f3742644f6a379f96323fbfdd6b77
Opcode Fuzzy Hash: 8f04636d71ea41ee731b8be0876856042fbbc7bec0ea37d9a3654a0c4c00df95
Instruction Fuzzy Hash: A1317E72A0021AFFDB04DFA8C995E9EB7B9FB04724F048115F914E7251E330EA108BE0

Function 00A51F63 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 44libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(SRSetRestorePointW,srclient.dll), ref: 00A51F8E
GetLastError.KERNEL32(?,00A14A21,00000001,?,?,00A1459E,?,?,?,?,00A154A3,?,?,?,?), ref: 00A51F9D

Strings

srclient.dll, xrefs: 00A51F6C
SRSetRestorePointW, xrefs: 00A51F83
c:\agent\_work\79\s\src\libs\dutil\srputil.cpp, xrefs: 00A51FBE

Memory Dump Source

Source File: 00000003.00000002.3297635874.0000000000A11000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00A10000, based on PE: true

Associated: 00000003.00000002.3297603093.0000000000A10000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.3297783757.0000000000A5B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.3297848804.0000000000A7B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.3297905107.0000000000A7E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_a10000_EMA3D.jbxd

Similarity

API ID: AddressErrorLastProc
String ID: SRSetRestorePointW$c:\agent\_work\79\s\src\libs\dutil\srputil.cpp$srclient.dll
API String ID: 199729137-3932515841
Opcode ID: c9162149ab11a806ac7e38297d3e8e5bddebb260dde8335b11c10b8dfccd9217
Instruction ID: 9dbe7cb3131c895b23ed8221adf92d4011c55d8ccb9e120c633b81af0bc73777
Opcode Fuzzy Hash: c9162149ab11a806ac7e38297d3e8e5bddebb260dde8335b11c10b8dfccd9217
Instruction Fuzzy Hash: 9D018633A50A72A3D73267D99D06B766A54BB00767F018627FD04AA251DB74CC8CC6E1

Function 00A138D1 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 79libraryCOMMON

Download Yara Rule

APIs

GetSystemDirectoryW.KERNEL32(?,00000104), ref: 00A13910
GetLastError.KERNEL32 ref: 00A1391A
LoadLibraryW.KERNELBASE(?,?,00000104,?), ref: 00A13983

Strings

_`AB, xrefs: 00A138DA

Memory Dump Source

Source File: 00000003.00000002.3297635874.0000000000A11000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00A10000, based on PE: true

Associated: 00000003.00000002.3297603093.0000000000A10000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.3297783757.0000000000A5B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.3297848804.0000000000A7B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.3297905107.0000000000A7E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_a10000_EMA3D.jbxd

Similarity

API ID: DirectoryErrorLastLibraryLoadSystem
String ID: _`AB
API String ID: 1230559179-2337101104
Opcode ID: b529d8ad2b231acb28d14639eb7078b1fc84f9b6a76322d23be4e4d5349d29ff
Instruction ID: 5b3b4708299409f81cbd3174664592aee2c84164154c5c76e78637c11809b20d
Opcode Fuzzy Hash: b529d8ad2b231acb28d14639eb7078b1fc84f9b6a76322d23be4e4d5349d29ff
Instruction Fuzzy Hash: 5621B3B7D0133967DF20DFA49C59FDE77A8AB00761F1502A1BD15E7281E670DE8486A0

Function 00A307BC Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 54fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00A311D6: SetFilePointerEx.KERNELBASE(?,?,?,00000000,00000000,?,?,?,00000000,?,00A307EB,?,?,?), ref: 00A311FE
Part of subcall function 00A311D6: GetLastError.KERNEL32(?,00A307EB,?,?,?), ref: 00A31208

ReadFile.KERNELBASE(?,?,?,?,00000000,?,?,?), ref: 00A307F9
GetLastError.KERNEL32 ref: 00A30803

Strings

Failed to read during cabinet extraction., xrefs: 00A30831
c:\agent\_work\79\s\src\burn\engine\cabextract.cpp, xrefs: 00A30827

Memory Dump Source

Source File: 00000003.00000002.3297635874.0000000000A11000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00A10000, based on PE: true

Associated: 00000003.00000002.3297603093.0000000000A10000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.3297783757.0000000000A5B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.3297848804.0000000000A7B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.3297905107.0000000000A7E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_a10000_EMA3D.jbxd

Similarity

API ID: ErrorFileLast$PointerRead
String ID: Failed to read during cabinet extraction.$c:\agent\_work\79\s\src\burn\engine\cabextract.cpp
API String ID: 2170121939-535368954
Opcode ID: 2fc5d89d9e2b0b280da0f3dddc6b2699b260336cf1e660dd10badd4442b710d5
Instruction ID: 01e48231d585ea44e26d308258c90ac29cc0108214515fdb87e263923cce3d50
Opcode Fuzzy Hash: 2fc5d89d9e2b0b280da0f3dddc6b2699b260336cf1e660dd10badd4442b710d5
Instruction Fuzzy Hash: 6301A132A10229BBCB21DFA9DD05E8A7BA8FF45765F014114FE04E7290D330D901CAE0

Function 00A311D6 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 47COMMON

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE(?,?,?,00000000,00000000,?,?,?,00000000,?,00A307EB,?,?,?), ref: 00A311FE
GetLastError.KERNEL32(?,00A307EB,?,?,?), ref: 00A31208

Strings

c:\agent\_work\79\s\src\burn\engine\cabextract.cpp, xrefs: 00A3122C
Failed to move to virtual file pointer., xrefs: 00A31236

Memory Dump Source

Source File: 00000003.00000002.3297635874.0000000000A11000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00A10000, based on PE: true

Associated: 00000003.00000002.3297603093.0000000000A10000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.3297783757.0000000000A5B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.3297848804.0000000000A7B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.3297905107.0000000000A7E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_a10000_EMA3D.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID: Failed to move to virtual file pointer.$c:\agent\_work\79\s\src\burn\engine\cabextract.cpp
API String ID: 2976181284-2647110642
Opcode ID: 049550c0788756753fcd2267bbf4dd26fe099033a71a10c23dd2bc014ddd44c0
Instruction ID: 918c56f761d58fb68651cae1e8f98d3ddd4b743143fda0696e784aa7998b0353
Opcode Fuzzy Hash: 049550c0788756753fcd2267bbf4dd26fe099033a71a10c23dd2bc014ddd44c0
Instruction Fuzzy Hash: D201843361063AB7D7215BD59C059CBBF25BF40B72B118125BE18A6150EB25981086E0

Function 00A15160 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(burn.clean.room,?,?,?,?,00A11104,?,?,00000000), ref: 00A1517F
CompareStringW.KERNELBASE(0000007F,00000001,?,0000000F,burn.clean.room,0000000F,?,?,?,?,00A11104,?,?,00000000), ref: 00A151AF

Strings

burn.clean.room, xrefs: 00A1516C, 00A15179, 00A151A6

Memory Dump Source

Source File: 00000003.00000002.3297635874.0000000000A11000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00A10000, based on PE: true

Associated: 00000003.00000002.3297603093.0000000000A10000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.3297783757.0000000000A5B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.3297848804.0000000000A7B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.3297905107.0000000000A7E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_a10000_EMA3D.jbxd

Similarity

API ID: CompareStringlstrlen
String ID: burn.clean.room
API String ID: 1433953587-3055529264
Opcode ID: 760e6cadd1086197719a4ee1c7ba11c858327920295ed099dda3a758b8092934
Instruction ID: b5d5955a7bf5d9a542e5f621946c2aadcfa219216b304f10e67c362c22901905
Opcode Fuzzy Hash: 760e6cadd1086197719a4ee1c7ba11c858327920295ed099dda3a758b8092934
Instruction Fuzzy Hash: 5501D6B2910620FB83219BA8AC88FF3BBADFB997917104215E908C3210C3619CC1C6B0

Function 00A13AA4 Relevance: 4.5, APIs: 3, Instructions: 21memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000000,00000000,?,00A505D9,00000000,?,?,00000000,00000000,8000FFFF,?,?,?,00A5056D,?), ref: 00A13AAE
RtlFreeHeap.NTDLL(00000000,?,00A505D9,00000000,?,?,00000000,00000000,8000FFFF,?,?,?,00A5056D,?,?,?), ref: 00A13AB5
GetLastError.KERNEL32(?,00A505D9,00000000,?,?,00000000,00000000,8000FFFF,?,?,?,00A5056D,?,?,?), ref: 00A13ABF

Memory Dump Source

Source File: 00000003.00000002.3297635874.0000000000A11000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00A10000, based on PE: true

Associated: 00000003.00000002.3297603093.0000000000A10000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.3297783757.0000000000A5B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.3297848804.0000000000A7B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.3297905107.0000000000A7E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_a10000_EMA3D.jbxd

Similarity

API ID: Heap$ErrorFreeLastProcess
String ID:
API String ID: 406640338-0
Opcode ID: 4d5fde84e0e0787e3fe374f4f696478d439439ae178efe593f805e8b7f4f526d
Instruction ID: f27610eaacff736d52deb42c121f8646f3d17ab042af822382337883db736874
Opcode Fuzzy Hash: 4d5fde84e0e0787e3fe374f4f696478d439439ae178efe593f805e8b7f4f526d
Instruction Fuzzy Hash: 6DD01273A10635578A219BE65C0C9DBBE58FF146E3B010121FD44EB250DB26CD4197F4

Function 00A53877 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 100COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00A538AC

Part of subcall function 00A5330F: GetModuleHandleA.KERNEL32(kernel32.dll,00000000,00000000,00A538BD,00000000,?,00000000), ref: 00A53329
Part of subcall function 00A5330F: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,00A3BD36,?,00A15442,?,00000000,?), ref: 00A53335

Strings

_`AB, xrefs: 00A5387D

Memory Dump Source

Source File: 00000003.00000002.3297635874.0000000000A11000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00A10000, based on PE: true

Associated: 00000003.00000002.3297603093.0000000000A10000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.3297783757.0000000000A5B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.3297848804.0000000000A7B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.3297905107.0000000000A7E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_a10000_EMA3D.jbxd

Similarity

API ID: ErrorHandleInitLastModuleVariant
String ID: _`AB
API String ID: 52713655-2337101104
Opcode ID: e2cf6622d1902e5ddf74c1764d3d04dd0bd823cd9857be06e10e63e7511c9bec
Instruction ID: 8ffb74dc3bfe1a152c434a8bad7eb9392aa5bbc8b91c9a89747b61467088cc3b
Opcode Fuzzy Hash: e2cf6622d1902e5ddf74c1764d3d04dd0bd823cd9857be06e10e63e7511c9bec
Instruction Fuzzy Hash: A2312F76D01629DBCB01DFA8C884ADEB7B4FF48761F014566ED15FB311D6709D048BA0

Function 00A51275 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 39registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(00000000,00000000,00000000,00000000,00000001,00A7BB7C,00000000,?,00A55A32,80000002,00000000,00020019,00000000,SOFTWARE\Policies\,00000000,00000000), ref: 00A51289

Strings

c:\agent\_work\79\s\src\libs\dutil\regutil.cpp, xrefs: 00A512C6

Memory Dump Source

Source File: 00000003.00000002.3297635874.0000000000A11000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00A10000, based on PE: true

Associated: 00000003.00000002.3297603093.0000000000A10000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.3297783757.0000000000A5B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.3297848804.0000000000A7B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.3297905107.0000000000A7E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_a10000_EMA3D.jbxd

Similarity

API ID: Open
String ID: c:\agent\_work\79\s\src\libs\dutil\regutil.cpp
API String ID: 71445658-1128744096
Opcode ID: 64a14ae3f285a0f2d51edaa5ec36c2eda206c7be34d1f2334b62c85112a4e17b
Instruction ID: 1857c65c832c7f3f44d41e91ea63b8b44e48932ed772a5ca45f09602b6493d13
Opcode Fuzzy Hash: 64a14ae3f285a0f2d51edaa5ec36c2eda206c7be34d1f2334b62c85112a4e17b
Instruction Fuzzy Hash: 96F02432B00226738B310A968C04BFB7E95FB803F2F158035BD08DB220E571CC1187E5

Function 00A47DA6 Relevance: 3.1, APIs: 2, Instructions: 100COMMON

Download Yara Rule

APIs

Part of subcall function 00A47B4B: GetOEMCP.KERNEL32(00000000,00A47DC1,00000000,00000000,00A41641,00A41641,00000000,75A8B38F,00000000), ref: 00A47B76

_free.LIBCMT ref: 00A47E1E
_free.LIBCMT ref: 00A47E54

Memory Dump Source

Source File: 00000003.00000002.3297635874.0000000000A11000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00A10000, based on PE: true

Associated: 00000003.00000002.3297603093.0000000000A10000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.3297783757.0000000000A5B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.3297848804.0000000000A7B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.3297905107.0000000000A7E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_a10000_EMA3D.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 5cbaa13baac9bb722ab256b147c69cb01242ac5f6459633f296232b6f56c02ce
Instruction ID: 080e23bca10ebffa4b02f6ad552fc90ab5c66b8e657a23b480beaf21938d9332
Opcode Fuzzy Hash: 5cbaa13baac9bb722ab256b147c69cb01242ac5f6459633f296232b6f56c02ce
Instruction Fuzzy Hash: 2131F275808289AFCB00DFA8C882B9E7BF4EF84310F1145A9F915972A1EB32DD51CB60

Function 00A139DF Relevance: 3.0, APIs: 2, Instructions: 13memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(?,?,?,00A1237C,?,00000001,75A8B390,8000FFFF,?,?,00A5058B,?,?,00000000,00000000,8000FFFF), ref: 00A139F0
RtlAllocateHeap.NTDLL(00000000,?,00A1237C,?,00000001,75A8B390,8000FFFF,?,?,00A5058B,?,?,00000000,00000000,8000FFFF), ref: 00A139F7

Memory Dump Source

Source File: 00000003.00000002.3297635874.0000000000A11000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00A10000, based on PE: true

Associated: 00000003.00000002.3297603093.0000000000A10000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.3297783757.0000000000A5B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.3297848804.0000000000A7B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.3297905107.0000000000A7E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_a10000_EMA3D.jbxd

Similarity

API ID: Heap$AllocateProcess
String ID:
API String ID: 1357844191-0
Opcode ID: c30535802b62bad6a673377fe0085607eb625f1feaf7ee22402b570b62b46913
Instruction ID: 808b561482f860517ecc13c7ca59f8fdbeddd20aa04ca8e776d0c4a018822002
Opcode Fuzzy Hash: c30535802b62bad6a673377fe0085607eb625f1feaf7ee22402b570b62b46913
Instruction Fuzzy Hash: 0BC012321A030CAB8B00AFF8EC0EC9A3BACBB28603B008600B905C7160C738E0518B70

Function 00A55ABD Relevance: 1.6, APIs: 1, Instructions: 59registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32(00000000,00000000,00000000,00A7BB7C,00000000,00000000,?,?,00A28A07,WiX\Burn,PackageCache,00000000,00A7BB7C,00000000,00000000,00000000), ref: 00A55B17

Part of subcall function 00A513B0: RegQueryValueExW.ADVAPI32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000002,00000001,00000000,00000000,00000000,00000000,00000000), ref: 00A51426
Part of subcall function 00A513B0: RegQueryValueExW.ADVAPI32(?,00000000,00000000,?,00000000,00000000,00000000,?), ref: 00A5145E

Memory Dump Source

Source File: 00000003.00000002.3297635874.0000000000A11000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00A10000, based on PE: true

Associated: 00000003.00000002.3297603093.0000000000A10000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.3297783757.0000000000A5B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.3297848804.0000000000A7B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.3297905107.0000000000A7E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_a10000_EMA3D.jbxd

Similarity

API ID: QueryValue$Close
String ID:
API String ID: 1979452859-0
Opcode ID: 28183aa21deb5eb552aea20f009ab2ec2f84a2ed498a3a2888e30a923c454336
Instruction ID: 28abf045c94edaf959a9f0abc967a42ab090de2781eeda6e609beed436d30113
Opcode Fuzzy Hash: 28183aa21deb5eb552aea20f009ab2ec2f84a2ed498a3a2888e30a923c454336
Instruction Fuzzy Hash: 8A118636C00629EBCF215FB8CD699AEF7A5FB04362B164139ED4267120E3354D54D7D0

Function 00A45F99 Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,?,?,?,00A47DE3,00000220,00000000,?,75A8B38F,?,?,?,00A41641,00000000,75A8B38F,00000000), ref: 00A45FCB

Memory Dump Source

Source File: 00000003.00000002.3297635874.0000000000A11000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00A10000, based on PE: true

Associated: 00000003.00000002.3297603093.0000000000A10000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.3297783757.0000000000A5B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.3297848804.0000000000A7B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.3297905107.0000000000A7E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_a10000_EMA3D.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 36b8c52e456fddf79379efe86110f884feaabf626d9f73267ce15e2b9b5c4d26
Instruction ID: 361296596299a884e80de325ce5e3929727f558ddffd84811c21a28ca6df9f77
Opcode Fuzzy Hash: 36b8c52e456fddf79379efe86110f884feaabf626d9f73267ce15e2b9b5c4d26
Instruction Fuzzy Hash: 90E0E539A01E1057DA2127B55C04B6A765CAFC27A0F110130AE45DA082CB60CC0989A2

Function 00A135A8 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

SHGetFolderPathW.SHELL32(00000000,00000000,00000000,00000000,00000000,00000000,00000104,00000000,?,00A28AC1,0000001C,00000000,00000000,00000000,00000000), ref: 00A135C8

Memory Dump Source

Source File: 00000003.00000002.3297635874.0000000000A11000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00A10000, based on PE: true

Associated: 00000003.00000002.3297603093.0000000000A10000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.3297783757.0000000000A5B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.3297848804.0000000000A7B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.3297905107.0000000000A7E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_a10000_EMA3D.jbxd

Similarity

API ID: FolderPath
String ID:
API String ID: 1514166925-0
Opcode ID: d41c07dc50ff69f23ead86dd0c1238925091732ae30625bf822ecac2251ac09d
Instruction ID: c91589eac736ceeff3c08ed97d3ad8db0ff509f726bc1e66cbc1fe773f975ccf
Opcode Fuzzy Hash: d41c07dc50ff69f23ead86dd0c1238925091732ae30625bf822ecac2251ac09d
Instruction Fuzzy Hash: A1E017723412247BAB016EA99D05DEB7B9DEF19BA2B004011FF44EA400DB61EA9157B0

Function 00A4F7A9 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00A4F7A0

Part of subcall function 00A59B04: DloadAcquireSectionWriteAccess.DELAYIMP ref: 00A59B0F
Part of subcall function 00A59B04: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00A59B77
Part of subcall function 00A59B04: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00A59B88

Memory Dump Source

Source File: 00000003.00000002.3297635874.0000000000A11000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00A10000, based on PE: true

Associated: 00000003.00000002.3297603093.0000000000A10000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.3297783757.0000000000A5B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.3297848804.0000000000A7B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.3297905107.0000000000A7E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_a10000_EMA3D.jbxd

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
String ID:
API String ID: 697777088-0
Opcode ID: 545576f98a6f9115df4b20f337c63400f4e3c7a360411fd562b54108b4890f05
Instruction ID: 7f47cedf6bad0338c54fb901f2c9f1e19d0177272b2f941671303635c2fc21df
Opcode Fuzzy Hash: 545576f98a6f9115df4b20f337c63400f4e3c7a360411fd562b54108b4890f05
Instruction Fuzzy Hash: BBB012F52A8001BD324461082E06D37025CD0C0B21330D82AB408C4040EC684C454432

Function 00A4F7B9 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00A4F7A0

Part of subcall function 00A59B04: DloadAcquireSectionWriteAccess.DELAYIMP ref: 00A59B0F
Part of subcall function 00A59B04: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00A59B77
Part of subcall function 00A59B04: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00A59B88

Memory Dump Source

Source File: 00000003.00000002.3297635874.0000000000A11000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00A10000, based on PE: true

Associated: 00000003.00000002.3297603093.0000000000A10000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.3297783757.0000000000A5B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.3297848804.0000000000A7B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.3297905107.0000000000A7E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_a10000_EMA3D.jbxd

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
String ID:
API String ID: 697777088-0
Opcode ID: 753ee56c3d626f3514b16c54af2b6677c0ca436fa0780944f041d5cdb1fffb4b
Instruction ID: 745ccae274d8191bc3752d3f25b634915a3339d2c38c5577312f427b6bc3b730
Opcode Fuzzy Hash: 753ee56c3d626f3514b16c54af2b6677c0ca436fa0780944f041d5cdb1fffb4b
Instruction Fuzzy Hash: 1FB012F52A8101BD324461083D0AD37015CD0C0B31330D92AB408C4040E8684C844532

Function 00A4F788 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00A4F7A0

Part of subcall function 00A59B04: DloadAcquireSectionWriteAccess.DELAYIMP ref: 00A59B0F
Part of subcall function 00A59B04: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00A59B77
Part of subcall function 00A59B04: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00A59B88

Memory Dump Source

Source File: 00000003.00000002.3297635874.0000000000A11000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00A10000, based on PE: true

Associated: 00000003.00000002.3297603093.0000000000A10000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.3297783757.0000000000A5B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.3297848804.0000000000A7B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.3297905107.0000000000A7E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_a10000_EMA3D.jbxd

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
String ID:
API String ID: 697777088-0
Opcode ID: 449d9dd3561913765c9d5dae6f9bcce412c980db099287ce065e0476708c733a
Instruction ID: ef94a7b9a75a2a820a6dcc532ee0dc16978d05941bfe922aa8bac3ce8cf376ea
Opcode Fuzzy Hash: 449d9dd3561913765c9d5dae6f9bcce412c980db099287ce065e0476708c733a
Instruction Fuzzy Hash: FFB012F52F8101BD324421042D06C37011CD1D0B22330D82AB80CC4040F8684C444432

Function 00A5983F Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00A59836

Part of subcall function 00A59B04: DloadAcquireSectionWriteAccess.DELAYIMP ref: 00A59B0F
Part of subcall function 00A59B04: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00A59B77
Part of subcall function 00A59B04: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00A59B88

Memory Dump Source

Source File: 00000003.00000002.3297635874.0000000000A11000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00A10000, based on PE: true

Associated: 00000003.00000002.3297603093.0000000000A10000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.3297783757.0000000000A5B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.3297848804.0000000000A7B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.3297905107.0000000000A7E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_a10000_EMA3D.jbxd

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
String ID:
API String ID: 697777088-0
Opcode ID: 50dacc4a89885008250ca99169dcd3ae3f01f8df89c3ff56d7d6a61b1baa8945
Instruction ID: 25bcb9f6965821b74a1404ba784d8687276f8cd0eec9e26bc9003bb99ebd4c64
Opcode Fuzzy Hash: 50dacc4a89885008250ca99169dcd3ae3f01f8df89c3ff56d7d6a61b1baa8945
Instruction Fuzzy Hash: 70B012F92BC001FD3248A1042D07D3B011CE5C0B23330D42ABC09C8041F8500C0C4032

Function 00A5981E Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00A59836

Part of subcall function 00A59B04: DloadAcquireSectionWriteAccess.DELAYIMP ref: 00A59B0F
Part of subcall function 00A59B04: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00A59B77
Part of subcall function 00A59B04: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00A59B88

Memory Dump Source

Source File: 00000003.00000002.3297635874.0000000000A11000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00A10000, based on PE: true

Associated: 00000003.00000002.3297603093.0000000000A10000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.3297783757.0000000000A5B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.3297848804.0000000000A7B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.3297905107.0000000000A7E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_a10000_EMA3D.jbxd

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
String ID:
API String ID: 697777088-0
Opcode ID: 5c282593143e52928a92cc0247dcdd53336e334f3ee04d52d499f29c31938a74
Instruction ID: c1c53dc884ee1a32d7a68e49503c3829a23d5e3cbb2734c732f27a19b1eb8b6b
Opcode Fuzzy Hash: 5c282593143e52928a92cc0247dcdd53336e334f3ee04d52d499f29c31938a74
Instruction Fuzzy Hash: 9AB012F92AC109FD321821002E47C3B011DF1C1B33330C43AB806C8041A8500C484032

Function 00A5984F Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00A59836

Part of subcall function 00A59B04: DloadAcquireSectionWriteAccess.DELAYIMP ref: 00A59B0F
Part of subcall function 00A59B04: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00A59B77
Part of subcall function 00A59B04: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00A59B88

Memory Dump Source

Source File: 00000003.00000002.3297635874.0000000000A11000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00A10000, based on PE: true

Associated: 00000003.00000002.3297603093.0000000000A10000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.3297783757.0000000000A5B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.3297848804.0000000000A7B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.3297905107.0000000000A7E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_a10000_EMA3D.jbxd

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
String ID:
API String ID: 697777088-0
Opcode ID: 4c246ef32a78875a012fbe48e1a697c8a6e3ea43cf9ae730448b6a2d1eabd6fa
Instruction ID: 4a89d8f6480a3a84aca06bdf770cf66f53986ecfa9a8c0c37f1f20f5abcfdc82
Opcode Fuzzy Hash: 4c246ef32a78875a012fbe48e1a697c8a6e3ea43cf9ae730448b6a2d1eabd6fa
Instruction Fuzzy Hash: 35B012F92AC201FD324861043E07D3B021CE0C0B23330C41AB809C9041EC500C094032

Function 00A114AC Relevance: 1.3, APIs: 1, Instructions: 52stringCOMMONLIBRARYCODE

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,?,00000000,00000004,?,00A122B1,00000000,?,?,00000000,?,00A4FAC7,?,00A5B534,?,?), ref: 00A114DC

Part of subcall function 00A13C5F: GetProcessHeap.KERNEL32(00000000,?,?,00A122D5,?,75A8B390,8000FFFF,?,?,00A5058B,?,?,00000000,00000000,8000FFFF), ref: 00A13C67
Part of subcall function 00A13C5F: HeapSize.KERNEL32(00000000,?,00A122D5,?,75A8B390,8000FFFF,?,?,00A5058B,?,?,00000000,00000000,8000FFFF), ref: 00A13C6E

Memory Dump Source

Source File: 00000003.00000002.3297635874.0000000000A11000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00A10000, based on PE: true

Associated: 00000003.00000002.3297603093.0000000000A10000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.3297783757.0000000000A5B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.3297848804.0000000000A7B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.3297905107.0000000000A7E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_a10000_EMA3D.jbxd

Similarity

API ID: Heap$ProcessSizelstrlen
String ID:
API String ID: 3492610842-0
Opcode ID: 0a9bc20b577574008a446ed869da8a82f1bf20f1ba18b7b4072ebe207b7929d4
Instruction ID: 86488c14d1392570b4d351a9034fcee22c1d6b531440fb848e9b80aea57cfa67
Opcode Fuzzy Hash: 0a9bc20b577574008a446ed869da8a82f1bf20f1ba18b7b4072ebe207b7929d4
Instruction Fuzzy Hash: 0A01D832100124BBCF116F55DC80FCA7B6AAF41BB0F104111FF156B191C770AD8096A1

Non-executed Functions

Function 00A3C041 Relevance: 37.1, APIs: 1, Strings: 20, Instructions: 375COMMON

Download Yara Rule

Strings

Failed to copy local source path for pseudo bundle., xrefs: 00A3C149
Failed to allocate space for burn package payload inside of related bundle struct, xrefs: 00A3C093
c:\agent\_work\79\s\src\burn\engine\pseudobundle.cpp, xrefs: 00A3C087, 00A3C0C0, 00A3C1AF, 00A3C3E0
Failed to append relation type to install arguments for related bundle package, xrefs: 00A3C2B6
-%ls, xrefs: 00A3C05E
Failed to copy repair arguments for related bundle package, xrefs: 00A3C2DE
Failed to copy display name for pseudo bundle., xrefs: 00A3C45D
Failed to copy download source for pseudo bundle., xrefs: 00A3C177
Failed to copy version for pseudo bundle., xrefs: 00A3C43B
Failed to allocate space for burn payload inside of related bundle struct, xrefs: 00A3C0CC
Failed to append relation type to uninstall arguments for related bundle package, xrefs: 00A3C352
Failed to append relation type to repair arguments for related bundle package, xrefs: 00A3C2FF
Failed to copy install arguments for related bundle package, xrefs: 00A3C295
Failed to allocate memory for dependency providers., xrefs: 00A3C3EC
Failed to copy key for pseudo bundle payload., xrefs: 00A3C101
Failed to allocate memory for pseudo bundle payload hash., xrefs: 00A3C1BB
Failed to copy cache id for pseudo bundle., xrefs: 00A3C26D
Failed to copy uninstall arguments for related bundle package, xrefs: 00A3C331
Failed to copy key for pseudo bundle., xrefs: 00A3C24E
Failed to copy filename for pseudo bundle., xrefs: 00A3C125

Memory Dump Source

Source File: 00000003.00000002.3297635874.0000000000A11000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00A10000, based on PE: true

Associated: 00000003.00000002.3297603093.0000000000A10000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.3297783757.0000000000A5B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.3297848804.0000000000A7B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.3297905107.0000000000A7E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_a10000_EMA3D.jbxd

Similarity

API ID: Heap$AllocateProcess
String ID: -%ls$Failed to allocate memory for dependency providers.$Failed to allocate memory for pseudo bundle payload hash.$Failed to allocate space for burn package payload inside of related bundle struct$Failed to allocate space for burn payload inside of related bundle struct$Failed to append relation type to install arguments for related bundle package$Failed to append relation type to repair arguments for related bundle package$Failed to append relation type to uninstall arguments for related bundle package$Failed to copy cache id for pseudo bundle.$Failed to copy display name for pseudo bundle.$Failed to copy download source for pseudo bundle.$Failed to copy filename for pseudo bundle.$Failed to copy install arguments for related bundle package$Failed to copy key for pseudo bundle payload.$Failed to copy key for pseudo bundle.$Failed to copy local source path for pseudo bundle.$Failed to copy repair arguments for related bundle package$Failed to copy uninstall arguments for related bundle package$Failed to copy version for pseudo bundle.$c:\agent\_work\79\s\src\burn\engine\pseudobundle.cpp
API String ID: 1357844191-1088614172
Opcode ID: c1fa5fa66786c5a456e973a607bd4fa1775ed9fea270d51381ef5fa1c3d399db
Instruction ID: 135613b7da570ee01877eb0e2c6911ce1b93c80e16794258dcf9c0c99d92400d
Opcode Fuzzy Hash: c1fa5fa66786c5a456e973a607bd4fa1775ed9fea270d51381ef5fa1c3d399db
Instruction Fuzzy Hash: 01C1B072640652FBDB659F78CC45FAAB7A8BB04B20F008629FC05FB241D770EC609B90

Function 00A501F0 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 131threadtimeCOMMONLIBRARYCODE

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(00A7C6EC,00000000,?), ref: 00A5021E
GetCurrentProcessId.KERNEL32(00000000), ref: 00A5022E
GetCurrentThreadId.KERNEL32 ref: 00A50237
GetLocalTime.KERNEL32(?), ref: 00A5024D
LeaveCriticalSection.KERNEL32(00A7C6EC,?,?,00000000,0000FDE9), ref: 00A50344

Strings

%ls[%04X:%04X][%04hu-%02hu-%02huT%02hu:%02hu:%02hu]%hs%03d:%ls %ls%ls, xrefs: 00A502EA
_`AB, xrefs: 00A501F6

Memory Dump Source

Source File: 00000003.00000002.3297635874.0000000000A11000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00A10000, based on PE: true

Associated: 00000003.00000002.3297603093.0000000000A10000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.3297783757.0000000000A5B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.3297848804.0000000000A7B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.3297905107.0000000000A7E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_a10000_EMA3D.jbxd

Similarity

API ID: CriticalCurrentSection$EnterLeaveLocalProcessThreadTime
String ID: %ls[%04X:%04X][%04hu-%02hu-%02huT%02hu:%02hu:%02hu]%hs%03d:%ls %ls%ls$_`AB
API String ID: 296830338-2581194003
Opcode ID: 0f59599b7be3b919def9cd24664e2d3d5cafd12cfb0e5cdcdc937685c50ca3ce
Instruction ID: 0ba94c887b8a3607abb277a9c6e74d83cf3d1e3cf45dfcba9b8eeb087de28990
Opcode Fuzzy Hash: 0f59599b7be3b919def9cd24664e2d3d5cafd12cfb0e5cdcdc937685c50ca3ce
Instruction Fuzzy Hash: F4416C71900219ABDB21DFE4DC49AFF77B8FB48762F108425FA01EA190D7349D85CBA1

Function 00A3D130 Relevance: 49.3, APIs: 12, Strings: 16, Instructions: 283synchronizationprocessCOMMON

Download Yara Rule

APIs

UuidCreate.RPCRT4(?), ref: 00A3D1A5
StringFromGUID2.OLE32(?,?,00000027), ref: 00A3D1CE
CreateProcessW.KERNEL32(?,?,00000000,00000000,00000000,08000000,00000000,00000000,?,?,?,?,?,?), ref: 00A3D2B7
GetLastError.KERNEL32(?,?,?,?), ref: 00A3D2C1
WaitForMultipleObjects.KERNEL32(00000002,?,00000000,00000064,?,?,?,?), ref: 00A3D35A
WaitForSingleObject.KERNEL32(00A5B500,000000FF,?,?,?,?), ref: 00A3D365
ReleaseMutex.KERNEL32(00A5B500,?,?,?,?), ref: 00A3D38F
GetExitCodeProcess.KERNEL32(?,?), ref: 00A3D3B0
GetLastError.KERNEL32(?,?,?,?), ref: 00A3D3BE
GetLastError.KERNEL32(?,?,?,?), ref: 00A3D3F6

Part of subcall function 00A3D038: WaitForSingleObject.KERNEL32(?,000000FF,759230B0,00000000,?,?,?,00A3D334,?), ref: 00A3D057
Part of subcall function 00A3D038: ReleaseMutex.KERNEL32(?,?,?,00A3D334,?), ref: 00A3D06B
Part of subcall function 00A3D038: WaitForSingleObject.KERNEL32(?,000000FF), ref: 00A3D0B0
Part of subcall function 00A3D038: ReleaseMutex.KERNEL32(?), ref: 00A3D0C3
Part of subcall function 00A3D038: SetEvent.KERNEL32(?), ref: 00A3D0CC

CloseHandle.KERNEL32(00000000,?,?,?,?,?,?), ref: 00A3D49F
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?), ref: 00A3D4B7

Strings

NetFxEvent.%ls, xrefs: 00A3D21D
c:\agent\_work\79\s\src\burn\engine\netfxchainer.cpp, xrefs: 00A3D1E3, 00A3D2E5, 00A3D3E2, 00A3D41A
Failed to create netfx chainer guid., xrefs: 00A3D1B2
%ls /pipe %ls, xrefs: 00A3D271
Failed to convert netfx chainer guid into string., xrefs: 00A3D1ED
D, xrefs: 00A3D29C
Failed to allocate event name., xrefs: 00A3D231
NetFxSection.%ls, xrefs: 00A3D1FB
Failed to allocate section name., xrefs: 00A3D20F
Failed to wait for netfx chainer process to complete, xrefs: 00A3D424
Failed to process netfx chainer message., xrefs: 00A3D33A
_`AB, xrefs: 00A3D139
Failed to get netfx return code., xrefs: 00A3D3EC
Failed to create netfx chainer., xrefs: 00A3D250
Failed to CreateProcess on path: %ls, xrefs: 00A3D2F0
Failed to allocate netfx chainer arguments., xrefs: 00A3D285

Memory Dump Source

Source File: 00000003.00000002.3297635874.0000000000A11000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00A10000, based on PE: true

Associated: 00000003.00000002.3297603093.0000000000A10000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.3297783757.0000000000A5B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.3297848804.0000000000A7B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.3297905107.0000000000A7E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_a10000_EMA3D.jbxd

Similarity

API ID: Wait$ErrorLastMutexObjectReleaseSingle$CloseCreateHandleProcess$CodeEventExitFromMultipleObjectsStringUuid
String ID: %ls /pipe %ls$D$Failed to CreateProcess on path: %ls$Failed to allocate event name.$Failed to allocate netfx chainer arguments.$Failed to allocate section name.$Failed to convert netfx chainer guid into string.$Failed to create netfx chainer guid.$Failed to create netfx chainer.$Failed to get netfx return code.$Failed to process netfx chainer message.$Failed to wait for netfx chainer process to complete$NetFxEvent.%ls$NetFxSection.%ls$_`AB$c:\agent\_work\79\s\src\burn\engine\netfxchainer.cpp
API String ID: 1533322865-1370055583
Opcode ID: f127922b02d1105dd2a925ccf9c9cd37988e7ff725e583966c79fdc59ff28854
Instruction ID: e3ee2e391b3e50e960bbaeb5c138440d38d79c3f6906b168833975d07dfa552a
Opcode Fuzzy Hash: f127922b02d1105dd2a925ccf9c9cd37988e7ff725e583966c79fdc59ff28854
Instruction Fuzzy Hash: 7CA18A72D00328EBEB219BA8DD45BAEBBB8BB04711F118165F909FB251D7349D44CFA1

Function 00A281B2 Relevance: 33.4, APIs: 7, Strings: 12, Instructions: 152COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000000,00000000,?), ref: 00A28208

Part of subcall function 00A50B93: OpenProcessToken.ADVAPI32(?,00000008,?,?,?,?,?,?,00A28214,00000000), ref: 00A50BB1
Part of subcall function 00A50B93: GetLastError.KERNEL32(?,?,?,00A28214,00000000), ref: 00A50BBB
Part of subcall function 00A50B93: CloseHandle.KERNELBASE(?,?,?,?,00A28214,00000000), ref: 00A50C45

GetWindowsDirectoryW.KERNEL32(?,00000104,00000000), ref: 00A2822E
GetLastError.KERNEL32 ref: 00A28238
GetTempPathW.KERNEL32(00000104,?,00000000), ref: 00A282B5
GetLastError.KERNEL32 ref: 00A282BF
UuidCreate.RPCRT4(?), ref: 00A282FE

Strings

Failed to create working folder guid., xrefs: 00A2830B
Failed to copy working folder path., xrefs: 00A28383
Failed to append bundle id on to temp path for working folder., xrefs: 00A28368
Failed to get windows path for working folder., xrefs: 00A28266
c:\agent\_work\79\s\src\burn\engine\cache.cpp, xrefs: 00A2825C, 00A282E3, 00A28334
_`AB, xrefs: 00A281BB
%ls%ls\, xrefs: 00A28350
Failed to get temp path for working folder., xrefs: 00A282ED
Failed to convert working folder guid into string., xrefs: 00A2833E
Failed to ensure windows path for working folder ended in backslash., xrefs: 00A28283
Failed to concat Temp directory on windows path for working folder., xrefs: 00A282A5
Temp\, xrefs: 00A2828D

Memory Dump Source

Source File: 00000003.00000002.3297635874.0000000000A11000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00A10000, based on PE: true

Associated: 00000003.00000002.3297603093.0000000000A10000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.3297783757.0000000000A5B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.3297848804.0000000000A7B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.3297905107.0000000000A7E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_a10000_EMA3D.jbxd

Similarity

API ID: ErrorLast$Process$CloseCreateCurrentDirectoryHandleOpenPathTempTokenUuidWindows
String ID: %ls%ls\$Failed to append bundle id on to temp path for working folder.$Failed to concat Temp directory on windows path for working folder.$Failed to convert working folder guid into string.$Failed to copy working folder path.$Failed to create working folder guid.$Failed to ensure windows path for working folder ended in backslash.$Failed to get temp path for working folder.$Failed to get windows path for working folder.$Temp\$_`AB$c:\agent\_work\79\s\src\burn\engine\cache.cpp
API String ID: 266130487-3629876793
Opcode ID: b9bb800ca8fe1d3b13694fdec9b0105f99e27f806ac89ae580f8850bf46cf414
Instruction ID: b93608844f09dddddfbf33a1c8ef9c017b2278957ad71419e9d91ea8377bada3
Opcode Fuzzy Hash: b9bb800ca8fe1d3b13694fdec9b0105f99e27f806ac89ae580f8850bf46cf414
Instruction Fuzzy Hash: 4B41D676A52734B7D720D6E89D0AFDF73787B10B12F014661BD05FB180EB789D4586A0

Function 00A1F1B7 Relevance: 29.9, APIs: 3, Strings: 14, Instructions: 182registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00A53D9B: GetVersionExW.KERNEL32(?,?,?,00000000), ref: 00A53DEA

RegCloseKey.ADVAPI32(00000000,?,00A60F38,00020006,00000000,?,00000000,00000000,00000000,?,00000000,00000001,00000000,00000000), ref: 00A1F3E7

Part of subcall function 00A5178B: RegSetValueExW.ADVAPI32(?,00000005,00000000,00000004,?,00000004,00000001,?,00A1F234,00A60F38,Resume,00000005,?,00000000,00000000,00000000), ref: 00A517A0

Strings

BundleResumeCommandLine, xrefs: 00A1F2EF, 00A1F382
Failed to write run key value., xrefs: 00A1F2E2
c:\agent\_work\79\s\src\burn\engine\registration.cpp, xrefs: 00A1F36B, 00A1F3B9
burn.runonce, xrefs: 00A1F281
Failed to write Resume value., xrefs: 00A1F23A
Failed to create run key., xrefs: 00A1F2C4
Failed to format resume command line for RunOnce., xrefs: 00A1F2A0
Failed to delete run key value., xrefs: 00A1F375
Failed to delete resume command line value., xrefs: 00A1F3C3
Resume, xrefs: 00A1F229
Installed, xrefs: 00A1F24C
Failed to write Installed value., xrefs: 00A1F25D
"%ls" /%ls, xrefs: 00A1F28C
Failed to write resume command line value., xrefs: 00A1F304

Memory Dump Source

Source File: 00000003.00000002.3297635874.0000000000A11000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00A10000, based on PE: true

Associated: 00000003.00000002.3297603093.0000000000A10000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.3297783757.0000000000A5B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.3297848804.0000000000A7B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.3297905107.0000000000A7E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_a10000_EMA3D.jbxd

Similarity

API ID: CloseValueVersion
String ID: "%ls" /%ls$BundleResumeCommandLine$Failed to create run key.$Failed to delete resume command line value.$Failed to delete run key value.$Failed to format resume command line for RunOnce.$Failed to write Installed value.$Failed to write Resume value.$Failed to write resume command line value.$Failed to write run key value.$Installed$Resume$burn.runonce$c:\agent\_work\79\s\src\burn\engine\registration.cpp
API String ID: 2348918689-4238253642
Opcode ID: 6b37af0e74c5e87a9f12569f2969a3ddd5ab03dc0f1e3e646d756e0d8c19c297
Instruction ID: 62da5ef0b418dc5a43f0e9dd6a6ce99bfaa1bd286f3a44fba1caccb336be857d
Opcode Fuzzy Hash: 6b37af0e74c5e87a9f12569f2969a3ddd5ab03dc0f1e3e646d756e0d8c19c297
Instruction Fuzzy Hash: 2251F236D4076AFECF119BA4CD06AEEBA74BB00711F080536FD21BA090D7759A90AAD0

Function 00A58197 Relevance: 29.9, APIs: 8, Strings: 9, Instructions: 153stringCOMMON

Download Yara Rule

APIs

CompareStringW.KERNEL32(0000007F,00000000,msi.dll,000000FF,http://appsyndication.org/2006/appsyn,000000FF,00000000,00000000,000002C0,?,00A58681,00000001,?), ref: 00A581B7
CompareStringW.KERNEL32(0000007F,00000000,digest,000000FF,002E0069,000000FF,?,00A58681,00000001,?), ref: 00A581D2
CompareStringW.KERNEL32(0000007F,00000000,name,000000FF,002E0069,000000FF,?,00A58681,00000001,?), ref: 00A581ED
CompareStringW.KERNEL32(0000007F,00000000,algorithm,000000FF,?,000000FF,?,00A58681,00000001,?), ref: 00A58259
CompareStringW.KERNEL32(0000007F,00000001,md5,000000FF,?,000000FF,?,00A58681,00000001,?), ref: 00A5827D
CompareStringW.KERNEL32(0000007F,00000001,sha1,000000FF,?,000000FF,?,00A58681,00000001,?), ref: 00A582A1
CompareStringW.KERNEL32(0000007F,00000001,sha256,000000FF,?,000000FF,?,00A58681,00000001,?), ref: 00A582C1
lstrlenW.KERNEL32(006C0064,?,00A58681,00000001,?), ref: 00A582DC

Strings

digest, xrefs: 00A581C9
md5, xrefs: 00A58274
c:\agent\_work\79\s\src\libs\dutil\apuputil.cpp, xrefs: 00A582F4
sha1, xrefs: 00A58298
name, xrefs: 00A581E4
sha256, xrefs: 00A582B8
msi.dll, xrefs: 00A581B1
algorithm, xrefs: 00A58250
http://appsyndication.org/2006/appsyn, xrefs: 00A581AA

Memory Dump Source

Source File: 00000003.00000002.3297635874.0000000000A11000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00A10000, based on PE: true

Associated: 00000003.00000002.3297603093.0000000000A10000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.3297783757.0000000000A5B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.3297848804.0000000000A7B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.3297905107.0000000000A7E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_a10000_EMA3D.jbxd

Similarity

API ID: CompareString$lstrlen
String ID: algorithm$c:\agent\_work\79\s\src\libs\dutil\apuputil.cpp$digest$http://appsyndication.org/2006/appsyn$md5$msi.dll$name$sha1$sha256
API String ID: 1657112622-1078064088
Opcode ID: 7d25fd9accb9d31c4add6ac643b695416a9bab38a857bd84815dafc37181035e
Instruction ID: 68155023708d0ea7091ba582ce7c169da4bac15fdaa29032b801989fab75e4a8
Opcode Fuzzy Hash: 7d25fd9accb9d31c4add6ac643b695416a9bab38a857bd84815dafc37181035e
Instruction Fuzzy Hash: DA518231648B12BBEB205F449C46F597E61BB11B32F208715F934BE1E5DBB4E854C7A0

Function 00A1B1D7 Relevance: 24.6, APIs: 3, Strings: 11, Instructions: 137COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,00000000,00000000,?,00A1BACA,00000008,?,00000000,00000000,?,?,?,00000000,76EDC3F0,00000000), ref: 00A1B1DF
GetLastError.KERNEL32(?,00A1BACA,00000008,?,00000000,00000000,?,?,?,00000000,76EDC3F0,00000000), ref: 00A1B1EB
_memcmp.LIBVCRUNTIME ref: 00A1B293

Strings

c:\agent\_work\79\s\src\burn\engine\section.cpp, xrefs: 00A1B20F, 00A1B240, 00A1B26B, 00A1B2D4, 00A1B2F5, 00A1B31E, 00A1B35E
Failed to find valid DOS image header in buffer., xrefs: 00A1B24C
Failed to read section info, data to short: %u, xrefs: 00A1B2E3
Failed to find Burn section., xrefs: 00A1B301
burn, xrefs: 00A1B2BA
.wixburn, xrefs: 00A1B28D
Failed to get module handle to process., xrefs: 00A1B219
Failed to find valid NT image header in buffer., xrefs: 00A1B277
.wix, xrefs: 00A1B2B2
Failed to read section info, unsupported version: %08x, xrefs: 00A1B32D
Bundle guid didn't match the guid in the PE Header in memory., xrefs: 00A1B36A

Memory Dump Source

Source File: 00000003.00000002.3297635874.0000000000A11000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00A10000, based on PE: true

Associated: 00000003.00000002.3297603093.0000000000A10000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.3297783757.0000000000A5B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.3297848804.0000000000A7B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.3297905107.0000000000A7E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_a10000_EMA3D.jbxd

Similarity

API ID: ErrorHandleLastModule_memcmp
String ID: .wix$.wixburn$Bundle guid didn't match the guid in the PE Header in memory.$Failed to find Burn section.$Failed to find valid DOS image header in buffer.$Failed to find valid NT image header in buffer.$Failed to get module handle to process.$Failed to read section info, data to short: %u$Failed to read section info, unsupported version: %08x$burn$c:\agent\_work\79\s\src\burn\engine\section.cpp
API String ID: 3888311042-1220921555
Opcode ID: 7e37e3385e0df71ff4d2171b8d15eb00c821ef18caba1dc6b4500c28c09ac627
Instruction ID: 14c598098cbcdfd9ee3ee820da911117ed0869c40a00d6f94e195736f974d018
Opcode Fuzzy Hash: 7e37e3385e0df71ff4d2171b8d15eb00c821ef18caba1dc6b4500c28c09ac627
Instruction Fuzzy Hash: 19417B32290310F7D7209B418D42EEF6251BF51B23B298425FD126F181EB79C98E82B5

Function 00A1605F Relevance: 19.4, APIs: 5, Strings: 6, Instructions: 106timeCOMMON

Download Yara Rule

APIs

GetSystemTime.KERNEL32(?), ref: 00A1608A
GetDateFormatW.KERNEL32(00000400,00000001,?,00000000,00000000,00000000), ref: 00A1609E
GetLastError.KERNEL32 ref: 00A160B0
GetDateFormatW.KERNEL32(00000400,00000001,?,00000000,?,00000000,?,00000000), ref: 00A16104
GetLastError.KERNEL32 ref: 00A1610E

Strings

Failed to get the required buffer length for the Date., xrefs: 00A160D5
c:\agent\_work\79\s\src\burn\engine\variable.cpp, xrefs: 00A160CB, 00A16129
Failed to allocate the buffer for the Date., xrefs: 00A160EC
_`AB, xrefs: 00A16065
Failed to set variant value., xrefs: 00A1614C
Failed to get the Date., xrefs: 00A16133

Memory Dump Source

Source File: 00000003.00000002.3297635874.0000000000A11000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00A10000, based on PE: true

Associated: 00000003.00000002.3297603093.0000000000A10000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.3297783757.0000000000A5B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.3297848804.0000000000A7B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.3297905107.0000000000A7E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_a10000_EMA3D.jbxd

Similarity

API ID: DateErrorFormatLast$SystemTime
String ID: Failed to allocate the buffer for the Date.$Failed to get the Date.$Failed to get the required buffer length for the Date.$Failed to set variant value.$_`AB$c:\agent\_work\79\s\src\burn\engine\variable.cpp
API String ID: 2700948981-3821038866
Opcode ID: 0dec43975e4d53662130e43b63c1b2618248bcd288dd8cbd3adf274968355a38
Instruction ID: 35dad31f2622fb33cd7bd3ef946bd9076b32c468a702f034b70c5e730875196a
Opcode Fuzzy Hash: 0dec43975e4d53662130e43b63c1b2618248bcd288dd8cbd3adf274968355a38
Instruction Fuzzy Hash: BB319432A40329BBDB119BE8CD42FEFBA78BB04752F114525FE01F7281DA709D8586A1

Function 00A2A021 Relevance: 17.7, APIs: 1, Strings: 9, Instructions: 226COMMON

Download Yara Rule

Strings

Failed to combine last source with source., xrefs: 00A2A103
Failed to copy source path., xrefs: 00A2A212
_`AB, xrefs: 00A2A027
WixBundleOriginalSource, xrefs: 00A2A0A5
WixBundleLayoutDirectory, xrefs: 00A2A15E
Failed to get current process directory., xrefs: 00A2A0E4
WixBundleLastUsedSource, xrefs: 00A2A08A
Failed to get bundle layout directory property., xrefs: 00A2A179
Failed to combine layout source with source., xrefs: 00A2A198

Memory Dump Source

Source File: 00000003.00000002.3297635874.0000000000A11000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00A10000, based on PE: true

Associated: 00000003.00000002.3297603093.0000000000A10000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.3297783757.0000000000A5B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.3297848804.0000000000A7B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.3297905107.0000000000A7E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_a10000_EMA3D.jbxd

Similarity

API ID: Find$CloseFileFirstlstrlen
String ID: Failed to combine last source with source.$Failed to combine layout source with source.$Failed to copy source path.$Failed to get bundle layout directory property.$Failed to get current process directory.$WixBundleLastUsedSource$WixBundleLayoutDirectory$WixBundleOriginalSource$_`AB
API String ID: 2767606509-109321133
Opcode ID: 257d6ab22aeb1482059a7af8140f298f6e683206b44e9643e87d9ecdf6be32e7
Instruction ID: f7942bb6473ca94758862267ea3670db46a750183748750f0e4e77482cb2cfc4
Opcode Fuzzy Hash: 257d6ab22aeb1482059a7af8140f298f6e683206b44e9643e87d9ecdf6be32e7
Instruction Fuzzy Hash: B5813872D00229EBDF15DFA8E941AEEBBB5BF18720F140139F910B72A1D7319D518BA1

Function 00A13171 Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 209COMMON

Download Yara Rule

APIs

ExpandEnvironmentStringsW.KERNEL32(00000040,00000000,00000040,00000000,00000040,00000000,00000000), ref: 00A131BC
GetLastError.KERNEL32 ref: 00A131C2
ExpandEnvironmentStringsW.KERNEL32(00000040,00000000,00000040,00000000,00000000), ref: 00A1321C
GetLastError.KERNEL32 ref: 00A13222
GetFullPathNameW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00A132D6
GetLastError.KERNEL32 ref: 00A132E0
GetFullPathNameW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000), ref: 00A13336
GetLastError.KERNEL32 ref: 00A13340

Strings

@, xrefs: 00A13196
c:\agent\_work\79\s\src\libs\dutil\pathutil.cpp, xrefs: 00A131E6

Memory Dump Source

Source File: 00000003.00000002.3297635874.0000000000A11000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00A10000, based on PE: true

Associated: 00000003.00000002.3297603093.0000000000A10000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.3297783757.0000000000A5B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.3297848804.0000000000A7B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.3297905107.0000000000A7E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_a10000_EMA3D.jbxd

Similarity

API ID: ErrorLast$EnvironmentExpandFullNamePathStrings
String ID: @$c:\agent\_work\79\s\src\libs\dutil\pathutil.cpp
API String ID: 1547313835-3275428685
Opcode ID: 226672fc99550abf353c4dba0dd80c69a3b116dab16a2e8a093119b9bf5b5957
Instruction ID: 782f380264bf63468c1a04caf859c354375bb0534dd70c35d763377d415960d8
Opcode Fuzzy Hash: 226672fc99550abf353c4dba0dd80c69a3b116dab16a2e8a093119b9bf5b5957
Instruction Fuzzy Hash: 45618F73D01229BBDF219FE58944BDEBA78AF00761F114261EE10BB150E7359F8087A4

Function 00A2E134 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 103windowCOMMON

Download Yara Rule

APIs

LoadBitmapW.USER32(?,00000001), ref: 00A2E16A
GetLastError.KERNEL32 ref: 00A2E176
GetObjectW.GDI32(00000000,00000018,?), ref: 00A2E1BD
GetCursorPos.USER32(?), ref: 00A2E1DE
MonitorFromPoint.USER32(?,?,00000002), ref: 00A2E1F0
GetMonitorInfoW.USER32(00000000,?), ref: 00A2E206

Strings

Failed to load splash screen bitmap., xrefs: 00A2E1A4
(, xrefs: 00A2E1FD
_`AB, xrefs: 00A2E13A
c:\agent\_work\79\s\src\burn\engine\splashscreen.cpp, xrefs: 00A2E19A

Memory Dump Source

Source File: 00000003.00000002.3297635874.0000000000A11000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00A10000, based on PE: true

Associated: 00000003.00000002.3297603093.0000000000A10000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.3297783757.0000000000A5B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.3297848804.0000000000A7B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.3297905107.0000000000A7E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_a10000_EMA3D.jbxd

Similarity

API ID: Monitor$BitmapCursorErrorFromInfoLastLoadObjectPoint
String ID: ($Failed to load splash screen bitmap.$_`AB$c:\agent\_work\79\s\src\burn\engine\splashscreen.cpp
API String ID: 2342928100-2937232581
Opcode ID: 94ffb57a91ba3863285cd9de7a957cce45b2b3e93a141024e9f750dc0ec1b2cc
Instruction ID: de5fcf6ac78363bcdb406979ef71e0aad3e10767014919f2945424670da2f173
Opcode Fuzzy Hash: 94ffb57a91ba3863285cd9de7a957cce45b2b3e93a141024e9f750dc0ec1b2cc
Instruction Fuzzy Hash: 85314F75A00215AFDB10CFBCD949A9EBBB4FF08711F048525F905EB281EB70E945CBA0

Function 00A25050 Relevance: 15.8, APIs: 3, Strings: 6, Instructions: 83COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(?,00000000,?,?,00A5B500), ref: 00A25059
GetProcessId.KERNEL32(000000FF,?,?,open,00000000,00000000,?,000000FF,?,?), ref: 00A250F7
CloseHandle.KERNEL32(00000000), ref: 00A25110

Strings

burn.elevated, xrefs: 00A25079
Failed to allocate parameters for elevated process., xrefs: 00A25092
runas, xrefs: 00A250B7
open, xrefs: 00A250C1, 00A250CF
-q -%ls %ls %ls %u, xrefs: 00A2507E
Failed to launch elevated child process: %ls, xrefs: 00A250E4

Memory Dump Source

Source File: 00000003.00000002.3297635874.0000000000A11000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00A10000, based on PE: true

Associated: 00000003.00000002.3297603093.0000000000A10000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.3297783757.0000000000A5B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.3297848804.0000000000A7B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.3297905107.0000000000A7E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_a10000_EMA3D.jbxd

Similarity

API ID: Process$CloseCurrentHandle
String ID: -q -%ls %ls %ls %u$Failed to allocate parameters for elevated process.$Failed to launch elevated child process: %ls$burn.elevated$open$runas
API String ID: 2815245435-1352204306
Opcode ID: 8ac3c72a12bde3a9e64ff550392ec937519e3f39ac3696ba40f3d633840a72d2
Instruction ID: 703445240483db6408701e7cb8144e531b4fa4b783c9c7aabe07d7b41eb83e22
Opcode Fuzzy Hash: 8ac3c72a12bde3a9e64ff550392ec937519e3f39ac3696ba40f3d633840a72d2
Instruction Fuzzy Hash: C7218075D00619FFCF019FA8ED418EEBBB8FF09355B10456AF911A2240D7319E509B90

Function 00A11173 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 52libraryloadermemoryCOMMON

Download Yara Rule

APIs

HeapSetInformation.KERNEL32(00000000,00000001,00000000,00000000,?,?,?,?,?,00A1111A,cabinet.dll,00000009,?,?,00000000), ref: 00A11184
GetModuleHandleW.KERNEL32(kernel32,?,?,?,?,?,00A1111A,cabinet.dll,00000009,?,?,00000000), ref: 00A1118F
GetProcAddress.KERNEL32(00000000,SetDefaultDllDirectories), ref: 00A1119D
GetLastError.KERNEL32(?,?,?,?,?,00A1111A,cabinet.dll,00000009,?,?,00000000), ref: 00A111B8
GetProcAddress.KERNEL32(00000000,SetDllDirectoryW), ref: 00A111C0
GetLastError.KERNEL32(?,?,?,?,?,00A1111A,cabinet.dll,00000009,?,?,00000000), ref: 00A111D5

Strings

SetDllDirectoryW, xrefs: 00A111BA
kernel32, xrefs: 00A1118A
SetDefaultDllDirectories, xrefs: 00A11197

Memory Dump Source

Source File: 00000003.00000002.3297635874.0000000000A11000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00A10000, based on PE: true

Associated: 00000003.00000002.3297603093.0000000000A10000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.3297783757.0000000000A5B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.3297848804.0000000000A7B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.3297905107.0000000000A7E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_a10000_EMA3D.jbxd

Similarity

API ID: AddressErrorLastProc$HandleHeapInformationModule
String ID: SetDefaultDllDirectories$SetDllDirectoryW$kernel32
API String ID: 3104334766-1824683568
Opcode ID: f19ad3b0a69e60eb35c8a437a1863d1ec27566c77f376bbe7000e3c480a4be78
Instruction ID: 10b50e2cb206b58dc856aa7a4742dde380f8a64a2b70d52b5a9f468433e6047d
Opcode Fuzzy Hash: f19ad3b0a69e60eb35c8a437a1863d1ec27566c77f376bbe7000e3c480a4be78
Instruction Fuzzy Hash: 8A017131310316BA9B10AFA6AC49DAFBB6CFB417637004515FE1692180E770DA89CBB1

Function 00A5712A Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 158COMMON

Download Yara Rule

APIs

CompareStringW.KERNEL32(0000007F,00000000,7591DFD0,000000FF,type,000000FF,?,7591DFD0,7591DFD0,7591DFD0), ref: 00A57180
SysFreeString.OLEAUT32(00000000), ref: 00A571CB
SysFreeString.OLEAUT32(00000000), ref: 00A57247
SysFreeString.OLEAUT32(00000000), ref: 00A57293

Strings

url, xrefs: 00A57193
`)u, xrefs: 00A571CB, 00A57247, 00A57293
type, xrefs: 00A57172

Memory Dump Source

Source File: 00000003.00000002.3297635874.0000000000A11000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00A10000, based on PE: true

Associated: 00000003.00000002.3297603093.0000000000A10000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.3297783757.0000000000A5B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.3297848804.0000000000A7B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.3297905107.0000000000A7E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_a10000_EMA3D.jbxd

Similarity

API ID: String$Free$Compare
String ID: `)u$type$url
API String ID: 1324494773-3139739812
Opcode ID: e566617fb9c45c302dabedb1777bf43e385a6b88a51e80e82a4d102b9d88950b
Instruction ID: 386876f953ad8c80086a624ad37d11fcadea5fd84c1b320a45a9c5ceb45bf9c8
Opcode Fuzzy Hash: e566617fb9c45c302dabedb1777bf43e385a6b88a51e80e82a4d102b9d88950b
Instruction Fuzzy Hash: 03513B32905219FBCF15DBA4D948EEEBBB8BF04712F144299F911BB1A0DB319E48DB50

Function 00A2916B Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 138COMMON

Download Yara Rule

APIs

_memcmp.LIBVCRUNTIME ref: 00A291F9

Part of subcall function 00A55922: GetLastError.KERNEL32(?,?,00A2921E,?,00000003,?,?), ref: 00A55941

_memcmp.LIBVCRUNTIME ref: 00A29233
GetLastError.KERNEL32 ref: 00A292AB

Strings

c:\agent\_work\79\s\src\burn\engine\cache.cpp, xrefs: 00A292CF
Failed to find expected public key in certificate chain., xrefs: 00A2926E
_`AB, xrefs: 00A29171
Failed to get certificate public key identifier., xrefs: 00A292D9
Failed to read certificate thumbprint., xrefs: 00A2929F

Memory Dump Source

Source File: 00000003.00000002.3297635874.0000000000A11000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00A10000, based on PE: true

Associated: 00000003.00000002.3297603093.0000000000A10000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.3297783757.0000000000A5B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.3297848804.0000000000A7B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.3297905107.0000000000A7E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_a10000_EMA3D.jbxd

Similarity

API ID: ErrorLast_memcmp
String ID: Failed to find expected public key in certificate chain.$Failed to get certificate public key identifier.$Failed to read certificate thumbprint.$_`AB$c:\agent\_work\79\s\src\burn\engine\cache.cpp
API String ID: 3428363238-793200336
Opcode ID: 5dafb3a4784954011adece9db928b616fbf79941a74d99ee3a9ec1abfbcbf441
Instruction ID: 762e30d8cf4cef6ccbe825dc74ec8027a8c3f3b592e4e3d91b91508e1609c3a1
Opcode Fuzzy Hash: 5dafb3a4784954011adece9db928b616fbf79941a74d99ee3a9ec1abfbcbf441
Instruction Fuzzy Hash: BD414A72E00225EBEB10DBA9D981AEFB7B8BF08B10F004169F905B7241D635ED44CBA4

Function 00A3D038 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 86synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF,759230B0,00000000,?,?,?,00A3D334,?), ref: 00A3D057
ReleaseMutex.KERNEL32(?,?,?,00A3D334,?), ref: 00A3D06B
WaitForSingleObject.KERNEL32(?,000000FF), ref: 00A3D0B0
ReleaseMutex.KERNEL32(?), ref: 00A3D0C3
SetEvent.KERNEL32(?), ref: 00A3D0CC

Strings

Failed to send files in use message from netfx chainer., xrefs: 00A3D110
Failed to get message from netfx chainer., xrefs: 00A3D0ED

Memory Dump Source

Source File: 00000003.00000002.3297635874.0000000000A11000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00A10000, based on PE: true

Associated: 00000003.00000002.3297603093.0000000000A10000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.3297783757.0000000000A5B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.3297848804.0000000000A7B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.3297905107.0000000000A7E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_a10000_EMA3D.jbxd

Similarity

API ID: MutexObjectReleaseSingleWait$Event
String ID: Failed to get message from netfx chainer.$Failed to send files in use message from netfx chainer.
API String ID: 2608678126-3424578679
Opcode ID: 46562e720242a8fa8a15cf3df681212eb657c30c192572a59ae43413055c1c6a
Instruction ID: ea746fd4460356ed257e3d078f6c9c0dd3a043e0b3c147ae9606bc09c1390d80
Opcode Fuzzy Hash: 46562e720242a8fa8a15cf3df681212eb657c30c192572a59ae43413055c1c6a
Instruction Fuzzy Hash: 3131067290061AFFCB01DFA4DC45EEEBBB8BF05325F148366F515A2291C774DA518BA0

Function 00A28109 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 65COMMON

Download Yara Rule

APIs

Part of subcall function 00A139DF: GetProcessHeap.KERNEL32(?,?,?,00A1237C,?,00000001,75A8B390,8000FFFF,?,?,00A5058B,?,?,00000000,00000000,8000FFFF), ref: 00A139F0
Part of subcall function 00A139DF: RtlAllocateHeap.NTDLL(00000000,?,00A1237C,?,00000001,75A8B390,8000FFFF,?,?,00A5058B,?,?,00000000,00000000,8000FFFF), ref: 00A139F7

CreateWellKnownSid.ADVAPI32(00000000,00000000,00000000,00000000,00000044,00000001,00000000,00000000,?,?,00A28D01,0000001A,00000000,00000000,00000000,00000000), ref: 00A28152
GetLastError.KERNEL32(?,?,00A28D01,0000001A,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?), ref: 00A2815C

Strings

Failed to create well known SID., xrefs: 00A2818A
c:\agent\_work\79\s\src\burn\engine\cache.cpp, xrefs: 00A28130, 00A28180
Failed to allocate memory for well known SID., xrefs: 00A2813A

Memory Dump Source

Source File: 00000003.00000002.3297635874.0000000000A11000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00A10000, based on PE: true

Associated: 00000003.00000002.3297603093.0000000000A10000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.3297783757.0000000000A5B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.3297848804.0000000000A7B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.3297905107.0000000000A7E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_a10000_EMA3D.jbxd

Similarity

API ID: Heap$AllocateCreateErrorKnownLastProcessWell
String ID: Failed to allocate memory for well known SID.$Failed to create well known SID.$c:\agent\_work\79\s\src\burn\engine\cache.cpp
API String ID: 2186923214-3348081855
Opcode ID: 5a445440469f95d2b97f0aed2d2e4254ff111a4ffbcca08b5b7390f56785c737
Instruction ID: 821a79d6da6f6994991b4ef21d5fd0a5022f18d0d907846510a98ba708aeba71
Opcode Fuzzy Hash: 5a445440469f95d2b97f0aed2d2e4254ff111a4ffbcca08b5b7390f56785c737
Instruction Fuzzy Hash: 4E012F33652231B7E7216759AE06E9F596CEF41F62B150125FD04BB1C0EE788E4281E0

Function 00A12078 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 54windowCOMMON

Download Yara Rule

APIs

FormatMessageW.KERNEL32(00A142CC,00A154CB,?,00000000,00000000,00000000,?,80070656,?,?,?,00A2E5DB,00000000,00A154CB,00000000,80070656), ref: 00A120A9
GetLastError.KERNEL32(?,?,?,00A2E5DB,00000000,00A154CB,00000000,80070656,?,?,00A2403F,00A154CB,?,80070656,00000001,crypt32.dll), ref: 00A120B6
LocalFree.KERNEL32(00000000,?,00000000,00000000,?,?,?,00A2E5DB,00000000,00A154CB,00000000,80070656,?,?,00A2403F,00A154CB), ref: 00A120FD

Strings

c:\agent\_work\79\s\src\libs\dutil\strutil.cpp, xrefs: 00A120DA

Memory Dump Source

Source File: 00000003.00000002.3297635874.0000000000A11000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00A10000, based on PE: true

Associated: 00000003.00000002.3297603093.0000000000A10000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.3297783757.0000000000A5B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.3297848804.0000000000A7B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.3297905107.0000000000A7E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_a10000_EMA3D.jbxd

Similarity

API ID: ErrorFormatFreeLastLocalMessage
String ID: c:\agent\_work\79\s\src\libs\dutil\strutil.cpp
API String ID: 1365068426-2901571208
Opcode ID: cd6bbee169aa906c223d40d770c5953dbdbda669dacc05968d3cc41bb315ddf8
Instruction ID: 4b1eef3c7bd5147a12f459f607fe27c387da798d93898159e9d693ba6c03abbf
Opcode Fuzzy Hash: cd6bbee169aa906c223d40d770c5953dbdbda669dacc05968d3cc41bb315ddf8
Instruction Fuzzy Hash: 5E016DB795112AFBEB20DB94DD09ADFBAACEF08751F014161BE01E7140E634CE50DBA0

Function 00A5501B Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 50fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(002E0032,40000000,00000001,00000000,00000002,00000080,00000000,00A20455,00000000,?,00A1F499,00A5B500,00000080,002E0032,00000000), ref: 00A55033
GetLastError.KERNEL32(?,00A1F499,00A5B500,00000080,002E0032,00000000,?,00A20455,crypt32.dll,00000094,?,?,?,?,?,00000000), ref: 00A55040
CloseHandle.KERNEL32(00000000,00000000,00A5B500,00A1F499,?,00A1F499,00A5B500,00000080,002E0032,00000000,?,00A20455,crypt32.dll,00000094), ref: 00A55094

Strings

c:\agent\_work\79\s\src\libs\dutil\fileutil.cpp, xrefs: 00A55064

Memory Dump Source

Source File: 00000003.00000002.3297635874.0000000000A11000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00A10000, based on PE: true

Associated: 00000003.00000002.3297603093.0000000000A10000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.3297783757.0000000000A5B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.3297848804.0000000000A7B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.3297905107.0000000000A7E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_a10000_EMA3D.jbxd

Similarity

API ID: CloseCreateErrorFileHandleLast
String ID: c:\agent\_work\79\s\src\libs\dutil\fileutil.cpp
API String ID: 2528220319-3405085980
Opcode ID: 58407c76771eaef482b0697b1337c34c205528041edcd5e929d53b490384b6eb
Instruction ID: 873e2cc017387a70e3d37e4d19efb0c0f2cc7f7cf4c439944305b896e7850d43
Opcode Fuzzy Hash: 58407c76771eaef482b0697b1337c34c205528041edcd5e929d53b490384b6eb
Instruction Fuzzy Hash: 4A01BC33A41A256BDA314AB99C19F9F3A24BB40B73F010210FE25AB1E0D7718C0196E0

Function 00A54029 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 35comCOMMON

Download Yara Rule

APIs

CLSIDFromProgID.OLE32(Microsoft.Update.AutoUpdate,00A154A3,?,00000000,00A154A3,?,?,?), ref: 00A54050
CoCreateInstance.OLE32(00000000,00000000,00000001,00A77AAC,?), ref: 00A54068

Strings

Microsoft.Update.AutoUpdate, xrefs: 00A5404B
_`AB, xrefs: 00A5402F

Memory Dump Source

Source File: 00000003.00000002.3297635874.0000000000A11000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00A10000, based on PE: true

Associated: 00000003.00000002.3297603093.0000000000A10000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.3297783757.0000000000A5B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.3297848804.0000000000A7B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.3297905107.0000000000A7E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_a10000_EMA3D.jbxd

Similarity

API ID: CreateFromInstanceProg
String ID: Microsoft.Update.AutoUpdate$_`AB
API String ID: 2151042543-2876930070
Opcode ID: 480d56be343da9c3c77356e5e5182b748d6922f1a14523da24cd578834bb7ec9
Instruction ID: f904673fbd983aad5a57a57b90f651f253ccfd5f8a278b035bfe48f08f122236
Opcode Fuzzy Hash: 480d56be343da9c3c77356e5e5182b748d6922f1a14523da24cd578834bb7ec9
Instruction Fuzzy Hash: 51F03A71610208BBEB00DBE8DD05AEFB7B8EF48751F504465EA01F6190D670AA0986B2

Function 00A56106 Relevance: 6.2, APIs: 3, Strings: 1, Instructions: 162stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?), ref: 00A561D3
lstrlenW.KERNEL32(00000000), ref: 00A561EB

Strings

c:\agent\_work\79\s\src\libs\dutil\dlutil.cpp, xrefs: 00A56274

Memory Dump Source

Source File: 00000003.00000002.3297635874.0000000000A11000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00A10000, based on PE: true

Associated: 00000003.00000002.3297603093.0000000000A10000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.3297783757.0000000000A5B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.3297848804.0000000000A7B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.3297905107.0000000000A7E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_a10000_EMA3D.jbxd

Similarity

API ID: lstrlen
String ID: c:\agent\_work\79\s\src\libs\dutil\dlutil.cpp
API String ID: 1659193697-1613074858
Opcode ID: db8a971e173aadbea5067a03e9eef0681003b8f9f3d31a934373922c4ffd479a
Instruction ID: 0fa51bb6545e87ecf299b3f6e69847fc6c5da8d30f3ba961127ca78f3127b2b5
Opcode Fuzzy Hash: db8a971e173aadbea5067a03e9eef0681003b8f9f3d31a934373922c4ffd479a
Instruction Fuzzy Hash: 5F51A072D0062AABDB219FE48C80AEFBBB9BF48752F554124FD04A7210DB30DD45DBA0

Function 00A550A2 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(00000000,00000000,00000000,?,00000000,00000000,00000000,?,?,?,00A54218,?,?,?), ref: 00A550C6
GetLastError.KERNEL32(?,?,00A54218,?,?,?), ref: 00A550D0

Strings

c:\agent\_work\79\s\src\libs\dutil\fileutil.cpp, xrefs: 00A550F9

Memory Dump Source

Source File: 00000003.00000002.3297635874.0000000000A11000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00A10000, based on PE: true

Associated: 00000003.00000002.3297603093.0000000000A10000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.3297783757.0000000000A5B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.3297848804.0000000000A7B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.3297905107.0000000000A7E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_a10000_EMA3D.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: c:\agent\_work\79\s\src\libs\dutil\fileutil.cpp
API String ID: 442123175-3405085980
Opcode ID: d4b5008857983ba5ff61033e52af0019b7c23336eb44ea65f5eff8e2170fb4b1
Instruction ID: 1d5896783911f01514825da2feebb33b2d148b0f133674d230bbc3cbc4887c19
Opcode Fuzzy Hash: d4b5008857983ba5ff61033e52af0019b7c23336eb44ea65f5eff8e2170fb4b1
Instruction Fuzzy Hash: 2BF06D33A00629ABDB10CEAADD45EDFBB69BB40B62B114221FD04E6180E670A900C6E0

Function 00A51112 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(RegDeleteKeyExW,AdvApi32.dll), ref: 00A51133

Strings

RegDeleteKeyExW, xrefs: 00A51128
AdvApi32.dll, xrefs: 00A51118

Memory Dump Source

Source File: 00000003.00000002.3297635874.0000000000A11000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00A10000, based on PE: true

Associated: 00000003.00000002.3297603093.0000000000A10000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.3297783757.0000000000A5B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.3297848804.0000000000A7B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000003.00000002.3297905107.0000000000A7E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_a10000_EMA3D.jbxd

Similarity

API ID: AddressProc
String ID: AdvApi32.dll$RegDeleteKeyExW
API String ID: 190572456-850864035
Opcode ID: 9b14c97ec6c0672b62a7c57d8f0a1021679292d28afe261247b700055bb6800e
Instruction ID: 434f7bfa88416864c7ca9c3a1f8ca9f5920f6473a141ca7edc706ca2a92361ab
Opcode Fuzzy Hash: 9b14c97ec6c0672b62a7c57d8f0a1021679292d28afe261247b700055bb6800e
Instruction Fuzzy Hash: 32E0EC31A41721ABC725DF9CFD057513AA0F700B67F01C66CE50C96260DBB14ACACF90

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: Process Creation, Service: Service Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report jlK7Q70gbN.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Cryptography

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\EMA3D_2024R2_20241007173013.log

C:\Windows\Temp\{562041EC-09A3-44AA-87AE-CC1700EABB21}\.cr\jlK7Q70gbN.exe

C:\Windows\Temp\{FFE22A89-11FD-4A47-9FF0-982DA2A5AD2F}\.ba\1028\mbapreq.wxl

C:\Windows\Temp\{FFE22A89-11FD-4A47-9FF0-982DA2A5AD2F}\.ba\1029\mbapreq.wxl

C:\Windows\Temp\{FFE22A89-11FD-4A47-9FF0-982DA2A5AD2F}\.ba\1030\mbapreq.wxl

C:\Windows\Temp\{FFE22A89-11FD-4A47-9FF0-982DA2A5AD2F}\.ba\1031\mbapreq.wxl

C:\Windows\Temp\{FFE22A89-11FD-4A47-9FF0-982DA2A5AD2F}\.ba\1032\mbapreq.wxl

C:\Windows\Temp\{FFE22A89-11FD-4A47-9FF0-982DA2A5AD2F}\.ba\1035\mbapreq.wxl

C:\Windows\Temp\{FFE22A89-11FD-4A47-9FF0-982DA2A5AD2F}\.ba\1036\mbapreq.wxl

C:\Windows\Temp\{FFE22A89-11FD-4A47-9FF0-982DA2A5AD2F}\.ba\1038\mbapreq.wxl

C:\Windows\Temp\{FFE22A89-11FD-4A47-9FF0-982DA2A5AD2F}\.ba\1040\mbapreq.wxl

C:\Windows\Temp\{FFE22A89-11FD-4A47-9FF0-982DA2A5AD2F}\.ba\1041\mbapreq.wxl

C:\Windows\Temp\{FFE22A89-11FD-4A47-9FF0-982DA2A5AD2F}\.ba\1042\mbapreq.wxl

C:\Windows\Temp\{FFE22A89-11FD-4A47-9FF0-982DA2A5AD2F}\.ba\1043\mbapreq.wxl

C:\Windows\Temp\{FFE22A89-11FD-4A47-9FF0-982DA2A5AD2F}\.ba\1044\mbapreq.wxl

C:\Windows\Temp\{FFE22A89-11FD-4A47-9FF0-982DA2A5AD2F}\.ba\1045\mbapreq.wxl

C:\Windows\Temp\{FFE22A89-11FD-4A47-9FF0-982DA2A5AD2F}\.ba\1046\mbapreq.wxl

C:\Windows\Temp\{FFE22A89-11FD-4A47-9FF0-982DA2A5AD2F}\.ba\1049\mbapreq.wxl

C:\Windows\Temp\{FFE22A89-11FD-4A47-9FF0-982DA2A5AD2F}\.ba\1051\mbapreq.wxl

C:\Windows\Temp\{FFE22A89-11FD-4A47-9FF0-982DA2A5AD2F}\.ba\1053\mbapreq.wxl

C:\Windows\Temp\{FFE22A89-11FD-4A47-9FF0-982DA2A5AD2F}\.ba\1055\mbapreq.wxl

C:\Windows\Temp\{FFE22A89-11FD-4A47-9FF0-982DA2A5AD2F}\.ba\1060\mbapreq.wxl

C:\Windows\Temp\{FFE22A89-11FD-4A47-9FF0-982DA2A5AD2F}\.ba\2052\mbapreq.wxl

C:\Windows\Temp\{FFE22A89-11FD-4A47-9FF0-982DA2A5AD2F}\.ba\2070\mbapreq.wxl

Windows Analysis Report
jlK7Q70gbN.exe

Function 006D51D2 Relevance: 38.8, APIs: 5, Strings: 17, Instructions: 314
COMMON

Function 006DF97E Relevance: 117.7, APIs: 3, Strings: 64, Instructions: 445
COMMON

Function 006DB45A Relevance: 93.3, APIs: 24, Strings: 29, Instructions: 577
fileCOMMON

Function 006DCD76 Relevance: 84.4, APIs: 3, Strings: 45, Instructions: 365
COMMON

Function 006F0AE0 Relevance: 54.6, APIs: 20, Strings: 11, Instructions: 306
synchronizationCOMMON

Function 006D4D7A Relevance: 42.2, APIs: 6, Strings: 18, Instructions: 219
COMMON

Function 006E7430 Relevance: 37.0, APIs: 1, Strings: 20, Instructions: 290
COMMON

Function 006E85C4 Relevance: 35.2, APIs: 9, Strings: 11, Instructions: 208
fileCOMMON

Function 006D762D Relevance: 34.9, APIs: 1, Strings: 22, Instructions: 419
COMMON

Function 006E81B2 Relevance: 31.7, APIs: 7, Strings: 11, Instructions: 152
COMMON

Function 006F0EC5 Relevance: 30.0, APIs: 8, Strings: 9, Instructions: 216
COMMON