Edit tour

Windows Analysis Report
conhost[1].exe

Overview

General Information

Sample name:	conhost[1].exe
Analysis ID:	1417362
MD5:	7417006ac4f38dbe0efd36647c3ebae4
SHA1:	4c7e2524a6d7cd99be807b7bfa544517cfd594d4
SHA256:	c43cf46192da061dd6169e55aac4d2d08a6c33c039a7dac0d88aa897661cbc87
Infos:

Detection

Score:	9
Range:	0 - 100
Whitelisted:	false
Confidence:	60%

Signatures

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to communicate with device drivers

Contains functionality to modify clipboard data

Contains functionality to read the clipboard data

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Found evasive API chain checking for process token information

Found potential string decryption / allocating functions

PE file contains sections with non-standard names

Program does not show much activity (idle)

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Tries to load missing DLLs

Classification

Analysis Advice

Sample tries to load a library which is not present or installed on the analysis machine, adding the library might reveal more behavior

Sample may offer command line options, please run it with the 'Execute binary with arguments' cookbook (it's possible that the command line switches require additional characters like: "-", "/", "--")

Process Tree

System is w10x64

conhost[1].exe (PID: 6884 cmdline: "C:\Users\user\Desktop\conhost[1].exe" MD5: 7417006AC4F38DBE0EFD36647C3EBAE4)

cmd.exe (PID: 6948 cmdline: C:\Windows\system32\cmd.exe MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: conhost[1].exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source:	Binary string: conhost.pdbUGP source: conhost[1].exe
Source:	Binary string: conhost.pdb source: conhost[1].exe

Source: C:\Users\user\Desktop\conhost[1].exe

Code function: 0_2_00007FF7E08C0390 OpenClipboard,EnableScrollBar,

0_2_00007FF7E08C0390

Source: C:\Users\user\Desktop\conhost[1].exe	Code function: 0_2_00007FF7E08C0360 SetClipboardData,		0_2_00007FF7E08C0360
Source: C:\Users\user\Desktop\conhost[1].exe	Code function: 0_2_00007FF7E087532C GlobalAlloc,GlobalLock,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,GlobalAlloc,GlobalLock,GlobalUnlock,SetClipboardData,CloseClipboard,		0_2_00007FF7E087532C

Source: C:\Users\user\Desktop\conhost[1].exe

Code function: 0_2_00007FF7E08C0370 GetClipboardData,

0_2_00007FF7E08C0370

Source: C:\Users\user\Desktop\conhost[1].exe	Code function: 0_2_00007FF7E086E17C _Init_thread_footer,NtOpenFile,NtOpenFile,	0_2_00007FF7E086E17C
Source: C:\Users\user\Desktop\conhost[1].exe	Code function: 0_2_00007FF7E07FA4A0 GetWindowLongPtrW,NtdllDefWindowProc_W,SetWindowLongPtrW,	0_2_00007FF7E07FA4A0
Source: C:\Users\user\Desktop\conhost[1].exe	Code function: 0_2_00007FF7E07FA540 EnterCriticalSection,NtdllDefWindowProc_W,LeaveCriticalSection,GetWindowRect,IsRectEmpty,GetWindowLongW,SetDlgItemTextW,SetWindowPos,IsIconic,MonitorFromRect,SetWindowPos,FreeLibrary,NtdllDefWindowProc_W,GetSystemMetrics,SetActiveWindow,SendMessageTimeoutW,NotifyWinEvent,	0_2_00007FF7E07FA540
Source: C:\Users\user\Desktop\conhost[1].exe	Code function: 0_2_00007FF7E07FA43C WideCharToMultiByte,NtdllDefWindowProc_W,	0_2_00007FF7E07FA43C
Source: C:\Users\user\Desktop\conhost[1].exe	Code function: 0_2_00007FF7E086E9E0 GetLastError,FreeLibrary,memset,NtdllDefWindowProc_W,RegisterClassW,CreateWindowExW,GetLastError,	0_2_00007FF7E086E9E0
Source: C:\Users\user\Desktop\conhost[1].exe	Code function: 0_2_00007FF7E08771C8 RtlCreateUnicodeString,AlpcInitializeMessageAttribute,NtAlpcConnectPort,AlpcGetMessageAttribute,AlpcGetMessageAttribute,NtAlpcQueryInformationMessage,memset,	0_2_00007FF7E08771C8
Source: C:\Users\user\Desktop\conhost[1].exe	Code function: 0_2_00007FF7E08094D4 NtQueryVolumeInformationFile,	0_2_00007FF7E08094D4
Source: C:\Users\user\Desktop\conhost[1].exe	Code function: 0_2_00007FF7E0877A68 NtAlpcSendWaitReceivePort,	0_2_00007FF7E0877A68

Source: C:\Users\user\Desktop\conhost[1].exe

Code function: 0_2_00007FF7E08024C0: memset,DeviceIoControl,_Init_thread_footer,default_delete,

0_2_00007FF7E08024C0

Source: C:\Users\user\Desktop\conhost[1].exe	Code function: 0_2_00007FF7E08001E0	0_2_00007FF7E08001E0
Source: C:\Users\user\Desktop\conhost[1].exe	Code function: 0_2_00007FF7E086A2D4	0_2_00007FF7E086A2D4
Source: C:\Users\user\Desktop\conhost[1].exe	Code function: 0_2_00007FF7E07FA540	0_2_00007FF7E07FA540
Source: C:\Users\user\Desktop\conhost[1].exe	Code function: 0_2_00007FF7E07F4890	0_2_00007FF7E07F4890
Source: C:\Users\user\Desktop\conhost[1].exe	Code function: 0_2_00007FF7E07F3840	0_2_00007FF7E07F3840
Source: C:\Users\user\Desktop\conhost[1].exe	Code function: 0_2_00007FF7E07F4030	0_2_00007FF7E07F4030
Source: C:\Users\user\Desktop\conhost[1].exe	Code function: 0_2_00007FF7E088A198	0_2_00007FF7E088A198
Source: C:\Users\user\Desktop\conhost[1].exe	Code function: 0_2_00007FF7E08625E0	0_2_00007FF7E08625E0
Source: C:\Users\user\Desktop\conhost[1].exe	Code function: 0_2_00007FF7E0874554	0_2_00007FF7E0874554
Source: C:\Users\user\Desktop\conhost[1].exe	Code function: 0_2_00007FF7E088A910	0_2_00007FF7E088A910
Source: C:\Users\user\Desktop\conhost[1].exe	Code function: 0_2_00007FF7E0844964	0_2_00007FF7E0844964
Source: C:\Users\user\Desktop\conhost[1].exe	Code function: 0_2_00007FF7E084EB40	0_2_00007FF7E084EB40
Source: C:\Users\user\Desktop\conhost[1].exe	Code function: 0_2_00007FF7E082ACA8	0_2_00007FF7E082ACA8
Source: C:\Users\user\Desktop\conhost[1].exe	Code function: 0_2_00007FF7E087EC6C	0_2_00007FF7E087EC6C
Source: C:\Users\user\Desktop\conhost[1].exe	Code function: 0_2_00007FF7E0874DE8	0_2_00007FF7E0874DE8
Source: C:\Users\user\Desktop\conhost[1].exe	Code function: 0_2_00007FF7E088AD80	0_2_00007FF7E088AD80
Source: C:\Users\user\Desktop\conhost[1].exe	Code function: 0_2_00007FF7E07FCFA0	0_2_00007FF7E07FCFA0
Source: C:\Users\user\Desktop\conhost[1].exe	Code function: 0_2_00007FF7E0801250	0_2_00007FF7E0801250
Source: C:\Users\user\Desktop\conhost[1].exe	Code function: 0_2_00007FF7E081728C	0_2_00007FF7E081728C
Source: C:\Users\user\Desktop\conhost[1].exe	Code function: 0_2_00007FF7E084D5C4	0_2_00007FF7E084D5C4
Source: C:\Users\user\Desktop\conhost[1].exe	Code function: 0_2_00007FF7E0883544	0_2_00007FF7E0883544
Source: C:\Users\user\Desktop\conhost[1].exe	Code function: 0_2_00007FF7E07FF690	0_2_00007FF7E07FF690
Source: C:\Users\user\Desktop\conhost[1].exe	Code function: 0_2_00007FF7E087D7C4	0_2_00007FF7E087D7C4
Source: C:\Users\user\Desktop\conhost[1].exe	Code function: 0_2_00007FF7E07FD7F0	0_2_00007FF7E07FD7F0
Source: C:\Users\user\Desktop\conhost[1].exe	Code function: 0_2_00007FF7E0801780	0_2_00007FF7E0801780
Source: C:\Users\user\Desktop\conhost[1].exe	Code function: 0_2_00007FF7E0809960	0_2_00007FF7E0809960
Source: C:\Users\user\Desktop\conhost[1].exe	Code function: 0_2_00007FF7E086FAF0	0_2_00007FF7E086FAF0
Source: C:\Users\user\Desktop\conhost[1].exe	Code function: 0_2_00007FF7E07FFCB0	0_2_00007FF7E07FFCB0
Source: C:\Users\user\Desktop\conhost[1].exe	Code function: 0_2_00007FF7E0843FE0	0_2_00007FF7E0843FE0
Source: C:\Users\user\Desktop\conhost[1].exe	Code function: 0_2_00007FF7E0875F30	0_2_00007FF7E0875F30
Source: C:\Users\user\Desktop\conhost[1].exe	Code function: 0_2_00007FF7E084E0F8	0_2_00007FF7E084E0F8

Source: C:\Users\user\Desktop\conhost[1].exe	Code function: String function: 00007FF7E07F9A04 appears 387 times
Source: C:\Users\user\Desktop\conhost[1].exe	Code function: String function: 00007FF7E08296D4 appears 68 times
Source: C:\Users\user\Desktop\conhost[1].exe	Code function: String function: 00007FF7E082CFCC appears 159 times
Source: C:\Users\user\Desktop\conhost[1].exe	Code function: String function: 00007FF7E082D614 appears 148 times
Source: C:\Users\user\Desktop\conhost[1].exe	Code function: String function: 00007FF7E08132F8 appears 175 times
Source: C:\Users\user\Desktop\conhost[1].exe	Code function: String function: 00007FF7E080F780 appears 54 times
Source: C:\Users\user\Desktop\conhost[1].exe	Code function: String function: 00007FF7E07F61E4 appears 141 times

Source: conhost[1].exe	Binary or memory string: OriginalFilename vs conhost[1].exe
Source: conhost[1].exe, 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameCONHOST.EXEj% vs conhost[1].exe
Source: conhost[1].exe, 00000000.00000000.1596244904.00007FF7E08C1000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameCONHOST.EXEj% vs conhost[1].exe
Source: conhost[1].exe	Binary or memory string: OriginalFilenameCONHOST.EXEj% vs conhost[1].exe

Source: C:\Users\user\Desktop\conhost[1].exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\conhost[1].exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\conhost[1].exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\conhost[1].exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\conhost[1].exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\conhost[1].exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\conhost[1].exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\conhost[1].exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\conhost[1].exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\conhost[1].exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\conhost[1].exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: winbrand.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior

Source: conhost[1].exe

Binary string: \Device\ConDrv\Serveronecore\windows\core\console\open\src\server\winntcontrol.cpponecore\windows\core\console\open\src\interactivity\base\servicelocator.cpponecore\windows\core\console\open\src\interactivity\base\hostsignalinputthread.cppHost Signal Handler Threadonecore\windows\core\console\open\src\interactivity\win32\uiatextrange.cpponecore\windows\core\console\open\src\interactivity\win32\accessibilitynotifier.cpponecore\windows\core\console\open\src\interactivity\win32\windowmetrics.cpponecore\windows\core\console\open\src\interactivity\win32\systemconfigurationprovider.cpponecore\windows\core\console\open\src\interactivity\win32\window.cpponecore\windows\core\console\open\src\interactivity\win32\windowio.cpponecore\windows\core\console\open\src\interactivity\win32\icon.cpponecore\windows\core\console\open\src\interactivity\win32\windowuiaprovider.cpponecore\windows\core\console\open\src\interactivity\win32\windowproc.cpponecore\windows\core\console\open\src\interactivity\win32\clipboard.cpponecore\windows\core\console\open\src\interactivity\win32\screeninfouiaprovider.cpponecore\windows\core\console\open\src\types\viewport.cpponecore\windows\core\console\open\src\types\convert.cpponecore\windows\core\console\open\src\types\utils.cpp

Source: classification engine

Classification label: clean9.winEXE@3/0@0/0

Source: C:\Users\user\Desktop\conhost[1].exe

Code function: 0_2_00007FF7E080C444 CoInitializeEx,CoCreateInstance,CoCreateInstance,

0_2_00007FF7E080C444

Source: C:\Users\user\Desktop\conhost[1].exe

Code function: 0_2_00007FF7E0849608 FindResourceExW,LoadResource,LockResource,memmove,

0_2_00007FF7E0849608

Source: C:\Users\user\Desktop\conhost[1].exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6884:120:WilError_03

Source: conhost[1].exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\conhost[1].exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: conhost[1].exe	String found in binary or memory: <!--StartFragment -->
Source: conhost[1].exe	String found in binary or memory: <!--StartFragment -->
Source: conhost[1].exe	String found in binary or memory: Software\Microsoft\Windows\CurrentVersionPutInputInBuffer: EventsWritten != 1, 1 expectedInvalid EventType: 0x%xonecore\windows\core\console\open\src\host\misc.cpponecore\windows\core\console\open\src\host\output.cppinvalid array<T, N> subscript onecore\windows\core\console\open\src\host\convarea.cppInvalid screen buffer size (0x%x, 0x%x) onecore\windows\core\console\open\src\host\_output.cpponecore\windows\core\console\open\src\host\utils.cppStartEndUnknownTextUnit_CharacterTextUnit_FormatTextUnit_WordTextUnit_LineTextUnit_ParagraphTextUnit_PageTextUnit_DocumentUIA_AutomationFocusChangedEventIdNavigateDirection_FirstChildNavigateDirection_LastChildNavigateDirection_NextSiblingNavigateDirection_PreviousSiblingonecore\windows\core\console\open\src\host\registry.cpponecore\windows\core\console\open\src\host\ntprivapi.cppNtOpenProcessNtQueryInformationProcessNtCloseWriteCharsLegacy failed %xWriteCharsLegacy failed 0x%xonecore\windows\core\console\open\src\host\renderdata.cpponecore\windows\core\console\open\src\host\utf8towidecharparser.cpponecore\windows\core\console\open\src\host\conimeinfo.cpp"" invalid stoi argumentstoi argument out of rangeonecore\windows\core\console\open\src\host\commandnumberpopup.cpponecore\windows\core\console\open\src\host\commandlistpopup.cpp onecore\windows\core\console\open\src\host\exemain.cppConhostV1.dllConsoleCreateIoThreadonecore\windows\core\console\open\src\buffer\out\cursor.cpponecore\windows\core\console\open\src\buffer\out\textbuffer.cpp<>&</TITLE></HEAD><BODY><!DOCTYPE><HTML><HEAD><TITLE><!--StartFragment --><DIV STYLE="display:inline-block;white-space:pre;background-color:;font-family:'',monospace;font-size:pt;padding:px;"><BR></SPAN><SPAN STYLE="color:</DIV><!--EndFragment --></BODY></HTML>Version:0.9

Source: unknown	Process created: C:\Users\user\Desktop\conhost[1].exe "C:\Users\user\Desktop\conhost[1].exe"
Source: C:\Users\user\Desktop\conhost[1].exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe
Source: C:\Users\user\Desktop\conhost[1].exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe	Jump to behavior

Source: C:\Users\user\Desktop\conhost[1].exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{529A9E6B-6587-4F23-AB9E-9C7D683E3C50}\InProcServer32

Jump to behavior

Source: conhost[1].exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: conhost[1].exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: conhost[1].exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: conhost[1].exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: conhost[1].exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: conhost[1].exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: conhost[1].exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: conhost[1].exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source: conhost[1].exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: conhost.pdbUGP source: conhost[1].exe
Source:	Binary string: conhost.pdb source: conhost[1].exe

Source: conhost[1].exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: conhost[1].exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: conhost[1].exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: conhost[1].exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: conhost[1].exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: conhost[1].exe

Static PE information: section name: .didat

Source: C:\Users\user\Desktop\conhost[1].exe	Code function: 0_2_00007FF7E07FA540 EnterCriticalSection,NtdllDefWindowProc_W,LeaveCriticalSection,GetWindowRect,IsRectEmpty,GetWindowLongW,SetDlgItemTextW,SetWindowPos,IsIconic,MonitorFromRect,SetWindowPos,FreeLibrary,NtdllDefWindowProc_W,GetSystemMetrics,SetActiveWindow,SendMessageTimeoutW,NotifyWinEvent,		0_2_00007FF7E07FA540
Source: C:\Users\user\Desktop\conhost[1].exe	Code function: 0_2_00007FF7E07F8448 IsIconic,		0_2_00007FF7E07F8448

Source: C:\Users\user\Desktop\conhost[1].exe

Check user administrative privileges: GetTokenInformation,DecisionNodes

graph_0-51297

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\conhost[1].exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\conhost[1].exe

Code function: 0_2_00007FF7E080CBF0 DelayLoadFailureHook,LdrResolveDelayLoadedAPI,

0_2_00007FF7E080CBF0

Source: C:\Users\user\Desktop\conhost[1].exe

Code function: 0_2_00007FF7E07F9B68 GetCurrentThreadId,IsDebuggerPresent,OutputDebugStringW,

0_2_00007FF7E07F9B68

Source: C:\Users\user\Desktop\conhost[1].exe

Code function: 0_2_00007FF7E0807F10 RegOpenKeyW,RegEnumValueW,GetProcessHeap,HeapAlloc,RegCloseKey,GetProcessHeap,HeapFree,

0_2_00007FF7E0807F10

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\conhost[1].exe	Code function: 0_2_00007FF7E08103A0 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF7E08103A0
Source: C:\Users\user\Desktop\conhost[1].exe	Code function: 0_2_00007FF7E0810598 SetUnhandledExceptionFilter,	0_2_00007FF7E0810598
Source: C:\Users\user\Desktop\conhost[1].exe	Code function: 0_2_00007FF7E080F7A8 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00007FF7E080F7A8

Source: C:\Users\user\Desktop\conhost[1].exe

Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe

Jump to behavior

Source: C:\Users\user\Desktop\conhost[1].exe

Code function: 0_2_00007FF7E081023C GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00007FF7E081023C

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	11 Process Injection	11 Process Injection	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	LSASS Memory	2 Security Software Discovery	Remote Desktop Protocol	3 Clipboard Data	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 DLL Side-Loading	Security Account Manager	1 Application Window Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	2 System Information Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
conhost[1].exe	0%	Virustotal		Browse
conhost[1].exe	0%	ReversingLabs

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1417362
Start date and time:	2024-03-29 04:22:14 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 2s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	6
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	conhost[1].exe
Detection:	CLEAN
Classification:	clean9.winEXE@3/0@0/0
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 72 Number of non-executed functions: 234
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information

File type:	PE32+ executable (GUI) x86-64, for MS Windows
Entropy (8bit):	6.386413783874579
TrID:	Win64 Executable GUI (202006/5) 86.49% Win 9x/ME Control Panel applet (15529/13) 6.65% Win64 Executable (generic) (12005/4) 5.14% Generic Win/DOS Executable (2004/3) 0.86% DOS Executable Generic (2002/1) 0.86%
File name:	conhost[1].exe
File size:	867'328 bytes
MD5:	7417006ac4f38dbe0efd36647c3ebae4
SHA1:	4c7e2524a6d7cd99be807b7bfa544517cfd594d4
SHA256:	c43cf46192da061dd6169e55aac4d2d08a6c33c039a7dac0d88aa897661cbc87
SHA512:	eab3ed2a86b8f1e7126c18b18be5af8917aac3831a3ad60d9f529bd3dd658e1f75d99df2784e7a857c1db7023f4e5bdd489565de9ca99ab7f613f1a0e2d85eaf
SSDEEP:	12288:Q+YOjiKiYObiKaoHY0VXb6DVaivm5z6guM77d8Y4ndUtO9FDbWt:Q+bWQsiho4mctguS76Yi9FHK
TLSH:	71056C1EA6AC01E5D07EC17DC583CA2AF6B13C25037597CF01A0866E6F27BE95E3A750
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........?]T.^3..^3..^3..&...^3..57..^3..50..^3..^2..[3..52..^3..5>.z^3..56..^3..5...^3..5...^3..51..^3.Rich.^3.........PE..d....6./...

File Icon


Icon Hash:	a43a7ac70101a5a0

Static PE Info

General

Entrypoint:	0x14001f750
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
Time Stamp:	0x2FE436DC [Sun Jun 18 14:23:24 1995 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	10
OS Version Minor:	0
File Version Major:	10
File Version Minor:	0
Subsystem Version Major:	10
Subsystem Version Minor:	0
Import Hash:	0f64302d3280de299f4c51a78746f606

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
call 00007F6BF87E4098h
dec eax
add esp, 28h
jmp 00007F6BF87E3423h
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
nop word ptr [eax+eax+00000000h]
dec eax
cmp ecx, dword ptr [000A2AF1h]
jne 00007F6BF87E35C5h
dec eax
rol ecx, 10h
test cx, FFFFh
jne 00007F6BF87E35B5h
ret
dec eax
ror ecx, 10h
jmp 00007F6BF87E3624h
int3
int3
int3
int3
int3
int3
int3
inc eax
push ebx
dec eax
sub esp, 20h
dec eax
mov ebx, ecx
call dword ptr [0007F7B1h]
mov ecx, 00000001h
mov dword ptr [000A31BEh], eax
call 00007F6BF87E417Eh
xor ecx, ecx
call dword ptr [0007F7E1h]
dec eax
mov ecx, ebx
call dword ptr [0007F7D0h]
cmp dword ptr [000A31A1h], 00000000h
jne 00007F6BF87E35BCh
mov ecx, 00000001h
call 00007F6BF87E415Ah
call dword ptr [0007F9E7h]
dec eax
mov ecx, eax
mov edx, C0000409h
dec eax
add esp, 20h
pop ebx
dec eax
jmp dword ptr [0007FA1Bh]
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
dec eax
mov dword ptr [esp+08h], ecx
dec eax
sub esp, 00000000h

Rich Headers

Programming Language:

[IMP] VS2008 SP1 build 30729

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xbd5a8	0x410	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xd1000	0x86a0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0xc6000	0x9780	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xda000	0xda0	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0xa4260	0x70	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x9e190	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x9d8f0	0x118	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x9ef20	0xa60	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0xbb960	0x6c0	.rdata
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x9a110	0x9a200	588b2a2d085d94144c118e4cb7c1eaa3	False	0.5159782415855637	data	6.321080305133317	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x9c000	0x24a2e	0x24c00	e78f73923a09ab0d82b2a189e644dbe8	False	0.40723984906462585	data	5.670522802031959	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xc1000	0x48c0	0x1400	d3b82b8c888dcccd330ac5f5c51f7682	False	0.2419921875	data	3.2355515818086236	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0xc6000	0x9780	0x9800	77080da1b3195a06bac061fb4d132dd8	False	0.5125925164473685	data	6.014363156387493	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.didat	0xd0000	0x608	0x800	110846e2e1631ae75d74b370ea6335cc	False	0.22607421875	data	2.4846620841217035	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0xd1000	0x86a0	0x8800	2d3696c9b9844c1d1aa277f6cd6b3323	False	0.2858455882352941	data	4.389595174659561	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xda000	0xda0	0xe00	77e7de05e8028492609a15f1395cbea6	False	0.365234375	data	5.413625264843202	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
MUI	0xd95c8	0xd8	data	English	United States	0.5416666666666666
RT_ICON	0xd19b0	0x668	Device independent bitmap graphic, 48 x 96 x 4, image size 1152	English	United States	0.21097560975609755
RT_ICON	0xd2018	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 512	English	United States	0.2647849462365591
RT_ICON	0xd2300	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128	English	United States	0.3783783783783784
RT_ICON	0xd2428	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	English	United States	0.11567164179104478
RT_ICON	0xd32d0	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	English	United States	0.18592057761732853
RT_ICON	0xd3b78	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	English	United States	0.08236994219653179
RT_ICON	0xd40e0	0x169e	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States	0.968048359240069
RT_ICON	0xd5780	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.06130705394190871
RT_ICON	0xd7d28	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	United States	0.1177298311444653
RT_ICON	0xd8dd0	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.09308510638297872
RT_GROUP_ICON	0xd9238	0x92	data	English	United States	0.636986301369863
RT_VERSION	0xd1620	0x38c	data	English	United States	0.4592511013215859
RT_MANIFEST	0xd1380	0x29d	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.5246636771300448
RT_MANIFEST	0xd92d0	0x2f4	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.47883597883597884

Imports

DLL	Import
msvcp_win.dll	?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ, ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z, ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ, ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ, ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ, ?width@ios_base@std@@QEBA_JXZ, ?width@ios_base@std@@QEAA_J_J@Z, ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z, ?good@ios_base@std@@QEBA_NXZ, ?uncaught_exception@std@@YA_NXZ, ?flags@ios_base@std@@QEBAHXZ, ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ, ?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ, ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ, ?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ, ?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ, ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ, ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ, ?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z, ?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ, ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ, ?pbase@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ, ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z, ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z, ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z, ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z, ?_Xlength_error@std@@YAXPEBD@Z, ?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD0@Z, ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ, ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ, ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z, ?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ, ?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADXZ, ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ, ?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ, ?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ, ?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z, ?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ, ?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z, ?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAADD@Z, ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z, ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z, ?_Xout_of_range@std@@YAXPEBD@Z, ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z, ?tellp@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA?AV?$fpos@U_Mbstatet@@@2@XZ, ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z, ?setf@ios_base@std@@QEAAHHH@Z, ?setf@ios_base@std@@QEAAHH@Z, ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@F@Z, ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z, ?_Xbad_function_call@std@@YAXXZ, ?_Xinvalid_argument@std@@YAXPEBD@Z, ?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z, _Mtx_destroy_in_situ, _Mtx_unlock, ?_Throw_C_error@std@@YAXH@Z, _Mtx_lock, _Mtx_init_in_situ, ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
api-ms-win-crt-time-l1-1-0.dll	_time64
api-ms-win-crt-runtime-l1-1-0.dll	_register_thread_local_exe_atexit_callback, _initterm, _c_exit, _initterm_e
api-ms-win-crt-private-l1-1-0.dll	_o__get_wide_winmain_command_line, _o__initialize_onexit_table, _o__initialize_wide_environment, _o__invalid_parameter_noinfo, _o__invalid_parameter_noinfo_noreturn, _o__itoa_s, _o__purecall, _o__register_onexit_function, _o__seh_filter_exe, _o__set_app_type, _o__set_fmode, _o__set_new_mode, memmove, _o__wcsicmp, _o__wcsnicmp, _o_calloc, _o_exit, _o_floor, _o_free, _o_iswdigit, _o_iswspace, _o_malloc, _o_roundf, _o_sqrt, _o_terminate, _o_towlower, _o_towupper, _o_wcscpy_s, _o_wcstol, _o_wcstoul, __C_specific_handler, __CxxFrameHandler3, _CxxThrowException, _o__exit, _o__errno, _o__crt_atexit, _o__configure_wide_argv, _o__configthreadlocale, _o__cexit, _o__callnewh, _o___stdio_common_vswprintf_s, _o___stdio_common_vswprintf, _o___stdio_common_vsprintf_s, _o___stdio_common_vsprintf, _o___stdio_common_vsnwprintf_s, _o___stdio_common_vsnprintf_s, _o___std_exception_destroy, _o___std_exception_copy, _o___p__commode, __std_terminate, __CxxFrameHandler4, memcmp, memcpy, wcschr
api-ms-win-crt-string-l1-1-0.dll	wcsncmp, wcsnlen, memset, wcscmp
api-ms-win-core-libraryloader-l1-2-0.dll	LockResource, LoadResource, GetProcAddress, FindResourceExW, LoadLibraryExW, LoadStringW, GetModuleHandleW, FreeLibrary, GetModuleFileNameW, GetModuleFileNameA, GetModuleHandleExW
api-ms-win-core-synch-l1-1-0.dll	ResetEvent, CreateEventW, InitializeCriticalSectionAndSpinCount, AcquireSRWLockExclusive, ReleaseSRWLockExclusive, WaitForSingleObject, AcquireSRWLockShared, LeaveCriticalSection, TryEnterCriticalSection, EnterCriticalSection, DeleteCriticalSection, InitializeCriticalSection, WaitForSingleObjectEx, OpenSemaphoreW, ReleaseSemaphore, InitializeCriticalSectionEx, CreateSemaphoreExW, CreateMutexExW, SetEvent, CreateEventExW, ReleaseMutex, ReleaseSRWLockShared
api-ms-win-core-heap-l1-1-0.dll	GetProcessHeap, HeapAlloc, HeapFree
api-ms-win-core-errorhandling-l1-1-0.dll	UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetLastError, SetLastError
api-ms-win-core-processthreads-l1-1-0.dll	GetProcessTimes, DeleteProcThreadAttributeList, InitializeProcThreadAttributeList, UpdateProcThreadAttribute, GetStartupInfoW, GetCurrentProcess, CreateProcessW, GetCurrentThread, GetCurrentThreadId, OpenProcessToken, CreateThread, ExitThread, SetProcessShutdownParameters, GetCurrentProcessId, TerminateProcess, ExitProcess
api-ms-win-core-localization-l1-2-0.dll	FormatMessageW, GetOEMCP, GetCPInfo, GetUserDefaultLocaleName, IsValidCodePage, GetACP
api-ms-win-core-debug-l1-1-0.dll	OutputDebugStringW, IsDebuggerPresent, OutputDebugStringA, DebugBreak
api-ms-win-core-handle-l1-1-0.dll	DuplicateHandle, CloseHandle
api-ms-win-core-threadpool-legacy-l1-1-0.dll	CreateTimerQueueTimer, CreateTimerQueue, DeleteTimerQueueEx, DeleteTimerQueueTimer
api-ms-win-core-file-l1-1-0.dll	ReadFile, WriteFile
api-ms-win-core-sidebyside-l1-1-0.dll	CreateActCtxW
api-ms-win-core-processenvironment-l1-1-0.dll	SearchPathW, GetCommandLineW, SetEnvironmentVariableW, GetEnvironmentVariableW, ExpandEnvironmentStringsW, GetStdHandle
api-ms-win-core-registry-l1-1-0.dll	RegOpenKeyExW, RegEnumValueW, RegCloseKey, RegGetValueW, RegQueryValueExW, RegOpenCurrentUser
api-ms-win-core-string-l1-1-0.dll	MultiByteToWideChar, WideCharToMultiByte, CompareStringOrdinal, GetStringTypeW
api-ms-win-core-threadpool-l1-2-0.dll	CloseThreadpoolTimer, WaitForThreadpoolTimerCallbacks, CreateThreadpoolTimer, SetThreadpoolTimer
api-ms-win-core-sysinfo-l1-1-0.dll	GetSystemTimeAsFileTime, GetWindowsDirectoryW, GetSystemDirectoryW
api-ms-win-eventing-provider-l1-1-0.dll	EventUnregister, EventWriteTransfer, EventRegister, EventSetInformation, EventActivityIdControl
api-ms-win-core-psapi-l1-1-0.dll	QueryFullProcessImageNameW
api-ms-win-core-shlwapi-legacy-l1-1-0.dll	PathIsSameRootW, PathFileExistsW, PathFindFileNameW
api-ms-win-shcore-obsolete-l1-1-0.dll	CommandLineToArgvW
api-ms-win-core-heap-l2-1-0.dll	LocalFree, GlobalAlloc, GlobalFree
ntdll.dll	RtlFreeHeap, RtlAllocateHeap, RtlQueryPackageClaims, NtQueryVolumeInformationFile, CsrClientCallServer, NtAlpcSendWaitReceivePort, RtlCreateUnicodeString, NtAlpcQueryInformationMessage, NtAlpcConnectPort, AlpcInitializeMessageAttribute, AlpcGetMessageAttribute
api-ms-win-core-rtlsupport-l1-1-0.dll	RtlLookupFunctionEntry, RtlCaptureContext, RtlVirtualUnwind
api-ms-win-core-processthreads-l1-1-1.dll	OpenProcess, IsProcessorFeaturePresent
api-ms-win-core-profile-l1-1-0.dll	QueryPerformanceCounter
api-ms-win-core-interlocked-l1-1-0.dll	InitializeSListHead
api-ms-win-core-com-l1-1-0.dll	CoUninitialize, CoTaskMemFree, CoInitializeEx, IIDFromString, CoCreateInstance
api-ms-win-core-registry-l2-1-0.dll	RegCreateKeyW, RegOpenKeyW
api-ms-win-core-synch-l1-2-0.dll	Sleep, SignalObjectAndWait
api-ms-win-core-io-l1-1-0.dll	DeviceIoControl
api-ms-win-core-namedpipe-l1-1-0.dll	CreatePipe
api-ms-win-core-processthreads-l1-1-3.dll	SetThreadDescription
api-ms-win-core-libraryloader-l1-2-1.dll	LoadLibraryW
api-ms-win-core-heap-obsolete-l1-1-0.dll	GlobalLock, GlobalUnlock, GlobalSize
api-ms-win-core-io-l1-1-1.dll	CancelSynchronousIo
api-ms-win-core-util-l1-1-0.dll	Beep
api-ms-win-core-apiquery-l1-1-0.dll	ApiSetQueryApiSetPresence
api-ms-win-security-base-l1-1-0.dll	GetSidSubAuthority, GetTokenInformation, GetSidSubAuthorityCount
api-ms-win-core-path-l1-1-0.dll	PathCchRemoveExtension
api-ms-win-shell-shellcom-l1-1-0.dll	SHCoCreateInstance
api-ms-win-core-sysinfo-l1-2-0.dll	VerSetConditionMask
api-ms-win-core-kernel32-legacy-l1-1-1.dll	VerifyVersionInfoW
api-ms-win-core-largeinteger-l1-1-0.dll	MulDiv
api-ms-win-core-delayload-l1-1-1.dll	ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0.dll	DelayLoadFailureHook
api-ms-win-crt-math-l1-1-0.dll	ceilf

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Target ID:	0
Start time:	04:22:57
Start date:	29/03/2024
Path:	C:\Users\user\Desktop\conhost[1].exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\conhost[1].exe"
Imagebase:	0x7ff7e07f0000
File size:	867'328 bytes
MD5 hash:	7417006AC4F38DBE0EFD36647C3EBAE4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	1
Start time:	04:22:57
Start date:	29/03/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe
Imagebase:	0x7ff7f42f0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	6.4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	17.8%
Total number of Nodes:	2000
Total number of Limit Nodes:	63

Executed Functions

Function 00007FF7E086A2D4 Relevance: 60.0, APIs: 28, Strings: 6, Instructions: 483
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CloseHandle.API-MS-WIN-CORE-HANDLE-L1-1-0 ref: 00007FF7E086A365
CloseHandle.API-MS-WIN-CORE-HANDLE-L1-1-0 ref: 00007FF7E086A3FF

Strings

%WINDIR%\system32\cmd.exe, xrefs: 00007FF7E086A83B
onecore\windows\core\console\open\src\server\entrypoints.cpp, xrefs: 00007FF7E086A344, 00007FF7E086A3D4, 00007FF7E086A48D, 00007FF7E086A57A, 00007FF7E086A64A, 00007FF7E086A6C6, 00007FF7E086A775, 00007FF7E086A86B, 00007FF7E086A8CC, 00007FF7E086A974, 00007FF7E086AA5E
\Output, xrefs: 00007FF7E086A4FB
\Input, xrefs: 00007FF7E086A473
\Device\ConDrv\Server, xrefs: 00007FF7E086A325
\Reference, xrefs: 00007FF7E086A3BC

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: CloseHandle
String ID: %WINDIR%\system32\cmd.exe$\Device\ConDrv\Server$\Input$\Output$\Reference$onecore\windows\core\console\open\src\server\entrypoints.cpp
API String ID: 2962429428-1317094634
Opcode ID: 2fb6155ce4c142ed654327455baf2032791b064daada749f767de5a627f7465d
Instruction ID: d58e1b04a2cba54671d3f0b7f541bc409e4677e5df18e73a0c58f7ca9f583c90
Opcode Fuzzy Hash: 2fb6155ce4c142ed654327455baf2032791b064daada749f767de5a627f7465d
Instruction Fuzzy Hash: 3722A432608A8286E710AB21E8407EDF760FB85BA8FC04232DA5D57BD9DF7CE554CB11

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E07FA540 Relevance: 34.0, APIs: 17, Strings: 2, Instructions: 785nativeCOMMON

Download Yara Rule

APIs

EnterCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FF7E07FA5A1
NtdllDefWindowProc_W.NTDLL ref: 00007FF7E07FA6DB
NotifyWinEvent.USER32 ref: 00007FF7E081DC0B

Strings

onecore\windows\core\console\open\src\interactivity\win32\windowproc.cpp, xrefs: 00007FF7E081D7D7, 00007FF7E081D85C
~, xrefs: 00007FF7E07FA648

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: CriticalEnterEventNotifyNtdllProc_SectionWindow
String ID: onecore\windows\core\console\open\src\interactivity\win32\windowproc.cpp$~
API String ID: 1545919202-736058143
Opcode ID: 85ec1b87d71284b0c9983e4654e457e1ce9ca4ec13fdeaa8fd0d62b9e291da42
Instruction ID: ff447a891a20fd7cd481ff2cc06ffc7ca56711755bc27e4587c59df85af9253b
Opcode Fuzzy Hash: 85ec1b87d71284b0c9983e4654e457e1ce9ca4ec13fdeaa8fd0d62b9e291da42
Instruction Fuzzy Hash: D8729162A0C6438AFA24BB25E450779E7A1FF99744FD44137DA8E43795CE3CF4608B22

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E08001E0 Relevance: 26.9, APIs: 9, Strings: 6, Instructions: 696
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

invalid unordered_map<K, T> key, xrefs: 00007FF7E081FB50
onecore\windows\core\console\open\src\renderer\base\renderer.cpp, xrefs: 00007FF7E081FB67, 00007FF7E081FB7C
invalid vector<T> subscript, xrefs: 00007FF7E081FB8E
invalid deque<T> subscript, xrefs: 00007FF7E081FC5A, 00007FF7E081FC6E
VUUUUUUU, xrefs: 00007FF7E08006C2
onecore\windows\core\console\open\src\buffer\out\textbuffercelliterator.cpp, xrefs: 00007FF7E081FBA8, 00007FF7E081FBC0

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID:
String ID: VUUUUUUU$invalid deque<T> subscript$invalid unordered_map<K, T> key$invalid vector<T> subscript$onecore\windows\core\console\open\src\buffer\out\textbuffercelliterator.cpp$onecore\windows\core\console\open\src\renderer\base\renderer.cpp
API String ID: 0-1200157833
Opcode ID: 4a6cfa8453aac8f9fae70810a8c520623c7b5b6ab5367d6bae87c6ed507a9865
Instruction ID: d16f77cbb56c82e335a9a6e407377471be04f73acdf16ae4e622366463c835f7
Opcode Fuzzy Hash: 4a6cfa8453aac8f9fae70810a8c520623c7b5b6ab5367d6bae87c6ed507a9865
Instruction Fuzzy Hash: 8562CE22A18B8585EB20AF65D4503FDB7A1FF54B88F905023EA8D17B5ADF3CE560C721

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E07F3840 Relevance: 21.3, APIs: 7, Strings: 5, Instructions: 268
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF7E080FD8C: _o_malloc.API-MS-WIN-CRT-PRIVATE-L1-1-0(?,?,00000000,00007FF7E080393E,?,?,?,?,00007FF7E082A040,?,?,?,?,?,?,?), ref: 00007FF7E080FDA6

Part of subcall function 00007FF7E07F336C: memset.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7E07F33F3

CreateWindowExW.USER32 ref: 00007FF7E07F3A07
FreeLibrary.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0 ref: 00007FF7E07F3AFB
MonitorFromRect.USER32 ref: 00007FF7E081B346
MonitorFromRect.USER32 ref: 00007FF7E081B366
GetMonitorInfoW.USER32 ref: 00007FF7E081B3A5

Part of subcall function 00007FF7E07F3C20: LoadLibraryExW.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0 ref: 00007FF7E07F3C4A

Part of subcall function 00007FF7E07F3B50: GetProcAddress.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0 ref: 00007FF7E07F3B80

Strings

onecore\windows\core\console\open\src\interactivity\win32\window.cpp, xrefs: 00007FF7E081B487, 00007FF7E081B4C0
onecore\windows\core\console\open\src\renderer\dx\dxrenderer.cpp, xrefs: 00007FF7E081B452
(, xrefs: 00007FF7E081B38F
ConsoleWindowClass, xrefs: 00007FF7E07F39FB
CreateWindow failed with gle = 0x%x, xrefs: 00007FF7E081B40E

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: Monitor$FromLibraryRect$AddressCreateFreeInfoLoadProcWindow_o_mallocmemset
String ID: ($ConsoleWindowClass$CreateWindow failed with gle = 0x%x$onecore\windows\core\console\open\src\interactivity\win32\window.cpp$onecore\windows\core\console\open\src\renderer\dx\dxrenderer.cpp
API String ID: 1139980140-1952155981
Opcode ID: 50eb771a3ee9fdf65174a5cd7481a29a364981a9268b66c08aa05397ad2b211d
Instruction ID: bbdb39d408d244f853a1d5cbe2cfd69da453a1ddf7bbfc552f792c6661a9fa23
Opcode Fuzzy Hash: 50eb771a3ee9fdf65174a5cd7481a29a364981a9268b66c08aa05397ad2b211d
Instruction Fuzzy Hash: 83C17271A087828AEB60EB65E4507BAF7A0FB99744F808036DA8D47755DF3CF464CB21

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E07F4030 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 207
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7E07F408B
CoInitializeEx.API-MS-WIN-CORE-COM-L1-1-0 ref: 00007FF7E07F40BB
memset.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7E07F414D
memset.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7E07F419C
CoUninitialize.API-MS-WIN-CORE-COM-L1-1-0 ref: 00007FF7E07F427E
SearchPathW.KERNELBASE ref: 00007FF7E07F42BC
PathFileExistsW.KERNELBASE ref: 00007FF7E07F42D4
IsValidCodePage.API-MS-WIN-CORE-LOCALIZATION-L1-2-0 ref: 00007FF7E07F4354

Strings

onecore\windows\core\console\open\src\interactivity\win32\systemconfigurationprovider.cpp, xrefs: 00007FF7E07F433D

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: memset$Path$CodeExistsFileInitializePageSearchUninitializeValid
String ID: onecore\windows\core\console\open\src\interactivity\win32\systemconfigurationprovider.cpp
API String ID: 1996372929-2568609167
Opcode ID: 130623dbf95e0c9764bd701d9cf7bcae3037fa7c1d87cbedf5cef16bede689bb
Instruction ID: 290b093cfa8c47b8bf5710d81d9c7bf01afd8e070dbd1344b64172a31e094a7d
Opcode Fuzzy Hash: 130623dbf95e0c9764bd701d9cf7bcae3037fa7c1d87cbedf5cef16bede689bb
Instruction Fuzzy Hash: 9B9174316087828AEB20EF65E8443AAB7A0FF49794F804136DA4D47795DF3CF565CB21

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E0807F10 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 144
memoryregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyW.ADVAPI32 ref: 00007FF7E0807F70
RegEnumValueW.KERNELBASE ref: 00007FF7E0807FCE
GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0 ref: 00007FF7E0807FF3
HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0 ref: 00007FF7E080800D
RegCloseKey.KERNELBASE ref: 00007FF7E0808100
GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0 ref: 00007FF7E0822A0A
HeapFree.API-MS-WIN-CORE-HEAP-L1-1-0 ref: 00007FF7E0822A1E

Strings

Software\Microsoft\Windows NT\CurrentVersion\Console\TrueTypeFont, xrefs: 00007FF7E0807F62
*, xrefs: 00007FF7E080807A

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: Heap$Process$AllocCloseEnumFreeOpenValue
String ID: *$Software\Microsoft\Windows NT\CurrentVersion\Console\TrueTypeFont
API String ID: 1259498659-1414037276
Opcode ID: 95a25b4c387e207c0183909abcc9ae36269f40b986082016df7b61991ff046e6
Instruction ID: 42d307c40f65ef6610f9da97e5654a4b2924b7e410349451ee428eeff216be28
Opcode Fuzzy Hash: 95a25b4c387e207c0183909abcc9ae36269f40b986082016df7b61991ff046e6
Instruction Fuzzy Hash: 8D619F32A08B82C6E710AF20E4003AAB7E4FB49B55FD44532DA8D577A4DF7CE565CB21

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E08024C0 Relevance: 14.3, APIs: 4, Strings: 4, Instructions: 310
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7E08025A2
DeviceIoControl.KERNELBASE ref: 00007FF7E08025FB
_Init_thread_footer.LIBCMT ref: 00007FF7E0820F66

Strings

onecore\windows\core\console\open\src\server\apidispatchers.cpp, xrefs: 00007FF7E0820F7D, 00007FF7E0820FC5, 00007FF7E0821075, 00007FF7E082109B, 00007FF7E08210BC
onecore\windows\core\console\open\src\server\objecthandle.cpp, xrefs: 00007FF7E0820FAE
onecore\windows\core\console\open\src\server\devicecomm.cpp, xrefs: 00007FF7E0821032
onecore\windows\core\console\open\src\server\apimessage.cpp, xrefs: 00007FF7E0820FEA, 00007FF7E0821012, 00007FF7E0821055

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: ControlDeviceInit_thread_footermemset
String ID: onecore\windows\core\console\open\src\server\apidispatchers.cpp$onecore\windows\core\console\open\src\server\apimessage.cpp$onecore\windows\core\console\open\src\server\devicecomm.cpp$onecore\windows\core\console\open\src\server\objecthandle.cpp
API String ID: 1779181428-3195736410
Opcode ID: dbd94078d11fc217706ec849a00fb5915cd96b8e9a403e26537bcbb400a994f5
Instruction ID: 4f4b88db8834f8f57b3ae6d1bf53d393734446b94cf5b8e30476f31f82f5b702
Opcode Fuzzy Hash: dbd94078d11fc217706ec849a00fb5915cd96b8e9a403e26537bcbb400a994f5
Instruction Fuzzy Hash: E8E17D36A09A4289FB10EF65D4403A9A3A5FB58B88F904133EE0D57799DF38F464C762

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E07F4890 Relevance: 12.1, APIs: 8, Instructions: 90threadCOMMON

Download Yara Rule

APIs

CreateEventW.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FF7E07F48B2
CreateEventW.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FF7E07F48E4
CreateEventW.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FF7E07F490D
CreateThread.KERNELBASE ref: 00007FF7E07F4943
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF7E081BA12

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: Create$Event$ErrorLastThread
String ID:
API String ID: 933546937-0
Opcode ID: 3e705504bee1b986780280c992fec324ae05ee63325228fd33bfdb941f436ccb
Instruction ID: 254eb3361a11305c02f3c879237be25ef07491018c1cbfed245c893ce2ec1c09
Opcode Fuzzy Hash: 3e705504bee1b986780280c992fec324ae05ee63325228fd33bfdb941f436ccb
Instruction Fuzzy Hash: 02315E36B08B5387E724ABA1A04037AEAA0FF8D745F848136CA4D46780DF78F0748721

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E080C444 Relevance: 4.8, APIs: 3, Instructions: 269comCOMMON

Download Yara Rule

APIs

CoInitializeEx.API-MS-WIN-CORE-COM-L1-1-0 ref: 00007FF7E080C492
CoCreateInstance.API-MS-WIN-CORE-COM-L1-1-0 ref: 00007FF7E080C4D7
CoCreateInstance.API-MS-WIN-CORE-COM-L1-1-0 ref: 00007FF7E080C629

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: CreateInstance$Initialize
String ID:
API String ID: 1108742289-0
Opcode ID: 9405de347dbfd829269eb6ef14b9164b92aa1fec28bf2dfa18d124d9f41105d7
Instruction ID: 10be39f181316f509972e27940da6c0385a9d3b3419f0cca04679836cc604eed
Opcode Fuzzy Hash: 9405de347dbfd829269eb6ef14b9164b92aa1fec28bf2dfa18d124d9f41105d7
Instruction Fuzzy Hash: F3C14C36B09A0792EB10EF69D8402ADB764FB88B98B954033CE0D57364DF38F469C361

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E07F9B68 Relevance: 4.7, APIs: 3, Instructions: 192threadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentThreadId.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF7E07F9C12
IsDebuggerPresent.API-MS-WIN-CORE-DEBUG-L1-1-0 ref: 00007FF7E07F9CF2

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: CurrentDebuggerPresentThread
String ID:
API String ID: 1979983199-0
Opcode ID: 08a343c138afcf0e4278cadc290ad3ac2402ddb9d0d3f4566890aecefd591565
Instruction ID: 4074ca8e924f85a65acacc16938b4623d91ea79076ce7b12a8b50284f00ca69a
Opcode Fuzzy Hash: 08a343c138afcf0e4278cadc290ad3ac2402ddb9d0d3f4566890aecefd591565
Instruction Fuzzy Hash: BD814A21A08B8285EA61AF25A840379F7A5FF49B84F945037C98D07365DF3CF860C722

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E07FA4A0 Relevance: 4.5, APIs: 3, Instructions: 41COMMON

Download Yara Rule

APIs

GetWindowLongPtrW.USER32 ref: 00007FF7E07FA4CC
SetWindowLongPtrW.USER32 ref: 00007FF7E07FA52A

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: LongWindow
String ID:
API String ID: 1378638983-0
Opcode ID: eaccde9b1cf64f8869ceb46db073be90b0a48436feec131d932085be766eb376
Instruction ID: 754183eb02c64153c75d1524cda521183dbac244881030a77410abb59755c36b
Opcode Fuzzy Hash: eaccde9b1cf64f8869ceb46db073be90b0a48436feec131d932085be766eb376
Instruction Fuzzy Hash: A2015631608B81CADA105B56B404179F760FB8EFD0B9C8136EE9D07795DF3CE4618B51

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E086E17C Relevance: 3.0, APIs: 2, Instructions: 41filenativeCOMMON

Download Yara Rule

APIs

NtOpenFile.NTDLL ref: 00007FF7E086E20E

Part of subcall function 00007FF7E0810000: EnterCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,?,00007FF7E0803769,?,?,?,?,00007FF7E081B159), ref: 00007FF7E0810010

Part of subcall function 00007FF7E086E0D4: LoadLibraryExW.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0(?,?,?,00007FF7E086E1D3), ref: 00007FF7E086E0F9
Part of subcall function 00007FF7E086E0D4: GetProcAddress.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0(?,?,?,00007FF7E086E1D3), ref: 00007FF7E086E130

Part of subcall function 00007FF7E080FD30: _onexit.LIBCMT ref: 00007FF7E080FD34

_Init_thread_footer.LIBCMT ref: 00007FF7E086E1E7

Part of subcall function 00007FF7E080FF98: EnterCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,?,00007FF7E0803790,?,?,?,?,00007FF7E081B159), ref: 00007FF7E080FFA8
Part of subcall function 00007FF7E080FF98: LeaveCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,?,00007FF7E0803790,?,?,?,?,00007FF7E081B159), ref: 00007FF7E080FFE8

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: CriticalSection$Enter$AddressFileInit_thread_footerLeaveLibraryLoadOpenProc_onexit
String ID:
API String ID: 3950269274-0
Opcode ID: 4a57cf8ef95a6fa6ad051b5736db962d27c8695b47695afc9f959abf5f25bdc2
Instruction ID: 62102d6cdd70289c05abae2ab706e0713e5e90134efd4f4ccb7c20ecb858f578
Opcode Fuzzy Hash: 4a57cf8ef95a6fa6ad051b5736db962d27c8695b47695afc9f959abf5f25bdc2
Instruction Fuzzy Hash: 2A114F35A08A4196E710EB15F840366F760FB85794F904133EA4D53BA5CE3CF965CF22

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E080CBF0 Relevance: 1.5, APIs: 1, Instructions: 12libraryCOMMON

Download Yara Rule

APIs

LdrResolveDelayLoadedAPI.NTDLL ref: 00007FF7E080CC1B

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: DelayLoadedResolve
String ID:
API String ID: 841769287-0
Opcode ID: d4bcf5648cf3a719f65998386e3ed87ae81a2469b60f108fe8cbda3770a06d38
Instruction ID: e9940666b51a2946455373ac65ade06cdb120be9dac03a00bbf6e8dc3dd6f9e3
Opcode Fuzzy Hash: d4bcf5648cf3a719f65998386e3ed87ae81a2469b60f108fe8cbda3770a06d38
Instruction Fuzzy Hash: 2BE0B674A08A818AE610AB44E800264FB60FB49795FC04277D94C57324DF3CB164CB65

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E080FD8C Relevance: 28.1, APIs: 11, Strings: 5, Instructions: 141
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_o_malloc.API-MS-WIN-CRT-PRIVATE-L1-1-0(?,?,00000000,00007FF7E080393E,?,?,?,?,00007FF7E082A040,?,?,?,?,?,?,?), ref: 00007FF7E080FDA6
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7E080FDBC

Part of subcall function 00007FF7E0810964: std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF7E081096D
Part of subcall function 00007FF7E0810964: _CxxThrowException.API-MS-WIN-CRT-PRIVATE-L1-1-0(?,?,?,?,?,?,?,?,00007FF7E080FDC1,?,?,00000000,00007FF7E080393E), ref: 00007FF7E081097E

InitializeCriticalSectionAndSpinCount.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FF7E080FDF5
GetModuleHandleW.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0 ref: 00007FF7E080FE03
GetModuleHandleW.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0 ref: 00007FF7E080FE19
GetProcAddress.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0 ref: 00007FF7E080FE36
GetProcAddress.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0 ref: 00007FF7E080FE4A
GetProcAddress.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0 ref: 00007FF7E080FE5E
CreateEventW.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FF7E080FEF7
DeleteCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FF7E080FF3B
CloseHandle.API-MS-WIN-CORE-HANDLE-L1-1-0 ref: 00007FF7E080FF4D

Part of subcall function 00007FF7E08103A0: IsProcessorFeaturePresent.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-1 ref: 00007FF7E08103BC
Part of subcall function 00007FF7E08103A0: memset.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7E08103E0
Part of subcall function 00007FF7E08103A0: RtlCaptureContext.API-MS-WIN-CORE-RTLSUPPORT-L1-1-0 ref: 00007FF7E08103E9
Part of subcall function 00007FF7E08103A0: RtlLookupFunctionEntry.API-MS-WIN-CORE-RTLSUPPORT-L1-1-0 ref: 00007FF7E0810403
Part of subcall function 00007FF7E08103A0: RtlVirtualUnwind.API-MS-WIN-CORE-RTLSUPPORT-L1-1-0 ref: 00007FF7E0810444
Part of subcall function 00007FF7E08103A0: memset.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7E0810477
Part of subcall function 00007FF7E08103A0: IsDebuggerPresent.API-MS-WIN-CORE-DEBUG-L1-1-0 ref: 00007FF7E0810498
Part of subcall function 00007FF7E08103A0: SetUnhandledExceptionFilter.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF7E08104B9
Part of subcall function 00007FF7E08103A0: UnhandledExceptionFilter.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF7E08104C4

Strings

kernel32.dll, xrefs: 00007FF7E080FE12
api-ms-win-core-synch-l1-2-0.dll, xrefs: 00007FF7E080FDFC
SleepConditionVariableCS, xrefs: 00007FF7E080FE40
InitializeConditionVariable, xrefs: 00007FF7E080FE2C
WakeAllConditionVariable, xrefs: 00007FF7E080FE54

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: AddressExceptionHandleProc$CriticalFilterModulePresentSectionUnhandledmemset$CaptureCloseConcurrency::cancel_current_taskContextCountCreateDebuggerDeleteEntryEventFeatureFunctionInitializeLookupProcessorSpinThrowUnwindVirtual_o_mallocstd::bad_alloc::bad_alloc
String ID: InitializeConditionVariable$SleepConditionVariableCS$WakeAllConditionVariable$api-ms-win-core-synch-l1-2-0.dll$kernel32.dll
API String ID: 683641506-1714406822
Opcode ID: 89482b8a29658c4957c474c3bd8516f9c8688f04d070855abcecea634f7f21d8
Instruction ID: 67da92f9da6cbe162c254bf36717d82f1bb55ce951566249d4deefbfe8a2f710
Opcode Fuzzy Hash: 89482b8a29658c4957c474c3bd8516f9c8688f04d070855abcecea634f7f21d8
Instruction Fuzzy Hash: D5416010A09B0382FA14BB24E810376E290BF567A4FD45633C91D667E6DF3CF8658632

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E0808200 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 110
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenCurrentUser.KERNELBASE ref: 00007FF7E0808238
RegOpenKeyW.ADVAPI32 ref: 00007FF7E0808272

Strings

Console, xrefs: 00007FF7E080826B, 00007FF7E0822AC4

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: Open$CurrentUser
String ID: Console
API String ID: 688027284-4190041642
Opcode ID: fc13efb3c6ea6ebafb38fb605395a0d4d6430630945e86f989dda7effe20daf3
Instruction ID: 9089fbadee4ef72e4882b0fdccef959cc3303d89768f32cd442746bd8ffd41b9
Opcode Fuzzy Hash: fc13efb3c6ea6ebafb38fb605395a0d4d6430630945e86f989dda7effe20daf3
Instruction Fuzzy Hash: 43416431608F42CAE710AF65E844378BBA0FB4DBA9F855232DA4E47794DF7CE4548321

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E07F8AF4 Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 203
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetClientRect.USER32 ref: 00007FF7E07F8B21
GetDC.USER32 ref: 00007FF7E07F8B8C
DeleteObject.GDI32 ref: 00007FF7E07F8BF6
DeleteDC.GDI32 ref: 00007FF7E07F8C12
DeleteObject.GDI32 ref: 00007FF7E07F8D16
DeleteDC.GDI32 ref: 00007FF7E07F8D26

Strings

onecore\windows\core\console\open\src\renderer\gdi\paint.cpp, xrefs: 00007FF7E081C7FA, 00007FF7E081C832, 00007FF7E081C851, 00007FF7E081C8A0, 00007FF7E081C8E1
, xrefs: 00007FF7E07F8C8E

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: Delete$Object$ClientRect
String ID: $onecore\windows\core\console\open\src\renderer\gdi\paint.cpp
API String ID: 3225647489-3907913552
Opcode ID: 0957ca3f2d78c0b5a0fe66ec131cf66af33073c9cc4b9ebdbd41c3cd4258681e
Instruction ID: 9bb44451ef964b49f13be0458a71dd3021725576c9629a743e055cad6c3f5867
Opcode Fuzzy Hash: 0957ca3f2d78c0b5a0fe66ec131cf66af33073c9cc4b9ebdbd41c3cd4258681e
Instruction Fuzzy Hash: EE818431A097818AEA50AB51A44077AFBA1FF8EB81F85A036CD0E57754DF3CF465CB12

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E07F364C Relevance: 16.6, APIs: 11, Instructions: 117
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemMenu.USER32 ref: 00007FF7E07F3676
LoadMenuW.USER32 ref: 00007FF7E07F3691
LoadStringW.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0 ref: 00007FF7E07F36EA
AppendMenuW.USER32 ref: 00007FF7E07F3709
LoadStringW.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0 ref: 00007FF7E07F372B
memset.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7E07F374A
SetMenuItemInfoW.USER32 ref: 00007FF7E07F3779
LoadStringW.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0 ref: 00007FF7E07F379F
AppendMenuW.USER32 ref: 00007FF7E07F37BB
LoadStringW.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0 ref: 00007FF7E07F37E1
AppendMenuW.USER32 ref: 00007FF7E07F37FD

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: Menu$Load$String$Append$InfoItemSystemmemset
String ID:
API String ID: 398140726-0
Opcode ID: c08555cc84f6c1548c84f533c10935f9dc63a1cdd43766967cfbe5da3ba769fb
Instruction ID: 498ebf7581caaeb4ed495de73f327a7e55996134b0db81f0ae70c92729455edf
Opcode Fuzzy Hash: c08555cc84f6c1548c84f533c10935f9dc63a1cdd43766967cfbe5da3ba769fb
Instruction Fuzzy Hash: 02516B35B04B468AF700AF61E4447B9ABA0FB89B94F848532CD0D67B54DF38E529CB61

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E07F6740 Relevance: 16.0, APIs: 7, Strings: 2, Instructions: 242
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF7E07F6A30: wcsnlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF7E07F67AF), ref: 00007FF7E07F6A47

memset.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7E07F67CB
MulDiv.API-MS-WIN-CORE-LARGEINTEGER-L1-1-0 ref: 00007FF7E07F67DC
MulDiv.API-MS-WIN-CORE-LARGEINTEGER-L1-1-0 ref: 00007FF7E07F67F8
_o_wcscpy_s.API-MS-WIN-CRT-PRIVATE-L1-1-0 ref: 00007FF7E07F686D
MulDiv.API-MS-WIN-CORE-LARGEINTEGER-L1-1-0 ref: 00007FF7E07F699A
DeleteObject.GDI32 ref: 00007FF7E07F69E0
DeleteDC.GDI32 ref: 00007FF7E07F69F0

Strings

Terminal, xrefs: 00007FF7E07F6810
onecore\windows\core\console\open\src\renderer\gdi\state.cpp, xrefs: 00007FF7E081C29C, 00007FF7E081C2F4, 00007FF7E081C333

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: Delete$Object_o_wcscpy_smemsetwcsnlen
String ID: Terminal$onecore\windows\core\console\open\src\renderer\gdi\state.cpp
API String ID: 459465077-367812907
Opcode ID: e5077dd480a39a492637a9a452f2f1d27335631b0803523240b5f8da18139766
Instruction ID: f93aac7e6594123d08862cf0babd977fbed449a28d2bf3821f82b43c6f882048
Opcode Fuzzy Hash: e5077dd480a39a492637a9a452f2f1d27335631b0803523240b5f8da18139766
Instruction Fuzzy Hash: 58A164326086828AEB10AB61E4407BEF761FB8AB85F949037DE4E57754CF3DE424C712

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E0808318 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 169
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF7E0808200: RegOpenCurrentUser.KERNELBASE ref: 00007FF7E0808238
Part of subcall function 00007FF7E0808200: RegOpenKeyW.ADVAPI32 ref: 00007FF7E0808272

Part of subcall function 00007FF7E0808838: GetWindowsDirectoryW.API-MS-WIN-CORE-SYSINFO-L1-1-0(?,?,?,?,?,00000000,?,00007FF7E080836D), ref: 00007FF7E0808887
Part of subcall function 00007FF7E0808838: CompareStringOrdinal.API-MS-WIN-CORE-STRING-L1-1-0 ref: 00007FF7E0808900

RegOpenKeyW.ADVAPI32 ref: 00007FF7E0808388
RegCloseKey.KERNELBASE ref: 00007FF7E08084AE
RegCloseKey.API-MS-WIN-CORE-REGISTRY-L1-1-0 ref: 00007FF7E08084C5
RegOpenKeyW.ADVAPI32 ref: 00007FF7E0808517
RegCloseKey.KERNELBASE ref: 00007FF7E080853C

Part of subcall function 00007FF7E08086C4: RegQueryValueExW.KERNELBASE ref: 00007FF7E08086F0

Strings

WindowPosition, xrefs: 00007FF7E08083EE
CodePage, xrefs: 00007FF7E0808411
ColorTable%02u, xrefs: 00007FF7E080843E

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: Open$Close$CompareCurrentDirectoryOrdinalQueryStringUserValueWindows
String ID: CodePage$ColorTable%02u$WindowPosition
API String ID: 2278421442-3581126301
Opcode ID: e5592a74f416dfd74213d25434947a49eb3ceee9e85fc7aa61e34401f8c42edf
Instruction ID: f32d9de8850b2e46ec71a21ae706313f8cd9b7f8db61ec34348da9417a6c66c6
Opcode Fuzzy Hash: e5592a74f416dfd74213d25434947a49eb3ceee9e85fc7aa61e34401f8c42edf
Instruction Fuzzy Hash: 2C616036B18A42C5FA10EB15E84077AA7A0FB88B88FC05032DE8E57755DE7CF465CB61

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E080F5D0 Relevance: 13.6, APIs: 9, Instructions: 106
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__scrt_initialize_crt.LIBCMT ref: 00007FF7E080F5DF
__scrt_acquire_startup_lock.LIBCMT ref: 00007FF7E080F5F4
__scrt_release_startup_lock.LIBCMT ref: 00007FF7E080F662
_register_thread_local_exe_atexit_callback.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7E080F6B0
__scrt_get_show_window_mode.LIBCMT ref: 00007FF7E080F6B5
_o__get_wide_winmain_command_line.API-MS-WIN-CRT-PRIVATE-L1-1-0 ref: 00007FF7E080F6BD
__scrt_is_managed_app.LIBCMT ref: 00007FF7E080F6D8
_o__cexit.API-MS-WIN-CRT-PRIVATE-L1-1-0 ref: 00007FF7E080F6E6
_o__exit.API-MS-WIN-CRT-PRIVATE-L1-1-0 ref: 00007FF7E080F73B

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: __scrt_acquire_startup_lock__scrt_get_show_window_mode__scrt_initialize_crt__scrt_is_managed_app__scrt_release_startup_lock_o__cexit_o__exit_o__get_wide_winmain_command_line_register_thread_local_exe_atexit_callback
String ID:
API String ID: 105026157-0
Opcode ID: 86571d060c2f4b11015df3e24945bd3ae71d8f93e48ff83bbd6313533f7ff502
Instruction ID: 83f0e171240bc75963bc1fb700f0085674e13d82f44810e16e68a7d82bb017f5
Opcode Fuzzy Hash: 86571d060c2f4b11015df3e24945bd3ae71d8f93e48ff83bbd6313533f7ff502
Instruction Fuzzy Hash: 1D315D11A0D24346FA14B76498113BAE381AF95348FC48037E54E6BBD3DE7CBC248A73

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E0800ED0 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 161
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7E0800F0B
DeviceIoControl.KERNELBASE ref: 00007FF7E0800F99
DeviceIoControl.KERNELBASE ref: 00007FF7E0801053

Strings

DeviceIoControl failed with Result 0x%x, xrefs: 00007FF7E0801169
onecore\windows\core\console\open\src\server\devicecomm.cpp, xrefs: 00007FF7E080112A, 00007FF7E081FF56
onecore\windows\core\console\open\src\server\apimessage.cpp, xrefs: 00007FF7E081FF73

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: ControlDevice$memset
String ID: DeviceIoControl failed with Result 0x%x$onecore\windows\core\console\open\src\server\apimessage.cpp$onecore\windows\core\console\open\src\server\devicecomm.cpp
API String ID: 3112380785-4252510830
Opcode ID: bbb6972217592379cf6a994356aca5b19b6f3177f366266d7923d9f6016e52ac
Instruction ID: f10468f6d205ee645176bf5b52ad154b7fa2820b11bb1d0e671fd45f84c1e84d
Opcode Fuzzy Hash: bbb6972217592379cf6a994356aca5b19b6f3177f366266d7923d9f6016e52ac
Instruction Fuzzy Hash: EB716F32A08B8286FB10EF65E4407ADB7A5FB89798F904036EA4D57B55DF38F460CB11

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E0807980 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 117
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF7E08075E4: GetOEMCP.API-MS-WIN-CORE-LOCALIZATION-L1-2-0 ref: 00007FF7E080762B
Part of subcall function 00007FF7E08075E4: GetACP.API-MS-WIN-CORE-LOCALIZATION-L1-2-0 ref: 00007FF7E080763D

CreateEventExW.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FF7E08079A9
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF7E08079C1
CreateEventExW.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FF7E08079F4
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF7E0807A0C

Part of subcall function 00007FF7E080BE64: DeviceIoControl.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7E086A183), ref: 00007FF7E080BE91

CreateThread.KERNELBASE ref: 00007FF7E0807A87
FindCloseChangeNotification.KERNELBASE ref: 00007FF7E0807A9F

Strings

onecore\windows\core\console\open\src\host\srvinit.cpp, xrefs: 00007FF7E0822813, 00007FF7E0822867

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: Create$ErrorEventLast$ChangeCloseControlDeviceFindNotificationThread
String ID: onecore\windows\core\console\open\src\host\srvinit.cpp
API String ID: 2061414795-2090781281
Opcode ID: 69c753e179489be78ab4b29c0059f47dc3d6574d130b7caa6291e01be3c964b2
Instruction ID: 86064be9bef83262677642531f8789364e74b151c9d7a5b013dee5dc75af0d4f
Opcode Fuzzy Hash: 69c753e179489be78ab4b29c0059f47dc3d6574d130b7caa6291e01be3c964b2
Instruction Fuzzy Hash: 2C418A21B0C64392FB24BB61A4503BAE691FF98744FD48037DA4E4A796DE3CF5258732

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E07F308C Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 87threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0(?,?,00000000,00007FF7E07F2F43), ref: 00007FF7E07F30DE
SetWindowsHookExW.USER32 ref: 00007FF7E07F30FA

Part of subcall function 00007FF7E07F633C: GetCurrentProcessId.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0(?,?,?,?,00000000,00007FF7E07F3128,?,?,00000000,00007FF7E07F2F43), ref: 00007FF7E07F6382
Part of subcall function 00007FF7E07F633C: GetCurrentThreadId.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0(?,?,?,?,00000000,00007FF7E07F3128,?,?,00000000,00007FF7E07F2F43), ref: 00007FF7E07F6390

Part of subcall function 00007FF7E07F3190: SetActiveWindow.USER32 ref: 00007FF7E07F31B3
Part of subcall function 00007FF7E07F3190: ShowWindow.USER32 ref: 00007FF7E07F31C4

NotifyWinEvent.USER32 ref: 00007FF7E07F3168
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,?,?,?,?,?,000001C82450C120,00007FF7E0807022), ref: 00007FF7E081B15C

Strings

onecore\windows\core\console\open\src\interactivity\win32\window.cpp, xrefs: 00007FF7E081B1BF
CreateWindowsWindow failed with status 0x%x, gle = 0x%x, xrefs: 00007FF7E081B16B
onecore\windows\core\console\open\src\interactivity\win32\windowio.cpp, xrefs: 00007FF7E081B189, 00007FF7E081B1A8

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: Current$ThreadWindow$ActiveErrorEventHookLastNotifyProcessShowWindows
String ID: CreateWindowsWindow failed with status 0x%x, gle = 0x%x$onecore\windows\core\console\open\src\interactivity\win32\window.cpp$onecore\windows\core\console\open\src\interactivity\win32\windowio.cpp
API String ID: 387974148-1859572769
Opcode ID: e9a91b82687fc7275b53282cedb79e64168926d00ad800e9861367d6a42509e4
Instruction ID: 4b853105d108a5245ca85d204f56d2b00c5032c115258be3c4203bf485f50b80
Opcode Fuzzy Hash: e9a91b82687fc7275b53282cedb79e64168926d00ad800e9861367d6a42509e4
Instruction Fuzzy Hash: B2415E25A08A4396EA10BB25E8503B9EBA0FF9DB84BC45033DA0D47765DE3CF464C722

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E07F3D4C Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 72registryCOMMON

Download Yara Rule

APIs

LoadCursorW.USER32 ref: 00007FF7E07F3DA8

Part of subcall function 00007FF7E07F4408: _Init_thread_footer.LIBCMT ref: 00007FF7E07F4450

RegisterClassExW.USER32 ref: 00007FF7E07F3E0B
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7E07F3233), ref: 00007FF7E081B5D2

Strings

P, xrefs: 00007FF7E07F3D8C
onecore\windows\core\console\open\src\interactivity\win32\window.cpp, xrefs: 00007FF7E081B5C0
+, xrefs: 00007FF7E07F3D93
ConsoleWindowClass, xrefs: 00007FF7E07F3DBB

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: ClassCursorErrorInit_thread_footerLastLoadRegister
String ID: +$ConsoleWindowClass$P$onecore\windows\core\console\open\src\interactivity\win32\window.cpp
API String ID: 3666843503-2508929681
Opcode ID: bd104d6fa308457d559e0cb38f5776f2eabad12d9d87308f057094b38c31f259
Instruction ID: d724172bcc853395d6b480b78fb537cbb63d54da1dca372407f81c64d3c5afe0
Opcode Fuzzy Hash: bd104d6fa308457d559e0cb38f5776f2eabad12d9d87308f057094b38c31f259
Instruction Fuzzy Hash: 0F316D32E04B529AEB00EBA0E4442ADB7B4FB48788F904237DE4D53B54DF38E565C761

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E07FCCE0 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 209COMMON

Download Yara Rule

Strings

vector<T> too long, xrefs: 00007FF7E081ECD8
UUUUUUUU, xrefs: 00007FF7E07FCE77

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID:
String ID: UUUUUUUU$vector<T> too long
API String ID: 0-1961640351
Opcode ID: da7c582c3a34ec837d2802e32e4152bd5b95ce8900358520e789fd5473c5f954
Instruction ID: b2fbac31c4b6c4bcc5e4001c156add6b75b473ecf2243b27eda44161e41164f6
Opcode Fuzzy Hash: da7c582c3a34ec837d2802e32e4152bd5b95ce8900358520e789fd5473c5f954
Instruction Fuzzy Hash: E991CE33619B8085D720EF15E84476EB7B8FB99790F964226DAAD43794DF38E0A1C311

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E0816E9C Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 169registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7E0808200: RegOpenCurrentUser.KERNELBASE ref: 00007FF7E0808238
Part of subcall function 00007FF7E0808200: RegOpenKeyW.ADVAPI32 ref: 00007FF7E0808272

GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF7E0816F0D
RegCloseKey.API-MS-WIN-CORE-REGISTRY-L1-1-0 ref: 00007FF7E0816F21

Part of subcall function 00007FF7E082763C: SetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,?,?,00007FF7E0816F38), ref: 00007FF7E0827648

IIDFromString.API-MS-WIN-CORE-COM-L1-1-0 ref: 00007FF7E0816FE3

Strings

%%Startup, xrefs: 00007FF7E0816F3E
onecore\windows\core\console\open\src\propslib\delegationconfig.cpp, xrefs: 00007FF7E0816FBC, 00007FF7E0816FFB
N, xrefs: 00007FF7E0816FD0

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: ErrorLastOpen$CloseCurrentFromStringUser
String ID: %%Startup$N$onecore\windows\core\console\open\src\propslib\delegationconfig.cpp
API String ID: 3802179046-4239833828
Opcode ID: 7faab78157e642b59734033c18791615cb718cbafc4c69f633b7d1252390dc66
Instruction ID: f1f4d2dfbe598f794f78b62282bab0165aad5ef4a0bb48e05b8f28f37a1515d3
Opcode Fuzzy Hash: 7faab78157e642b59734033c18791615cb718cbafc4c69f633b7d1252390dc66
Instruction Fuzzy Hash: C8818222A09B8186F710AB24E8402B9B770FF99744F916236EA8D53765DF3DF5A0C721

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E080B760 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 50synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FF7E080B78A
WaitForSingleObject.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FF7E080B79D
ResetEvent.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FF7E080B7AD
SetEvent.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FF7E080B7D6
SleepEx.KERNEL32 ref: 00007FF7E080B7EE

Strings

onecore\windows\core\console\open\src\renderer\base\thread.cpp, xrefs: 00007FF7E0825D03

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: EventObjectSingleWait$ResetSleep
String ID: onecore\windows\core\console\open\src\renderer\base\thread.cpp
API String ID: 1999667587-1671638080
Opcode ID: 84ec2b8fe5a6cc1f73e90be529820d4510c89e4cff8a1aefdf7c77b915609e09
Instruction ID: 0b7488fb375c76ecc3ad522c1fa65863507d2cb69e90b5a43032ffa8c6c0c612
Opcode Fuzzy Hash: 84ec2b8fe5a6cc1f73e90be529820d4510c89e4cff8a1aefdf7c77b915609e09
Instruction Fuzzy Hash: 83113D26A08A4286EB50AF35D450378ABA0FF89F59F945232CD5E573A1CF38F4658322

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E080A9F0 Relevance: 9.2, APIs: 4, Strings: 1, Instructions: 457COMMON

Download Yara Rule

APIs

MulDiv.API-MS-WIN-CORE-LARGEINTEGER-L1-1-0 ref: 00007FF7E080AB1C
InvertRect.USER32 ref: 00007FF7E080AB8A

Strings

onecore\windows\core\console\open\src\renderer\gdi\paint.cpp, xrefs: 00007FF7E0825349, 00007FF7E0825381, 00007FF7E082553E, 00007FF7E0825564, 00007FF7E082558A, 00007FF7E08255B0, 00007FF7E08255D6, 00007FF7E08255FC, 00007FF7E0825622, 00007FF7E0825648, 00007FF7E082568F, 00007FF7E08256DF, 00007FF7E082578A, 00007FF7E08257B0, 00007FF7E08257D6, 00007FF7E08257FC, 00007FF7E0825822, 00007FF7E0825848, 00007FF7E082586E, 00007FF7E0825894

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: InvertRect
String ID: onecore\windows\core\console\open\src\renderer\gdi\paint.cpp
API String ID: 3660401689-3409953778
Opcode ID: 3ef4159072fe74af2585ad147ba53bbe3bf49334057d50279dd4d4bc3400aa08
Instruction ID: c32f333c746b10b7611803d07de4d14c82b0154a963d0b4473b3d3b63436a101
Opcode Fuzzy Hash: 3ef4159072fe74af2585ad147ba53bbe3bf49334057d50279dd4d4bc3400aa08
Instruction Fuzzy Hash: 3312C122A4864286F720EB60D0442BDB7A2FB58758FD19237DA0D17B95DF3CF5A1C326

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E0809398 Relevance: 9.1, APIs: 6, Instructions: 108threadCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7E080D800: EventRegister.API-MS-WIN-EVENTING-PROVIDER-L1-1-0(?,?,?,?,?,?,000001C82450C120,00007FF7E080733E), ref: 00007FF7E080D84C
Part of subcall function 00007FF7E080D800: EventSetInformation.API-MS-WIN-EVENTING-PROVIDER-L1-1-0(?,?,?,?,?,?,000001C82450C120,00007FF7E080733E), ref: 00007FF7E080D871

GetStdHandle.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0 ref: 00007FF7E08093D5
GetStdHandle.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0 ref: 00007FF7E08093E9
GetCommandLineW.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0 ref: 00007FF7E08093F8

Part of subcall function 00007FF7E07F8538: CommandLineToArgvW.API-MS-WIN-SHCORE-OBSOLETE-L1-1-0 ref: 00007FF7E07F85B6

EventUnregister.API-MS-WIN-EVENTING-PROVIDER-L1-1-0 ref: 00007FF7E080949B
SetProcessShutdownParameters.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF7E08094B3
ExitThread.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF7E08094C1

Part of subcall function 00007FF7E08077E8: RegOpenKeyExW.KERNELBASE ref: 00007FF7E0807817
Part of subcall function 00007FF7E08077E8: RegQueryValueExW.KERNELBASE ref: 00007FF7E0807859

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: Event$CommandHandleLine$ArgvExitInformationOpenParametersProcessQueryRegisterShutdownThreadUnregisterValue
String ID:
API String ID: 3181419396-0
Opcode ID: a1c4ee5ea7b59342cb05d75793bd8c418fbe2ac6402cb65e3a1fbd8b9118c587
Instruction ID: 611880ca697e5a3f8f97b107a9ce3ebbd101d5f209a702268ca17880b77c467f
Opcode Fuzzy Hash: a1c4ee5ea7b59342cb05d75793bd8c418fbe2ac6402cb65e3a1fbd8b9118c587
Instruction Fuzzy Hash: 6B418C21B08A829AFB10BB70D4502BDB7A0BF58388FD10177DA4D5A796DE38F465C362

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E080ADD0 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 153COMMON

Download Yara Rule

Strings

onecore\windows\core\console\open\src\renderer\gdi\paint.cpp, xrefs: 00007FF7E0825930
onecore\windows\core\console\open\src\renderer\gdi\state.cpp, xrefs: 00007FF7E0825949, 00007FF7E082596A, 00007FF7E0825990, 00007FF7E08259B6, 00007FF7E08259DC, 00007FF7E0825A02, 00007FF7E0825A22

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID:
String ID: onecore\windows\core\console\open\src\renderer\gdi\paint.cpp$onecore\windows\core\console\open\src\renderer\gdi\state.cpp
API String ID: 0-357235055
Opcode ID: 077f840fea9819a06087a83384223d9309759567d531e3daf935357b79ba7af2
Instruction ID: c3852494801ab4ae59309850bfa9304067195f55b597ed0baa3e4acfa01eb507
Opcode Fuzzy Hash: 077f840fea9819a06087a83384223d9309759567d531e3daf935357b79ba7af2
Instruction Fuzzy Hash: 35616231A08A8285FB50AB25E4407B9E7A0FF84B98FD44133DA4E57795DF3CF4A58722

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E0807D70 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 147COMMON

Download Yara Rule

Strings

AllowAltF4Close, xrefs: 00007FF7E0807DD2
WordDelimiters, xrefs: 00007FF7E0807E0C, 00007FF7E0807E74

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: QueryValue
String ID: AllowAltF4Close$WordDelimiters
API String ID: 3660427363-1684327172
Opcode ID: 2797744265af84ea1eb56430fcc3294bf2633fa174054370e8285b95abd3f1f1
Instruction ID: 45f72c993aabc796d49a8e70189d72c262b051fc13dcd7ab15540ad90911f553
Opcode Fuzzy Hash: 2797744265af84ea1eb56430fcc3294bf2633fa174054370e8285b95abd3f1f1
Instruction Fuzzy Hash: BB619A36B18A4285EB54EB21E4406ADB7A1FB68788F801032DE8D53B59CF3CF465CB11

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E08090B8 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 102synchronizationCOMMON

Download Yara Rule

APIs

GetCurrentProcessId.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF7E08090EA
CreateMutexW.KERNELBASE ref: 00007FF7E0809132

Part of subcall function 00007FF7E0809200: WaitForSingleObjectEx.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FF7E0809219

Part of subcall function 00007FF7E0808DB0: memset.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7E0808E61
Part of subcall function 00007FF7E0808DB0: memset.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7E0808E7C

Part of subcall function 00007FF7E080E134: ReleaseMutex.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FF7E080E138

Strings

Local\SM0:%d:%d:%hs, xrefs: 00007FF7E0809106
wil, xrefs: 00007FF7E0822E3B, 00007FF7E0822E6D
x, xrefs: 00007FF7E08090FE

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: Mutexmemset$CreateCurrentObjectProcessReleaseSingleWait
String ID: Local\SM0:%d:%d:%hs$wil$x
API String ID: 588896006-630742106
Opcode ID: 60032cc7b009ede1fe2acf72d49425f035304dc705b6817203536b47d7b41713
Instruction ID: fd172c5427464511872ca3bdb842d6091e5c9f9e56d32a03633fc0b77018ff12
Opcode Fuzzy Hash: 60032cc7b009ede1fe2acf72d49425f035304dc705b6817203536b47d7b41713
Instruction Fuzzy Hash: 5D418232618A4296FB14AB21E4403FAE3A0FF98784FC45032EA8E47756DE7CF465C751

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E08077E8 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 48registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE ref: 00007FF7E0807817
RegQueryValueExW.KERNELBASE ref: 00007FF7E0807859

Strings

ForceV2, xrefs: 00007FF7E0807852
Console, xrefs: 00007FF7E0807807

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: OpenQueryValue
String ID: Console$ForceV2
API String ID: 4153817207-204486278
Opcode ID: 71234e7760d4f20a33a0bbf8ffc25d87a8b8842a46504550143a2fec4486d5d4
Instruction ID: 9823894f01b9acdf436ef8ad6ff1067c852b297fe9f0396c4334f4842234ac44
Opcode Fuzzy Hash: 71234e7760d4f20a33a0bbf8ffc25d87a8b8842a46504550143a2fec4486d5d4
Instruction Fuzzy Hash: BB117232E18A42C6FB20AB50E40437AF7A4FB85799FD04232DA8D42B64DF7CE454CB25

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E07F4468 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 179COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7E080FD8C: _o_malloc.API-MS-WIN-CRT-PRIVATE-L1-1-0(?,?,00000000,00007FF7E080393E,?,?,?,?,00007FF7E082A040,?,?,?,?,?,?,?), ref: 00007FF7E080FDA6

Part of subcall function 00007FF7E080FD8C: Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7E080FDBC
Part of subcall function 00007FF7E080FD8C: InitializeCriticalSectionAndSpinCount.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FF7E080FDF5
Part of subcall function 00007FF7E080FD8C: GetModuleHandleW.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0 ref: 00007FF7E080FE03
Part of subcall function 00007FF7E080FD8C: GetModuleHandleW.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0 ref: 00007FF7E080FE19
Part of subcall function 00007FF7E080FD8C: GetProcAddress.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0 ref: 00007FF7E080FE36
Part of subcall function 00007FF7E080FD8C: GetProcAddress.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0 ref: 00007FF7E080FE4A
Part of subcall function 00007FF7E080FD8C: GetProcAddress.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0 ref: 00007FF7E080FE5E

Part of subcall function 00007FF7E07F4890: CreateEventW.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FF7E07F48B2
Part of subcall function 00007FF7E07F4890: CreateEventW.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FF7E07F48E4
Part of subcall function 00007FF7E07F4890: CreateEventW.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FF7E07F490D
Part of subcall function 00007FF7E07F4890: CreateThread.KERNELBASE ref: 00007FF7E07F4943

Part of subcall function 00007FF7E07F474C: ~_Func_class.LIBCONCRT ref: 00007FF7E07F4786

Part of subcall function 00007FF7E0802BCC: LeaveCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,00000001,?,00000000,00007FF7E0875ED6,?,?,?,?,00000000,00007FF7E0824487), ref: 00007FF7E0802BFC

WaitForSingleObjectEx.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FF7E07F4638
EnterCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FF7E07F465A
FindCloseChangeNotification.KERNELBASE ref: 00007FF7E07F4669

Strings

onecore\windows\core\console\open\src\host\srvinit.cpp, xrefs: 00007FF7E081B68B, 00007FF7E081B6BC, 00007FF7E081B6DB, 00007FF7E081B715

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: Create$AddressCriticalEventProcSection$HandleModule$ChangeCloseConcurrency::cancel_current_taskCountEnterFindFunc_classInitializeLeaveNotificationObjectSingleSpinThreadWait_o_malloc
String ID: onecore\windows\core\console\open\src\host\srvinit.cpp
API String ID: 2405433026-2090781281
Opcode ID: 9dc250b217d863a623bee425c3f180cb7d9fcbe0af7a11138e4df1584ce87291
Instruction ID: b924f116f9a929d5a31aff5aa6a1af1b197f0662cc316b33dde0c01b9ff16ae0
Opcode Fuzzy Hash: 9dc250b217d863a623bee425c3f180cb7d9fcbe0af7a11138e4df1584ce87291
Instruction Fuzzy Hash: F5916D21A08B828AEB20BB51E4503BAA7A4FF99754F804133CA4D47796DF7CF474C722

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E07F6630 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 103COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7E07F6740: memset.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7E07F67CB
Part of subcall function 00007FF7E07F6740: MulDiv.API-MS-WIN-CORE-LARGEINTEGER-L1-1-0 ref: 00007FF7E07F67DC
Part of subcall function 00007FF7E07F6740: MulDiv.API-MS-WIN-CORE-LARGEINTEGER-L1-1-0 ref: 00007FF7E07F67F8
Part of subcall function 00007FF7E07F6740: _o_wcscpy_s.API-MS-WIN-CRT-PRIVATE-L1-1-0 ref: 00007FF7E07F686D

DeleteObject.GDI32 ref: 00007FF7E07F66C7
DeleteObject.GDI32 ref: 00007FF7E081C216
DeleteObject.GDI32 ref: 00007FF7E081C256

Strings

onecore\windows\core\console\open\src\renderer\gdi\state.cpp, xrefs: 00007FF7E07F6725, 00007FF7E081C1FA, 00007FF7E081C23C, 00007FF7E081C275

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: DeleteObject$_o_wcscpy_smemset
String ID: onecore\windows\core\console\open\src\renderer\gdi\state.cpp
API String ID: 2027464467-181080528
Opcode ID: 73e345f51cd89fd9c63c104ba66e475015b57add9a2206fd59f4b46000c648f2
Instruction ID: 8dc7fb2d6c5f032879d0880060a0d0f29bff6e2dfb6a25bd367c7a69962ec308
Opcode Fuzzy Hash: 73e345f51cd89fd9c63c104ba66e475015b57add9a2206fd59f4b46000c648f2
Instruction Fuzzy Hash: 72413D32A09A829BEB40AB61E4403B9A760FF49B81F945037DA4E93751DF38F475C722

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E07F3544 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 79COMMON

Download Yara Rule

APIs

GetDC.USER32 ref: 00007FF7E07F3562
DeleteObject.GDI32 ref: 00007FF7E07F35A1
ReleaseDC.USER32 ref: 00007FF7E07F35EB

Strings

onecore\windows\core\console\open\src\renderer\gdi\state.cpp, xrefs: 00007FF7E081B21F, 00007FF7E081B240, 00007FF7E081B262, 00007FF7E081B284

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: DeleteObjectRelease
String ID: onecore\windows\core\console\open\src\renderer\gdi\state.cpp
API String ID: 111263778-181080528
Opcode ID: fb49ace60a9cb14482e76d2d3fe04202ba201d533200a15313111d77437a7515
Instruction ID: 4ae4c7a4776fcd46c02c68511d9099726b8c134a43df40ce71467e0a06525c7c
Opcode Fuzzy Hash: fb49ace60a9cb14482e76d2d3fe04202ba201d533200a15313111d77437a7515
Instruction Fuzzy Hash: 60318D61B0DA8396EA54AB51A440379E764FF88B80F848037DE4E57B54CF3CF0758B22

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E0817FFC Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 76COMMON

Download Yara Rule

APIs

GetTokenInformation.API-MS-WIN-SECURITY-BASE-L1-1-0 ref: 00007FF7E0818042
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF7E0818056
GetTokenInformation.API-MS-WIN-SECURITY-BASE-L1-1-0 ref: 00007FF7E08180BD

Strings

onecore\internal\sdk\inc\wil\opensource\wil\token_helpers.h, xrefs: 00007FF7E0818088, 00007FF7E08180D2, 00007FF7E0818111

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: InformationToken$ErrorLast
String ID: onecore\internal\sdk\inc\wil\opensource\wil\token_helpers.h
API String ID: 2567405617-2881811202
Opcode ID: 67d32a1ae32010cc25eb9c886df297ba97b8570a00a158c54a86b82b8b995226
Instruction ID: 937a11781efd46cc9334e07e8d41fd4372119cf2dd2c1c3254fda4f2a2a458d9
Opcode Fuzzy Hash: 67d32a1ae32010cc25eb9c886df297ba97b8570a00a158c54a86b82b8b995226
Instruction Fuzzy Hash: 5F318322B0864282FB106B15E80177AE761EFC57D4FE48132DA4D17B95DE3DF4668712

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E08075E4 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 68COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7E080FD8C: _o_malloc.API-MS-WIN-CRT-PRIVATE-L1-1-0(?,?,00000000,00007FF7E080393E,?,?,?,?,00007FF7E082A040,?,?,?,?,?,?,?), ref: 00007FF7E080FDA6

GetOEMCP.API-MS-WIN-CORE-LOCALIZATION-L1-2-0 ref: 00007FF7E080762B
GetACP.API-MS-WIN-CORE-LOCALIZATION-L1-2-0 ref: 00007FF7E080763D

Part of subcall function 00007FF7E080FD8C: Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7E080FDBC
Part of subcall function 00007FF7E080FD8C: InitializeCriticalSectionAndSpinCount.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FF7E080FDF5
Part of subcall function 00007FF7E080FD8C: GetModuleHandleW.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0 ref: 00007FF7E080FE03
Part of subcall function 00007FF7E080FD8C: GetModuleHandleW.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0 ref: 00007FF7E080FE19
Part of subcall function 00007FF7E080FD8C: GetProcAddress.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0 ref: 00007FF7E080FE36
Part of subcall function 00007FF7E080FD8C: GetProcAddress.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0 ref: 00007FF7E080FE4A
Part of subcall function 00007FF7E080FD8C: GetProcAddress.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0 ref: 00007FF7E080FE5E

Part of subcall function 00007FF7E0807F10: RegOpenKeyW.ADVAPI32 ref: 00007FF7E0807F70
Part of subcall function 00007FF7E0807F10: RegEnumValueW.KERNELBASE ref: 00007FF7E0807FCE
Part of subcall function 00007FF7E0807F10: GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0 ref: 00007FF7E0807FF3
Part of subcall function 00007FF7E0807F10: HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0 ref: 00007FF7E080800D

Strings

onecore\windows\core\console\open\src\server\devicecomm.cpp, xrefs: 00007FF7E08076E8
onecore\windows\core\console\open\src\host\renderfontdefaults.cpp, xrefs: 00007FF7E0807677

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: AddressProc$HandleHeapModule$AllocConcurrency::cancel_current_taskCountCriticalEnumInitializeOpenProcessSectionSpinValue_o_malloc
String ID: onecore\windows\core\console\open\src\host\renderfontdefaults.cpp$onecore\windows\core\console\open\src\server\devicecomm.cpp
API String ID: 4221633738-3638091250
Opcode ID: a2723e1037f0bd41d12e8eed9f5bcfafa84f49ef05180da3c4f3de3927b019ac
Instruction ID: 0830a2289f52925f65167ea43116d68fbb926ea3557568431a913d7f0597f8d8
Opcode Fuzzy Hash: a2723e1037f0bd41d12e8eed9f5bcfafa84f49ef05180da3c4f3de3927b019ac
Instruction Fuzzy Hash: B8313035A08A4286F605BB54E4003B9B7A1FF54754FC44232D99D877A2EF3DF4648722

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E07F2F00 Relevance: 6.1, APIs: 4, Instructions: 77windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7E07F2D08: GetEnvironmentVariableW.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0 ref: 00007FF7E07F2DD3

EnterCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FF7E07F2F1E
GetMessageW.USER32 ref: 00007FF7E07F2F6E
DispatchMessageW.USER32 ref: 00007FF7E07F2F9F

Part of subcall function 00007FF7E07F308C: GetCurrentThreadId.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0(?,?,00000000,00007FF7E07F2F43), ref: 00007FF7E07F30DE
Part of subcall function 00007FF7E07F308C: SetWindowsHookExW.USER32 ref: 00007FF7E07F30FA
Part of subcall function 00007FF7E07F308C: NotifyWinEvent.USER32 ref: 00007FF7E07F3168

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: Message$CriticalCurrentDispatchEnterEnvironmentEventHookNotifySectionThreadVariableWindows
String ID:
API String ID: 1259943464-0
Opcode ID: ccf14bf73a039b9fec25a85e6546e9a236cec985bc75126feac83c117555f8d6
Instruction ID: e8709d9e800c8021ab4b8cdf48f585d98b8a4e28bb4e70b7ed1b5d911accb680
Opcode Fuzzy Hash: ccf14bf73a039b9fec25a85e6546e9a236cec985bc75126feac83c117555f8d6
Instruction Fuzzy Hash: F2314C25E18A4299FB00BB6198913B9F7A0AF69744FC44037EA1D43796DE3CF4758622

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E086C610 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 282COMMON

Download Yara Rule

APIs

default_delete.LIBCPMT ref: 00007FF7E086CA5D

Part of subcall function 00007FF7E0842F00: memset.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000028,00007FF7E08502AF,?,?,?,?,00000000,?,00000000,00007FF7E08501BC), ref: 00007FF7E0842F2D

_o_terminate.API-MS-WIN-CRT-PRIVATE-L1-1-0 ref: 00007FF7E086CA83

Strings

onecore\windows\core\console\open\src\server\apidispatchers.cpp, xrefs: 00007FF7E086C663, 00007FF7E086C757, 00007FF7E086C78F, 00007FF7E086C837, 00007FF7E086C9DC

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: _o_terminatedefault_deletememset
String ID: onecore\windows\core\console\open\src\server\apidispatchers.cpp
API String ID: 1132286936-3284698556
Opcode ID: fde5961494f2eff5e4237dbb3e4d5b6568c0184219e4f839cfbc981fde5951a4
Instruction ID: 189b2e2456b2b8855ad4d5a7035f6848dd0c5138a862b1cbb70f05ac074deb36
Opcode Fuzzy Hash: fde5961494f2eff5e4237dbb3e4d5b6568c0184219e4f839cfbc981fde5951a4
Instruction Fuzzy Hash: 0BC18175A0868282EA70AB55B0407BAE791FF94B80F918037DA8D47B55DF3CF464C762

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E0803B30 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 138COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7E07F8F28: GetCurrentThreadId.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0(?,?,00000000,00007FF7E07F635D,?,?,?,?,00000000,00007FF7E07F3128,?,?,00000000,00007FF7E07F2F43), ref: 00007FF7E07F8F31

Part of subcall function 00007FF7E080FD8C: _o_malloc.API-MS-WIN-CRT-PRIVATE-L1-1-0(?,?,00000000,00007FF7E080393E,?,?,?,?,00007FF7E082A040,?,?,?,?,?,?,?), ref: 00007FF7E080FDA6

Part of subcall function 00007FF7E08039D4: OpenProcess.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-1 ref: 00007FF7E0803A52

?_Xlength_error@std@@YAXPEBD@Z.MSVCP_WIN ref: 00007FF7E0821D9B

Strings

onecore\windows\core\console\open\src\server\processlist.cpp, xrefs: 00007FF7E0821D5A
list<T> too long, xrefs: 00007FF7E0821D94

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: CurrentOpenProcessThreadXlength_error@std@@_o_malloc
String ID: list<T> too long$onecore\windows\core\console\open\src\server\processlist.cpp
API String ID: 584409634-208596408
Opcode ID: a0d2ce8b8050471da4974daf0101d702b93ebc83116f7af41c4a3d9b9280f2a5
Instruction ID: a6d590fef88f1ad8d3f3ebecfdb3595b6f1085d7de79a7569f2ded40b95838e9
Opcode Fuzzy Hash: a0d2ce8b8050471da4974daf0101d702b93ebc83116f7af41c4a3d9b9280f2a5
Instruction Fuzzy Hash: 47519F32A08A4186EB54AB15E050379B7E0FB94B88F949436DB8D47B96CF3CF861C721

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E07F3B50 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 89libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0 ref: 00007FF7E07F3B80

Strings

onecore\windows\core\console\open\src\interactivity\win32\windowtheme.cpp, xrefs: 00007FF7E081B52B
DarkMode_Explorer, xrefs: 00007FF7E081B4F9

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: AddressProc
String ID: DarkMode_Explorer$onecore\windows\core\console\open\src\interactivity\win32\windowtheme.cpp
API String ID: 190572456-2049200211
Opcode ID: 0cd93e2ea6b2b49560b1f9e83bf05438ba2dfbb9cf8b0e9135c03fb704ef9d77
Instruction ID: 7d97bd7879f6be1a9177f5911a82366968a8104be7b24ad4bb0075015c488c2b
Opcode Fuzzy Hash: 0cd93e2ea6b2b49560b1f9e83bf05438ba2dfbb9cf8b0e9135c03fb704ef9d77
Instruction Fuzzy Hash: F4318E61A0CB439AFB50AB54A49037AA761EF4A780FD06033C90E53391DF3CF468C622

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E07F8E58 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 71COMMON

Download Yara Rule

APIs

OpenProcessToken.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF7E07F8E8C

Part of subcall function 00007FF7E080BB0C: RtlQueryPackageClaims.NTDLL ref: 00007FF7E080BB40

FindCloseChangeNotification.KERNELBASE ref: 00007FF7E07F8F01

Strings

onecore\windows\core\console\open\src\server\processpolicy.cpp, xrefs: 00007FF7E081C961, 00007FF7E081C97D, 00007FF7E081C99C

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: ChangeClaimsCloseFindNotificationOpenPackageProcessQueryToken
String ID: onecore\windows\core\console\open\src\server\processpolicy.cpp
API String ID: 3297886754-2159332910
Opcode ID: 93c8558f7c48d896d9c4088f07808c36744434de1b3111d6bb49c5471fb9969f
Instruction ID: a0e6bddad5da3f35fd3f56813c62f7af207518e95423a05d06da93096152c2a2
Opcode Fuzzy Hash: 93c8558f7c48d896d9c4088f07808c36744434de1b3111d6bb49c5471fb9969f
Instruction Fuzzy Hash: 3531842260C68386EB50AB15A0402BAAB60FB89794FD44233DA5E43799CE3CF565C762

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E07F8A50 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32 ref: 00007FF7E07F8A71

Part of subcall function 00007FF7E07F8AF4: GetClientRect.USER32 ref: 00007FF7E07F8B21

GetDC.USER32 ref: 00007FF7E07F8AA3

Strings

onecore\windows\core\console\open\src\renderer\gdi\paint.cpp, xrefs: 00007FF7E081C7A7, 00007FF7E081C7C7

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: ClientRectVisibleWindow
String ID: onecore\windows\core\console\open\src\renderer\gdi\paint.cpp
API String ID: 2093131216-3409953778
Opcode ID: bcdf387d913997fc76ebdf337c9ba0f6388e30a3300b957304a86cfcc4d2e3c1
Instruction ID: 058c8282aad624ecde8df6cdeda40dfef6a1169992270ff79b76b4da65badb90
Opcode Fuzzy Hash: bcdf387d913997fc76ebdf337c9ba0f6388e30a3300b957304a86cfcc4d2e3c1
Instruction Fuzzy Hash: F5219B32A0868285EB90AF25D440379A750EF48B9CF949133DA1D473D5DF3CF4A4C722

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E080DB9C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 53COMMON

Download Yara Rule

APIs

BeginPaint.USER32 ref: 00007FF7E080DBCC
EndPaint.USER32 ref: 00007FF7E080DC12

Strings

onecore\windows\core\console\open\src\interactivity\win32\windowproc.cpp, xrefs: 00007FF7E0827068, 00007FF7E0827086

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: Paint$Begin
String ID: onecore\windows\core\console\open\src\interactivity\win32\windowproc.cpp
API String ID: 3787552996-255808027
Opcode ID: d75906cabbd135e2b09a02a994a758599352d23f9e913afea7032d4d0eb9f89a
Instruction ID: 36bdcb2a594248d48b056e78a7a8acd40b85fcbe1ddcdf21d4eabcb22caacd66
Opcode Fuzzy Hash: d75906cabbd135e2b09a02a994a758599352d23f9e913afea7032d4d0eb9f89a
Instruction Fuzzy Hash: 3F216F61B0CB8682FE60AB25E4503B9A3A0FF88B44F949132D98E47755DF3CF519C722

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E080B400 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 52COMMON

Download Yara Rule

APIs

FillRect.USER32 ref: 00007FF7E080B43F
DeleteObject.GDI32 ref: 00007FF7E080B457

Strings

onecore\windows\core\console\open\src\renderer\gdi\paint.cpp, xrefs: 00007FF7E0825BBF, 00007FF7E0825BD9, 00007FF7E0825BFD

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: DeleteFillObjectRect
String ID: onecore\windows\core\console\open\src\renderer\gdi\paint.cpp
API String ID: 1372181131-3409953778
Opcode ID: 1ea43a43cedeb61a734e5e2425742af34b021a12afaa4105a5ae6bb0f3f8a154
Instruction ID: 7b86789f304f9a8378d59cba92d694acaa976dce05078cb582ceb07a56959219
Opcode Fuzzy Hash: 1ea43a43cedeb61a734e5e2425742af34b021a12afaa4105a5ae6bb0f3f8a154
Instruction Fuzzy Hash: 0D118625608B4286E610AB55F4407B9E6A0FB8DB94F94A033DE0D53765DF3CF5A4C712

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E08181F0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 39COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7E0817FFC: GetTokenInformation.API-MS-WIN-SECURITY-BASE-L1-1-0 ref: 00007FF7E0818042
Part of subcall function 00007FF7E0817FFC: GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF7E0818056

GetSidSubAuthorityCount.API-MS-WIN-SECURITY-BASE-L1-1-0 ref: 00007FF7E081823C
GetSidSubAuthority.API-MS-WIN-SECURITY-BASE-L1-1-0 ref: 00007FF7E0818252

Strings

onecore\windows\core\console\conint\processpolicy.cpp, xrefs: 00007FF7E081821E

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: Authority$CountErrorInformationLastToken
String ID: onecore\windows\core\console\conint\processpolicy.cpp
API String ID: 184111022-3682059561
Opcode ID: f44cfd390e7427bfce922ec8325fea8398b290dbf94853171cdb98acb5f93061
Instruction ID: acf3fb0fe3724bd5a624ddef72b92e0874230608d7fec8ad3cc5d3d256d0681e
Opcode Fuzzy Hash: f44cfd390e7427bfce922ec8325fea8398b290dbf94853171cdb98acb5f93061
Instruction Fuzzy Hash: C5016132608981C6D740AB15E4903BAB7A0FFC8B94F849032EA4E87755CE3CE459C711

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E07F3CB4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 35libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0 ref: 00007FF7E07F3CDD
GetProcAddress.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0 ref: 00007FF7E07F3CFE

Strings

EnableChildWindowDpiMessage, xrefs: 00007FF7E07F3CD6

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: AddressProc
String ID: EnableChildWindowDpiMessage
API String ID: 190572456-233965631
Opcode ID: e2daeb415acb03678ffe11faf66226804ac1aa83e7a5f201559d7d9c527b626a
Instruction ID: 17445af079f008ffa2dffe0864b8eb729ddcf8d8e440aa286b95bb74af482e15
Opcode Fuzzy Hash: e2daeb415acb03678ffe11faf66226804ac1aa83e7a5f201559d7d9c527b626a
Instruction Fuzzy Hash: E401ED24B0DA869AFE14AB15E840374E790AF59B84F984036CD0E46751DF3CF8B59622

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E080CEA0 Relevance: 4.6, APIs: 3, Instructions: 74COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7E080CAFC: LoadLibraryW.KERNELBASE(?,?,?,?,?,?,?,00007FF7E07F4BE5), ref: 00007FF7E080CB11

GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF7E0826A56
FreeLibrary.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0 ref: 00007FF7E0826A85

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: Library$ErrorFreeLastLoad
String ID:
API String ID: 1501378888-0
Opcode ID: a930adfcc60502900953242a714a47bf8aeaa8a65ee9e27ded345f46f1669db9
Instruction ID: 4fed48ee73702b5c9cf099ff887136ec890db65077063ad59dfb00be2c40205d
Opcode Fuzzy Hash: a930adfcc60502900953242a714a47bf8aeaa8a65ee9e27ded345f46f1669db9
Instruction Fuzzy Hash: 3B214F31A0864386FA14AF91E4503BAE695BF88754FD48036EB4E47785DFBCF8648322

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E07FC350 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 129COMMON

Download Yara Rule

APIs

?_Xout_of_range@std@@YAXPEBD@Z.MSVCP_WIN(?,?,?,?,?,?,?,?,00007FF7E07F31F0,?,?,00000000,00007FF7E07F313B,?,?,00000000), ref: 00007FF7E081E86B

Strings

invalid deque<T> subscript, xrefs: 00007FF7E081E864

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: Xout_of_range@std@@
String ID: invalid deque<T> subscript
API String ID: 1960685668-2228476695
Opcode ID: 4585d2b37325c699cdb172b816c26d00d296ef04d724098ec90211f9d478fcc0
Instruction ID: ba26abb2207b5a5dbf1e532b12e3e4a55888b24cdf607328ea3ce0958bd4328b
Opcode Fuzzy Hash: 4585d2b37325c699cdb172b816c26d00d296ef04d724098ec90211f9d478fcc0
Instruction Fuzzy Hash: 37513836A19B5586EA28EF1AE450379B7A0FB98B80F944137DA4D83764DF3CE421C721

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E08039D4 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7E080FD8C: _o_malloc.API-MS-WIN-CRT-PRIVATE-L1-1-0(?,?,00000000,00007FF7E080393E,?,?,?,?,00007FF7E082A040,?,?,?,?,?,?,?), ref: 00007FF7E080FDA6

OpenProcess.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-1 ref: 00007FF7E0803A52

Part of subcall function 00007FF7E07F8E58: OpenProcessToken.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF7E07F8E8C
Part of subcall function 00007FF7E07F8E58: FindCloseChangeNotification.KERNELBASE ref: 00007FF7E07F8F01

Strings

onecore\windows\core\console\open\src\server\processhandle.cpp, xrefs: 00007FF7E0821B40

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: OpenProcess$ChangeCloseFindNotificationToken_o_malloc
String ID: onecore\windows\core\console\open\src\server\processhandle.cpp
API String ID: 2776094353-196835915
Opcode ID: aad74363f159e933836b21511dd4a74910d22a7d319744f39c12092afff27737
Instruction ID: ee96e762c5e38591353f2b63b80ebcb823923e63b1b5d11cbc579a486f9a2cac
Opcode Fuzzy Hash: aad74363f159e933836b21511dd4a74910d22a7d319744f39c12092afff27737
Instruction Fuzzy Hash: 68219C72618B4486E740EF01E448BA9B7E9FB88B54F8A8139DE4C07792CF3CE450C761

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E080BE64 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 24COMMON

Download Yara Rule

APIs

DeviceIoControl.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7E086A183), ref: 00007FF7E080BE91

Strings

onecore\windows\core\console\open\src\server\devicecomm.cpp, xrefs: 00007FF7E0826283

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: ControlDevice
String ID: onecore\windows\core\console\open\src\server\devicecomm.cpp
API String ID: 2352790924-3100342381
Opcode ID: ba034b46ec0b23c7f9023b7a1e5cdf6f509564d89de755d9395a5e2959253202
Instruction ID: 85e44e1252a0b0dab325e11b060bb093657e2d9ddfb56be2cfccdc379eabb381
Opcode Fuzzy Hash: ba034b46ec0b23c7f9023b7a1e5cdf6f509564d89de755d9395a5e2959253202
Instruction Fuzzy Hash: 7CF06D36A18B42CAE700DB64E44436DB3E4F788790FA04132D64C86710CF3DE5658B11

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E080CAFC Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 17libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNELBASE(?,?,?,?,?,?,?,00007FF7E07F4BE5), ref: 00007FF7E080CB11

Strings

ext-ms-win-ntuser-window-l1-1-0, xrefs: 00007FF7E080CB05

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: LibraryLoad
String ID: ext-ms-win-ntuser-window-l1-1-0
API String ID: 1029625771-2367781076
Opcode ID: ff0ef25f3b5fffa23d58deb0a9897e06cdc76d409071552cccb77962417fa5f5
Instruction ID: bd3ff06009ba9ded0ce695335d5be976f29ae4853b4fa3dca7860e22f8682137
Opcode Fuzzy Hash: ff0ef25f3b5fffa23d58deb0a9897e06cdc76d409071552cccb77962417fa5f5
Instruction Fuzzy Hash: A1D0C721B08A0186FB24AF62A400374A2D0AB88B10FCC9032C80C0A341DF3CF0A08322

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E0803C54 Relevance: 3.2, APIs: 1, Strings: 1, Instructions: 191COMMON

Download Yara Rule

APIs

EnterCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FF7E0803C9E

Part of subcall function 00007FF7E07F6C80: memset.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7E07F6D5B
Part of subcall function 00007FF7E07F6C80: _o_wcscpy_s.API-MS-WIN-CRT-PRIVATE-L1-1-0 ref: 00007FF7E07F6D6F
Part of subcall function 00007FF7E07F6C80: memset.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7E07F6D88

Part of subcall function 00007FF7E08044D8: memset.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7E0804516

Part of subcall function 00007FF7E081728C: CoInitializeEx.API-MS-WIN-CORE-COM-L1-1-0 ref: 00007FF7E08173C0
Part of subcall function 00007FF7E081728C: CoCreateInstance.API-MS-WIN-CORE-COM-L1-1-0 ref: 00007FF7E0817411

Part of subcall function 00007FF7E080BE64: DeviceIoControl.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7E086A183), ref: 00007FF7E080BE91

Strings

onecore\windows\core\console\open\src\server\iodispatchers.cpp, xrefs: 00007FF7E0803D74

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: memset$ControlCreateCriticalDeviceEnterInitializeInstanceSection_o_wcscpy_s
String ID: onecore\windows\core\console\open\src\server\iodispatchers.cpp
API String ID: 3618303396-2920610734
Opcode ID: 4dbc1ab172e9b01e2916110fea69ae44fca6d97b70c887de9f5ba8f34c162b1a
Instruction ID: b10b9291c34fae6497253b0c9f4a7d13884ecd37567d224ff38f54af578f3096
Opcode Fuzzy Hash: 4dbc1ab172e9b01e2916110fea69ae44fca6d97b70c887de9f5ba8f34c162b1a
Instruction Fuzzy Hash: 8F915122A18B8286F720AB15E4403BAF7A4FBA9784F804136EA4D47B95DF3CF455C761

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E080AF84 Relevance: 3.1, APIs: 1, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

memset.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00000001,?,00007FF7E086AEBE), ref: 00007FF7E080AFF7

Strings

onecore\windows\core\console\open\src\server\apimessage.cpp, xrefs: 00007FF7E0825A59

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: memset
String ID: onecore\windows\core\console\open\src\server\apimessage.cpp
API String ID: 2221118986-884894635
Opcode ID: 0a93d4353845a3c5878bfbfbf4d29c77fa67e346f1878334bf1fe1d1b689b324
Instruction ID: cd798bd8e15f22ec39261412833fb2f7bf768005de0e31b2310b2fd54bb95bf2
Opcode Fuzzy Hash: 0a93d4353845a3c5878bfbfbf4d29c77fa67e346f1878334bf1fe1d1b689b324
Instruction Fuzzy Hash: 5E210B32B0875286E710EF29A480229B7E1FB48BD4F504137DE0D57B59EE3DE862C711

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E07F336C Relevance: 3.1, APIs: 1, Strings: 1, Instructions: 60COMMON

Download Yara Rule

APIs

memset.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7E07F33F3

Strings

onecore\windows\core\console\open\src\renderer\gdi\state.cpp, xrefs: 00007FF7E081B1FC, 00007FF7E081B21F

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: memset
String ID: onecore\windows\core\console\open\src\renderer\gdi\state.cpp
API String ID: 2221118986-181080528
Opcode ID: 11e181e2ef1a22a4fa5a39a63aca7238e7d9b52012e603696beaa878ec9efff8
Instruction ID: 95efed5c5137825c849962bd7e972b1334bccacde20f66977fd3d396b3c7856d
Opcode Fuzzy Hash: 11e181e2ef1a22a4fa5a39a63aca7238e7d9b52012e603696beaa878ec9efff8
Instruction Fuzzy Hash: 0E31B432918B8585E740EF70D4843E977A0EB49B68F98433ADE1D8A3D5DF3CA0A4C721

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E07F3E48 Relevance: 3.0, APIs: 2, Instructions: 40COMMON

Download Yara Rule

APIs

IsDlgButtonChecked.USER32 ref: 00007FF7E07F3EA3
IsDlgButtonChecked.USER32 ref: 00007FF7E07F3EBC

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: ButtonChecked
String ID:
API String ID: 1719414920-0
Opcode ID: 9c938b063ae1c74f4aacd4afc7449b3887d1516581e6c9d4cc955ec8867ea6d7
Instruction ID: 78957b9bc7e63578ea21797089f06900ac7fe8b5ac445f5d6811449c81b3df16
Opcode Fuzzy Hash: 9c938b063ae1c74f4aacd4afc7449b3887d1516581e6c9d4cc955ec8867ea6d7
Instruction Fuzzy Hash: 36012D22704A9693EB009F66E44059DA760FB8DBC4B959033EF4D47718CE39E95ACB11

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E07F3190 Relevance: 3.0, APIs: 2, Instructions: 34COMMON

Download Yara Rule

APIs

SetActiveWindow.USER32 ref: 00007FF7E07F31B3
ShowWindow.USER32 ref: 00007FF7E07F31C4

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: Window$ActiveShow
String ID:
API String ID: 789302438-0
Opcode ID: 40d8d60e3d52dd23abbe9f42418284e1bc84510699fc08d9c6b81293faad0079
Instruction ID: 647c0ddd6ffd6d74bf1e1e3e3f26837891f67a20924eb2cfa7691555aa977359
Opcode Fuzzy Hash: 40d8d60e3d52dd23abbe9f42418284e1bc84510699fc08d9c6b81293faad0079
Instruction Fuzzy Hash: A701FF61A08B4786EE54AB16E58427DA6A0EB4DB84F944033CD1E46761CE3DF479C622

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E0807700 Relevance: 3.0, APIs: 2, Instructions: 22registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7E0808200: RegOpenCurrentUser.KERNELBASE ref: 00007FF7E0808238
Part of subcall function 00007FF7E0808200: RegOpenKeyW.ADVAPI32 ref: 00007FF7E0808272

RegCloseKey.KERNELBASE(?,?,00000000,00007FF7E07F4C1B), ref: 00007FF7E080773B
RegCloseKey.API-MS-WIN-CORE-REGISTRY-L1-1-0(?,?,00000000,00007FF7E07F4C1B), ref: 00007FF7E080774C

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: CloseOpen$CurrentUser
String ID:
API String ID: 2076574964-0
Opcode ID: 86c306239c4ddfa5aa241bbe7177b4a0f593bf21c3fa90607d621e304acdf670
Instruction ID: 77111afba732758c07164f33cf06d7d81dc81fc9a5fb638e27e8876502da9cb9
Opcode Fuzzy Hash: 86c306239c4ddfa5aa241bbe7177b4a0f593bf21c3fa90607d621e304acdf670
Instruction Fuzzy Hash: 62F03735718946C2EA00AB11E4406B9EB60FF85B85FC46032EE4F0B765DF7DE4A8CB11

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E07F4FEC Relevance: 1.6, APIs: 1, Instructions: 98COMMON

Download Yara Rule

APIs

GetCPInfo.API-MS-WIN-CORE-LOCALIZATION-L1-2-0(?,?,?,?,?,?,?,?,00000000,00007FF7E07F4D4C), ref: 00007FF7E07F506B

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: Info
String ID:
API String ID: 1807457897-0
Opcode ID: f14f64e95679472db7b35d07fc2c4e3cf573b6c2a6d2e6b8cd18f5e6a3b0ab4b
Instruction ID: 962259a52ab7f1a75414a453c78f0ff881b83d58005ed95fbddb60da55805be5
Opcode Fuzzy Hash: f14f64e95679472db7b35d07fc2c4e3cf573b6c2a6d2e6b8cd18f5e6a3b0ab4b
Instruction Fuzzy Hash: 4D413825A18A0386FA14BB24E8513B5A7A0BF69744FC00137D54D873A2DF7CF564CB22

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E0801095 Relevance: 1.6, APIs: 1, Instructions: 60COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7E08024C0: memset.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7E08025A2
Part of subcall function 00007FF7E08024C0: DeviceIoControl.KERNELBASE ref: 00007FF7E08025FB

DeviceIoControl.KERNELBASE ref: 00007FF7E0800F99
DeviceIoControl.KERNELBASE ref: 00007FF7E0801053

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: ControlDevice$memset
String ID:
API String ID: 3112380785-0
Opcode ID: 927ad33f8ab33099ba1bc953e1e4ac2726bd20f979bbb6b650f298fffe1fdd68
Instruction ID: cf017e282c6e9908d597d8e826ebf4368aeeda9c5dc5e81b94e2bcdfdf16e25f
Opcode Fuzzy Hash: 927ad33f8ab33099ba1bc953e1e4ac2726bd20f979bbb6b650f298fffe1fdd68
Instruction Fuzzy Hash: 0D217832A18B818AFB50DF60E44026EB7F1FB95748F540136EB8D96B58DF38E460DB10

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E08086C4 Relevance: 1.5, APIs: 1, Instructions: 36registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNELBASE ref: 00007FF7E08086F0

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: 9096d2b29d7658d0d1c42a5f4b6cd185ffd2113cadd8fee6b98d0f6e655550ff
Instruction ID: a37c6313f0098ca6778dddb540f9ddf33436979b3d49a8b6f5d0510adba7b440
Opcode Fuzzy Hash: 9096d2b29d7658d0d1c42a5f4b6cd185ffd2113cadd8fee6b98d0f6e655550ff
Instruction Fuzzy Hash: 4A018FB6A19741CBFB449B18904573DB2E0F748398FA04036EB8E47744DB3CE8A0CB21

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E080B570 Relevance: 1.5, APIs: 1, Instructions: 28threadCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7E080B5DC: GetCurrentThreadId.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0(?,?,?,00007FF7E080B57E), ref: 00007FF7E080B610

GetCurrentThreadId.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF7E080B57E

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: 8bb362dd67c4abac960d4abd61c8e3d820fe317d3b5f049fbb3da9ff70c0b320
Instruction ID: 4b8c035c9d160e207fee4bdcb105a2f6f2650096b85f7c85eee1415b945d0a89
Opcode Fuzzy Hash: 8bb362dd67c4abac960d4abd61c8e3d820fe317d3b5f049fbb3da9ff70c0b320
Instruction Fuzzy Hash: 3EF03A74E0D6068AFA197B60A925379B6D1BF99308FD48433C40C06386EE3CB9618E73

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E080B6D0 Relevance: 1.5, APIs: 1, Instructions: 27COMMON

Download Yara Rule

APIs

SetScrollInfo.USER32 ref: 00007FF7E080B72C

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: InfoScroll
String ID:
API String ID: 629608716-0
Opcode ID: da6d97b26d76b76542c7af19fdd4d10ccd5dc26307b1bd809d2e5d4f75203cff
Instruction ID: d5fd663edea468f21604a5a920f03b83b2ea54893a4ff299e3ae8558531e9251
Opcode Fuzzy Hash: da6d97b26d76b76542c7af19fdd4d10ccd5dc26307b1bd809d2e5d4f75203cff
Instruction Fuzzy Hash: D6F03CB3A186808BE760DF24E84175AB7E0F799B09F804616EA8C83B15DF3CD5058F00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E07F43A4 Relevance: 1.5, APIs: 1, Instructions: 26windowCOMMON

Download Yara Rule

APIs

ExtractIconExW.SHELL32 ref: 00007FF7E07F43CC

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: ExtractIcon
String ID:
API String ID: 556654666-0
Opcode ID: 1bfdb838004fddc47f7fb4642291eaae359895f15b64d8238ee633cbb20ea4a5
Instruction ID: c17b466036946b66c67ae428a1561473d8402e31d9d2cc5ad82650b36ae8a375
Opcode Fuzzy Hash: 1bfdb838004fddc47f7fb4642291eaae359895f15b64d8238ee633cbb20ea4a5
Instruction Fuzzy Hash: 84F08C6661468486DB509F59E4412A8A3A0FB58B84B984522DE5887714CF3CE4A6CA00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E080E0B0 Relevance: 1.5, APIs: 1, Instructions: 21threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNELBASE ref: 00007FF7E080E0DB

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: CreateThread
String ID:
API String ID: 2422867632-0
Opcode ID: f35dd847acce4158e1fb236cd9bd9ad2addd7f51e53b47b04fc428a89ca1a7e6
Instruction ID: c285f279fd2711b8931446f661fedc5aeec719fc44940a35d977d1dc7b4d6d78
Opcode Fuzzy Hash: f35dd847acce4158e1fb236cd9bd9ad2addd7f51e53b47b04fc428a89ca1a7e6
Instruction Fuzzy Hash: 5FE03032A18B4187E724CF24F441669FBB0F789768F988239DA9D067A8DB3CD165CA10

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E080BDC0 Relevance: 1.5, APIs: 1, Instructions: 15COMMON

Download Yara Rule

APIs

NotifyWinEvent.USER32 ref: 00007FF7E080BDEB

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: EventNotify
String ID:
API String ID: 1801992857-0
Opcode ID: 6d2145976b6f00127d3547ca1f634e192ded3877e4bc87512b2cf20bb39a59b7
Instruction ID: cc462d164f0f880508bd9e867f6cacb86c3293201f7d220e4493da174c2c9a14
Opcode Fuzzy Hash: 6d2145976b6f00127d3547ca1f634e192ded3877e4bc87512b2cf20bb39a59b7
Instruction Fuzzy Hash: 84E0CD24B1694182EB146715DCA0734A760FF49F45FC15031CB0D07710CE3CA4248B11

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E080E070 Relevance: 1.5, APIs: 1, Instructions: 13windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32 ref: 00007FF7E080E083

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 7a63f267b84f7be99e190ffbb054523b9a0373e909b48339e1db061994f5387c
Instruction ID: bd8bacbc15d1cb3bd4b7652aae79961d03457ca527cb25afbb42bbefebdfce60
Opcode Fuzzy Hash: 7a63f267b84f7be99e190ffbb054523b9a0373e909b48339e1db061994f5387c
Instruction Fuzzy Hash: 4AD022B7B7088283E7005BB1FC83B2925A0E39EB46FD27010CB0A97B40C93CC0520F00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E080D9B0 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

SystemParametersInfoW.USER32 ref: 00007FF7E080D9C1

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: InfoParametersSystem
String ID:
API String ID: 3098949447-0
Opcode ID: a83f00480aded687f23c5aa130310f309df9e4a649b905f1067a1d7096a0db58
Instruction ID: ca7ac3988d21951c8415c74ebffb037e844d9a0a1836fcc4a67f5041a721826e
Opcode Fuzzy Hash: a83f00480aded687f23c5aa130310f309df9e4a649b905f1067a1d7096a0db58
Instruction Fuzzy Hash: E5D01277A15680C7D348BB15E8809AABB70F7DD754BC46011E70703B14CA38D5E9CF00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E085C388 Relevance: 1.5, APIs: 1, Instructions: 9registryCOMMON

Download Yara Rule

APIs

RegOpenKeyW.ADVAPI32(?,?,?,?,00007FF7E0816F4F), ref: 00007FF7E085C38C

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: 00140a1532980521842c9a79a2b83843f974fd40ab8fd3ab8e1bc5daa0ae7b42
Instruction ID: 4b1c74efd90dbf328598695ef988ddde1dd959fc262bfd509b3a2212bbeba140
Opcode Fuzzy Hash: 00140a1532980521842c9a79a2b83843f974fd40ab8fd3ab8e1bc5daa0ae7b42
Instruction Fuzzy Hash: 6BC08C68E10481CAD20077165C01378A490BB89712FC18062C008C1341CA2CE0644B31

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E0854760 Relevance: 1.5, APIs: 1, Instructions: 9registryCOMMON

Download Yara Rule

APIs

RegCloseKey.KERNELBASE(?,?,?,?,00007FF7E0817103), ref: 00007FF7E085476C

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: Close
String ID:
API String ID: 3535843008-0
Opcode ID: 37140430e2f384be3ae912214004bf8914cc9523fc1a8eace7b5b0703db2df15
Instruction ID: 41e785cf1288c5816048f25b80fc00299a06f7a8e5ccaa69d763d0f62cf79067
Opcode Fuzzy Hash: 37140430e2f384be3ae912214004bf8914cc9523fc1a8eace7b5b0703db2df15
Instruction Fuzzy Hash: EDC04C25A07545CAEE08AB619455138A760BF9FB06BE8A571C50E16300CF3C64694721

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E08044D8 Relevance: 1.4, APIs: 1, Instructions: 164COMMON

Download Yara Rule

APIs

memset.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7E0804516

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: f93d6eb085b2083018b0cca92b7adeb816a6f2df40a6cfeca14c3c0f8bdc5b92
Instruction ID: 149d73122fb566ac09a9e357b08ee37b64251216db94690ba07901cb69264a1d
Opcode Fuzzy Hash: f93d6eb085b2083018b0cca92b7adeb816a6f2df40a6cfeca14c3c0f8bdc5b92
Instruction Fuzzy Hash: F7817B67E08BC487E7158F38C6012B9B3A0F769B48F55A215DB9C57622EB39F2E5C700

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00007FF7E07FFCB0 Relevance: 32.0, APIs: 13, Strings: 5, Instructions: 451COMMON

Download Yara Rule

APIs

_o_terminate.API-MS-WIN-CRT-PRIVATE-L1-1-0 ref: 00007FF7E081F732
?_Xout_of_range@std@@YAXPEBD@Z.MSVCP_WIN ref: 00007FF7E081F746
_o_terminate.API-MS-WIN-CRT-PRIVATE-L1-1-0 ref: 00007FF7E081F76D
?_Xout_of_range@std@@YAXPEBD@Z.MSVCP_WIN ref: 00007FF7E081F781

Strings

invalid unordered_map<K, T> key, xrefs: 00007FF7E081F900
invalid vector<T> subscript, xrefs: 00007FF7E081F927
invalid deque<T> subscript, xrefs: 00007FF7E081F73F, 00007FF7E081F77A, 00007FF7E081F796
onecore\windows\core\console\open\src\buffer\out\textbuffercelliterator.cpp, xrefs: 00007FF7E081F93F, 00007FF7E081F95B
VUUUUUUU, xrefs: 00007FF7E0800053

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: Xout_of_range@std@@_o_terminate
String ID: VUUUUUUU$invalid deque<T> subscript$invalid unordered_map<K, T> key$invalid vector<T> subscript$onecore\windows\core\console\open\src\buffer\out\textbuffercelliterator.cpp
API String ID: 1206583107-2159643177
Opcode ID: 38c8b80b411c102e31fe0f492724646f83131d51db3d1b58e0f21689adf7d8ea
Instruction ID: 2d2005e678a0e0f91cba1bf8621654c2efaa54a3af33ca7b3d1ef94a53582bfd
Opcode Fuzzy Hash: 38c8b80b411c102e31fe0f492724646f83131d51db3d1b58e0f21689adf7d8ea
Instruction Fuzzy Hash: 3712AE22A09B8585EB10EB65D0402B8B7A1FF58B88B948537CE4E17B65DF3CF5A1C321

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E07FF690 Relevance: 30.3, APIs: 10, Strings: 7, Instructions: 560COMMON

Download Yara Rule

APIs

?_Xout_of_range@std@@YAXPEBD@Z.MSVCP_WIN ref: 00007FF7E081F3B9
?_Xout_of_range@std@@YAXPEBD@Z.MSVCP_WIN ref: 00007FF7E081F554
?_Xout_of_range@std@@YAXPEBD@Z.MSVCP_WIN ref: 00007FF7E081F5FA

Strings

invalid unordered_map<K, T> key, xrefs: 00007FF7E081F5F3
VUUUUUUU, xrefs: 00007FF7E07FFAF8
invalid vector<T> subscript, xrefs: 00007FF7E081F54D
invalid deque<T> subscript, xrefs: 00007FF7E081F3B2, 00007FF7E081F477, 00007FF7E081F492, 00007FF7E081F4AD
onecore\windows\core\console\open\src\types\convert.cpp, xrefs: 00007FF7E081F6E0
onecore\windows\core\console\open\src\host\screeninfo.cpp, xrefs: 00007FF7E081F465, 00007FF7E081F709
onecore\windows\core\console\open\src\buffer\out\textbuffercelliterator.cpp, xrefs: 00007FF7E081F4D5, 00007FF7E081F4F3

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: Xout_of_range@std@@
String ID: VUUUUUUU$invalid deque<T> subscript$invalid unordered_map<K, T> key$invalid vector<T> subscript$onecore\windows\core\console\open\src\buffer\out\textbuffercelliterator.cpp$onecore\windows\core\console\open\src\host\screeninfo.cpp$onecore\windows\core\console\open\src\types\convert.cpp
API String ID: 1960685668-1255646998
Opcode ID: ec1d4d118aa555b5f25c39f1a38b41e4a251a33d4f47c47f18bb1bc1044d76bf
Instruction ID: 3dce37dc7d6125b79f234696d95506c5d40bed541922b7dd309b26093063b4ef
Opcode Fuzzy Hash: ec1d4d118aa555b5f25c39f1a38b41e4a251a33d4f47c47f18bb1bc1044d76bf
Instruction Fuzzy Hash: 0432C366A18A8681EF24EB15D0507BAA3A1FF98B80FD04037CA4D57796DF3CF860C361

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E0801250 Relevance: 28.6, APIs: 6, Strings: 10, Instructions: 635COMMON

Download Yara Rule

APIs

?_Xout_of_range@std@@YAXPEBD@Z.MSVCP_WIN ref: 00007FF7E0820116
?_Xout_of_range@std@@YAXPEBD@Z.MSVCP_WIN ref: 00007FF7E0820356
?_Xout_of_range@std@@YAXPEBD@Z.MSVCP_WIN ref: 00007FF7E08203D3

Strings

onecore\windows\core\console\open\src\buffer\out\row.cpp, xrefs: 00007FF7E0820486
onecore\windows\core\console\open\src\buffer\out\charrow.cpp, xrefs: 00007FF7E082058C
invalid string_view position, xrefs: 00007FF7E082010F, 00007FF7E0820176, 00007FF7E08201D9, 00007FF7E082034F, 00007FF7E08203CC
VUUUUUUU, xrefs: 00007FF7E08014F3
invalid vector<T> subscript, xrefs: 00007FF7E082059E
onecore\windows\core\console\open\src\buffer\out\charrowcellreference.cpp, xrefs: 00007FF7E0820574
VUUUUUUU, xrefs: 00007FF7E080142C
onecore\windows\core\console\open\src\types\codepointwidthdetector.cpp, xrefs: 00007FF7E08203EA
VUUUUUUU, xrefs: 00007FF7E0801573
onecore\windows\core\console\open\src\buffer\out\outputcelliterator.cpp, xrefs: 00007FF7E08200D3, 00007FF7E08205DE

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: Xout_of_range@std@@
String ID: VUUUUUUU$VUUUUUUU$VUUUUUUU$invalid string_view position$invalid vector<T> subscript$onecore\windows\core\console\open\src\buffer\out\charrow.cpp$onecore\windows\core\console\open\src\buffer\out\charrowcellreference.cpp$onecore\windows\core\console\open\src\buffer\out\outputcelliterator.cpp$onecore\windows\core\console\open\src\buffer\out\row.cpp$onecore\windows\core\console\open\src\types\codepointwidthdetector.cpp
API String ID: 1960685668-845067340
Opcode ID: 9923a29590919a9c9127537bc93becf8f3c2398c84a6510d3f6df8a615940280
Instruction ID: e208c9a73aa4eb5c4edba43ae38bb74f480152107e6a423b33b3b6969229f119
Opcode Fuzzy Hash: 9923a29590919a9c9127537bc93becf8f3c2398c84a6510d3f6df8a615940280
Instruction Fuzzy Hash: 3052BE22A08A8596EB14AB74C1453FCA3A1FB55798F808233DF4D17B96EF38F5A5C311

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E087532C Relevance: 24.8, APIs: 11, Strings: 3, Instructions: 251clipboardmemoryCOMMON

Download Yara Rule

APIs

GlobalAlloc.API-MS-WIN-CORE-HEAP-L2-1-0 ref: 00007FF7E08753B6
GlobalLock.API-MS-WIN-CORE-HEAP-OBSOLETE-L1-1-0 ref: 00007FF7E08753E7
GlobalUnlock.API-MS-WIN-CORE-HEAP-OBSOLETE-L1-1-0 ref: 00007FF7E087542C
OpenClipboard.USER32 ref: 00007FF7E087546C
EmptyClipboard.USER32 ref: 00007FF7E087549B
SetClipboardData.USER32 ref: 00007FF7E08754CE
GlobalAlloc.API-MS-WIN-CORE-HEAP-L2-1-0 ref: 00007FF7E08755A7
GlobalLock.API-MS-WIN-CORE-HEAP-OBSOLETE-L1-1-0 ref: 00007FF7E08755D8
GlobalUnlock.API-MS-WIN-CORE-HEAP-OBSOLETE-L1-1-0 ref: 00007FF7E087561D
SetClipboardData.USER32 ref: 00007FF7E087567D
CloseClipboard.USER32 ref: 00007FF7E08756BB

Strings

onecore\windows\core\console\open\src\interactivity\win32\clipboard.cpp, xrefs: 00007FF7E08753D2, 00007FF7E08753FC, 00007FF7E0875443, 00007FF7E0875485, 00007FF7E08754B4, 00007FF7E08754E3, 00007FF7E08755C3, 00007FF7E08755ED, 00007FF7E0875634, 00007FF7E0875666, 00007FF7E0875692, 00007FF7E08756D4
HTML Format, xrefs: 00007FF7E0875646
Windows Console Host, xrefs: 00007FF7E087554A

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: Global$Clipboard$AllocDataLockUnlock$CloseEmptyOpen
String ID: HTML Format$Windows Console Host$onecore\windows\core\console\open\src\interactivity\win32\clipboard.cpp
API String ID: 3454716560-1260932009
Opcode ID: f76930f987153cee35c04029cee38e16808d9e0fc032d0632b61abe5d8397ed6
Instruction ID: 0d044f810f0846f53b1e6cbd0f153231bf47d625a663aa2440beced13616b5b1
Opcode Fuzzy Hash: f76930f987153cee35c04029cee38e16808d9e0fc032d0632b61abe5d8397ed6
Instruction Fuzzy Hash: 04B16036A05A468AEB00AF65D4443F9A7A2FB98B84FD44033DA0D53759DF7CF865C321

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E07FCFA0 Relevance: 23.5, APIs: 11, Strings: 2, Instructions: 723COMMON

Download Yara Rule

APIs

?_Xout_of_range@std@@YAXPEBD@Z.MSVCP_WIN ref: 00007FF7E081F391
?_Xout_of_range@std@@YAXPEBD@Z.MSVCP_WIN ref: 00007FF7E081F3A5
?_Xout_of_range@std@@YAXPEBD@Z.MSVCP_WIN ref: 00007FF7E081F3B9

Strings

onecore\windows\core\console\open\src\host\_stream.cpp, xrefs: 00007FF7E081F238
invalid deque<T> subscript, xrefs: 00007FF7E081F38A, 00007FF7E081F39E, 00007FF7E081F3B2

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: Xout_of_range@std@@
String ID: invalid deque<T> subscript$onecore\windows\core\console\open\src\host\_stream.cpp
API String ID: 1960685668-3945297005
Opcode ID: 004b24496161a0f140cb5d54deb2b9a8894713f6dd84608b0d0b780c0934e9bc
Instruction ID: 9062ceda659595d3318535fd4caa081011f7b3f60aa2808df4b1fb6f82484b4b
Opcode Fuzzy Hash: 004b24496161a0f140cb5d54deb2b9a8894713f6dd84608b0d0b780c0934e9bc
Instruction Fuzzy Hash: 23727126A1C7C585EA20EB25E0403BAF7A1FF99744F905136DA8D43759EF3CE464CB12

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E084EB40 Relevance: 21.3, APIs: 10, Strings: 2, Instructions: 346COMMON

Download Yara Rule

APIs

default_delete.LIBCPMT ref: 00007FF7E084ECD0

Strings

onecore\windows\core\console\open\src\server\objecthandle.cpp, xrefs: 00007FF7E084EB4E
onecore\windows\core\console\open\src\host\readdatacooked.cpp, xrefs: 00007FF7E084EBF9, 00007FF7E084F036

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: default_delete
String ID: onecore\windows\core\console\open\src\host\readdatacooked.cpp$onecore\windows\core\console\open\src\server\objecthandle.cpp
API String ID: 3712186324-2221960914
Opcode ID: 5857e9075e7d9512f2284e0c43dc198d981737869d2f9938d0806dacffc31188
Instruction ID: 66770b67f14880536adec2e7f44dd303e6d2ea5412707a6d5ca3b0bdaaafabdb
Opcode Fuzzy Hash: 5857e9075e7d9512f2284e0c43dc198d981737869d2f9938d0806dacffc31188
Instruction Fuzzy Hash: 0BD1A562A08B8186EB30AB69E04137EE3A0FB55B94F845636DB8E03B95DF7DF450C311

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E0874DE8 Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 195libraryloaderCOMMON

Download Yara Rule

APIs

memset.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7E0874E2A
LoadLibraryExW.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0 ref: 00007FF7E0874EA0
memset.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7E0874EC4
GetSystemDirectoryW.API-MS-WIN-CORE-SYSINFO-L1-1-0 ref: 00007FF7E0874ED4
LoadLibraryExW.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0 ref: 00007FF7E0874FB7
GetProcAddress.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0 ref: 00007FF7E0874FD9

Part of subcall function 00007FF7E0874554: GetWindowRect.USER32 ref: 00007FF7E08745E1

FreeLibrary.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0 ref: 00007FF7E0875031
EnterCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FF7E0875060

Strings

.\console.dll, xrefs: 00007FF7E0874E97
\console.dll, xrefs: 00007FF7E0874F59
CPlApplet, xrefs: 00007FF7E0874FCF
onecore\windows\core\console\open\src\interactivity\win32\menu.cpp, xrefs: 00007FF7E0874E4B, 00007FF7E0875048

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: Library$Loadmemset$AddressCriticalDirectoryEnterFreeProcRectSectionSystemWindow
String ID: .\console.dll$CPlApplet$\console.dll$onecore\windows\core\console\open\src\interactivity\win32\menu.cpp
API String ID: 1517543677-1215343536
Opcode ID: 7a90a091d0f52849ed14452e99e505ed3fe9846d2fe5e52f845196a240e93f4e
Instruction ID: d437896603ab3d3e9f3c045fb8102d0b3f364cbb69e237af545c2d7bcc30e80a
Opcode Fuzzy Hash: 7a90a091d0f52849ed14452e99e505ed3fe9846d2fe5e52f845196a240e93f4e
Instruction Fuzzy Hash: E971C422B18A4286EB54AB25D8147B9A7A0FF84744FC86433DD0E87799DF3CF558C722

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E0809960 Relevance: 19.6, APIs: 9, Strings: 2, Instructions: 312COMMON

Download Yara Rule

APIs

memset.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7E0809A59
memset.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7E0809AA6
_o_terminate.API-MS-WIN-CRT-PRIVATE-L1-1-0 ref: 00007FF7E082477C
_o_terminate.API-MS-WIN-CRT-PRIVATE-L1-1-0 ref: 00007FF7E082479D
WideCharToMultiByte.API-MS-WIN-CORE-STRING-L1-1-0 ref: 00007FF7E08247DC
WideCharToMultiByte.API-MS-WIN-CORE-STRING-L1-1-0 ref: 00007FF7E082483F
MultiByteToWideChar.API-MS-WIN-CORE-STRING-L1-1-0 ref: 00007FF7E0824871
MultiByteToWideChar.API-MS-WIN-CORE-STRING-L1-1-0 ref: 00007FF7E08248B2
_o_terminate.API-MS-WIN-CRT-PRIVATE-L1-1-0 ref: 00007FF7E082490B

Strings

onecore\windows\core\console\open\src\renderer\gdi\math.cpp, xrefs: 00007FF7E082497D
onecore\windows\core\console\open\src\renderer\gdi\paint.cpp, xrefs: 00007FF7E082470C, 00007FF7E082473D, 00007FF7E0824941, 00007FF7E082499D

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: ByteCharMultiWide$_o_terminate$memset
String ID: onecore\windows\core\console\open\src\renderer\gdi\math.cpp$onecore\windows\core\console\open\src\renderer\gdi\paint.cpp
API String ID: 2157953957-3378245266
Opcode ID: b3af8851f210106928c51e306d907b8ac035fc85282f710267371c24d84ba422
Instruction ID: 32e569f9e5ec617c06170d5cc0a773d9d6219f9feb2944661fa35d72c48f98f8
Opcode Fuzzy Hash: b3af8851f210106928c51e306d907b8ac035fc85282f710267371c24d84ba422
Instruction Fuzzy Hash: D7D1C532A0878286E720EB21E45077AF7A4FB89B94F90A137DA8D53794DF3CE465C711

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E081728C Relevance: 19.5, APIs: 9, Strings: 2, Instructions: 255comsynchronizationpipeCOMMON

Download Yara Rule

APIs

CoInitializeEx.API-MS-WIN-CORE-COM-L1-1-0 ref: 00007FF7E08173C0
CoCreateInstance.API-MS-WIN-CORE-COM-L1-1-0 ref: 00007FF7E0817411
CreatePipe.API-MS-WIN-CORE-NAMEDPIPE-L1-1-0 ref: 00007FF7E08174A7
GetCurrentProcess.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF7E08174C8
GetCurrentProcess.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF7E08174D7
GetCurrentProcess.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF7E08174E6
DuplicateHandle.API-MS-WIN-CORE-HANDLE-L1-1-0 ref: 00007FF7E0817512
WaitForSingleObject.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FF7E081769E
ExitProcess.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF7E08176AC

Strings

onecore\windows\core\console\open\src\server\iodispatchers.cpp, xrefs: 00007FF7E08176FF, 00007FF7E0817711, 00007FF7E0817723, 00007FF7E0817738, 00007FF7E081774D
onecore\internal\sdk\inc\wil\opensource\wil\resource.h, xrefs: 00007FF7E08176EA

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: Process$Current$Create$DuplicateExitHandleInitializeInstanceObjectPipeSingleWait
String ID: onecore\internal\sdk\inc\wil\opensource\wil\resource.h$onecore\windows\core\console\open\src\server\iodispatchers.cpp
API String ID: 3593327365-798144096
Opcode ID: d960d5e14453ca26b4cc43961bb404a2e1d43e11d9509595c5d19f59c2db9b6b
Instruction ID: ecab1aa4a95ee4f3b6bdcf103baaca783ac2b4e6546b363138764d626fdbd5de
Opcode Fuzzy Hash: d960d5e14453ca26b4cc43961bb404a2e1d43e11d9509595c5d19f59c2db9b6b
Instruction Fuzzy Hash: 13C15036608B8286E760EB25E4403AAF7A0FB89754F844137DA9D43B65DF3CF064CB21

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E08771C8 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 133windownativeCOMMON

Download Yara Rule

APIs

RtlCreateUnicodeString.NTDLL ref: 00007FF7E0877208
AlpcInitializeMessageAttribute.NTDLL ref: 00007FF7E0877238
NtAlpcConnectPort.NTDLL ref: 00007FF7E08772F1
AlpcGetMessageAttribute.NTDLL ref: 00007FF7E0877310
AlpcGetMessageAttribute.NTDLL ref: 00007FF7E0877328
NtAlpcQueryInformationMessage.NTDLL ref: 00007FF7E0877378
memset.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7E08773C6

Strings

\ConsoleInputServerPort, xrefs: 00007FF7E08771FD

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: Alpc$Message$Attribute$ConnectCreateInformationInitializePortQueryStringUnicodememset
String ID: \ConsoleInputServerPort
API String ID: 1000960221-2084386880
Opcode ID: d70be9f50a9605f18c35c02a6d51181896ae7a02e91167237e31f86e3fa97f49
Instruction ID: e765f831baed0a327ec9d202ab3b648b3f592d6f66296c7567e0132c092126b6
Opcode Fuzzy Hash: d70be9f50a9605f18c35c02a6d51181896ae7a02e91167237e31f86e3fa97f49
Instruction Fuzzy Hash: A7516932A08B51DAE710CF20E8447AEBBB4F749348F910126EE8D57B08DF78E5A4CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E08103A0 Relevance: 13.6, APIs: 9, Instructions: 72COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-1 ref: 00007FF7E08103BC
memset.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7E08103E0
RtlCaptureContext.API-MS-WIN-CORE-RTLSUPPORT-L1-1-0 ref: 00007FF7E08103E9
RtlLookupFunctionEntry.API-MS-WIN-CORE-RTLSUPPORT-L1-1-0 ref: 00007FF7E0810403
RtlVirtualUnwind.API-MS-WIN-CORE-RTLSUPPORT-L1-1-0 ref: 00007FF7E0810444
memset.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7E0810477
IsDebuggerPresent.API-MS-WIN-CORE-DEBUG-L1-1-0 ref: 00007FF7E0810498
SetUnhandledExceptionFilter.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF7E08104B9
UnhandledExceptionFilter.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF7E08104C4

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: ExceptionFilterPresentUnhandledmemset$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 313767242-0
Opcode ID: a38168b68acdbfef8fd9f57433e00a2adc235c3168885ea1ae28803a8634db5d
Instruction ID: dddb74aa5cbde5d7af659c3a3b23de63ffc17d23135d509472e7b9f732c7c325
Opcode Fuzzy Hash: a38168b68acdbfef8fd9f57433e00a2adc235c3168885ea1ae28803a8634db5d
Instruction Fuzzy Hash: AC316572609B8186EB60AF60E8403EDB360FB44758F84443ADB4D57B99DF7CE558CB21

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E0843FE0 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 243COMMON

Download Yara Rule

APIs

default_delete.LIBCPMT ref: 00007FF7E08440D3
memmove.API-MS-WIN-CRT-PRIVATE-L1-1-0 ref: 00007FF7E084424B

Strings

onecore\windows\core\console\open\src\host\inputreadhandledata.cpp, xrefs: 00007FF7E084405D

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: default_deletememmove
String ID: onecore\windows\core\console\open\src\host\inputreadhandledata.cpp
API String ID: 36335320-3387545977
Opcode ID: ccfe96a43fd18fbe976e1eaeeaf5ec8a391075d85fe09d6adc6994ee83848ebf
Instruction ID: 681370d0a2e3c60fbfc94196a11fd1d0ddade01d83b17174982a831db96268ed
Opcode Fuzzy Hash: ccfe96a43fd18fbe976e1eaeeaf5ec8a391075d85fe09d6adc6994ee83848ebf
Instruction Fuzzy Hash: 1491D522B1879189EB60FF11A0417AAE7A5FB55BC4F846036EF8D07B45DE3CE4A1C712

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E086E9E0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 83registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7E080CAFC: LoadLibraryW.KERNELBASE(?,?,?,?,?,?,?,00007FF7E07F4BE5), ref: 00007FF7E080CB11

GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF7E086EA13
FreeLibrary.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0 ref: 00007FF7E086EA44
memset.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7E086EA64
RegisterClassW.USER32 ref: 00007FF7E086EAA4
CreateWindowExW.USER32 ref: 00007FF7E086EAE2
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF7E086EAF6

Strings

PseudoConsoleWindow, xrefs: 00007FF7E086EA84

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: ErrorLastLibrary$ClassCreateFreeLoadRegisterWindowmemset
String ID: PseudoConsoleWindow
API String ID: 671991893-840225159
Opcode ID: 1699381ed861368e9aa51664b16f804d2e2b9c845235e8800711acc22298da40
Instruction ID: af6184eb692840c555bffbb5cf87500ffe8f0a84c3818a8088989e670f15abb5
Opcode Fuzzy Hash: 1699381ed861368e9aa51664b16f804d2e2b9c845235e8800711acc22298da40
Instruction Fuzzy Hash: 5D318336A08B8186E3609F55F440369F6A1FB88790FD68136D68D53758DF3CF461CB22

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E07FD7F0 Relevance: 12.1, APIs: 2, Strings: 4, Instructions: 1575COMMON

Download Yara Rule

APIs

GetStringTypeW.API-MS-WIN-CORE-STRING-L1-1-0 ref: 00007FF7E07FDC78

Part of subcall function 00007FF7E0840798: MultiByteToWideChar.API-MS-WIN-CORE-STRING-L1-1-0 ref: 00007FF7E0840855

Strings

CONSRV: Ignoring backspace to previous line, xrefs: 00007FF7E07FEFCF
, xrefs: 00007FF7E07FDC84
onecore\windows\core\console\open\src\host\_stream.cpp, xrefs: 00007FF7E07FF43D, 00007FF7E07FF65B, 00007FF7E07FF673
onecore\windows\core\console\open\src\types\codepointwidthdetector.cpp, xrefs: 00007FF7E07FF455

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: ByteCharMultiStringTypeWide
String ID: $CONSRV: Ignoring backspace to previous line$onecore\windows\core\console\open\src\host\_stream.cpp$onecore\windows\core\console\open\src\types\codepointwidthdetector.cpp
API String ID: 3139900361-3398608187
Opcode ID: 03b4235f10196d47ce5aabbb0c16536e598ef2272ded692a81a7485f9f27b1aa
Instruction ID: e52670a7935fc5e400376df6e72182550c5e678d9471c085deabe320e60e2aa6
Opcode Fuzzy Hash: 03b4235f10196d47ce5aabbb0c16536e598ef2272ded692a81a7485f9f27b1aa
Instruction Fuzzy Hash: 5CF29F22A1CAC185EA759B25E0413FAF3A1FF98784F445122DACD53B59EF3CE4A1CB11

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E084E0F8 Relevance: 9.4, APIs: 2, Strings: 4, Instructions: 444COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7E084A914: memset.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7E084A956
Part of subcall function 00007FF7E084A914: _vswprintf_c.LEGACY_STDIO_DEFINITIONS ref: 00007FF7E084A96B

memmove.API-MS-WIN-CRT-PRIVATE-L1-1-0(?,?,?,?,?,?,?,00000000,?,00000000,?,onecore\windows\core\console\open\src\server\objecthandle.cpp,?,00007FF7E084F180), ref: 00007FF7E084E513
memmove.API-MS-WIN-CRT-PRIVATE-L1-1-0(?,?,?,?,?,?,?,00000000,?,00000000,?,onecore\windows\core\console\open\src\server\objecthandle.cpp,?,00007FF7E084F180), ref: 00007FF7E084E614

Strings

onecore\windows\core\console\open\src\server\objecthandle.cpp, xrefs: 00007FF7E084E0FE
onecore\windows\core\console\open\src\host\readdatacooked.cpp, xrefs: 00007FF7E084E407
WriteCharsLegacy failed %x, xrefs: 00007FF7E084E280, 00007FF7E084E4E3
WriteCharsLegacy failed 0x%x, xrefs: 00007FF7E084E3A7, 00007FF7E084E72B

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: memmove$_vswprintf_cmemset
String ID: WriteCharsLegacy failed %x$WriteCharsLegacy failed 0x%x$onecore\windows\core\console\open\src\host\readdatacooked.cpp$onecore\windows\core\console\open\src\server\objecthandle.cpp
API String ID: 1118619546-1833037669
Opcode ID: 1c28c976be025ce30be37d1b00e05af8c637796405b572f14ecea54c1241d808
Instruction ID: 2966c144ddc6fcf63ea6d38647f7043895be077c35b60ae93c4cba1e931d76f9
Opcode Fuzzy Hash: 1c28c976be025ce30be37d1b00e05af8c637796405b572f14ecea54c1241d808
Instruction Fuzzy Hash: 36229F72A147918AE750AF35C0403AD7BA4FB04B98F915237EE4D57799EF38E8A0C361

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E088A910 Relevance: 9.2, APIs: 4, Strings: 2, Instructions: 190memorysleepCOMMON

Download Yara Rule

APIs

HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0 ref: 00007FF7E088A970
memset.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7E088A996
Sleep.API-MS-WIN-CORE-SYNCH-L1-2-0 ref: 00007FF7E088A9B1

Part of subcall function 00007FF7E088AC1C: HeapFree.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,00000000,00007FF7E088ABE4), ref: 00007FF7E088AC96
Part of subcall function 00007FF7E088AC1C: HeapFree.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,00000000,00007FF7E088ABE4), ref: 00007FF7E088ACB4

Strings

Courier New, xrefs: 00007FF7E088AA30
en-us, xrefs: 00007FF7E088AA0A

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: Heap$Free$AllocSleepmemset
String ID: Courier New$en-us
API String ID: 3324063907-2224409271
Opcode ID: cead42774eb9d84a466740232a417697810dff1019e194685ac062292d6ee36e
Instruction ID: 2b448cda22b2b81ba15845a204630c4cf706c9b7b8c128d0b424830165beb245
Opcode Fuzzy Hash: cead42774eb9d84a466740232a417697810dff1019e194685ac062292d6ee36e
Instruction Fuzzy Hash: D5918F32B14B4686EB00EF3AD8403A8B761FB89B98F955232DE0D5B764DF39E451C760

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E0874554 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 213COMMON

Download Yara Rule

APIs

GetWindowRect.USER32 ref: 00007FF7E08745E1

Part of subcall function 00007FF7E07F4408: _Init_thread_footer.LIBCMT ref: 00007FF7E07F4450

memmove.API-MS-WIN-CRT-PRIVATE-L1-1-0(?,?,?,?,?,?,?,?,00000001,00007FF7E0874E40), ref: 00007FF7E0874703
memset.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,00000001,00007FF7E0874E40), ref: 00007FF7E08747E7
memset.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,00000001,00007FF7E0874E40), ref: 00007FF7E087474D

Part of subcall function 00007FF7E0872B38: memmove.API-MS-WIN-CRT-PRIVATE-L1-1-0(?,?,?,00007FF7E07F417C), ref: 00007FF7E0872B60

Strings

onecore\windows\core\console\open\src\interactivity\win32\menu.cpp, xrefs: 00007FF7E0874663, 00007FF7E0874770

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: memmovememset$Init_thread_footerRectWindow
String ID: onecore\windows\core\console\open\src\interactivity\win32\menu.cpp
API String ID: 4133184459-2952571135
Opcode ID: 47ead6a6dc8b2f4bb23c12e2f1563f1a741b1f719efe53c22453d2e97aa17745
Instruction ID: fd95c79c92adbc8bfb130c88f27e8c7b1ef16a076a2ded860e92b073b1a1fce3
Opcode Fuzzy Hash: 47ead6a6dc8b2f4bb23c12e2f1563f1a741b1f719efe53c22453d2e97aa17745
Instruction Fuzzy Hash: D2A19A3AA086829AE748EF25E5407A8B7A0FB58780F844137DA1D87755DF3CF475CB22

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E0801780 Relevance: 6.3, APIs: 3, Strings: 1, Instructions: 306COMMON

Download Yara Rule

APIs

memmove.API-MS-WIN-CRT-PRIVATE-L1-1-0 ref: 00007FF7E0801952
memmove.API-MS-WIN-CRT-PRIVATE-L1-1-0 ref: 00007FF7E0801A04

Strings

onecore\windows\core\console\open\src\buffer\out\attrrow.cpp, xrefs: 00007FF7E08206E0

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: memmove
String ID: onecore\windows\core\console\open\src\buffer\out\attrrow.cpp
API String ID: 2162964266-2351056112
Opcode ID: 7387e73138805870515b5675e2abddaa99fee1c2c49673b474438d25282a496d
Instruction ID: 602c317578b2786dd521bdffb58020b42e618d54877af68f8aa96622484fdbf0
Opcode Fuzzy Hash: 7387e73138805870515b5675e2abddaa99fee1c2c49673b474438d25282a496d
Instruction Fuzzy Hash: 4FC1F462F197A144FF109B6584102BCBBF1BB15B98B944033DE9C27796CF38E562C321

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E0849608 Relevance: 6.1, APIs: 4, Instructions: 63COMMON

Download Yara Rule

APIs

FindResourceExW.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0(?,?,00000001,00007FF7E08493D6), ref: 00007FF7E0849651
LoadResource.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0(?,?,00000001,00007FF7E08493D6), ref: 00007FF7E0849668
LockResource.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0(?,?,00000001,00007FF7E08493D6), ref: 00007FF7E084967C
memmove.API-MS-WIN-CRT-PRIVATE-L1-1-0(?,?,00000001,00007FF7E08493D6), ref: 00007FF7E08496BF

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: Resource$FindLoadLockmemmove
String ID:
API String ID: 3479116980-0
Opcode ID: 27e3433fc7ddbfc7b62fb350d3baf12d08a0c4a3679c6fde9e3b08f1f963ece2
Instruction ID: 7161698bc29dbf696ae7938b9d01189e8d5fa5c1736a386eb720967370c218c3
Opcode Fuzzy Hash: 27e3433fc7ddbfc7b62fb350d3baf12d08a0c4a3679c6fde9e3b08f1f963ece2
Instruction Fuzzy Hash: 2621F6A1B05B818AEB609F05A440239E6E1FF99F90B994135DE8D17795DF3CF821C310

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E080F7A8 Relevance: 6.0, APIs: 4, Instructions: 21COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.API-MS-WIN-CORE-DEBUG-L1-1-0(?,?,?,00007FF7E080F8DD), ref: 00007FF7E080F7B1
SetUnhandledExceptionFilter.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,?,00007FF7E080F8DD), ref: 00007FF7E080F7C9
UnhandledExceptionFilter.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,?,00007FF7E080F8DD), ref: 00007FF7E080F7D2
GetCurrentProcess.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0(?,?,?,00007FF7E080F8DD), ref: 00007FF7E080F7EB

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: ExceptionFilterUnhandled$CurrentDebuggerPresentProcess
String ID:
API String ID: 2506494423-0
Opcode ID: 4b20ff4fb918c47df7b43a62383b1f621ddfa75d121d6af590887687acafd5d8
Instruction ID: 811d59ba4cd55ed6673db27cf2f86175c16310a8f5991aa38d75c4506b79c389
Opcode Fuzzy Hash: 4b20ff4fb918c47df7b43a62383b1f621ddfa75d121d6af590887687acafd5d8
Instruction Fuzzy Hash: 70F06564D08603CBF7183BA0A815334E250AF59714FC40037CA0E09393DF7C78A48732

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E07FA43C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 54nativeCOMMON

Download Yara Rule

APIs

WideCharToMultiByte.API-MS-WIN-CORE-STRING-L1-1-0 ref: 00007FF7E07FA474
NtdllDefWindowProc_W.NTDLL ref: 00007FF7E081D79F

Strings

onecore\windows\core\console\open\src\types\convert.cpp, xrefs: 00007FF7E081D739, 00007FF7E081D750, 00007FF7E081D76D

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: ByteCharMultiNtdllProc_WideWindow
String ID: onecore\windows\core\console\open\src\types\convert.cpp
API String ID: 2884015231-4041387901
Opcode ID: c2344d99f5e431281ebbb50e120f7b4043e2dc82a2175189585dda22a4af8c00
Instruction ID: 39b13f319e61aa4671ea70aa0ff9647b0e17af9951e77d2e54f9b06eeef753e6
Opcode Fuzzy Hash: c2344d99f5e431281ebbb50e120f7b4043e2dc82a2175189585dda22a4af8c00
Instruction Fuzzy Hash: E311C362E0C74682F71077949054379DB60AF98794FE04537D68D13BD5CE3CF4658222

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E0875F30 Relevance: 4.7, APIs: 3, Instructions: 243COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7E0810000: EnterCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,?,00007FF7E0803769,?,?,?,?,00007FF7E081B159), ref: 00007FF7E0810010

Part of subcall function 00007FF7E080FD30: _onexit.LIBCMT ref: 00007FF7E080FD34

_Init_thread_footer.LIBCMT ref: 00007FF7E0875FA5

Part of subcall function 00007FF7E080FF98: EnterCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,?,00007FF7E0803790,?,?,?,?,00007FF7E081B159), ref: 00007FF7E080FFA8
Part of subcall function 00007FF7E080FF98: LeaveCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,?,00007FF7E0803790,?,?,?,?,00007FF7E081B159), ref: 00007FF7E080FFE8

Part of subcall function 00007FF7E08051F4: memmove.API-MS-WIN-CRT-PRIVATE-L1-1-0(?,?,?,00007FF7E0805951,?,?,?,00007FF7E07F1267), ref: 00007FF7E0805224

EnterCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FF7E08760CD
SetWindowLongPtrW.USER32 ref: 00007FF7E087628D

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: CriticalSection$Enter$Init_thread_footerLeaveLongWindow_onexitmemmove
String ID:
API String ID: 1010988071-0
Opcode ID: 5613ac7f2f2352003b9cd18280b783c65a1fca720c255712c546491c33e169f7
Instruction ID: fc46b1c27a1f6ca9e463ac1b5bc97a098fe36f795bed87cf17d2dd637ca3f7bb
Opcode Fuzzy Hash: 5613ac7f2f2352003b9cd18280b783c65a1fca720c255712c546491c33e169f7
Instruction Fuzzy Hash: 01A1C432A08A4686EB00EB66D8443B9E7A1FF99784F848233D90D57765DF3CF465CB21

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E08094D4 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 23filenativeCOMMON

Download Yara Rule

APIs

NtQueryVolumeInformationFile.NTDLL ref: 00007FF7E08094F0

Strings

onecore\windows\core\console\open\src\host\exemain.cpp, xrefs: 00007FF7E0823009

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: FileInformationQueryVolume
String ID: onecore\windows\core\console\open\src\host\exemain.cpp
API String ID: 634242254-3772832676
Opcode ID: 0fbd3bc5b44322365b29f88852f3eef38487287aff61bea0370e85e0512d1853
Instruction ID: 954f7ce3de47e52fbf60f3a7b15cb607afc5a9f0d052e03843ebc1d68935e9fe
Opcode Fuzzy Hash: 0fbd3bc5b44322365b29f88852f3eef38487287aff61bea0370e85e0512d1853
Instruction Fuzzy Hash: FAF0A0A2718643C5E700AB65E800BA9EBA0FB81B84FC05132D64CA37A4DE3CE119CB11

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E084D5C4 Relevance: 2.6, APIs: 2, Instructions: 103COMMON

Download Yara Rule

APIs

memset.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000,00007FF7E07F4189), ref: 00007FF7E084D5EA
memmove.API-MS-WIN-CRT-PRIVATE-L1-1-0(?,?,00000000,00007FF7E07F4189), ref: 00007FF7E084D6B1

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: memmovememset
String ID:
API String ID: 1288253900-0
Opcode ID: 03b139c33d83ba5ee53381c1b2f0b6da3b4fd2c10359d6c886aa76cbe74f1b7e
Instruction ID: 22fa15b832c2d2ff7de2586d2b76fc2cf3db706b2260fb4078dc5cfbbd97fbef
Opcode Fuzzy Hash: 03b139c33d83ba5ee53381c1b2f0b6da3b4fd2c10359d6c886aa76cbe74f1b7e
Instruction Fuzzy Hash: 295190776146919FD369CF79E68169ABBE0F708340F04852ADBAAC3B00E738F560CB10

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E087D7C4 Relevance: 1.7, Strings: 1, Instructions: 445COMMON

Download Yara Rule

Strings

onecore\windows\core\console\open\src\tsf\tfeditses.cpp, xrefs: 00007FF7E087DC56, 00007FF7E087DCBB, 00007FF7E087DDA4

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID:
String ID: onecore\windows\core\console\open\src\tsf\tfeditses.cpp
API String ID: 0-2059936226
Opcode ID: 3ff47884fe392a2e59f6512da17317d27421c4b033de8e8d54c43cd588ff2ff5
Instruction ID: d20b7300995f182baf6a3a4b7f995150afa241fb1bafff872ccf917c69e5ac3b
Opcode Fuzzy Hash: 3ff47884fe392a2e59f6512da17317d27421c4b033de8e8d54c43cd588ff2ff5
Instruction Fuzzy Hash: 31222E36608BC582D6709B15E4903AAB7A4FB88B84F944133DE8D93B69DF3CE495CB11

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E087EC6C Relevance: 1.6, Strings: 1, Instructions: 349COMMON

Download Yara Rule

Strings

onecore\windows\core\console\open\src\tsf\tfeditses.cpp, xrefs: 00007FF7E087ECF5, 00007FF7E087ED88, 00007FF7E087EE36, 00007FF7E087EEFD, 00007FF7E087EF5C, 00007FF7E087EFD5

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID:
String ID: onecore\windows\core\console\open\src\tsf\tfeditses.cpp
API String ID: 0-2059936226
Opcode ID: dbc731b3c37723fc460128b3273a513a93623d242ccee1de5fbf8468f452903d
Instruction ID: a9f3d2e9a2264178869dd847d7e6cb16df724b26ad000eecece2727b68ee5a6c
Opcode Fuzzy Hash: dbc731b3c37723fc460128b3273a513a93623d242ccee1de5fbf8468f452903d
Instruction Fuzzy Hash: 69F17532709AC281EA70EB15E4443AAE351FBC8790F944233DA9D97B99DF3CE455CB11

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E07F8448 Relevance: 1.6, APIs: 1, Instructions: 68windowCOMMON

Download Yara Rule

APIs

IsIconic.USER32 ref: 00007FF7E07F84B0

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: Iconic
String ID:
API String ID: 110040809-0
Opcode ID: 9068afc85db04c7bc8fdbc2c950caf1cea046e5dd071fb0963d56da4dc97d689
Instruction ID: da0e6500338fc4b8bae48fa977165dd0573b00199dc67ac84721b07a3a505eb9
Opcode Fuzzy Hash: 9068afc85db04c7bc8fdbc2c950caf1cea046e5dd071fb0963d56da4dc97d689
Instruction Fuzzy Hash: ED316E72A087818AEB64AF25E440279B7A0FB8CB44F844136DA8D03756DF3CF5B1CA21

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E0877A68 Relevance: 1.5, APIs: 1, Instructions: 21nativeCOMMON

Download Yara Rule

APIs

NtAlpcSendWaitReceivePort.NTDLL ref: 00007FF7E0877AAA

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: AlpcPortReceiveSendWait
String ID:
API String ID: 1544246631-0
Opcode ID: 96335afa32a163275d59152c94de65dfcb58fb4bd1e5bec9257e49fe85bd3ddf
Instruction ID: 31ba5a588d0e9b52a1588c2e8c4afd7e5c2b224aac270daf340c3a21fa278873
Opcode Fuzzy Hash: 96335afa32a163275d59152c94de65dfcb58fb4bd1e5bec9257e49fe85bd3ddf
Instruction Fuzzy Hash: 6EF015B7A00B94C6C304DF10E888A5C37B8F369B90FA18128CB9C07300CF768AB5C780

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E088A198 Relevance: 1.5, APIs: 1, Instructions: 217COMMON

Download Yara Rule

APIs

memset.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7E088A376

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: c784b1c81fddccf678159b29d2a14d35a5c1dd171f68f6a6c951c46dcca90c6b
Instruction ID: df420399bbbb1b4d7193465514221a72d0d2c4aee8f56dd139a3bd9518d8db87
Opcode Fuzzy Hash: c784b1c81fddccf678159b29d2a14d35a5c1dd171f68f6a6c951c46dcca90c6b
Instruction Fuzzy Hash: 80B15B36A04B468AE700DF7AD8402ADB7B5FB88B8CB854026DE4C57768DF38E565C360

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E0883544 Relevance: 1.3, Strings: 1, Instructions: 70COMMON

Download Yara Rule

Strings

onecore\windows\core\console\open\src\renderer\dx\dxrenderer.cpp, xrefs: 00007FF7E0883582

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID:
String ID: onecore\windows\core\console\open\src\renderer\dx\dxrenderer.cpp
API String ID: 0-3506895815
Opcode ID: d4b27e129f135dd6f597cfcf370770624bd7d82f26d8e6d5e6f956233e6c8147
Instruction ID: dbe26d7053f11bbbfe1435e3a3e28ae22d2ad11166cb9f2b7cf29e9ed8451d75
Opcode Fuzzy Hash: d4b27e129f135dd6f597cfcf370770624bd7d82f26d8e6d5e6f956233e6c8147
Instruction Fuzzy Hash: 8A210761D266995AE252D73F5C40E24B511AFAE78179CD722F80862A91DB3CF0B1DB20

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E08625E0 Relevance: .7, Instructions: 656COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: Init_thread_footer
String ID:
API String ID: 1385522511-0
Opcode ID: 60294320b2635873fce02d32b61c2fba14cecacfae23ffbcad21eda511285cb0
Instruction ID: 585799864e2e67eb60cfbd1c6fe6de676922ca144f285f83d41ba6571999aef7
Opcode Fuzzy Hash: 60294320b2635873fce02d32b61c2fba14cecacfae23ffbcad21eda511285cb0
Instruction Fuzzy Hash: 6052B43AE18B4386E728AB25E44477CB760EBA4B54F9240B7DA4D077A1DE3DF854C321

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E082ACA8 Relevance: .3, Instructions: 315COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0e95e0bdf6359c02b911645d69179460b5126967ef7ec910e81b61f8ae5bb7b
Instruction ID: 97908ed3ed8292c65dd9d1e81144160ba85db4b2d882cee15c933aa8526d9a5f
Opcode Fuzzy Hash: d0e95e0bdf6359c02b911645d69179460b5126967ef7ec910e81b61f8ae5bb7b
Instruction Fuzzy Hash: 22E1BF2361DAC181EB609B25E4403EEF7A0FB95B44F849126EACD43B99DF3CE495CB11

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E088AD80 Relevance: .2, Instructions: 244COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e7ee3d643a3c9d84308e79e712096f5c3a40876c48c5ac4ac4af2b5ddb0efaa5
Instruction ID: 12108ff59f55d92bad5afbc4d7d2aacda82a45f20951bdeded2fdfdd32b4b998
Opcode Fuzzy Hash: e7ee3d643a3c9d84308e79e712096f5c3a40876c48c5ac4ac4af2b5ddb0efaa5
Instruction Fuzzy Hash: 68B1B232A14A858AE711DF36C44027DB771FF88B88B958232DE0D27794DF39E4A1C761

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E086FAF0 Relevance: .2, Instructions: 169COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 163cf4253105cb67d069f8e629d34bb0617e27e0c3a9618f294728462168bba4
Instruction ID: f921fac278812ea973d5bb3ee084e91057909bc0879dd077cfbfc167ae83e84b
Opcode Fuzzy Hash: 163cf4253105cb67d069f8e629d34bb0617e27e0c3a9618f294728462168bba4
Instruction Fuzzy Hash: 1A61B37260864186EB54EF25E48136EF7A1FB88B80F445136EE4D97B5ADF3CE811CB11

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E0844964 Relevance: .1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ca95789e93bd3c9d3ade36c0ca1c5e1ffaab8b8cec43365625eabbc50a691ae
Instruction ID: 15663fb68dcfe1c116dcd9cc780596791a97a53a13575b99d79298d77a623288
Opcode Fuzzy Hash: 9ca95789e93bd3c9d3ade36c0ca1c5e1ffaab8b8cec43365625eabbc50a691ae
Instruction Fuzzy Hash: CE513A167147919AEB04EFB1E5002E9B762FF28BA87806433EF4C43B59EB39E495C311

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E08C0390 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 17e0dc97cce8be6edf95d12af8c1dba0092588794951c931147b5fdcef4a7a74
Instruction ID: 6f4dca445439516a64fb634c5656dc34643e34f0c0d9281ad79f4baf89dbe51f
Opcode Fuzzy Hash: 17e0dc97cce8be6edf95d12af8c1dba0092588794951c931147b5fdcef4a7a74
Instruction Fuzzy Hash: A1E0FE8391EBD10BE303AA740C211182F3196A380438E82ABCB95D32C3E50C6818932A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E08C0370 Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9dd186c077c61bf56ca7cca78b78ab3831236cddefce50df4072602d650e6d14
Instruction ID: 0370f16398d574c54393a7646049e9c3bfa5db6b65633321626a10225b0e3f3f
Opcode Fuzzy Hash: 9dd186c077c61bf56ca7cca78b78ab3831236cddefce50df4072602d650e6d14
Instruction Fuzzy Hash: EB900252B0D7C006D703C6341C119083E2260438043C9809AC39183583A40D0A698215

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E08C0360 Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b244b4f70fad90b39670434564d88c45866e8bd85f7bd71bacdac0a2d37a02e
Instruction ID: f9b667eb0362b929d0e3e5936c02387a0609936c856fc6cc5d7e24d0327502d0
Opcode Fuzzy Hash: 8b244b4f70fad90b39670434564d88c45866e8bd85f7bd71bacdac0a2d37a02e
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E0810598 Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83517eb6cf338bc21991db560b62711a9da4a3a1e383193c0c98667c4a32f2fa
Instruction ID: 07be94d45dcc257a1644c461d8fc34cf9d18251b8c86f41793f59384f365fe14
Opcode Fuzzy Hash: 83517eb6cf338bc21991db560b62711a9da4a3a1e383193c0c98667c4a32f2fa
Instruction Fuzzy Hash: 93A00121908982D0E644AB40A851264E322BF91300BC01572E10DA52A8EE7CB4208B22

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E07F2D08 Relevance: 31.6, APIs: 4, Strings: 14, Instructions: 99registryCOMMON

Download Yara Rule

APIs

GetEnvironmentVariableW.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0 ref: 00007FF7E07F2DD3
RegGetValueW.API-MS-WIN-CORE-REGISTRY-L1-1-0 ref: 00007FF7E081AFC3
SetEnvironmentVariableW.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0 ref: 00007FF7E081AFF8

Strings

CommonW6432Dir, xrefs: 00007FF7E07F2DB4
CommonProgramW6432, xrefs: 00007FF7E07F2DBF
CommonFilesDir (x86), xrefs: 00007FF7E07F2D88
ProgramFilesDir (x86), xrefs: 00007FF7E07F2D70
Software\Microsoft\Windows\CurrentVersion, xrefs: 00007FF7E081AF99
ProgramW6432Dir, xrefs: 00007FF7E07F2D9E
ProgramW6432, xrefs: 00007FF7E07F2DA9
GetModuleFileNameW failed %d., xrefs: 00007FF7E081B024
ProgramFiles, xrefs: 00007FF7E07F2D4A
CommonFilesDir, xrefs: 00007FF7E07F2D58
CommonProgramFiles, xrefs: 00007FF7E07F2D64
CommonProgramFiles(x86), xrefs: 00007FF7E07F2D93
ProgramFiles(x86), xrefs: 00007FF7E07F2D7C
ProgramFilesDir, xrefs: 00007FF7E07F2D37

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: EnvironmentVariable$Value
String ID: CommonFilesDir$CommonFilesDir (x86)$CommonProgramFiles$CommonProgramFiles(x86)$CommonProgramW6432$CommonW6432Dir$GetModuleFileNameW failed %d.$ProgramFiles$ProgramFiles(x86)$ProgramFilesDir$ProgramFilesDir (x86)$ProgramW6432$ProgramW6432Dir$Software\Microsoft\Windows\CurrentVersion
API String ID: 2902449149-4252908956
Opcode ID: d19cb9386a6c44b719a80682e7511099f9dd54d27cc9f00fa7e6dfb086e4dc26
Instruction ID: 860e4ac79a583cb8b17f1d9b17240c1194e2c63e3f76c4096878c67b8e56f4bd
Opcode Fuzzy Hash: d19cb9386a6c44b719a80682e7511099f9dd54d27cc9f00fa7e6dfb086e4dc26
Instruction Fuzzy Hash: 0B516D32A08F4199EB10AB64E8402ADB7A8FB48764FD40233CA5D077A4DF3CF565C761

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E0827890 Relevance: 26.4, APIs: 2, Strings: 13, Instructions: 153windowthreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

FormatMessageW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0 ref: 00007FF7E0827971
GetCurrentThreadId.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF7E08279F3

Strings

[%hs(%hs)], xrefs: 00007FF7E0827AA0
ReturnHr, xrefs: 00007FF7E0827933
Exception, xrefs: 00007FF7E082793C
%hs(%d) tid(%x) %08X %ws, xrefs: 00007FF7E0827A0C
%hs!%p: , xrefs: 00007FF7E08279BB
CallContext:[%hs] , xrefs: 00007FF7E0827A79
Msg:[%ws] , xrefs: 00007FF7E0827A5E
[%hs], xrefs: 00007FF7E0827AB9
%hs(%u)\%hs!%p: , xrefs: 00007FF7E082799D
(caller: %p) , xrefs: 00007FF7E08279DB
, xrefs: 00007FF7E0827A43
LogHr, xrefs: 00007FF7E082792A
FailFast, xrefs: 00007FF7E0827921

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: CurrentFormatMessageThread
String ID: $%hs!%p: $%hs(%d) tid(%x) %08X %ws$%hs(%u)\%hs!%p: $(caller: %p) $CallContext:[%hs] $Exception$FailFast$LogHr$Msg:[%ws] $ReturnHr$[%hs(%hs)]$[%hs]
API String ID: 2411632146-3173542853
Opcode ID: cdc322ca8443490073d7461ff290b3b810c4c4b12b6323568b1f387cb805b127
Instruction ID: 14880ee2ada788484126bb2a168464ed22dc01c85a0c2a0e5c1ec6f9fbdb7f5f
Opcode Fuzzy Hash: cdc322ca8443490073d7461ff290b3b810c4c4b12b6323568b1f387cb805b127
Instruction Fuzzy Hash: 6C616F61A09B4295EA28FB66A4007B9E7A0FF48B94FC45137DA8D03B54DF3CF5708762

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E087BCDC Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 145COMMON

Download Yara Rule

APIs

GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7E0875891), ref: 00007FF7E087BD44
CoTaskMemFree.API-MS-WIN-CORE-COM-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7E0875891), ref: 00007FF7E087BD56
SetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7E0875891), ref: 00007FF7E087BD65
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7E0875891), ref: 00007FF7E087BDAA
CoTaskMemFree.API-MS-WIN-CORE-COM-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7E0875891), ref: 00007FF7E087BDBC
SetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7E0875891), ref: 00007FF7E087BDCB
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7E0875891), ref: 00007FF7E087BDFA
CoTaskMemFree.API-MS-WIN-CORE-COM-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7E0875891), ref: 00007FF7E087BE0C
SetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7E0875891), ref: 00007FF7E087BE1B
CoTaskMemFree.API-MS-WIN-CORE-COM-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7E0875891), ref: 00007FF7E087BEA5
CoTaskMemFree.API-MS-WIN-CORE-COM-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7E0875891), ref: 00007FF7E087BEBB
CoTaskMemFree.API-MS-WIN-CORE-COM-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7E0875891), ref: 00007FF7E087BED1

Strings

onecore\windows\core\console\conint\edpconsolepolicy.cpp, xrefs: 00007FF7E087BE80

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: ErrorFreeLastTask
String ID: onecore\windows\core\console\conint\edpconsolepolicy.cpp
API String ID: 3486484475-1700090441
Opcode ID: 94d16bd44a969096ddd01fe79475cc1c4d24ff359c09eec205e35ab4fe330655
Instruction ID: 966f6ecf1881c7d4470b5ad35ebb28c78ced37eeafe9fb35b145fde883ea9756
Opcode Fuzzy Hash: 94d16bd44a969096ddd01fe79475cc1c4d24ff359c09eec205e35ab4fe330655
Instruction Fuzzy Hash: 52513032A04B51CAE700AB61E8443BDFBB1FF8AB85B895176CA4E53758CF38E455C721

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E08557F4 Relevance: 21.1, APIs: 14, Instructions: 139COMMON

Download Yara Rule

APIs

?width@ios_base@std@@QEBA_JXZ.MSVCP_WIN ref: 00007FF7E0855823
?width@ios_base@std@@QEBA_JXZ.MSVCP_WIN ref: 00007FF7E085583E
?width@ios_base@std@@QEBA_JXZ.MSVCP_WIN ref: 00007FF7E0855859
?flags@ios_base@std@@QEBAHXZ.MSVCP_WIN ref: 00007FF7E0855898
?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ.MSVCP_WIN ref: 00007FF7E08558C5
?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADXZ.MSVCP_WIN ref: 00007FF7E08558DE
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z.MSVCP_WIN ref: 00007FF7E08558EF
?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ.MSVCP_WIN ref: 00007FF7E0855916
?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADXZ.MSVCP_WIN ref: 00007FF7E085592F
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z.MSVCP_WIN ref: 00007FF7E0855940
?width@ios_base@std@@QEAA_J_J@Z.MSVCP_WIN ref: 00007FF7E0855964
?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ.MSVCP_WIN ref: 00007FF7E0855985
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z.MSVCP_WIN ref: 00007FF7E085599A
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z.MSVCP_WIN ref: 00007FF7E08559D6

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: U?$char_traits@$D@std@@@std@@$?width@ios_base@std@@$?rdbuf@?$basic_ios@D@std@@@2@V?$basic_streambuf@$?fill@?$basic_ios@?sputc@?$basic_streambuf@$?flags@ios_base@std@@?setstate@?$basic_ios@?sputn@?$basic_streambuf@
String ID:
API String ID: 4125389999-0
Opcode ID: f9756d035ce2c2b98d2eeecdcc29ad19153cb104ba508e185438df4faed3ed94
Instruction ID: 2e215eee00ef89e47b8bdeca3e521be5f0c3a1e19ac3875c81c5ce7385193ea3
Opcode Fuzzy Hash: f9756d035ce2c2b98d2eeecdcc29ad19153cb104ba508e185438df4faed3ed94
Instruction Fuzzy Hash: EF510C22A08A46C6EB10AB15E460378FFA0FF8AF56B99D533CA0E47365CF3CE4558611

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E0854E08 Relevance: 21.1, APIs: 14, Instructions: 138COMMON

Download Yara Rule

APIs

?width@ios_base@std@@QEBA_JXZ.MSVCP_WIN ref: 00007FF7E0854E41
?width@ios_base@std@@QEBA_JXZ.MSVCP_WIN ref: 00007FF7E0854E5C
?width@ios_base@std@@QEBA_JXZ.MSVCP_WIN ref: 00007FF7E0854E77
?flags@ios_base@std@@QEBAHXZ.MSVCP_WIN ref: 00007FF7E0854EB6
?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ.MSVCP_WIN ref: 00007FF7E0854EDB
?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADXZ.MSVCP_WIN ref: 00007FF7E0854EF4
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z.MSVCP_WIN ref: 00007FF7E0854F05
?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ.MSVCP_WIN ref: 00007FF7E0854F25
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z.MSVCP_WIN ref: 00007FF7E0854F3A
?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ.MSVCP_WIN ref: 00007FF7E0854F5A
?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADXZ.MSVCP_WIN ref: 00007FF7E0854F73
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z.MSVCP_WIN ref: 00007FF7E0854F84
?width@ios_base@std@@QEAA_J_J@Z.MSVCP_WIN ref: 00007FF7E0854FAA
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z.MSVCP_WIN ref: 00007FF7E0854FD6

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: U?$char_traits@$D@std@@@std@@$?width@ios_base@std@@$?rdbuf@?$basic_ios@D@std@@@2@V?$basic_streambuf@$?fill@?$basic_ios@?sputc@?$basic_streambuf@$?flags@ios_base@std@@?setstate@?$basic_ios@?sputn@?$basic_streambuf@
String ID:
API String ID: 4125389999-0
Opcode ID: 6e2a4a113bce1778c96fd6ac7084957fab6c5defa97d799c8237e92369277812
Instruction ID: c2b7aa8578b14733a2c7356c8162443d35f10142a9f6302e009d1ca5c1945d84
Opcode Fuzzy Hash: 6e2a4a113bce1778c96fd6ac7084957fab6c5defa97d799c8237e92369277812
Instruction Fuzzy Hash: FA516532A09941C6EB10AB15D690338FBA1FF8AB95BD5E532DA1E47791CF3CE425C311

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E07F6C80 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 123COMMON

Download Yara Rule

APIs

memset.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7E07F6D5B
_o_wcscpy_s.API-MS-WIN-CRT-PRIVATE-L1-1-0 ref: 00007FF7E07F6D6F
memset.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7E07F6D88
_o_terminate.API-MS-WIN-CRT-PRIVATE-L1-1-0 ref: 00007FF7E081C384
_o_terminate.API-MS-WIN-CRT-PRIVATE-L1-1-0 ref: 00007FF7E081C391
_o_terminate.API-MS-WIN-CRT-PRIVATE-L1-1-0(?,?,?,?,00007FF7E07F6E2E), ref: 00007FF7E081C413
_o_terminate.API-MS-WIN-CRT-PRIVATE-L1-1-0(?,?,?,?,00007FF7E07F6E2E), ref: 00007FF7E081C420
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,?,?,00007FF7E07F6E2E), ref: 00007FF7E081C42E
DeleteObject.GDI32 ref: 00007FF7E081C43F
SetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,?,?,00007FF7E07F6E2E), ref: 00007FF7E081C44D

Strings

__DefaultTTFont__, xrefs: 00007FF7E07F6D60
onecore\windows\core\console\open\src\types\utils.cpp, xrefs: 00007FF7E081C3A3, 00007FF7E081C3C0, 00007FF7E081C3DD, 00007FF7E081C3FB

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: _o_terminate$ErrorLastmemset$DeleteObject_o_wcscpy_s
String ID: __DefaultTTFont__$onecore\windows\core\console\open\src\types\utils.cpp
API String ID: 1333036408-622446547
Opcode ID: bb973cd707dc0d373ff0efca89316ea8a22bcaad7960ee03043d2fce96075d64
Instruction ID: 14d28b8d7ad044ac18a562088e3e26d76590a1e0fff99cfbef788ecb731fc869
Opcode Fuzzy Hash: bb973cd707dc0d373ff0efca89316ea8a22bcaad7960ee03043d2fce96075d64
Instruction Fuzzy Hash: EB515832608B829BD718EF20E5447A9BBA4FB49754F948226DB9D13B54CF38F135CB21

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E0854BD4 Relevance: 19.6, APIs: 13, Instructions: 127COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7E08562B4: ?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ.MSVCP_WIN(?,?,00000000,00007FF7E085587C), ref: 00007FF7E08562D6
Part of subcall function 00007FF7E08562B4: ?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ.MSVCP_WIN(?,?,00000000,00007FF7E085587C), ref: 00007FF7E08562F4
Part of subcall function 00007FF7E08562B4: ?good@ios_base@std@@QEBA_NXZ.MSVCP_WIN(?,?,00000000,00007FF7E085587C), ref: 00007FF7E085631E
Part of subcall function 00007FF7E08562B4: ?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ.MSVCP_WIN(?,?,00000000,00007FF7E085587C), ref: 00007FF7E0856338
Part of subcall function 00007FF7E08562B4: ?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ.MSVCP_WIN(?,?,00000000,00007FF7E085587C), ref: 00007FF7E0856353
Part of subcall function 00007FF7E08562B4: ?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ.MSVCP_WIN(?,?,00000000,00007FF7E085587C), ref: 00007FF7E085636E
Part of subcall function 00007FF7E08562B4: ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ.MSVCP_WIN(?,?,00000000,00007FF7E085587C), ref: 00007FF7E085637D
Part of subcall function 00007FF7E08562B4: ?good@ios_base@std@@QEBA_NXZ.MSVCP_WIN(?,?,00000000,00007FF7E085587C), ref: 00007FF7E0856393

?width@ios_base@std@@QEBA_JXZ.MSVCP_WIN(?,?,?,?,?,00007FF7E0856875), ref: 00007FF7E0854C15
?width@ios_base@std@@QEBA_JXZ.MSVCP_WIN(?,?,?,?,?,00007FF7E0856875), ref: 00007FF7E0854C35
?flags@ios_base@std@@QEBAHXZ.MSVCP_WIN(?,?,?,?,?,00007FF7E0856875), ref: 00007FF7E0854C4F
?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ.MSVCP_WIN(?,?,?,?,?,00007FF7E0856875), ref: 00007FF7E0854C7C
?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADXZ.MSVCP_WIN(?,?,?,?,?,00007FF7E0856875), ref: 00007FF7E0854C95
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z.MSVCP_WIN(?,?,?,?,?,00007FF7E0856875), ref: 00007FF7E0854CA6
?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ.MSVCP_WIN(?,?,?,?,?,00007FF7E0856875), ref: 00007FF7E0854CD1
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z.MSVCP_WIN(?,?,?,?,?,00007FF7E0856875), ref: 00007FF7E0854CE3
?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ.MSVCP_WIN(?,?,?,?,?,00007FF7E0856875), ref: 00007FF7E0854D11
?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADXZ.MSVCP_WIN(?,?,?,?,?,00007FF7E0856875), ref: 00007FF7E0854D2A
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z.MSVCP_WIN(?,?,?,?,?,00007FF7E0856875), ref: 00007FF7E0854D3B
?width@ios_base@std@@QEAA_J_J@Z.MSVCP_WIN(?,?,?,?,?,00007FF7E0856875), ref: 00007FF7E0854D6F
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z.MSVCP_WIN(?,?,?,?,?,00007FF7E0856875), ref: 00007FF7E0854D8A

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: U?$char_traits@$D@std@@@std@@$D@std@@@2@$?rdbuf@?$basic_ios@V?$basic_streambuf@$?sputc@?$basic_streambuf@?tie@?$basic_ios@?width@ios_base@std@@V?$basic_ostream@$?fill@?$basic_ios@?good@ios_base@std@@$?flags@ios_base@std@@?flush@?$basic_ostream@?setstate@?$basic_ios@V12@
String ID:
API String ID: 4018470129-0
Opcode ID: 8848741addf6a6f853dec7a388f563ece79af925e54cdfbc8358374c40df991a
Instruction ID: 5440d7b1b4e103b7f57b7f30a46e080416ae80d291843cca863ae741d72f0bc5
Opcode Fuzzy Hash: 8848741addf6a6f853dec7a388f563ece79af925e54cdfbc8358374c40df991a
Instruction Fuzzy Hash: 1B518232A08A8286EB10AF14E450378FBA1FFC6F56B95A532CA1E47365CF3CE4158711

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E0846448 Relevance: 17.9, APIs: 4, Strings: 6, Instructions: 421COMMON

Download Yara Rule

APIs

?_Xout_of_range@std@@YAXPEBD@Z.MSVCP_WIN ref: 00007FF7E084666D
?_Xout_of_range@std@@YAXPEBD@Z.MSVCP_WIN ref: 00007FF7E08466FE
?_Xout_of_range@std@@YAXPEBD@Z.MSVCP_WIN ref: 00007FF7E08467B2
?_Xout_of_range@std@@YAXPEBD@Z.MSVCP_WIN ref: 00007FF7E08467E0

Strings

invalid unordered_map<K, T> key, xrefs: 00007FF7E08467AB
Invalid screen buffer size (0x%x, 0x%x), xrefs: 00007FF7E0846AFA
invalid vector<T> subscript, xrefs: 00007FF7E0846666, 00007FF7E08466F7, 00007FF7E08467D9
VUUUUUUU, xrefs: 00007FF7E08466D3
VUUUUUUU, xrefs: 00007FF7E084664A
onecore\windows\core\console\open\src\host\screeninfo.cpp, xrefs: 00007FF7E0846A64

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: Xout_of_range@std@@
String ID: Invalid screen buffer size (0x%x, 0x%x)$VUUUUUUU$VUUUUUUU$invalid unordered_map<K, T> key$invalid vector<T> subscript$onecore\windows\core\console\open\src\host\screeninfo.cpp
API String ID: 1960685668-3002075300
Opcode ID: 0a6f2e3015521e3ba3835ee33860c521b94af97b5b3c12a25119d0359cca4b64
Instruction ID: 0a94fe99e505f78ca3dbd959c9536bad20d88b2f9a052e8ac09f4583d5968157
Opcode Fuzzy Hash: 0a6f2e3015521e3ba3835ee33860c521b94af97b5b3c12a25119d0359cca4b64
Instruction Fuzzy Hash: BC12D526A096C289DB64EF25A0403BEBBB0FB94B84F845033DE8E57755DE3CE461C712

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E07FB010 Relevance: 17.8, APIs: 5, Strings: 5, Instructions: 322COMMON

Download Yara Rule

APIs

_Init_thread_footer.LIBCMT ref: 00007FF7E081DEF6

Strings

onecore\windows\core\console\open\src\server\apidispatchers.cpp, xrefs: 00007FF7E07FB32F, 00007FF7E081DFB5, 00007FF7E081E08E
output handle, xrefs: 00007FF7E081E0C0
onecore\windows\core\console\open\src\server\objecthandle.cpp, xrefs: 00007FF7E07FB318, 00007FF7E081E077
input handle, xrefs: 00007FF7E081DFE7
own, xrefs: 00007FF7E07FB08A

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: Init_thread_footer
String ID: input handle$onecore\windows\core\console\open\src\server\apidispatchers.cpp$onecore\windows\core\console\open\src\server\objecthandle.cpp$output handle$own
API String ID: 1385522511-896711049
Opcode ID: 830025a46a998af0142f839041354eed634dd40081c61289a98da091bdf95830
Instruction ID: 97cf8eda44f02bfbc2bd487de81b92debc1d8408c917a0fcee531c23d4c3c74e
Opcode Fuzzy Hash: 830025a46a998af0142f839041354eed634dd40081c61289a98da091bdf95830
Instruction Fuzzy Hash: 88F17E22B08A4689FB10EB64D4403B9B765BF487A8F804632DA2D177D9DF3CF565C362

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E080A660 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 312COMMON

Download Yara Rule

APIs

_Init_thread_footer.LIBCMT ref: 00007FF7E0824EEE

Strings

onecore\windows\core\console\open\src\server\apidispatchers.cpp, xrefs: 00007FF7E0824F1A, 00007FF7E0824F6C, 00007FF7E0824F89, 00007FF7E0825029
onecore\windows\core\console\open\src\host\input.cpp, xrefs: 00007FF7E08250F8

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: Init_thread_footer
String ID: onecore\windows\core\console\open\src\host\input.cpp$onecore\windows\core\console\open\src\server\apidispatchers.cpp
API String ID: 1385522511-2142256027
Opcode ID: a000ba800c102f5875bdd06a0055532109bc1e1939082dff6af46997d62328c0
Instruction ID: 675c7eec916cb1078c949437487cc06e6ebe73f0be2b89f43e3307ac745c9163
Opcode Fuzzy Hash: a000ba800c102f5875bdd06a0055532109bc1e1939082dff6af46997d62328c0
Instruction Fuzzy Hash: 5BD18D36A08A4286FB11AB24D8403B9A7A0FB55B88FD45133DA0D477A5DF3CF865C722

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E0867D28 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 105COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7E0867658: ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ.MSVCP_WIN ref: 00007FF7E086768F
Part of subcall function 00007FF7E0867658: ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z.MSVCP_WIN ref: 00007FF7E08676AE

Part of subcall function 00007FF7E0854E08: ?width@ios_base@std@@QEBA_JXZ.MSVCP_WIN ref: 00007FF7E0854E41
Part of subcall function 00007FF7E0854E08: ?width@ios_base@std@@QEBA_JXZ.MSVCP_WIN ref: 00007FF7E0854E5C
Part of subcall function 00007FF7E0854E08: ?width@ios_base@std@@QEBA_JXZ.MSVCP_WIN ref: 00007FF7E0854E77
Part of subcall function 00007FF7E0854E08: ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z.MSVCP_WIN ref: 00007FF7E0854FD6

??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@F@Z.MSVCP_WIN ref: 00007FF7E0867D7E

Part of subcall function 00007FF7E0854E08: ?flags@ios_base@std@@QEBAHXZ.MSVCP_WIN ref: 00007FF7E0854EB6
Part of subcall function 00007FF7E0854E08: ?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ.MSVCP_WIN ref: 00007FF7E0854EDB
Part of subcall function 00007FF7E0854E08: ?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADXZ.MSVCP_WIN ref: 00007FF7E0854EF4
Part of subcall function 00007FF7E0854E08: ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z.MSVCP_WIN ref: 00007FF7E0854F05
Part of subcall function 00007FF7E0854E08: ?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ.MSVCP_WIN ref: 00007FF7E0854F25
Part of subcall function 00007FF7E0854E08: ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z.MSVCP_WIN ref: 00007FF7E0854F3A
Part of subcall function 00007FF7E0854E08: ?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ.MSVCP_WIN ref: 00007FF7E0854F5A
Part of subcall function 00007FF7E0854E08: ?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADXZ.MSVCP_WIN ref: 00007FF7E0854F73
Part of subcall function 00007FF7E0854E08: ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z.MSVCP_WIN ref: 00007FF7E0854F84
Part of subcall function 00007FF7E0854E08: ?width@ios_base@std@@QEAA_J_J@Z.MSVCP_WIN ref: 00007FF7E0854FAA

??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@F@Z.MSVCP_WIN ref: 00007FF7E0867DA4
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@F@Z.MSVCP_WIN ref: 00007FF7E0867DCA
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@F@Z.MSVCP_WIN ref: 00007FF7E0867DF0
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@F@Z.MSVCP_WIN ref: 00007FF7E0867E21
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@F@Z.MSVCP_WIN ref: 00007FF7E0867E4E

Part of subcall function 00007FF7E0859B6C: ?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ.MSVCP_WIN ref: 00007FF7E0859BA6
Part of subcall function 00007FF7E0859B6C: ?pbase@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ.MSVCP_WIN ref: 00007FF7E0859BBA
Part of subcall function 00007FF7E0859B6C: ?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ.MSVCP_WIN ref: 00007FF7E0859BCC

Part of subcall function 00007FF7E08592A8: memmove.API-MS-WIN-CRT-PRIVATE-L1-1-0(?,?,?,?,?,00007FF7E0855124), ref: 00007FF7E08592E9

??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ.MSVCP_WIN ref: 00007FF7E0867EE3

Strings

) [, xrefs: 00007FF7E0867DFC
{LT:(, xrefs: 00007FF7E0867D65
) RB:(, xrefs: 00007FF7E0867DB0

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: U?$char_traits@$D@std@@@std@@$??6?$basic_ostream@V01@$?width@ios_base@std@@V?$basic_streambuf@$?rdbuf@?$basic_ios@D@std@@@2@$?fill@?$basic_ios@?pptr@?$basic_streambuf@?sputc@?$basic_streambuf@$??0?$basic_ios@??0?$basic_iostream@??1?$basic_ios@?flags@ios_base@std@@?pbase@?$basic_streambuf@?setstate@?$basic_ios@?sputn@?$basic_streambuf@D@std@@@1@@memmove
String ID: ) RB:($) [${LT:(
API String ID: 3851257767-2145079954
Opcode ID: 08374050b828f8fb646aed72b435958b4247fcc2b6e59fb133af151844d00237
Instruction ID: 5ae6d4e21205d7d341b6ec55b19d85397046c416e8e9badb093447ecdc5f3cc3
Opcode Fuzzy Hash: 08374050b828f8fb646aed72b435958b4247fcc2b6e59fb133af151844d00237
Instruction Fuzzy Hash: 24515C22618993C6EB00BF24E8402B9B771FB85748FC05033E64E47A5ADF3CE955C761

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E0887D14 Relevance: 16.2, APIs: 7, Strings: 2, Instructions: 459COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7E0888A3C: ?_Xout_of_range@std@@YAXPEBD@Z.MSVCP_WIN(?,?,?,?,00007FF7E0887B1E,?,?,?,00007FF7E0887BBD), ref: 00007FF7E0888A74

?_Xout_of_range@std@@YAXPEBD@Z.MSVCP_WIN ref: 00007FF7E0887EF3

Strings

invalid string position, xrefs: 00007FF7E0887EEC, 00007FF7E0888312
onecore\windows\core\console\open\src\renderer\dx\customtextlayout.cpp, xrefs: 00007FF7E08880DE, 00007FF7E08883F6

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: Xout_of_range@std@@
String ID: invalid string position$onecore\windows\core\console\open\src\renderer\dx\customtextlayout.cpp
API String ID: 1960685668-2152613991
Opcode ID: 00b7e70ed14d76a47b0ddddda086195d3c5d267131cf16efac06d9e8224a32fa
Instruction ID: 271740cae48870ccd58c12240d9b5e24871df6af148a7ec9529fec8943df0f87
Opcode Fuzzy Hash: 00b7e70ed14d76a47b0ddddda086195d3c5d267131cf16efac06d9e8224a32fa
Instruction Fuzzy Hash: 1A12BD32609BC586DA60EB15E4847EEB3A4FB88780FC14036DA8D47B55DF3CE464CB21

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E07FA0F0 Relevance: 16.1, APIs: 7, Strings: 2, Instructions: 368COMMON

Download Yara Rule

APIs

EnterCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FF7E07FA163
memset.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7E07FA235
MultiByteToWideChar.API-MS-WIN-CORE-STRING-L1-1-0 ref: 00007FF7E07FA2C0
_Init_thread_footer.LIBCMT ref: 00007FF7E07FA421
default_delete.LIBCPMT ref: 00007FF7E081D3C2
default_delete.LIBCPMT ref: 00007FF7E081D6E9

Part of subcall function 00007FF7E0802BCC: LeaveCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,00000001,?,00000000,00007FF7E0875ED6,?,?,?,?,00000000,00007FF7E0824487), ref: 00007FF7E0802BFC

Strings

onecore\windows\core\console\open\src\host\_stream.cpp, xrefs: 00007FF7E081D443, 00007FF7E081D4AA, 00007FF7E081D4DA, 00007FF7E081D54F, 00007FF7E081D710
invalid string position, xrefs: 00007FF7E081D571

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: CriticalSectiondefault_delete$ByteCharEnterInit_thread_footerLeaveMultiWidememset
String ID: invalid string position$onecore\windows\core\console\open\src\host\_stream.cpp
API String ID: 183490158-599477270
Opcode ID: 9447402e4fcbf744fbc35bbbcf38776492537029412d737a03e48353f46a8ae0
Instruction ID: 5294328a1c8992bd301762353769f9d7fd1e32d7aa21cb22463452e11092dc98
Opcode Fuzzy Hash: 9447402e4fcbf744fbc35bbbcf38776492537029412d737a03e48353f46a8ae0
Instruction Fuzzy Hash: 4FF19272A0D78286E620EB15A45036AF7A1FB99780F944137EACD53795DF3CF460CB22

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E08057E0 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 104COMMON

Download Yara Rule

APIs

memmove.API-MS-WIN-CRT-PRIVATE-L1-1-0(?,00000000,?,00007FF7E07FCF76,?,?,00000000,00000000,?,?,001E0078,00000000,?,001E007823290078,00007FF7E07F59D3), ref: 00007FF7E0805879
memmove.API-MS-WIN-CRT-PRIVATE-L1-1-0(?,00000000,?,00007FF7E07FCF76,?,?,00000000,00000000,?,?,001E0078,00000000,?,001E007823290078,00007FF7E07F59D3), ref: 00007FF7E0805894
memset.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000,?,00007FF7E07FCF76,?,?,00000000,00000000,?,?,001E0078,00000000,?,001E007823290078,00007FF7E07F59D3), ref: 00007FF7E08058A9
memset.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000,?,00007FF7E07FCF76,?,?,00000000,00000000,?,?,001E0078,00000000,?,001E007823290078,00007FF7E07F59D3), ref: 00007FF7E08058B6

Strings

deque<T> too long, xrefs: 00007FF7E08224DA

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: memmovememset
String ID: deque<T> too long
API String ID: 1288253900-309773918
Opcode ID: 6ac3ba3981665b315708dc7a052e643b31a8bb94a78c1fdb430e38880f7002c4
Instruction ID: ab0961eff14fba6e704bb87db485490033137d1bf21ba9f4b8452f30b3c936d2
Opcode Fuzzy Hash: 6ac3ba3981665b315708dc7a052e643b31a8bb94a78c1fdb430e38880f7002c4
Instruction Fuzzy Hash: 1B31D471704B8186EA14EB52F5411B9E3A1FB45BE07848236CF6E07B96CE7CF051C311

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E07F6EC4 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 100COMMON

Download Yara Rule

APIs

_o_terminate.API-MS-WIN-CRT-PRIVATE-L1-1-0(?,?,?,?,00007FF7E07F6E2E), ref: 00007FF7E07F6FC7
_o_terminate.API-MS-WIN-CRT-PRIVATE-L1-1-0(?,?,?,?,00007FF7E07F6E2E), ref: 00007FF7E081C413
_o_terminate.API-MS-WIN-CRT-PRIVATE-L1-1-0(?,?,?,?,00007FF7E07F6E2E), ref: 00007FF7E081C420
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,?,?,00007FF7E07F6E2E), ref: 00007FF7E081C42E
DeleteObject.GDI32 ref: 00007FF7E081C43F
SetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,?,?,00007FF7E07F6E2E), ref: 00007FF7E081C44D

Strings

HV, xrefs: 00007FF7E07F6F70
vvv, xrefs: 00007FF7E07F6F63
onecore\windows\core\console\open\src\types\utils.cpp, xrefs: 00007FF7E081C3DD, 00007FF7E081C3FB

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: _o_terminate$ErrorLast$DeleteObject
String ID: onecore\windows\core\console\open\src\types\utils.cpp$vvv$HV
API String ID: 3255449295-4251474025
Opcode ID: 98d900ee76abbb3aca156ff75b5eb35b316101948dad377900127df46ce86bb0
Instruction ID: 07178352c68bfa4a5258f219c325cbdcdbdb3d1aeb65545320e2d496077eebd9
Opcode Fuzzy Hash: 98d900ee76abbb3aca156ff75b5eb35b316101948dad377900127df46ce86bb0
Instruction Fuzzy Hash: B141F2B2C09A42CAEB616F25D44427CBEE0FB49B18F918537C21946790CF7DB569C712

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E0827C30 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 96synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,00000000,00007FF7E0822C3B), ref: 00007FF7E0827C42

Strings

wil, xrefs: 00007FF7E0827C5D, 00007FF7E0827D8D

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: ObjectSingleWait
String ID: wil
API String ID: 24740636-1589926490
Opcode ID: 2412010e690b60513d44839e1241b0a1ded830746aa7e610ccf17685d510b888
Instruction ID: 7b1c1f047338626794205cceb29c838cc50422997230c64de58d0c9c5b01be8d
Opcode Fuzzy Hash: 2412010e690b60513d44839e1241b0a1ded830746aa7e610ccf17685d510b888
Instruction Fuzzy Hash: C2410031A0C68287F7606B36E400379E6A1EF85791FE08133DA4D46799DF3DF8658722

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E07F2E2C Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 79COMMON

Download Yara Rule

APIs

GetModuleFileNameW.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0 ref: 00007FF7E07F2E6F
CreateActCtxW.API-MS-WIN-CORE-SIDEBYSIDE-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000001,00007FF7E07F2DFB), ref: 00007FF7E07F2EC3
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF7E081B018

Strings

d, xrefs: 00007FF7E07F2EBA
GetModuleFileNameW requires more than ScratchBufferSize(%d) - 1., xrefs: 00007FF7E081B038
InitSideBySide failed create an activation context. Error: %d, xrefs: 00007FF7E081B09E
8, xrefs: 00007FF7E07F2EA0
GetModuleFileNameW failed %d., xrefs: 00007FF7E081B024

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: CreateErrorFileLastModuleName
String ID: 8$GetModuleFileNameW failed %d.$GetModuleFileNameW requires more than ScratchBufferSize(%d) - 1.$InitSideBySide failed create an activation context. Error: %d$d
API String ID: 1775755052-3069648676
Opcode ID: 2bf8e5f26a7e522e886feec0f199d7387dee6a369ebcef8fca90a8dd5463f742
Instruction ID: 1b2237c2774d0074748cacd584c08b482ac8ede57fd716ef621c6c386e2835c9
Opcode Fuzzy Hash: 2bf8e5f26a7e522e886feec0f199d7387dee6a369ebcef8fca90a8dd5463f742
Instruction Fuzzy Hash: 1E317F22A1968286EB20BB149444279F7A0FB5CB94FA4C236D76D03391DF7CB4B5C762

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E0879CF8 Relevance: 15.1, APIs: 10, Instructions: 95COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7E0867658: ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ.MSVCP_WIN ref: 00007FF7E086768F
Part of subcall function 00007FF7E0867658: ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z.MSVCP_WIN ref: 00007FF7E08676AE

Part of subcall function 00007FF7E0854E08: ?width@ios_base@std@@QEBA_JXZ.MSVCP_WIN ref: 00007FF7E0854E41
Part of subcall function 00007FF7E0854E08: ?width@ios_base@std@@QEBA_JXZ.MSVCP_WIN ref: 00007FF7E0854E5C
Part of subcall function 00007FF7E0854E08: ?width@ios_base@std@@QEBA_JXZ.MSVCP_WIN ref: 00007FF7E0854E77
Part of subcall function 00007FF7E0854E08: ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z.MSVCP_WIN ref: 00007FF7E0854FD6

??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z.MSVCP_WIN ref: 00007FF7E0879D3E
?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAADD@Z.MSVCP_WIN ref: 00007FF7E0879D59
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z.MSVCP_WIN ref: 00007FF7E0879D6F
?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z.MSVCP_WIN ref: 00007FF7E0879D87
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z.MSVCP_WIN ref: 00007FF7E0879DBA
?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z.MSVCP_WIN ref: 00007FF7E0879DCD
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z.MSVCP_WIN ref: 00007FF7E0879E02
?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z.MSVCP_WIN ref: 00007FF7E0879E15
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z.MSVCP_WIN ref: 00007FF7E0879E4B

Part of subcall function 00007FF7E0859B6C: ?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ.MSVCP_WIN ref: 00007FF7E0859BA6
Part of subcall function 00007FF7E0859B6C: ?pbase@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ.MSVCP_WIN ref: 00007FF7E0859BBA
Part of subcall function 00007FF7E0859B6C: ?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ.MSVCP_WIN ref: 00007FF7E0859BCC

??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ.MSVCP_WIN ref: 00007FF7E0879E72

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: U?$char_traits@$D@std@@@std@@$??6?$basic_ostream@V01@$?setw@std@@?width@ios_base@std@@J@1@_Smanip@_U?$_$?pptr@?$basic_streambuf@V21@@Vios_base@1@$??0?$basic_ios@??0?$basic_iostream@??1?$basic_ios@?fill@?$basic_ios@?pbase@?$basic_streambuf@?setstate@?$basic_ios@D@std@@@1@@V?$basic_streambuf@
String ID:
API String ID: 1081597296-0
Opcode ID: 0d1a008b47d1a31075911c6a7d4a737539e9c08f65b9511d43e785cfe1ae63aa
Instruction ID: 6b3d7deac2b1d0024cbc05d5dbd5fc78d38d74b4f163562728d92aa7b30ffebd
Opcode Fuzzy Hash: 0d1a008b47d1a31075911c6a7d4a737539e9c08f65b9511d43e785cfe1ae63aa
Instruction Fuzzy Hash: 43413C32604A81D6EB00EB15E8502B9FB71FBC9B45BD59032DA4E43729DF3CE919C721

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E0800AF0 Relevance: 14.3, APIs: 3, Strings: 5, Instructions: 254COMMON

Download Yara Rule

Strings

onecore\windows\core\console\open\src\types\viewport.cpp, xrefs: 00007FF7E081FCA9
invalid unordered_map<K, T> key, xrefs: 00007FF7E081FE28
vector<T> too long, xrefs: 00007FF7E081FE68
invalid vector<T> subscript, xrefs: 00007FF7E081FE54
VUUUUUUU, xrefs: 00007FF7E0800C17

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID:
String ID: VUUUUUUU$invalid unordered_map<K, T> key$invalid vector<T> subscript$onecore\windows\core\console\open\src\types\viewport.cpp$vector<T> too long
API String ID: 0-2488907146
Opcode ID: a308d393284eca5e7c7cd858f958883a907639ef86a52b9d33daf958d4fb3120
Instruction ID: 78c2b461cb2a7e3832d169b0540d520c8e1070577946c998789a464dc2cdae47
Opcode Fuzzy Hash: a308d393284eca5e7c7cd858f958883a907639ef86a52b9d33daf958d4fb3120
Instruction Fuzzy Hash: D9B1CF22A08B5586EB10AF65D4402BCB7B1FB19798B804132DF4E17B96DF38F4B5C721

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E07FC540 Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 162COMMON

Download Yara Rule

APIs

EnterCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FF7E07FC561
LeaveCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FF7E07FC5E1

Strings

onecore\windows\core\console\open\src\host\input.cpp, xrefs: 00007FF7E081E93A
onecore\windows\core\console\open\src\host\_stream.cpp, xrefs: 00007FF7E081E89C

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: onecore\windows\core\console\open\src\host\_stream.cpp$onecore\windows\core\console\open\src\host\input.cpp
API String ID: 3168844106-1286246513
Opcode ID: ff9247dfb89cd798fdd638c3022b504905704d822479bdbe10e62340809997b8
Instruction ID: 2121550312335bc456412247d7407f89ddf49948f4689af57ca60d0a399e71c0
Opcode Fuzzy Hash: ff9247dfb89cd798fdd638c3022b504905704d822479bdbe10e62340809997b8
Instruction Fuzzy Hash: 7951D331A0864286FA61AB25E45037AEB90FF95780FD09133DE4D437A9DF3CF825C622

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E082D49C Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 108COMMON

Download Yara Rule

APIs

memmove.API-MS-WIN-CRT-PRIVATE-L1-1-0(00000000,00000000,00000000,00007FF7E0869FD8,?,?,00000000,00007FF7E0879611,?,?,?,?,?,?,00000000,00000000), ref: 00007FF7E082D54B
memmove.API-MS-WIN-CRT-PRIVATE-L1-1-0(00000000,00000000,00000000,00007FF7E0869FD8,?,?,00000000,00007FF7E0879611,?,?,?,?,?,?,00000000,00000000), ref: 00007FF7E082D562
memset.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00000000,00000000,00007FF7E0869FD8,?,?,00000000,00007FF7E0879611,?,?,?,?,?,?,00000000,00000000), ref: 00007FF7E082D577
memmove.API-MS-WIN-CRT-PRIVATE-L1-1-0(00000000,00000000,00000000,00007FF7E0869FD8,?,?,00000000,00007FF7E0879611,?,?,?,?,?,?,00000000,00000000), ref: 00007FF7E082D58E
memmove.API-MS-WIN-CRT-PRIVATE-L1-1-0(00000000,00000000,00000000,00007FF7E0869FD8,?,?,00000000,00007FF7E0879611,?,?,?,?,?,?,00000000,00000000), ref: 00007FF7E082D5A7
memset.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00000000,00000000,00007FF7E0869FD8,?,?,00000000,00007FF7E0879611,?,?,?,?,?,?,00000000,00000000), ref: 00007FF7E082D5B5

Strings

deque<T> too long, xrefs: 00007FF7E082D5F8

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: memmove$memset
String ID: deque<T> too long
API String ID: 3790616698-309773918
Opcode ID: 85044e2ca63d2213f09870668d33ecbeaaaa3a2f00211c4601c7991c5d5b367b
Instruction ID: 305ce043088dacc69bf8470fbfd2b1e5817c131a00e70df879d17f4513481b5b
Opcode Fuzzy Hash: 85044e2ca63d2213f09870668d33ecbeaaaa3a2f00211c4601c7991c5d5b367b
Instruction Fuzzy Hash: 9831E3A2704B8286DE14EB66F9111A9E751EB45BE0B888236DF7D0BBD1CE7CF051C310

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E0833C28 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 106COMMON

Download Yara Rule

APIs

memmove.API-MS-WIN-CRT-PRIVATE-L1-1-0(?,?,00000000,00007FF7E0830A76), ref: 00007FF7E0833CD4
memmove.API-MS-WIN-CRT-PRIVATE-L1-1-0(?,?,00000000,00007FF7E0830A76), ref: 00007FF7E0833CEB
memset.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000,00007FF7E0830A76), ref: 00007FF7E0833D00
memmove.API-MS-WIN-CRT-PRIVATE-L1-1-0(?,?,00000000,00007FF7E0830A76), ref: 00007FF7E0833D17
memmove.API-MS-WIN-CRT-PRIVATE-L1-1-0(?,?,00000000,00007FF7E0830A76), ref: 00007FF7E0833D30
memset.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000,00007FF7E0830A76), ref: 00007FF7E0833D3E

Strings

deque<T> too long, xrefs: 00007FF7E0833D81

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: memmove$memset
String ID: deque<T> too long
API String ID: 3790616698-309773918
Opcode ID: c94d586eeb9a8f885b15f80766213bc52aafb6313ccda9610c7c6419d30e33c7
Instruction ID: 440b70db8b7015e77d1753978f01ff808287242fc623ff6b51fd1a2f6e0ae695
Opcode Fuzzy Hash: c94d586eeb9a8f885b15f80766213bc52aafb6313ccda9610c7c6419d30e33c7
Instruction Fuzzy Hash: 9131D5A2704B8182EA14EB56F5411A9E751EB85FE0B888236DF7E1BBD5CE7CF051C311

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E0877AC4 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 102filethreadCOMMON

Download Yara Rule

APIs

GetCurrentProcess.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF7E0877B03
GetCurrentThread.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF7E0877B12
GetCurrentProcess.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF7E0877B21
DuplicateHandle.API-MS-WIN-CORE-HANDLE-L1-1-0 ref: 00007FF7E0877B4C
ReadFile.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF7E0877BA2
EnterCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FF7E0877BBD
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF7E0877C8D

Strings

onecore\windows\core\console\open\src\interactivity\onecore\coniosrvcomm.cpp, xrefs: 00007FF7E0877AF1, 00007FF7E0877B64

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: Current$Process$CriticalDuplicateEnterErrorFileHandleLastReadSectionThread
String ID: onecore\windows\core\console\open\src\interactivity\onecore\coniosrvcomm.cpp
API String ID: 3595956420-2051704093
Opcode ID: 09521f832c68216bbbe0019030e12fe47b43bbeedab1727718d1cee584749ec7
Instruction ID: e6bd567f4981c5852e1f9516a0bffa77e0aee9fe2afecf39d3a356f121657bdb
Opcode Fuzzy Hash: 09521f832c68216bbbe0019030e12fe47b43bbeedab1727718d1cee584749ec7
Instruction Fuzzy Hash: 3241732250C78287E710AB61E44437EFBA0FB99790F945136DA8D43B59DF3CE064CB62

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E0859530 Relevance: 13.6, APIs: 9, Instructions: 112COMMON

Download Yara Rule

APIs

?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ.MSVCP_WIN ref: 00007FF7E0859568
?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ.MSVCP_WIN ref: 00007FF7E085957A
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ.MSVCP_WIN ref: 00007FF7E0859598

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: D@std@@@std@@U?$char_traits@$?epptr@?$basic_streambuf@?pptr@?$basic_streambuf@Pninc@?$basic_streambuf@
String ID:
API String ID: 4060314879-0
Opcode ID: afc7f0d0d386d9fa25e3d37f0674254394d7a8f0372d0f41bf728260cb42a3e5
Instruction ID: 51bbb3383df4ffc732c39b64ce72c4e1fbc9edf9bf42ea45644917aaa3b7f4a0
Opcode Fuzzy Hash: afc7f0d0d386d9fa25e3d37f0674254394d7a8f0372d0f41bf728260cb42a3e5
Instruction Fuzzy Hash: C3418E31A08A9186EA01AB269504378FBE0FB4AF90BD58632CE5E17791EF3CF425C311

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E08030E8 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 231COMMON

Download Yara Rule

APIs

EnterCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FF7E080313C
default_delete.LIBCPMT ref: 00007FF7E08215B4
default_delete.LIBCPMT ref: 00007FF7E08215FE

Strings

onecore\windows\core\console\open\src\host\directio.cpp, xrefs: 00007FF7E0821609, 00007FF7E0821775

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: default_delete$CriticalEnterSection
String ID: onecore\windows\core\console\open\src\host\directio.cpp
API String ID: 739439809-2458865805
Opcode ID: fb653188433389e3fdcb372f0ed61a365c9514b905ac601cc41ce7c64e13b2cd
Instruction ID: a7757cbdf08b22fcebaf71ead8e3eefb2fb1ef5ebb43a88bc5c39f82d2f12b6a
Opcode Fuzzy Hash: fb653188433389e3fdcb372f0ed61a365c9514b905ac601cc41ce7c64e13b2cd
Instruction Fuzzy Hash: 6391642260DB8191FA20FB25E4503BEE7A4FBA6744F945032DA8D4375ADE3CF465C721

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E0804E6C Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 198COMMON

Download Yara Rule

APIs

memmove.API-MS-WIN-CRT-PRIVATE-L1-1-0 ref: 00007FF7E0804F4D
memmove.API-MS-WIN-CRT-PRIVATE-L1-1-0 ref: 00007FF7E08220DA

Strings

onecore\windows\core\console\open\src\server\apidispatchers.cpp, xrefs: 00007FF7E082214A, 00007FF7E082216A, 00007FF7E08221B4
onecore\windows\core\console\open\src\server\objecthandle.cpp, xrefs: 00007FF7E082219B

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: memmove
String ID: onecore\windows\core\console\open\src\server\apidispatchers.cpp$onecore\windows\core\console\open\src\server\objecthandle.cpp
API String ID: 2162964266-1968334596
Opcode ID: eca5536e85223d47c90db6dab28a097eb88be671ed860a2cc12f2f0ad9a3866a
Instruction ID: fff106dd6bc660af453e30438ae5070defab86e7611c94e57d67eec324a512a0
Opcode Fuzzy Hash: eca5536e85223d47c90db6dab28a097eb88be671ed860a2cc12f2f0ad9a3866a
Instruction Fuzzy Hash: 2D8163A1B08A4292FA14BB15E4503B9A3A1FB44BE4F945633DA1D077D5DF7CF861C321

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E080A280 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 189COMMON

Download Yara Rule

APIs

?_Xout_of_range@std@@YAXPEBD@Z.MSVCP_WIN ref: 00007FF7E0824BFA
LeaveCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FF7E0824C97
CloseHandle.API-MS-WIN-CORE-HANDLE-L1-1-0 ref: 00007FF7E0824D32

Strings

onecore\windows\core\console\open\src\host\input.cpp, xrefs: 00007FF7E0824C71
onecore\windows\core\console\open\src\buffer\out\textcolor.cpp, xrefs: 00007FF7E0824B20, 00007FF7E0824B8E, 00007FF7E0824BB3, 00007FF7E0824BD3
invalid string_view position, xrefs: 00007FF7E0824BF3

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: CloseCriticalHandleLeaveSectionXout_of_range@std@@
String ID: invalid string_view position$onecore\windows\core\console\open\src\buffer\out\textcolor.cpp$onecore\windows\core\console\open\src\host\input.cpp
API String ID: 3449835143-4230967921
Opcode ID: f39fa539044adcd5bd4e5639b892f0b10d3e1aa357427bdc3e79ee972bb53b35
Instruction ID: b7caf68f44b90923a6c16b2cbebcb2015676c6046196b18c5e6bce8dac5051ee
Opcode Fuzzy Hash: f39fa539044adcd5bd4e5639b892f0b10d3e1aa357427bdc3e79ee972bb53b35
Instruction Fuzzy Hash: 6871AE26A0964281FA24BB69D050379E790FF9A780FC06533DA4E437A5CE3DF865C732

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E0803ABC Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 130COMMON

Download Yara Rule

APIs

QueryFullProcessImageNameW.API-MS-WIN-CORE-PSAPI-L1-1-0 ref: 00007FF7E0821B91
PathFindFileNameW.API-MS-WIN-CORE-SHLWAPI-LEGACY-L1-1-0 ref: 00007FF7E0821BAD

Strings

d, xrefs: 00007FF7E0821BF5

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: Name$FileFindFullImagePathProcessQuery
String ID: d
API String ID: 2220688768-2564639436
Opcode ID: 81fb39bd0dc53461950f0586e4b15195c34def60f00a58d33a52ab5d0e90171e
Instruction ID: f84ab0db609bd999cf8ebd26f8ab7d070dfe3384dcfc8fdf6cc519a43c237cce
Opcode Fuzzy Hash: 81fb39bd0dc53461950f0586e4b15195c34def60f00a58d33a52ab5d0e90171e
Instruction Fuzzy Hash: D751A472608B8185EB10AF25D4503BDB7A0FB58BA8F944236DB8D07799EF3CE494C761

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E082B7B8 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 123COMMON

Download Yara Rule

APIs

?_Xout_of_range@std@@YAXPEBD@Z.MSVCP_WIN(?,?,?,?,?,?,?,?,?,?,?,?,00007FF7E0805756), ref: 00007FF7E082B7EA
memmove.API-MS-WIN-CRT-PRIVATE-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,00007FF7E0805756), ref: 00007FF7E082B82F
memmove.API-MS-WIN-CRT-PRIVATE-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,00007FF7E0805756), ref: 00007FF7E082B86B
memmove.API-MS-WIN-CRT-PRIVATE-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,00007FF7E0805756), ref: 00007FF7E082B8ED
memmove.API-MS-WIN-CRT-PRIVATE-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,00007FF7E0805756), ref: 00007FF7E082B904
memmove.API-MS-WIN-CRT-PRIVATE-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,00007FF7E0805756), ref: 00007FF7E082B91C

Strings

invalid string position, xrefs: 00007FF7E082B7E3

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: memmove$Xout_of_range@std@@
String ID: invalid string position
API String ID: 685110151-1799206989
Opcode ID: a9f407e3d603e98a637268d5b2d9e2bd9286a8c187078849d5f01c6329f597d8
Instruction ID: 62083c3f18036e88807b971bcf31640dd3dd1bc6fdfcbedf37ac0603c316ec64
Opcode Fuzzy Hash: a9f407e3d603e98a637268d5b2d9e2bd9286a8c187078849d5f01c6329f597d8
Instruction Fuzzy Hash: 8741CE72B19B8695DA10EF22E4442A9A36AFB44BC4BD80137DE4E07B51DF7CF266C311

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E08061B0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 105COMMON

Download Yara Rule

APIs

memmove.API-MS-WIN-CRT-PRIVATE-L1-1-0(?,00000000,?,00007FF7E080612C,?,?,?,00007FF7E0840167), ref: 00007FF7E080627A
memset.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000,?,00007FF7E080612C,?,?,?,00007FF7E0840167), ref: 00007FF7E080628F
memset.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000,?,00007FF7E080612C,?,?,?,00007FF7E0840167), ref: 00007FF7E080629C
?_Xlength_error@std@@YAXPEBD@Z.MSVCP_WIN(?,00000000,?,00007FF7E080612C,?,?,?,00007FF7E0840167), ref: 00007FF7E0822598

Strings

deque<T> too long, xrefs: 00007FF7E0822591

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: memset$Xlength_error@std@@memmove
String ID: deque<T> too long
API String ID: 4008601576-309773918
Opcode ID: 961046d1b9cf29daf2c58389ae555ee7697ecccdda03337787a79f47058cf3f6
Instruction ID: 3a400021b31fc2bdffbfc96cc8df9778d1c64d3d1fc538c1831643e7d5e8f36e
Opcode Fuzzy Hash: 961046d1b9cf29daf2c58389ae555ee7697ecccdda03337787a79f47058cf3f6
Instruction Fuzzy Hash: A531C661B04A8282EA14EB52F5111A9E351FB45BE4B848632DF7D0BBD6CF7CF061C311

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E07F6E08 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 102COMMON

Download Yara Rule

APIs

_o_terminate.API-MS-WIN-CRT-PRIVATE-L1-1-0 ref: 00007FF7E07F6EB1
_o_terminate.API-MS-WIN-CRT-PRIVATE-L1-1-0(?,?,?,?,00007FF7E07F6E2E), ref: 00007FF7E081C413
_o_terminate.API-MS-WIN-CRT-PRIVATE-L1-1-0(?,?,?,?,00007FF7E07F6E2E), ref: 00007FF7E081C420
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,?,?,00007FF7E07F6E2E), ref: 00007FF7E081C42E
DeleteObject.GDI32 ref: 00007FF7E081C43F
SetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,?,?,00007FF7E07F6E2E), ref: 00007FF7E081C44D

Strings

onecore\windows\core\console\open\src\types\utils.cpp, xrefs: 00007FF7E081C3A3, 00007FF7E081C3C0, 00007FF7E081C3DD, 00007FF7E081C3FB

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: _o_terminate$ErrorLast$DeleteObject
String ID: onecore\windows\core\console\open\src\types\utils.cpp
API String ID: 3255449295-2938961315
Opcode ID: f7a404fbac1230c2e51adbc29ef9f42c9f5e27123eeb997c529b45ea0d62d0cd
Instruction ID: f65bc345868a84126f21e1726f45880dc7a81e5bccbc791fe92c93d507cad278
Opcode Fuzzy Hash: f7a404fbac1230c2e51adbc29ef9f42c9f5e27123eeb997c529b45ea0d62d0cd
Instruction Fuzzy Hash: D54190B6D086428AE754AB54D0446B8FB60FB49B14F909233CA4D13B54DF3CF4B0CB61

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E088A5C4 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 85registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.API-MS-WIN-CORE-REGISTRY-L1-1-0(?,?,000000B8,00000000,?,00007FF7E088A9AA), ref: 00007FF7E088A610
RegQueryValueExW.API-MS-WIN-CORE-REGISTRY-L1-1-0 ref: 00007FF7E088A662
RegQueryValueExW.API-MS-WIN-CORE-REGISTRY-L1-1-0 ref: 00007FF7E088A6AF
RegCloseKey.API-MS-WIN-CORE-REGISTRY-L1-1-0 ref: 00007FF7E088A6E8

Strings

DisplayInitDelay, xrefs: 00007FF7E088A65B
FontSize, xrefs: 00007FF7E088A6A8
SYSTEM\CurrentControlSet\Control\ConKbd, xrefs: 00007FF7E088A602

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: QueryValue$CloseOpen
String ID: DisplayInitDelay$FontSize$SYSTEM\CurrentControlSet\Control\ConKbd
API String ID: 1586453840-3302960082
Opcode ID: 50dff6cbb8965549bc5760e955ddb5c12dfafe7aef7bec54db47dae549adeebd
Instruction ID: b26419c9729d178d534725f769803bd09ed2047cdd47e24c5d69ab17ba1cac27
Opcode Fuzzy Hash: 50dff6cbb8965549bc5760e955ddb5c12dfafe7aef7bec54db47dae549adeebd
Instruction Fuzzy Hash: 3F3162366046528FE760DF24D4406A9B7A4FB1875CBC85236EA0D06B98EF3CE4A4CB65

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E08884E4 Relevance: 12.3, APIs: 7, Strings: 1, Instructions: 274COMMON

Download Yara Rule

APIs

memset.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF7E088639F), ref: 00007FF7E08885D1
memset.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF7E088639F), ref: 00007FF7E0888639
memset.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF7E088639F), ref: 00007FF7E088869A
memset.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7E0888762
memset.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7E08887C0

Part of subcall function 00007FF7E08857A4: ?_Xlength_error@std@@YAXPEBD@Z.MSVCP_WIN(?,?,?,?,?,?,?,00007FF7E088639F), ref: 00007FF7E08857D8
Part of subcall function 00007FF7E08857A4: memset.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,00007FF7E088639F), ref: 00007FF7E0885852
Part of subcall function 00007FF7E08857A4: memmove.API-MS-WIN-CRT-PRIVATE-L1-1-0(?,?,?,?,?,?,?,00007FF7E088639F), ref: 00007FF7E0885864

memset.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7E0888821

Strings

onecore\windows\core\console\open\src\renderer\dx\customtextlayout.cpp, xrefs: 00007FF7E08886F7

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: memset$Xlength_error@std@@memmove
String ID: onecore\windows\core\console\open\src\renderer\dx\customtextlayout.cpp
API String ID: 4008601576-174823080
Opcode ID: cfa9b065acd7a3fa1abe35d91f0c1e13eb52256e71e5777eb52c680f5287a7d6
Instruction ID: ee1d8fbeaabf5d3edad2d89ec64ccbb9cec145ad77c69289066b73cf51c93225
Opcode Fuzzy Hash: cfa9b065acd7a3fa1abe35d91f0c1e13eb52256e71e5777eb52c680f5287a7d6
Instruction Fuzzy Hash: 43A1C766B09A8A81DE14FB56D6482BEE356EB48BC0BD59433DE5E0B741DE7CF060C321

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E0881FC0 Relevance: 12.1, APIs: 8, Instructions: 106COMMON

Download Yara Rule

APIs

OffsetRect.USER32 ref: 00007FF7E088204C
IntersectRect.USER32 ref: 00007FF7E0882068
SubtractRect.USER32 ref: 00007FF7E0882084
IsRectEmpty.USER32 ref: 00007FF7E0882096
OffsetRect.USER32 ref: 00007FF7E08820D5
IntersectRect.USER32 ref: 00007FF7E08820F1
SubtractRect.USER32 ref: 00007FF7E088210D
IsRectEmpty.USER32 ref: 00007FF7E088211F

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: Rect$EmptyIntersectOffsetSubtract
String ID:
API String ID: 357338179-0
Opcode ID: b08e633d56a0d33f6675435537e79c243b787c62dcb873a71ccbdadf1697e1cc
Instruction ID: 43025f7f3bc516e83f7be73d9a406497a7d68964587e2d5aebc5eef0887850c9
Opcode Fuzzy Hash: b08e633d56a0d33f6675435537e79c243b787c62dcb873a71ccbdadf1697e1cc
Instruction Fuzzy Hash: 52418F23528B82C7D6509F24E4406BAF770FBDAB41F81B132EA8E56614EF3CE559CB11

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E08562B4 Relevance: 12.1, APIs: 8, Instructions: 66COMMON

Download Yara Rule

APIs

?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ.MSVCP_WIN(?,?,00000000,00007FF7E085587C), ref: 00007FF7E08562D6
?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ.MSVCP_WIN(?,?,00000000,00007FF7E085587C), ref: 00007FF7E08562F4
?good@ios_base@std@@QEBA_NXZ.MSVCP_WIN(?,?,00000000,00007FF7E085587C), ref: 00007FF7E085631E
?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ.MSVCP_WIN(?,?,00000000,00007FF7E085587C), ref: 00007FF7E0856338
?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ.MSVCP_WIN(?,?,00000000,00007FF7E085587C), ref: 00007FF7E0856353
?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ.MSVCP_WIN(?,?,00000000,00007FF7E085587C), ref: 00007FF7E085636E
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ.MSVCP_WIN(?,?,00000000,00007FF7E085587C), ref: 00007FF7E085637D
?good@ios_base@std@@QEBA_NXZ.MSVCP_WIN(?,?,00000000,00007FF7E085587C), ref: 00007FF7E0856393

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: U?$char_traits@$D@std@@@std@@$D@std@@@2@$?tie@?$basic_ios@V?$basic_ostream@$?good@ios_base@std@@?rdbuf@?$basic_ios@V?$basic_streambuf@$?flush@?$basic_ostream@V12@
String ID:
API String ID: 2615938766-0
Opcode ID: 36409a7c97e633ceded7e7cfc77b6a13b5861a99479c5fe31fb273c57bc0fb2b
Instruction ID: 44ab23987e09919ab975f4ea66cd3ea747acb0e7c3f58ba40fa9ee177a32da1d
Opcode Fuzzy Hash: 36409a7c97e633ceded7e7cfc77b6a13b5861a99479c5fe31fb273c57bc0fb2b
Instruction Fuzzy Hash: 9631A532605A86C6DB14AF15E594378BBA0FF8AF86789D432CA0E47325CF38E464C321

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E080B9F0 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 210COMMON

Download Yara Rule

Strings

onecore\windows\core\console\open\src\renderer\gdi\paint.cpp, xrefs: 00007FF7E0825E32, 00007FF7E0825F7F
!, xrefs: 00007FF7E0826074

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID:
String ID: !$onecore\windows\core\console\open\src\renderer\gdi\paint.cpp
API String ID: 0-1593173792
Opcode ID: 40f5a708ce0fecfc1fa9b217ee2e852d25cae484e93f8062a421551220fd1aa8
Instruction ID: 5c26081302b688643d2f3e53e626bad1169338e5587009555a150bcab6aa1a12
Opcode Fuzzy Hash: 40f5a708ce0fecfc1fa9b217ee2e852d25cae484e93f8062a421551220fd1aa8
Instruction Fuzzy Hash: B681A632B09A528AF750AB61D4407BDAAA0FB49B88F945036DE0D67B54DF3CF464C722

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E07FC7A0 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 206COMMON

Download Yara Rule

APIs

EnterCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FF7E07FC7B9
memmove.API-MS-WIN-CRT-PRIVATE-L1-1-0 ref: 00007FF7E07FC965
LeaveCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FF7E081EB5F

Strings

invalid deque<T> subscript, xrefs: 00007FF7E081EB20, 00007FF7E081EB3C

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: CriticalSection$EnterLeavememmove
String ID: invalid deque<T> subscript
API String ID: 572680541-2228476695
Opcode ID: 99eac763fc95b2756f9ad0f8888b8a9e3be958ad2c79219ecddb8371fd6e30e9
Instruction ID: 82106bbd276b0e1b0a03cdaeb5527381cc388c02716262c7e5a07858dd88ab08
Opcode Fuzzy Hash: 99eac763fc95b2756f9ad0f8888b8a9e3be958ad2c79219ecddb8371fd6e30e9
Instruction Fuzzy Hash: 27916D266196C586EA60EF15D0503BAB360FF89B40F849133DA8E83765DF3CF465DB21

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E0885DB4 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 195COMMON

Download Yara Rule

APIs

_o_terminate.API-MS-WIN-CRT-PRIVATE-L1-1-0 ref: 00007FF7E0885E2E
_o_terminate.API-MS-WIN-CRT-PRIVATE-L1-1-0 ref: 00007FF7E0885E55
_o_terminate.API-MS-WIN-CRT-PRIVATE-L1-1-0 ref: 00007FF7E0885E7C
_o_terminate.API-MS-WIN-CRT-PRIVATE-L1-1-0 ref: 00007FF7E0885EAF
_o_terminate.API-MS-WIN-CRT-PRIVATE-L1-1-0 ref: 00007FF7E08860C6

Strings

onecore\windows\core\console\open\src\renderer\dx\customtextlayout.cpp, xrefs: 00007FF7E088600F

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: _o_terminate
String ID: onecore\windows\core\console\open\src\renderer\dx\customtextlayout.cpp
API String ID: 882196631-174823080
Opcode ID: 686fcee5a475943731644fbff7381f2511805cbaceacf462176a68265d3b6b01
Instruction ID: e9e4b209c08f198724b2d74310b7e0ece7385422380e3c4bae1c4aa3a57fb5c3
Opcode Fuzzy Hash: 686fcee5a475943731644fbff7381f2511805cbaceacf462176a68265d3b6b01
Instruction Fuzzy Hash: 3E913972604F4581DA10EF15E844BA8B7A8FB48B88FE68136CE9D17720DF38E4B4C365

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E0869CC4 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 163COMMON

Download Yara Rule

APIs

GetCurrentProcess.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000,?,00007FF7E082126E), ref: 00007FF7E0869D70
GetCurrentProcess.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000,?,00007FF7E082126E), ref: 00007FF7E0869D83
DuplicateHandle.API-MS-WIN-CORE-HANDLE-L1-1-0 ref: 00007FF7E0869DAD
?_Xout_of_range@std@@YAXPEBD@Z.MSVCP_WIN(?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000,?,00007FF7E082126E), ref: 00007FF7E0869E5F

Strings

onecore\windows\core\console\open\src\server\processlist.cpp, xrefs: 00007FF7E0869DC8
invalid deque<T> subscript, xrefs: 00007FF7E0869E58

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: CurrentProcess$DuplicateHandleXout_of_range@std@@
String ID: invalid deque<T> subscript$onecore\windows\core\console\open\src\server\processlist.cpp
API String ID: 4104642312-902665438
Opcode ID: 17ea3c6a19a46cce9ace851915c7313c1a9113965640edfa47d938889b3cc997
Instruction ID: 40e858e857cce8880161648f0ad6d85814a197068a64759908b81d9e717704f8
Opcode Fuzzy Hash: 17ea3c6a19a46cce9ace851915c7313c1a9113965640edfa47d938889b3cc997
Instruction Fuzzy Hash: B461AE36A09B8182EB10EF11E4403ADB7A4FB89B90F968236DE8D53795DF7CE461C711

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E0805E60 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 132timeCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7E07F6C80: memset.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7E07F6D5B
Part of subcall function 00007FF7E07F6C80: _o_wcscpy_s.API-MS-WIN-CRT-PRIVATE-L1-1-0 ref: 00007FF7E07F6D6F
Part of subcall function 00007FF7E07F6C80: memset.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7E07F6D88

_Mtx_init_in_situ.MSVCP_WIN ref: 00007FF7E0806052
CreateTimerQueue.API-MS-WIN-CORE-THREADPOOL-LEGACY-L1-1-0 ref: 00007FF7E080607A
InitializeCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FF7E08060C3
memmove.API-MS-WIN-CRT-PRIVATE-L1-1-0(?,00000000,?,00007FF7E080612C,?,?,?,00007FF7E0840167), ref: 00007FF7E0822554
memmove.API-MS-WIN-CRT-PRIVATE-L1-1-0(?,00000000,?,00007FF7E080612C,?,?,?,00007FF7E0840167), ref: 00007FF7E082256D

Strings

onecore\windows\core\console\open\src\host\cursorblinker.cpp, xrefs: 00007FF7E0822538

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: memmovememset$CreateCriticalInitializeMtx_init_in_situQueueSectionTimer_o_wcscpy_s
String ID: onecore\windows\core\console\open\src\host\cursorblinker.cpp
API String ID: 2788725267-1313982512
Opcode ID: 16d147cef07c3e6a4aa407ec7be356e50af53395e100cf84ab51a3e0e49dea01
Instruction ID: e0c9728351ac24a20f6ed05b87b25a4c17fc170d69b3f8bc63a327d508f40d47
Opcode Fuzzy Hash: 16d147cef07c3e6a4aa407ec7be356e50af53395e100cf84ab51a3e0e49dea01
Instruction Fuzzy Hash: 5671E832A09F81AAD34C9F20EA903E9B7A5FB44750F985229C7AC43350DF38B1B0CB55

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E0872EE0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 80COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32 ref: 00007FF7E0872F05
SetWindowLongW.USER32 ref: 00007FF7E0872F38
GetWindowLongW.USER32 ref: 00007FF7E0872F4C
SetWindowLongW.USER32 ref: 00007FF7E0872F74
SetWindowPos.USER32 ref: 00007FF7E08733BB

Strings

, xrefs: 00007FF7E0873374

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: Window$Long
String ID:
API String ID: 847901565-3916222277
Opcode ID: 39c85e282bbbc4e71f4dd69814b2e0e27a11d159b6e4f201555ae21131f0cd15
Instruction ID: b43621bf08c25ffd1519835821cde352a217a6fbb9e0dac9b69526cd4df8a0b1
Opcode Fuzzy Hash: 39c85e282bbbc4e71f4dd69814b2e0e27a11d159b6e4f201555ae21131f0cd15
Instruction Fuzzy Hash: D131E562B18B4186D7149B39A844238BF60FB8ABE4F549332DD2E577A5CF3CE091CB11

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E0854788 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 75libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryExW.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00007FF7E0822F9C), ref: 00007FF7E085482B
GetProcAddress.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00007FF7E0822F9C), ref: 00007FF7E085484E
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00007FF7E0822F9C), ref: 00007FF7E0854870

Part of subcall function 00007FF7E0809654: EventWriteTransfer.API-MS-WIN-EVENTING-PROVIDER-L1-1-0 ref: 00007FF7E08096D7

FreeLibrary.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00007FF7E0822F9C), ref: 00007FF7E0854899

Strings

ConsoleCreateIoThread, xrefs: 00007FF7E0854844
ConhostV1.dll, xrefs: 00007FF7E0854824

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: Library$AddressErrorEventFreeLastLoadProcTransferWrite
String ID: ConhostV1.dll$ConsoleCreateIoThread
API String ID: 331234469-2092506167
Opcode ID: 9dc76ab2e295bd126d566f984959e07fb7fce04886f0030e31297bbbd108f9d4
Instruction ID: 389a68138f161d6a64590bc8f3ed1840dd3b3b486d8bb6948290b9cd20d7d295
Opcode Fuzzy Hash: 9dc76ab2e295bd126d566f984959e07fb7fce04886f0030e31297bbbd108f9d4
Instruction Fuzzy Hash: 08315B31A18B8286FB40AB11E844379B6A5FB88B80FD59136D90D47760DF3CF865C762

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E0875768 Relevance: 10.6, APIs: 7, Instructions: 71clipboardCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 00007FF7E087579D
GetClipboardData.USER32 ref: 00007FF7E08757B6
GlobalLock.API-MS-WIN-CORE-HEAP-OBSOLETE-L1-1-0(?,?,?,?,?,00007FF7E08243B0), ref: 00007FF7E08757D1
GlobalSize.API-MS-WIN-CORE-HEAP-OBSOLETE-L1-1-0(?,?,?,?,?,00007FF7E08243B0), ref: 00007FF7E08757E3
GlobalUnlock.API-MS-WIN-CORE-HEAP-OBSOLETE-L1-1-0(?,?,?,?,?,00007FF7E08243B0), ref: 00007FF7E0875894

Part of subcall function 00007FF7E0810000: EnterCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,?,00007FF7E0803769,?,?,?,?,00007FF7E081B159), ref: 00007FF7E0810010

Part of subcall function 00007FF7E084937C: LoadStringW.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0 ref: 00007FF7E08493F1

Part of subcall function 00007FF7E080FD30: _onexit.LIBCMT ref: 00007FF7E080FD34

_Init_thread_footer.LIBCMT ref: 00007FF7E0875856

Part of subcall function 00007FF7E080FF98: EnterCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,?,00007FF7E0803790,?,?,?,?,00007FF7E081B159), ref: 00007FF7E080FFA8
Part of subcall function 00007FF7E080FF98: LeaveCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,?,00007FF7E0803790,?,?,?,?,00007FF7E081B159), ref: 00007FF7E080FFE8

CloseClipboard.USER32 ref: 00007FF7E08758A0

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: ClipboardCriticalGlobalSection$Enter$CloseDataInit_thread_footerLeaveLoadLockOpenSizeStringUnlock_onexit
String ID:
API String ID: 1746292183-0
Opcode ID: c2aa3001176dba1493289d9fb03642c26da2384a5352e1e2ce46fd7bee29e7db
Instruction ID: 0871b3ce9b0b476632f02e39c79d9f318fb20f6af26d6ff256094174d726a68d
Opcode Fuzzy Hash: c2aa3001176dba1493289d9fb03642c26da2384a5352e1e2ce46fd7bee29e7db
Instruction Fuzzy Hash: 58313225A09A4286EB50BB21E844379E7A1FF89B95FC84133D94E42365DF3CF464CB22

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E0859C70 Relevance: 10.6, APIs: 7, Instructions: 54COMMON

Download Yara Rule

APIs

?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ.MSVCP_WIN ref: 00007FF7E0859C82
?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ.MSVCP_WIN ref: 00007FF7E0859C9D
?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ.MSVCP_WIN ref: 00007FF7E0859CB6
?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ.MSVCP_WIN ref: 00007FF7E0859CE4
?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ.MSVCP_WIN ref: 00007FF7E0859CF6
?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z.MSVCP_WIN ref: 00007FF7E0859D0E
?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ.MSVCP_WIN ref: 00007FF7E0859D1D

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: D@std@@@std@@U?$char_traits@$?gptr@?$basic_streambuf@$?eback@?$basic_streambuf@?egptr@?$basic_streambuf@?pptr@?$basic_streambuf@?setg@?$basic_streambuf@D00@
String ID:
API String ID: 1210260451-0
Opcode ID: 954d59f9f1108cd55123d8427b80449b28120059a508f47fe3b0b788f3727b58
Instruction ID: a46c3502776de5a03455f61abec8e81cb495512978faeb65b6dd8de57f33faff
Opcode Fuzzy Hash: 954d59f9f1108cd55123d8427b80449b28120059a508f47fe3b0b788f3727b58
Instruction Fuzzy Hash: 5C116321A09A8182EA107B11E60427CFBA0FB4AFC1BC89135DE5E17755CF3CF861C721

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E08591C8 Relevance: 10.6, APIs: 7, Instructions: 52COMMONLIBRARYCODE

Download Yara Rule

APIs

?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ.MSVCP_WIN(?,?,?,00007FF7E0856464,?,?,?,00007FF7E0867796,?,?,00000002,00007FF7E0879E6E), ref: 00007FF7E08591DB
?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ.MSVCP_WIN(?,?,?,00007FF7E0856464,?,?,?,00007FF7E0867796,?,?,00000002,00007FF7E0879E6E), ref: 00007FF7E08591F0
?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ.MSVCP_WIN(?,?,?,00007FF7E0856464,?,?,?,00007FF7E0867796,?,?,00000002,00007FF7E0879E6E), ref: 00007FF7E08591FF
?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ.MSVCP_WIN(?,?,?,00007FF7E0856464,?,?,?,00007FF7E0867796,?,?,00000002,00007FF7E0879E6E), ref: 00007FF7E0859212
?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ.MSVCP_WIN(?,?,?,00007FF7E0856464,?,?,?,00007FF7E0867796,?,?,00000002,00007FF7E0879E6E), ref: 00007FF7E0859225
?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z.MSVCP_WIN(?,?,?,00007FF7E0856464,?,?,?,00007FF7E0867796,?,?,00000002,00007FF7E0879E6E), ref: 00007FF7E0859249
?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD0@Z.MSVCP_WIN(?,?,?,00007FF7E0856464,?,?,?,00007FF7E0867796,?,?,00000002,00007FF7E0879E6E), ref: 00007FF7E085925E

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: D@std@@@std@@U?$char_traits@$?eback@?$basic_streambuf@$?egptr@?$basic_streambuf@?epptr@?$basic_streambuf@?pptr@?$basic_streambuf@?setg@?$basic_streambuf@?setp@?$basic_streambuf@D00@
String ID:
API String ID: 2626452370-0
Opcode ID: fd9a0a9e50be676fdc655645c5d94e1191374bc7ce2073a7e0c082820c18252a
Instruction ID: aeab9f16289c42e0d5e12a98ab8562c4d35163b55bb3a1cf83d5e0b9eff7bb9e
Opcode Fuzzy Hash: fd9a0a9e50be676fdc655645c5d94e1191374bc7ce2073a7e0c082820c18252a
Instruction Fuzzy Hash: CC119432A04A86CBE7006B25F414339FB90FF8FB52F98A131CA1E16755CF3CA458C621

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E0852C14 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 48COMMON

Download Yara Rule

APIs

_o__errno.API-MS-WIN-CRT-PRIVATE-L1-1-0(?,?,?,?,00000000,00000000,?,00007FF7E081C63D), ref: 00007FF7E0852C29
_o_wcstol.API-MS-WIN-CRT-PRIVATE-L1-1-0(?,?,?,?,00000000,00000000,?,00007FF7E081C63D), ref: 00007FF7E0852C53
?_Xinvalid_argument@std@@YAXPEBD@Z.MSVCP_WIN(?,?,?,?,00000000,00000000,?,00007FF7E081C63D), ref: 00007FF7E0852C70

Strings

invalid stoi argument, xrefs: 00007FF7E0852C69
stoi argument out of range, xrefs: 00007FF7E0852CA1

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: Xinvalid_argument@std@@_o__errno_o_wcstol
String ID: invalid stoi argument$stoi argument out of range
API String ID: 503588107-1606216832
Opcode ID: 67582d527fe91d97a67b2888f1fb616bbf3593617620bb60c456d336b9453458
Instruction ID: 9b07d9e199765dbc46d7a6dce9363cff7cb67d75dae4854a1fb6cda594349097
Opcode Fuzzy Hash: 67582d527fe91d97a67b2888f1fb616bbf3593617620bb60c456d336b9453458
Instruction Fuzzy Hash: A4115232618A41C2D714AF51F544278F760FB9AB91FC89072DA4E07B55CF3CE860C751

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E087706C Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 46COMMON

Download Yara Rule

APIs

CancelSynchronousIo.API-MS-WIN-CORE-IO-L1-1-1(?,?,00000000,00007FF7E086E794), ref: 00007FF7E087708C
CloseHandle.API-MS-WIN-CORE-HANDLE-L1-1-0(?,?,00000000,00007FF7E086E794), ref: 00007FF7E08770B4
CloseHandle.API-MS-WIN-CORE-HANDLE-L1-1-0(?,?,00000000,00007FF7E086E794), ref: 00007FF7E08770D2
CloseHandle.API-MS-WIN-CORE-HANDLE-L1-1-0(?,?,00000000,00007FF7E086E794), ref: 00007FF7E08770EB
CloseHandle.API-MS-WIN-CORE-HANDLE-L1-1-0(?,?,00000000,00007FF7E086E794), ref: 00007FF7E0877104

Strings

onecore\windows\core\console\open\src\interactivity\onecore\coniosrvcomm.cpp, xrefs: 00007FF7E08770A1

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: CloseHandle$CancelSynchronous
String ID: onecore\windows\core\console\open\src\interactivity\onecore\coniosrvcomm.cpp
API String ID: 2419186852-2051704093
Opcode ID: f0c711347f30bb761f83e148b4daf10671029e9a6abbbb227eda6878ea483b3e
Instruction ID: ce6baddd547f65318cf13079c41fe79c96a42c34d964504e088bb6b438ac6ccd
Opcode Fuzzy Hash: f0c711347f30bb761f83e148b4daf10671029e9a6abbbb227eda6878ea483b3e
Instruction Fuzzy Hash: 25110B32504E4286EB14AF20E550378F7B4FB89F54BD94332CA6E46798DF38E464C761

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E0843B18 Relevance: 9.2, APIs: 6, Instructions: 178COMMON

Download Yara Rule

APIs

default_delete.LIBCPMT ref: 00007FF7E0843BA7

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: default_delete
String ID:
API String ID: 3712186324-0
Opcode ID: 70836816703c6a91851eb3ebbb52bad29745bb23c46fe12cbc0c8e7f110563d6
Instruction ID: 9bd803748b0e02b03554795917cfcb52a091e66226bb180a0f2203aa2778412b
Opcode Fuzzy Hash: 70836816703c6a91851eb3ebbb52bad29745bb23c46fe12cbc0c8e7f110563d6
Instruction Fuzzy Hash: C471B422A1C68249EB60EB11E04577EE3A0FFA5B84F944136EA8D07B86DF3CE455C712

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E086B6A0 Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 382COMMON

Download Yara Rule

Strings

onecore\windows\core\console\open\src\server\apidispatchers.cpp, xrefs: 00007FF7E086B6EF, 00007FF7E086B761, 00007FF7E086B859, 00007FF7E086B9D5, 00007FF7E086BA74, 00007FF7E086BBAB

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID:
String ID: onecore\windows\core\console\open\src\server\apidispatchers.cpp
API String ID: 0-3284698556
Opcode ID: 55aa0084a83d509916466cce73bd9debf9246c94179de1583d0194787e6a045f
Instruction ID: f45ae6e178c0b85c61b2c47fb740ce58ae4103a8e2c852d932b03441f8437ad8
Opcode Fuzzy Hash: 55aa0084a83d509916466cce73bd9debf9246c94179de1583d0194787e6a045f
Instruction Fuzzy Hash: A5F1A176B08B968AEB109B64E8403FC67A1FB8478CF958032DE4D57759DF38E5A1C321

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E08598B0 Relevance: 9.1, APIs: 6, Instructions: 117COMMON

Download Yara Rule

APIs

?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ.MSVCP_WIN ref: 00007FF7E08598D8
?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ.MSVCP_WIN ref: 00007FF7E08598EA
?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ.MSVCP_WIN ref: 00007FF7E085990B
?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z.MSVCP_WIN ref: 00007FF7E08599C4
?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ.MSVCP_WIN ref: 00007FF7E08599DE
?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z.MSVCP_WIN ref: 00007FF7E08599F6

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: D@std@@@std@@U?$char_traits@$D00@$?eback@?$basic_streambuf@?epptr@?$basic_streambuf@?gptr@?$basic_streambuf@?pptr@?$basic_streambuf@?setg@?$basic_streambuf@?setp@?$basic_streambuf@
String ID:
API String ID: 2849800682-0
Opcode ID: 9f776588e57b1de3c2b79c687690192d845ba969c5bd1f8c9f3aee907e9b27ad
Instruction ID: d4580017cd8823976846772e3de5e932552c14a41b0609953480ffc2e2c902f4
Opcode Fuzzy Hash: 9f776588e57b1de3c2b79c687690192d845ba969c5bd1f8c9f3aee907e9b27ad
Instruction Fuzzy Hash: 3D41D132A09B9186EA566B12990837AEAD0EF49FD4FC84136CD9D17794DF3CF460C222

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E08069CC Relevance: 9.1, APIs: 6, Instructions: 114COMMON

Download Yara Rule

APIs

SetRectEmpty.USER32 ref: 00007FF7E0806A06
EqualRect.USER32 ref: 00007FF7E0806A29
MonitorFromWindow.USER32 ref: 00007FF7E0806A56
GetMonitorInfoW.USER32 ref: 00007FF7E0806A8D
GetWindowInfo.USER32 ref: 00007FF7E0806AD4
MonitorFromRect.USER32 ref: 00007FF7E0806B4B

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: MonitorRect$FromInfoWindow$EmptyEqual
String ID:
API String ID: 1512513361-0
Opcode ID: 8461f421c73a057cc16f1a1f7ff4a400b3bd8bb5649a2bb3e93a0b85775b1560
Instruction ID: 960dce742a6e063cf4cfbabbc833326c87ae676d921646e7524370c3ed698a36
Opcode Fuzzy Hash: 8461f421c73a057cc16f1a1f7ff4a400b3bd8bb5649a2bb3e93a0b85775b1560
Instruction Fuzzy Hash: AE517732A08B428AEB00AF65D8402BCB7B0FB59B88B859136DE0D13714EF38E5A5C751

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E08743EC Relevance: 9.1, APIs: 6, Instructions: 105windowCOMMON

Download Yara Rule

APIs

EnableMenuItem.USER32 ref: 00007FF7E0874420
EnableMenuItem.USER32 ref: 00007FF7E087447C
EnableMenuItem.USER32 ref: 00007FF7E087449C
EnableMenuItem.USER32 ref: 00007FF7E08744C1
EnableMenuItem.USER32 ref: 00007FF7E08744F1
EnableMenuItem.USER32 ref: 00007FF7E0874516

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: EnableItemMenu
String ID:
API String ID: 1841910628-0
Opcode ID: a69b66f216c0165ed59490d104911a34f2bbfc73e2be31879352639ba26c9cb0
Instruction ID: cc9034359afdd028dd3af8aca3db34b97913320c3ba2202bd040337ef524495c
Opcode Fuzzy Hash: a69b66f216c0165ed59490d104911a34f2bbfc73e2be31879352639ba26c9cb0
Instruction Fuzzy Hash: CB41D722A0D7D246E7216B14A418738EFA0EF86B84FDC6036CD4943786CF3CB454DB62

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E0859A40 Relevance: 9.1, APIs: 6, Instructions: 85COMMON

Download Yara Rule

APIs

?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ.MSVCP_WIN ref: 00007FF7E0859A6C
?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ.MSVCP_WIN ref: 00007FF7E0859A7E
?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ.MSVCP_WIN ref: 00007FF7E0859A9F
?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z.MSVCP_WIN ref: 00007FF7E0859AF0
?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ.MSVCP_WIN ref: 00007FF7E0859B0A
?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z.MSVCP_WIN ref: 00007FF7E0859B22

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: D@std@@@std@@U?$char_traits@$D00@$?eback@?$basic_streambuf@?epptr@?$basic_streambuf@?gptr@?$basic_streambuf@?pptr@?$basic_streambuf@?setg@?$basic_streambuf@?setp@?$basic_streambuf@
String ID:
API String ID: 2849800682-0
Opcode ID: 3078223af781b2fb2acaa49924e7c6a51ca2107b40ef13fa0c06e8dd46a6646c
Instruction ID: 0667c309478fd75c5608410ec6d36235d5968ee4a68fb1dce67b469fa18d8469
Opcode Fuzzy Hash: 3078223af781b2fb2acaa49924e7c6a51ca2107b40ef13fa0c06e8dd46a6646c
Instruction Fuzzy Hash: 3B319421A05F9186EA55AF12E504379F6A0FB49FA0F884136CE5D07794DF3CE461C322

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E08845A8 Relevance: 9.1, APIs: 3, Strings: 2, Instructions: 329COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7E0884520: GetUserDefaultLocaleName.API-MS-WIN-CORE-LOCALIZATION-L1-2-0 ref: 00007FF7E0884554

_o_roundf.API-MS-WIN-CRT-PRIVATE-L1-1-0 ref: 00007FF7E0884798
ceilf.API-MS-WIN-CRT-MATH-L1-1-0 ref: 00007FF7E08847ED
ceilf.API-MS-WIN-CRT-MATH-L1-1-0 ref: 00007FF7E08847FA

Part of subcall function 00007FF7E07F6A74: _o_wcscpy_s.API-MS-WIN-CRT-PRIVATE-L1-1-0(?,?,00000000,00007FF7E07F69DC), ref: 00007FF7E07F6A94

Strings

, xrefs: 00007FF7E0884696
onecore\windows\core\console\open\src\renderer\dx\dxrenderer.cpp, xrefs: 00007FF7E08846D4, 00007FF7E088471E, 00007FF7E08848A7, 00007FF7E08848D6, 00007FF7E088492B, 00007FF7E088495A, 00007FF7E08849A8, 00007FF7E08849DC, 00007FF7E0884A10

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: ceilf$DefaultLocaleNameUser_o_roundf_o_wcscpy_s
String ID: $onecore\windows\core\console\open\src\renderer\dx\dxrenderer.cpp
API String ID: 1877041966-2592510457
Opcode ID: 0b81f494d37291cdbc9bf6cd68331e73fe9c1b440e56e7df9adee94f622094d9
Instruction ID: 0fcec4dd7191a1a3cb4d927f87ad69293dea13c8a5c4e46705c7c3d011160b11
Opcode Fuzzy Hash: 0b81f494d37291cdbc9bf6cd68331e73fe9c1b440e56e7df9adee94f622094d9
Instruction Fuzzy Hash: 63E19F22618A8591E611AB35E4407EAF360FFD9784F806233EA8DA3B65DF3CF455CB11

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E08143EC Relevance: 9.1, APIs: 6, Instructions: 76COMMON

Download Yara Rule

APIs

AcquireSRWLockShared.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,?,?,?,00007FF7E0814526,?,?,?,?,00007FF7E08133BC), ref: 00007FF7E081440D
ReleaseSRWLockShared.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,?,?,?,00007FF7E0814526,?,?,?,?,00007FF7E08133BC), ref: 00007FF7E081442D
EnterCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,?,?,?,00007FF7E0814526,?,?,?,?,00007FF7E08133BC), ref: 00007FF7E081444D
AcquireSRWLockExclusive.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,?,?,?,00007FF7E0814526,?,?,?,?,00007FF7E08133BC), ref: 00007FF7E081445C
ReleaseSRWLockExclusive.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,?,?,?,00007FF7E0814526,?,?,?,?,00007FF7E08133BC), ref: 00007FF7E08144B4
LeaveCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,?,?,?,00007FF7E0814526,?,?,?,?,00007FF7E08133BC), ref: 00007FF7E08144D9

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: Lock$AcquireCriticalExclusiveReleaseSectionShared$EnterLeave
String ID:
API String ID: 3221859647-0
Opcode ID: 0fb2b8643c1750d9ec6887a9461d2bf4b50a3b6f18594da4b3aa1edbeccf63a9
Instruction ID: 906bd6c439f84ba52a2482bf5f083b763f1b01660d8989b20b92ae029f2df87a
Opcode Fuzzy Hash: 0fb2b8643c1750d9ec6887a9461d2bf4b50a3b6f18594da4b3aa1edbeccf63a9
Instruction Fuzzy Hash: 50319F22B09A5186EA11AF11E500379EB60FF89F90BC9A132DE0E1BB05DF3CF4958725

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E07F3F74 Relevance: 9.1, APIs: 6, Instructions: 61windowCOMMON

Download Yara Rule

APIs

LoadIconW.USER32 ref: 00007FF7E07F3FA7
GetSystemMetrics.USER32 ref: 00007FF7E07F3FC5
GetSystemMetrics.USER32 ref: 00007FF7E07F3FD8
LoadImageW.USER32 ref: 00007FF7E07F3FFE

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: LoadMetricsSystem$IconImage
String ID:
API String ID: 1419466641-0
Opcode ID: a3b2a5e09a3be08ed5a21d5fbe8d6cea0f2e8cc6b2f763d5809ee226f82dcbdf
Instruction ID: 2f5cad3b37132c1da52fd1f3850412d703f72c01f251146ae7b0d9734a4a944f
Opcode Fuzzy Hash: a3b2a5e09a3be08ed5a21d5fbe8d6cea0f2e8cc6b2f763d5809ee226f82dcbdf
Instruction Fuzzy Hash: 4421AF32A08B8287E7156B25A00033AEAF1FF8C785F958136DA4E43795DF3DF4618722

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E0859B6C Relevance: 9.1, APIs: 6, Instructions: 55COMMON

Download Yara Rule

APIs

?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ.MSVCP_WIN ref: 00007FF7E0859BA6
?pbase@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ.MSVCP_WIN ref: 00007FF7E0859BBA
?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ.MSVCP_WIN ref: 00007FF7E0859BCC
?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ.MSVCP_WIN ref: 00007FF7E0859BEC
?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ.MSVCP_WIN ref: 00007FF7E0859C00
?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ.MSVCP_WIN ref: 00007FF7E0859C12

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: D@std@@@std@@U?$char_traits@$?pptr@?$basic_streambuf@$?eback@?$basic_streambuf@?egptr@?$basic_streambuf@?gptr@?$basic_streambuf@?pbase@?$basic_streambuf@
String ID:
API String ID: 2812601886-0
Opcode ID: 76a16eaecf9adbb4869d35939d9fdd9d41bd77e51ab5bb702147e18b6369a4b4
Instruction ID: 3e806f7ab149d92b40c4c5d9908533f53102ab8f318a317feacc5c2f3ba8afeb
Opcode Fuzzy Hash: 76a16eaecf9adbb4869d35939d9fdd9d41bd77e51ab5bb702147e18b6369a4b4
Instruction Fuzzy Hash: 2321F932A0878186EB046F15E55437CBBA1FB4AF80F988179CA4D17751CF7CE8A5C752

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E08748EC Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 288windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7E07F4DDC: GetCPInfo.API-MS-WIN-CORE-LOCALIZATION-L1-2-0 ref: 00007FF7E07F4E1A

SetWindowPos.USER32 ref: 00007FF7E0874C57
memmove.API-MS-WIN-CRT-PRIVATE-L1-1-0 ref: 00007FF7E0874CC1
PostMessageW.USER32 ref: 00007FF7E0874D8E

Strings

__DefaultTTFont__, xrefs: 00007FF7E0874A3C
onecore\windows\core\console\open\src\interactivity\win32\menu.cpp, xrefs: 00007FF7E0874B8E

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: InfoMessagePostWindowmemmove
String ID: __DefaultTTFont__$onecore\windows\core\console\open\src\interactivity\win32\menu.cpp
API String ID: 1336903424-1124889736
Opcode ID: 0d2c16886e010c375ceff02216363e3df32eabc2f377190ad1ddcdc8c4a8b1ab
Instruction ID: 3768d5c835961d87a128b1699af6d2e54feed18b48027bbcaf41479ae00a43e6
Opcode Fuzzy Hash: 0d2c16886e010c375ceff02216363e3df32eabc2f377190ad1ddcdc8c4a8b1ab
Instruction Fuzzy Hash: CEE19926B082829AE704EB65D4407ADBBB1FB58744F840036DE0D97B56DF38F4B4CB62

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E084336C Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 273COMMON

Download Yara Rule

APIs

default_delete.LIBCPMT ref: 00007FF7E08433F5
default_delete.LIBCPMT ref: 00007FF7E084352E
default_delete.LIBCPMT ref: 00007FF7E0843748

Strings

onecore\windows\core\console\open\src\host\stream.cpp, xrefs: 00007FF7E084341E
onecore\windows\core\console\open\src\server\objecthandle.cpp, xrefs: 00007FF7E0843380

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: default_delete
String ID: onecore\windows\core\console\open\src\host\stream.cpp$onecore\windows\core\console\open\src\server\objecthandle.cpp
API String ID: 3712186324-1446427362
Opcode ID: 7a45ce00970e47c52ad0009c808c3e5fa5b616802f2505975e52181b171fea42
Instruction ID: 516803c9186fe322ccc222ff1c1d2d92d88afdc928239efa3677731fcf2849c0
Opcode Fuzzy Hash: 7a45ce00970e47c52ad0009c808c3e5fa5b616802f2505975e52181b171fea42
Instruction Fuzzy Hash: 0EB1D32260968285EA61AF21D04037AE7A0FFA1F84F958033DE4D67795DF3CF865D722

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E0841384 Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 266COMMON

Download Yara Rule

Strings

invalid array<T, N> subscript, xrefs: 00007FF7E08417A5
Access attempted beyond valid size., xrefs: 00007FF7E08417CC

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID:
String ID: Access attempted beyond valid size.$invalid array<T, N> subscript
API String ID: 0-3498661005
Opcode ID: 3af32187d5bfc8bfc847fc2421240af4388805316c144439daf0c6700f513cf8
Instruction ID: b6041d48b216331322064c2091916c96e0c3dde59eecdb96ba972b4f131a8a9c
Opcode Fuzzy Hash: 3af32187d5bfc8bfc847fc2421240af4388805316c144439daf0c6700f513cf8
Instruction Fuzzy Hash: D1D1A622918AC685EB11DF64E4412FDF770FB95348F805222EB8D17A6AEF7CE695C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E08160D4 Relevance: 9.0, APIs: 7, Instructions: 208memoryCOMMON

Download Yara Rule

APIs

memset.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,00007FF7E0815C34), ref: 00007FF7E0816112

Part of subcall function 00007FF7E0815C88: GetProcAddress.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0(?,?,?,?,?,?,?,00007FF7E0814857), ref: 00007FF7E0815CB3

GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,00007FF7E0815C34), ref: 00007FF7E08161B1
HeapFree.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,00007FF7E0815C34), ref: 00007FF7E08161C5
GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,00007FF7E0815C34), ref: 00007FF7E08161D1
HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,00007FF7E0815C34), ref: 00007FF7E08161E5
GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,00007FF7E0815C34), ref: 00007FF7E0816399
HeapFree.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,00007FF7E0815C34), ref: 00007FF7E08163AD

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: Heap$Process$Free$AddressAllocProcmemset
String ID:
API String ID: 2515388404-0
Opcode ID: 4c27764ffaf48febe6b084884596d5765b9a398c846ade67ae7245ecb8db0036
Instruction ID: 4d5a2f94470deb787967114fb392500fd5f56c3ea9a27c743b6baece5c21ea8a
Opcode Fuzzy Hash: 4c27764ffaf48febe6b084884596d5765b9a398c846ade67ae7245ecb8db0036
Instruction Fuzzy Hash: 45919032A04B528AEB20DF65E4006ADBBB0FB49B48B844536DF8E53B55DF3CE464C721

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E084F670 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 198COMMON

Download Yara Rule

APIs

default_delete.LIBCPMT ref: 00007FF7E084F916
memmove.API-MS-WIN-CRT-PRIVATE-L1-1-0 ref: 00007FF7E084F924
default_delete.LIBCPMT ref: 00007FF7E084F93B

Strings

onecore\windows\core\console\open\src\host\readdataraw.cpp, xrefs: 00007FF7E084F6A9, 00007FF7E084F6D8

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: default_delete$memmove
String ID: onecore\windows\core\console\open\src\host\readdataraw.cpp
API String ID: 1454313208-2856902044
Opcode ID: 3f952c808f3a5d9977e1dfadac96ec167f8a572ac05e3383780fae57e0c1ea80
Instruction ID: 252eb06f458a920dfeec3908cd42f791661959ccc02f6e6336741c1bbdd2a711
Opcode Fuzzy Hash: 3f952c808f3a5d9977e1dfadac96ec167f8a572ac05e3383780fae57e0c1ea80
Instruction Fuzzy Hash: D681D52261C68189EB61EB21D04137EFB90FB55B95F85413ADA8D0779BCF3CE460C712

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E0808C64 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 181COMMON

Download Yara Rule

APIs

OpenSemaphoreW.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FF7E0808D40
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF7E0808D58

Strings

wil, xrefs: 00007FF7E0822C11, 00007FF7E0822C48, 00007FF7E0822D1D
_p0, xrefs: 00007FF7E0808CFA

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: ErrorLastOpenSemaphore
String ID: _p0$wil
API String ID: 1909229842-1814513734
Opcode ID: 2268b22ae84e5958d74ae46bf5b8446627f93ea05c0a2da666ec465def3f7ce9
Instruction ID: 686cadfa891a4a74fa010909d2ce0c66b77893b184e7f192ee5713bdb982a16d
Opcode Fuzzy Hash: 2268b22ae84e5958d74ae46bf5b8446627f93ea05c0a2da666ec465def3f7ce9
Instruction Fuzzy Hash: 1D71D462B19A8295FF65EB2594103B9A2E0FF94B84FC44133DA4E07795DE3CF964C321

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E080503C Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 174COMMON

Download Yara Rule

APIs

_o_terminate.API-MS-WIN-CRT-PRIVATE-L1-1-0(?,?,?,?,00000000,?,001E0078,00007FF7E081BF2D), ref: 00007FF7E08221F2
?_Xlength_error@std@@YAXPEBD@Z.MSVCP_WIN(?,?,?,?,00000000,?,001E0078,00007FF7E081BF2D), ref: 00007FF7E0822206
_o_terminate.API-MS-WIN-CRT-PRIVATE-L1-1-0(?,?,?,?,?,?,?,?,00007FF7E0854A9B,?,?,?,00007FF7E082B657), ref: 00007FF7E0822228

Part of subcall function 00007FF7E080FD8C: _o_malloc.API-MS-WIN-CRT-PRIVATE-L1-1-0(?,?,00000000,00007FF7E080393E,?,?,?,?,00007FF7E082A040,?,?,?,?,?,?,?), ref: 00007FF7E080FDA6

Strings

onecore\windows\core\console\open\src\host\screeninfo.cpp, xrefs: 00007FF7E08221CC
list<T> too long, xrefs: 00007FF7E08221FF

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: _o_terminate$Xlength_error@std@@_o_malloc
String ID: list<T> too long$onecore\windows\core\console\open\src\host\screeninfo.cpp
API String ID: 1587979356-3049636842
Opcode ID: 2a72b04dd71178c7f887f5a12763b0528f33d0916cf241c28ebcbb85c1543813
Instruction ID: 1e7d1aad0fb9123a9ff99d2df33ce944bf24293be1a49bcee136c777e4a3a67c
Opcode Fuzzy Hash: 2a72b04dd71178c7f887f5a12763b0528f33d0916cf241c28ebcbb85c1543813
Instruction Fuzzy Hash: 35716D36908B5281E724EF25E4403BAB7A0FB64B58F954136DA8C17765DF3CF8A1C325

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E085ADD8 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 119COMMON

Download Yara Rule

APIs

?_Xlength_error@std@@YAXPEBD@Z.MSVCP_WIN(?,00000101,?,00007FF7E085AD9B,?,?,?,?,?,?,?,?,00007FF7E085ABF2,?,?,00000001), ref: 00007FF7E085AE0A

Strings

VUUUUUUU, xrefs: 00007FF7E085AE1E
vector<T> too long, xrefs: 00007FF7E085AE03
VUUUUUUU, xrefs: 00007FF7E085B2D1
UUUUUUUU, xrefs: 00007FF7E085ADF4

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: Xlength_error@std@@
String ID: UUUUUUUU$VUUUUUUU$VUUUUUUU$vector<T> too long
API String ID: 1004598685-446613321
Opcode ID: 9717c9da8d60016bd69831e33968d632646f48a00e23cc84574f81e93b032ba8
Instruction ID: 35647bd254e9d80550d31ac05319b53eb67e3c13111f70e451e4cba73574fb62
Opcode Fuzzy Hash: 9717c9da8d60016bd69831e33968d632646f48a00e23cc84574f81e93b032ba8
Instruction Fuzzy Hash: CE41BE62B05A9482DE14CF1AE554269F765FB98FD0B948133DE9D4BB94DE3CE461C300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E07FC6D0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 88COMMON

Download Yara Rule

APIs

default_delete.LIBCPMT ref: 00007FF7E081EAD3
default_delete.LIBCPMT ref: 00007FF7E081EAE2

Strings

onecore\windows\core\console\open\src\host\_stream.cpp, xrefs: 00007FF7E081EAF7, 00007FF7E081EB0E
invalid deque<T> subscript, xrefs: 00007FF7E081EB20

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: default_delete
String ID: invalid deque<T> subscript$onecore\windows\core\console\open\src\host\_stream.cpp
API String ID: 3712186324-3945297005
Opcode ID: 0563db78b98e92c24f906bf9c285beae0941d57e5438626cf47b06e23704ec9c
Instruction ID: cbc58ee7d353f2ec811b88f0dcdae19ed71f63704d30c7bff12257bec9ecf68b
Opcode Fuzzy Hash: 0563db78b98e92c24f906bf9c285beae0941d57e5438626cf47b06e23704ec9c
Instruction Fuzzy Hash: 26316D71A08B5286EA50AB59E4442AAF3A4FF98B80FD44132EA8D53759CF7CF474C721

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E0807244 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 82COMMON

Download Yara Rule

APIs

memset.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7E08072C4
memset.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7E08072EB
_time64.API-MS-WIN-CRT-TIME-L1-1-0 ref: 00007FF7E0807326

Part of subcall function 00007FF7E080D800: EventRegister.API-MS-WIN-EVENTING-PROVIDER-L1-1-0(?,?,?,?,?,?,000001C82450C120,00007FF7E080733E), ref: 00007FF7E080D84C
Part of subcall function 00007FF7E080D800: EventSetInformation.API-MS-WIN-EVENTING-PROVIDER-L1-1-0(?,?,?,?,?,?,000001C82450C120,00007FF7E080733E), ref: 00007FF7E080D871

Part of subcall function 00007FF7E08073CC: EventActivityIdControl.API-MS-WIN-EVENTING-PROVIDER-L1-1-0(?,?,?,?,00007FF7E0807343), ref: 00007FF7E08073E5

Part of subcall function 00007FF7E0809654: EventWriteTransfer.API-MS-WIN-EVENTING-PROVIDER-L1-1-0 ref: 00007FF7E08096D7

Strings

bash.exe, xrefs: 00007FF7E08072A7

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: Event$memset$ActivityControlInformationRegisterTransferWrite_time64
String ID: bash.exe
API String ID: 1899261239-706137074
Opcode ID: 2aca6ba8a165d0e14e754e04ea226aabb8ec41ebf91112347fb57d24d2fb9d09
Instruction ID: 30896e80d0e43eea36d4c0b923e615ae43167bb8ee6526fd722b0e26da00c767
Opcode Fuzzy Hash: 2aca6ba8a165d0e14e754e04ea226aabb8ec41ebf91112347fb57d24d2fb9d09
Instruction Fuzzy Hash: 75411328A1CA4295FA10BB14F8513B9B3A0FF58354FC0523BE58C427A6DF3CB0658B23

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E0828910 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 57libraryloaderCOMMON

Download Yara Rule

APIs

_CxxThrowException.API-MS-WIN-CRT-PRIVATE-L1-1-0 ref: 00007FF7E0828959
GetModuleHandleW.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0 ref: 00007FF7E082898F
GetProcAddress.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0 ref: 00007FF7E08289A5

Strings

RaiseFailFastException, xrefs: 00007FF7E082899E
kernelbase.dll, xrefs: 00007FF7E0828985

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: AddressExceptionHandleModuleProcThrow
String ID: RaiseFailFastException$kernelbase.dll
API String ID: 1273124314-919018592
Opcode ID: 774e1f01f8ff696480aafbb6591747e7c7e73f6ffecc91957a92168d70910420
Instruction ID: 54f51567864b5fefe8a2fa14368263080477c3a4f18b87d8736c2489c11788d0
Opcode Fuzzy Hash: 774e1f01f8ff696480aafbb6591747e7c7e73f6ffecc91957a92168d70910420
Instruction Fuzzy Hash: 0C115421E18B8181EA50AB11F8403B9E760FF9DB80FD49232E98D17B15EF3CE5A4C711

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E0805A30 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 41libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0(?,?,00000000,00007FF7E08059C2,?,?,00000000,00007FF7E07F3895), ref: 00007FF7E0805A8F
GetProcAddress.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0(?,?,00000000,00007FF7E08059C2,?,?,00000000,00007FF7E07F3895), ref: 00007FF7E0805AB2
GetSystemMetrics.USER32 ref: 00007FF7E08224F0

Strings

GetDpiMetrics, xrefs: 00007FF7E0805A88
GetSystemMetricsForDpi, xrefs: 00007FF7E0805AAB

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: AddressProc$MetricsSystem
String ID: GetDpiMetrics$GetSystemMetricsForDpi
API String ID: 1058010697-1926441701
Opcode ID: 870d910ea766203a309d06d1c08e010de39d5cc7c575f33755eef3d616031376
Instruction ID: 1dfa4ad53902b1bbf9152080d822d5439e79d10d517f40f157906c7589545bde
Opcode Fuzzy Hash: 870d910ea766203a309d06d1c08e010de39d5cc7c575f33755eef3d616031376
Instruction Fuzzy Hash: 32112B21F09B5296FB146B14E880339E7A1BB59B44FC89137C90E46761CF3CF864C722

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E07F3C20 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 35libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0 ref: 00007FF7E07F3C4A
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF7E081B570
FreeLibrary.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0 ref: 00007FF7E081B581
SetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF7E081B58F

Strings

uxtheme.dll, xrefs: 00007FF7E07F3C3B

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: ErrorLastLibrary$FreeLoad
String ID: uxtheme.dll
API String ID: 1452865118-291804724
Opcode ID: 5c428ecbb47be5985d29b916de15f634b6a37ca79d304ddba89552af80ba823d
Instruction ID: abef50bb62fa484fd17a00414aa890fb0ee435ce2e741f999ae46252a22e018b
Opcode Fuzzy Hash: 5c428ecbb47be5985d29b916de15f634b6a37ca79d304ddba89552af80ba823d
Instruction Fuzzy Hash: FD010C31A08B81CAE7006F11E440379FA64FB8DB81F989171DA4E07759DF3CE4658710

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E086E0D4 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 34libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryExW.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0(?,?,?,00007FF7E086E1D3), ref: 00007FF7E086E0F9
GetProcAddress.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0(?,?,?,00007FF7E086E1D3), ref: 00007FF7E086E130

Strings

ntdll.dll, xrefs: 00007FF7E086E0F2
onecore\windows\core\console\open\src\server\winntcontrol.cpp, xrefs: 00007FF7E086E10F, 00007FF7E086E146
NtOpenFile, xrefs: 00007FF7E086E126

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: NtOpenFile$ntdll.dll$onecore\windows\core\console\open\src\server\winntcontrol.cpp
API String ID: 2574300362-2293150788
Opcode ID: b1bd1531d35623811a58369ad4a83d88b4027a4ed46e59b38f6004a85d40806c
Instruction ID: d9a690c78d699bdadcc8190559907997e7ab5a826e32ee55d96cb6a2b2de6e1f
Opcode Fuzzy Hash: b1bd1531d35623811a58369ad4a83d88b4027a4ed46e59b38f6004a85d40806c
Instruction Fuzzy Hash: 96012935A18B4686EA10EB45E8807A4B7A0FB88741FD88537C95D13728EF3CF1648761

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E07F9934 Relevance: 7.7, APIs: 1, Strings: 4, Instructions: 189COMMON

Download Yara Rule

Strings

Print, xrefs: 00007FF7E081CFBE
Escape, xrefs: 00007FF7E081CECD
OscTermination, xrefs: 00007FF7E081D05A
Ground, xrefs: 00007FF7E081CF72, 00007FF7E081D0A4

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID:
String ID: Escape$Ground$OscTermination$Print
API String ID: 0-1586554955
Opcode ID: 4cc34e71eff768f83918a14d0fca74ebbe29ed5f1df80cc9af0f2e12c871b7b1
Instruction ID: 1055dc81730370dd16025644984156eeddba37bce80b9885be6addd2c63494b7
Opcode Fuzzy Hash: 4cc34e71eff768f83918a14d0fca74ebbe29ed5f1df80cc9af0f2e12c871b7b1
Instruction Fuzzy Hash: 9E716F2190C61285ED14F71591A537DE356BF8A385FD1413BD68E47B9ACE7CF8318222

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E080A960 Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 128COMMON

Download Yara Rule

APIs

EnterCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FF7E080A97E
LeaveCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FF7E080A9BD

Strings

onecore\windows\core\console\open\src\host\input.cpp, xrefs: 00007FF7E0825259

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: onecore\windows\core\console\open\src\host\input.cpp
API String ID: 3168844106-1659879473
Opcode ID: 903bdddec1fee752dc86eb549503d78c47410d9580e8d545422b19b67da23a25
Instruction ID: 04a06497c5210100f2291fe662b7ffbbb77c23e9b5f1b5b6d24825a43e12acd3
Opcode Fuzzy Hash: 903bdddec1fee752dc86eb549503d78c47410d9580e8d545422b19b67da23a25
Instruction Fuzzy Hash: 1341BF35B0860286E621AB25E554379EBA0FF56B80FD45133DE1D437A5EF3CF825CA22

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E080A2E0 Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 116COMMON

Download Yara Rule

APIs

EnterCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FF7E080A2FB
LeaveCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FF7E080A32E
LeaveCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FF7E0824C97
CloseHandle.API-MS-WIN-CORE-HANDLE-L1-1-0 ref: 00007FF7E0824D32

Strings

onecore\windows\core\console\open\src\host\input.cpp, xrefs: 00007FF7E0824C71

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: CriticalSection$Leave$CloseEnterHandle
String ID: onecore\windows\core\console\open\src\host\input.cpp
API String ID: 409575328-1659879473
Opcode ID: 068db45a7ee2fc14f8ff2381333a4a6c0b2df748c2d12f0909ade1dab273298f
Instruction ID: e30a5b7145aab049ed12ae3f8c0963105ca9747f9ea69dcec54a945c5a3198d2
Opcode Fuzzy Hash: 068db45a7ee2fc14f8ff2381333a4a6c0b2df748c2d12f0909ade1dab273298f
Instruction Fuzzy Hash: F4417E35A0964286E621AB25E400779EBA0FF55B84FD06133DD0D437A5CF3CF825CA32

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E0850278 Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 112COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7E0842F00: memset.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000028,00007FF7E08502AF,?,?,?,?,00000000,?,00000000,00007FF7E08501BC), ref: 00007FF7E0842F2D

memmove.API-MS-WIN-CRT-PRIVATE-L1-1-0(?,?,?,?,00000000,?,00000000,00007FF7E08501BC), ref: 00007FF7E08502BC
memmove.API-MS-WIN-CRT-PRIVATE-L1-1-0(?,?,?,?,00000000,?,00000000,00007FF7E08501BC), ref: 00007FF7E08502CF
MultiByteToWideChar.API-MS-WIN-CORE-STRING-L1-1-0(?,?,?,?,00000000,?,00000000,00007FF7E08501BC), ref: 00007FF7E0850329
MultiByteToWideChar.API-MS-WIN-CORE-STRING-L1-1-0(?,?,?,?,00000000,?,00000000,00007FF7E08501BC), ref: 00007FF7E0850385

Strings

onecore\windows\core\console\open\src\host\utf8towidecharparser.cpp, xrefs: 00007FF7E085039C, 00007FF7E08503F0

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: ByteCharMultiWidememmove$memset
String ID: onecore\windows\core\console\open\src\host\utf8towidecharparser.cpp
API String ID: 2437670355-2572910317
Opcode ID: d424c25434414199a8bc6626623e542bff93f4cf6804d30ee96411a2788f549d
Instruction ID: 83c20bbe1a61a7c20d0f833e2b5e246ca0f8d7ddb822faff15202563c3dcadd8
Opcode Fuzzy Hash: d424c25434414199a8bc6626623e542bff93f4cf6804d30ee96411a2788f549d
Instruction Fuzzy Hash: 9C416D72A0C68287E610EB52E5406AEF7A1FB84B80F848036EA4D57B55DF3CF871CB51

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E0878370 Relevance: 7.6, APIs: 5, Instructions: 71COMMON

Download Yara Rule

APIs

memset.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7E087839B

Part of subcall function 00007FF7E0877A68: NtAlpcSendWaitReceivePort.NTDLL ref: 00007FF7E0877AAA

memmove.API-MS-WIN-CRT-PRIVATE-L1-1-0 ref: 00007FF7E0878405
memset.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7E087840D
_o__errno.API-MS-WIN-CRT-PRIVATE-L1-1-0 ref: 00007FF7E0878413
_o__invalid_parameter_noinfo.API-MS-WIN-CRT-PRIVATE-L1-1-0 ref: 00007FF7E0878426

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: memset$AlpcPortReceiveSendWait_o__errno_o__invalid_parameter_noinfomemmove
String ID:
API String ID: 3940503590-0
Opcode ID: 2b4a2d6b13f83a7f593e17790240c5dafbde43e958407915a9e3ce93dd326837
Instruction ID: a082699b1a796f1970c2870356051ac4ca8aca548233ead9aa69ad646d4a6e35
Opcode Fuzzy Hash: 2b4a2d6b13f83a7f593e17790240c5dafbde43e958407915a9e3ce93dd326837
Instruction Fuzzy Hash: E921E232B4D746C2E620AB65E44436AF3A0FF45B80B885036DB8D83B4ACF7DF4918725

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E0837980 Relevance: 7.5, APIs: 5, Instructions: 48COMMON

Download Yara Rule

APIs

default_delete.LIBCPMT ref: 00007FF7E08379B6
_Mtx_destroy_in_situ.MSVCP_WIN(?,?,?,00007FF7E0838DFD,?,?,?,00007FF7E080F390), ref: 00007FF7E08379C0
CloseHandle.API-MS-WIN-CORE-HANDLE-L1-1-0(?,?,?,00007FF7E0838DFD,?,?,?,00007FF7E080F390), ref: 00007FF7E08379DB
CloseHandle.API-MS-WIN-CORE-HANDLE-L1-1-0(?,?,?,00007FF7E0838DFD,?,?,?,00007FF7E080F390), ref: 00007FF7E08379F6
CloseHandle.API-MS-WIN-CORE-HANDLE-L1-1-0(?,?,?,00007FF7E0838DFD,?,?,?,00007FF7E080F390), ref: 00007FF7E0837A11

Part of subcall function 00007FF7E0837A38: CloseHandle.API-MS-WIN-CORE-HANDLE-L1-1-0(?,?,00000000,00007FF7E0822F39), ref: 00007FF7E0837A63
Part of subcall function 00007FF7E0837A38: CloseHandle.API-MS-WIN-CORE-HANDLE-L1-1-0(?,?,00000000,00007FF7E0822F39), ref: 00007FF7E0837A7D

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: CloseHandle$Mtx_destroy_in_situdefault_delete
String ID:
API String ID: 1176461943-0
Opcode ID: 6e1be804b6b4fa53dda71a057ea5a0f9106ea20e77364808e4c025cf8417f651
Instruction ID: 29a7fbaaea265734c72c83e8d7092696dd056bbf234cd28f10b99ee202072d76
Opcode Fuzzy Hash: 6e1be804b6b4fa53dda71a057ea5a0f9106ea20e77364808e4c025cf8417f651
Instruction Fuzzy Hash: 9011EC21605A4286EA106B65D44077CE7A0FF86B75BD45732CA7D473D4DF3CE468C362

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E08165D4 Relevance: 7.5, APIs: 5, Instructions: 45COMMON

Download Yara Rule

APIs

_o__errno.API-MS-WIN-CRT-PRIVATE-L1-1-0(?,?,?,00007FF7E0827C0D), ref: 00007FF7E08165FA
_o__invalid_parameter_noinfo.API-MS-WIN-CRT-PRIVATE-L1-1-0(?,?,?,00007FF7E0827C0D), ref: 00007FF7E081660D

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: _o__errno_o__invalid_parameter_noinfo
String ID:
API String ID: 2671245207-0
Opcode ID: 24415926d3ee476f0c58ec62fe3a4579c29719075c8639ff521ee5c3ce8230c2
Instruction ID: 404723577e6093cedf70ccb4cf7143f3f2c54c516676897edf318cbe9cb5fdc1
Opcode Fuzzy Hash: 24415926d3ee476f0c58ec62fe3a4579c29719075c8639ff521ee5c3ce8230c2
Instruction Fuzzy Hash: 65018061E0D64382FA503B51A5403B9E7509F69BD4FD48436EE8E1778BCE3CB8714622

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E08893C0 Relevance: 7.5, APIs: 5, Instructions: 44COMMON

Download Yara Rule

APIs

memset.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7E08893F0
VerSetConditionMask.API-MS-WIN-CORE-SYSINFO-L1-2-0 ref: 00007FF7E0889410
VerSetConditionMask.API-MS-WIN-CORE-SYSINFO-L1-2-0 ref: 00007FF7E0889425
VerSetConditionMask.API-MS-WIN-CORE-SYSINFO-L1-2-0 ref: 00007FF7E088943A
VerifyVersionInfoW.API-MS-WIN-CORE-KERNEL32-LEGACY-L1-1-1 ref: 00007FF7E0889462

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: ConditionMask$InfoVerifyVersionmemset
String ID:
API String ID: 375572348-0
Opcode ID: f47bddfb2f8a75bb9cda1a97ffca19ea07f3ac28074e03505e6b1a483f031f92
Instruction ID: 7996331b58114e4b7c5767d79763077455fcc6284f7cad09268f68ec4a54c115
Opcode Fuzzy Hash: f47bddfb2f8a75bb9cda1a97ffca19ea07f3ac28074e03505e6b1a483f031f92
Instruction Fuzzy Hash: AA113D3260868187E720DF21E4513EAF7A1FB8DB05F819225CA4D4B715EF3CE519CB65

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E08656D8 Relevance: 7.5, APIs: 5, Instructions: 41COMMON

Download Yara Rule

APIs

SignalObjectAndWait.API-MS-WIN-CORE-SYNCH-L1-2-0 ref: 00007FF7E0865703
CloseHandle.API-MS-WIN-CORE-HANDLE-L1-1-0 ref: 00007FF7E0865713
CloseHandle.API-MS-WIN-CORE-HANDLE-L1-1-0(?,?,00000001,00007FF7E0841D94,?,?,?,00007FF7E0841D6A), ref: 00007FF7E086572D
CloseHandle.API-MS-WIN-CORE-HANDLE-L1-1-0(?,?,00000001,00007FF7E0841D94,?,?,?,00007FF7E0841D6A), ref: 00007FF7E0865747
CloseHandle.API-MS-WIN-CORE-HANDLE-L1-1-0(?,?,00000001,00007FF7E0841D94,?,?,?,00007FF7E0841D6A), ref: 00007FF7E0865761

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: CloseHandle$ObjectSignalWait
String ID:
API String ID: 1085041809-0
Opcode ID: b7582d90487d11762a75e502340f8b40b2efef550ba094f475c9484f4599503a
Instruction ID: d9009c090d88b70463d38f7111d7ebc53f5420c81b16a5a3e7ba2e7763b88b81
Opcode Fuzzy Hash: b7582d90487d11762a75e502340f8b40b2efef550ba094f475c9484f4599503a
Instruction Fuzzy Hash: F2113A36605B42C6EB059F60E455338B7B0FF8AF49F959632CA5D0A358CF38E469C361

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E083FE18 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 294COMMON

Download Yara Rule

APIs

default_delete.LIBCPMT ref: 00007FF7E083FF5C
default_delete.LIBCPMT ref: 00007FF7E0840125
default_delete.LIBCPMT ref: 00007FF7E0840248

Strings

onecore\windows\core\console\open\src\host\inputbuffer.cpp, xrefs: 00007FF7E083FE74

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: default_delete
String ID: onecore\windows\core\console\open\src\host\inputbuffer.cpp
API String ID: 3712186324-425006629
Opcode ID: 0ee274926705595e3af977bcfb282ae1a1d3d9a48d04c946438012163d37ac10
Instruction ID: 4889811e37adb337da987a57bef5ee6cbccbadfe3d14899b657f0e95cb03937c
Opcode Fuzzy Hash: 0ee274926705595e3af977bcfb282ae1a1d3d9a48d04c946438012163d37ac10
Instruction Fuzzy Hash: D8D15032A09B4585FB10EB61D4502AEB3B5FB84B88F904033EA8D577A9DF3CE925C751

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E0883808 Relevance: 7.3, APIs: 1, Strings: 3, Instructions: 285COMMON

Download Yara Rule

APIs

GetClientRect.USER32 ref: 00007FF7E0883AE9

Strings

W, xrefs: 00007FF7E08839BA
onecore\windows\core\console\open\src\renderer\dx\dxrenderer.cpp, xrefs: 00007FF7E0883978, 00007FF7E0883A2D, 00007FF7E0883AB1, 00007FF7E0883B02, 00007FF7E0883BE6
, xrefs: 00007FF7E08839D6

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: ClientRect
String ID: $W$onecore\windows\core\console\open\src\renderer\dx\dxrenderer.cpp
API String ID: 846599473-1401837405
Opcode ID: 9b15fd788ad6baeaee8bf4d232ace6384cda657d030338d1cbd337fd37c0ceb7
Instruction ID: e850bf720b29d3ac500f2a95a3601a9f3d4dc48ab4ff0ccaa0fbece028a55125
Opcode Fuzzy Hash: 9b15fd788ad6baeaee8bf4d232ace6384cda657d030338d1cbd337fd37c0ceb7
Instruction Fuzzy Hash: 99C1C132608B8286E760EF25E4407AAB7A4FB89780FD15136DA8D57B55DF3CE054CB21

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E0845E08 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 246COMMON

Download Yara Rule

APIs

_o_terminate.API-MS-WIN-CRT-PRIVATE-L1-1-0 ref: 00007FF7E08461D7
_o_terminate.API-MS-WIN-CRT-PRIVATE-L1-1-0 ref: 00007FF7E08461E4

Strings

onecore\windows\core\console\open\src\buffer\out\outputcellrect.cpp, xrefs: 00007FF7E0845EEB
onecore\windows\core\console\open\src\host\screeninfo.cpp, xrefs: 00007FF7E0845E77

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: _o_terminate
String ID: onecore\windows\core\console\open\src\buffer\out\outputcellrect.cpp$onecore\windows\core\console\open\src\host\screeninfo.cpp
API String ID: 882196631-1126056439
Opcode ID: 279b55d1be5724a1524f555df0d655f4f23f42a9b558cd391aad1a2978c89c25
Instruction ID: bcf8bdb78a023d05d3a26ce0eb1fc81e12b3a572043bc64de4d4e53f19fa2a2c
Opcode Fuzzy Hash: 279b55d1be5724a1524f555df0d655f4f23f42a9b558cd391aad1a2978c89c25
Instruction Fuzzy Hash: 07B19F22A08BC189EB10EF25E8403EDB7B0FB95754F905132EA8D47B5AEF38E565C711

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E0832730 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 240COMMON

Download Yara Rule

APIs

EnterCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FF7E083277F
_o_terminate.API-MS-WIN-CRT-PRIVATE-L1-1-0 ref: 00007FF7E0832AFA

Part of subcall function 00007FF7E0802BCC: LeaveCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,00000001,?,00000000,00007FF7E0875ED6,?,?,?,?,00000000,00007FF7E0824487), ref: 00007FF7E0802BFC

Strings

onecore\windows\core\console\open\src\host\alias.cpp, xrefs: 00007FF7E0832830, 00007FF7E08328A7, 00007FF7E0832990, 00007FF7E0832A24

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: CriticalSection$EnterLeave_o_terminate
String ID: onecore\windows\core\console\open\src\host\alias.cpp
API String ID: 1404396024-1127424212
Opcode ID: f62e0f3bf0319b34bd3184a3e4d40a0347be2cc2d5b9b66fd73008aaf06889ab
Instruction ID: 86fe86570d62db4c33a5ad54769a292b9b7edbfa0b376b6429d87b5223c22c1a
Opcode Fuzzy Hash: f62e0f3bf0319b34bd3184a3e4d40a0347be2cc2d5b9b66fd73008aaf06889ab
Instruction Fuzzy Hash: DCB1863260DAC286EA20BB24E4503AAE360FBD9744F909533EA8D53B59DF3CF554CB11

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E0836100 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 233COMMON

Download Yara Rule

APIs

EnterCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FF7E083614F
_o_terminate.API-MS-WIN-CRT-PRIVATE-L1-1-0 ref: 00007FF7E0836423

Part of subcall function 00007FF7E0802BCC: LeaveCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,00000001,?,00000000,00007FF7E0875ED6,?,?,?,?,00000000,00007FF7E0824487), ref: 00007FF7E0802BFC

Strings

onecore\windows\core\console\open\src\host\history.cpp, xrefs: 00007FF7E08361DD, 00007FF7E08362D0, 00007FF7E083635F, 00007FF7E0836440

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: CriticalSection$EnterLeave_o_terminate
String ID: onecore\windows\core\console\open\src\host\history.cpp
API String ID: 1404396024-3034099481
Opcode ID: 40df7c4616b1eedb3490bcb172abd129cad79aa6ad56f816d74ff3b8dd8774af
Instruction ID: 24c4b12de5cda63a9bba779a5a4b172aa5c8a41f5c05d2030d454b1413c57da0
Opcode Fuzzy Hash: 40df7c4616b1eedb3490bcb172abd129cad79aa6ad56f816d74ff3b8dd8774af
Instruction Fuzzy Hash: 4BA1A922A1DA8282EA50BB24E4503BAE360FFD9744F909533EA8D53B59DF7CF464C711

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E0831C50 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 195COMMON

Download Yara Rule

APIs

EnterCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FF7E0831C9B
_o_terminate.API-MS-WIN-CRT-PRIVATE-L1-1-0 ref: 00007FF7E0831F12

Part of subcall function 00007FF7E0802BCC: LeaveCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,00000001,?,00000000,00007FF7E0875ED6,?,?,?,?,00000000,00007FF7E0824487), ref: 00007FF7E0802BFC

Strings

onecore\windows\core\console\open\src\host\alias.cpp, xrefs: 00007FF7E0831CE9, 00007FF7E0831D47, 00007FF7E0831DE3, 00007FF7E0831E67

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: CriticalSection$EnterLeave_o_terminate
String ID: onecore\windows\core\console\open\src\host\alias.cpp
API String ID: 1404396024-1127424212
Opcode ID: c1bcddcb767d151dc5a7a09ee8f79d14cce3493aa5340d7b17eaeef69a30902a
Instruction ID: cf2f367c5c37d10a0ed5729f51e6572e5311c0781fac049bf174799987eacdc9
Opcode Fuzzy Hash: c1bcddcb767d151dc5a7a09ee8f79d14cce3493aa5340d7b17eaeef69a30902a
Instruction Fuzzy Hash: 8F818E21A0DA8282EA50BB25E4503BAE3A0FFD9B54F805533EA8D53756DF7CF460C721

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E07F9490 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 171COMMON

Download Yara Rule

APIs

InvertRect.USER32 ref: 00007FF7E07F9507
InvertRect.USER32 ref: 00007FF7E07F9523
ScrollWindowEx.USER32 ref: 00007FF7E07F9601

Strings

onecore\windows\core\console\open\src\renderer\gdi\paint.cpp, xrefs: 00007FF7E081CBFE, 00007FF7E081CC1E, 00007FF7E081CC39, 00007FF7E081CC5A, 00007FF7E081CCA2

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: InvertRect$ScrollWindow
String ID: onecore\windows\core\console\open\src\renderer\gdi\paint.cpp
API String ID: 2048803274-3409953778
Opcode ID: d0b8c9b47d5f615f309a6a7c09df019e1ce5aa864076f98dd404c2d1a3f6cf98
Instruction ID: 16c6cfb193d53402969bf4d68fbb2d11c150c337342a3e33ae81e19b50e0486a
Opcode Fuzzy Hash: d0b8c9b47d5f615f309a6a7c09df019e1ce5aa864076f98dd404c2d1a3f6cf98
Instruction Fuzzy Hash: A471B232B08B828AEB10DF25D4406BDA761FB48B98F949236DE0D97B54DF38F4A1C751

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E0807AF8 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 169COMMON

Download Yara Rule

APIs

CreateSemaphoreExW.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FF7E0807BF9
CreateSemaphoreExW.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FF7E0807CBE

Strings

wil, xrefs: 00007FF7E08228A2, 00007FF7E08228CD
_p0, xrefs: 00007FF7E0807B96

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: CreateSemaphore
String ID: _p0$wil
API String ID: 1078844751-1814513734
Opcode ID: 5363f88a2a4c080c93fda53401a3d290b8b620af0846554e3479f07cc01c28c2
Instruction ID: 29c64086c62700c956da4a2f7168bb098a74626a5558aced3ddd95c6daf42eb8
Opcode Fuzzy Hash: 5363f88a2a4c080c93fda53401a3d290b8b620af0846554e3479f07cc01c28c2
Instruction Fuzzy Hash: 1151D262F1964686FE25AF2494543BAE3D0BF84B94FD44536DA8D07784EF3CF4258321

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E086AB64 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 136COMMON

Download Yara Rule

APIs

memset.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,00000000,00007FF7E086B1BF,?,?,00000000,?,00000000,00007FF7E08210DF), ref: 00007FF7E086ABF5

Strings

list<T> too long, xrefs: 00007FF7E086AD7E
onecore\windows\core\console\open\src\server\waitblock.cpp, xrefs: 00007FF7E086AB97, 00007FF7E086ABC1, 00007FF7E086AC0F

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: memset
String ID: list<T> too long$onecore\windows\core\console\open\src\server\waitblock.cpp
API String ID: 2221118986-3756024062
Opcode ID: 641b59db7f65a3ab08e139c3f2af9518f3cb42f67ecdc0b6212fba24bd7b8df0
Instruction ID: 25b5ba8895dcb3cb88dcfa6c72ec0bf1fd79f96b3a1f0a376c552f4b38d017bd
Opcode Fuzzy Hash: 641b59db7f65a3ab08e139c3f2af9518f3cb42f67ecdc0b6212fba24bd7b8df0
Instruction Fuzzy Hash: 24613E32914F8486E310DF25E9403A8B7A4F7A9788F56D226DB8C17B56DF78E2E4C350

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E087C91C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 105COMMON

Download Yara Rule

APIs

?_Xlength_error@std@@YAXPEBD@Z.MSVCP_WIN ref: 00007FF7E087C992
memmove.API-MS-WIN-CRT-PRIVATE-L1-1-0 ref: 00007FF7E087CA3F
memmove.API-MS-WIN-CRT-PRIVATE-L1-1-0 ref: 00007FF7E087CA56

Strings

vector<T> too long, xrefs: 00007FF7E087C98B

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: memmove$Xlength_error@std@@
String ID: vector<T> too long
API String ID: 1743304318-3788999226
Opcode ID: 6aff1f75edffbdf4b80d613d3d6867ab484c2079979520281b4ed76577727b7f
Instruction ID: deeb9b97286b29a668a32aaba2ed5aa01f3613a97f5b9a2cdfda5f3d1d38c58d
Opcode Fuzzy Hash: 6aff1f75edffbdf4b80d613d3d6867ab484c2079979520281b4ed76577727b7f
Instruction Fuzzy Hash: EF31F262B14A8982CE10DFAAE9044A9E760F758BD0B849227DF9C47395EF7CF191C300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E085AF6C Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 99COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7E0804E6C: memmove.API-MS-WIN-CRT-PRIVATE-L1-1-0 ref: 00007FF7E0804F4D

?_Xout_of_range@std@@YAXPEBD@Z.MSVCP_WIN ref: 00007FF7E085B0A3

Strings

VUUUUUUU, xrefs: 00007FF7E085AFB8
VUUUUUUU, xrefs: 00007FF7E085B086
invalid vector<T> subscript, xrefs: 00007FF7E085B09C

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: Xout_of_range@std@@memmove
String ID: VUUUUUUU$VUUUUUUU$invalid vector<T> subscript
API String ID: 1894236298-1373641553
Opcode ID: d7f7870fa350f9f146b3f48668fcc591c04c79c586d27b06217e8ad9d5010fb2
Instruction ID: 2f5c297add9c9acf8bb1154c634fd407581c63792d7f904d8d3b3f25beb6177b
Opcode Fuzzy Hash: d7f7870fa350f9f146b3f48668fcc591c04c79c586d27b06217e8ad9d5010fb2
Instruction Fuzzy Hash: 3B31E162B04A4986DA14EF16E5043AAA760F794FD4F984036DE5E0B760EE38F596C340

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E080ACBC Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 93COMMON

Download Yara Rule

APIs

memmove.API-MS-WIN-CRT-PRIVATE-L1-1-0 ref: 00007FF7E080AD7C
?_Xlength_error@std@@YAXPEBD@Z.MSVCP_WIN ref: 00007FF7E08258D7
memmove.API-MS-WIN-CRT-PRIVATE-L1-1-0 ref: 00007FF7E08258F2

Strings

vector<T> too long, xrefs: 00007FF7E08258D0

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: memmove$Xlength_error@std@@
String ID: vector<T> too long
API String ID: 1743304318-3788999226
Opcode ID: 208dce97dfcf3630004ad17c013da983815f5fdfdf5fffa99dea6ce1f33f18a4
Instruction ID: a0f4978d83edda2508e54fbf26efcdea772e520b8f8a5850a91c8c5f67149c23
Opcode Fuzzy Hash: 208dce97dfcf3630004ad17c013da983815f5fdfdf5fffa99dea6ce1f33f18a4
Instruction Fuzzy Hash: 8331A162B05A8581EA10DB65E900179B7A1FB45FF8B509336DE7D07BD8DE3CE091C301

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E0813A14 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 85synchronizationCOMMON

Download Yara Rule

APIs

GetCurrentProcessId.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF7E0813A49
CreateMutexExW.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FF7E0813A91

Strings

Local\SM0:%d:%d:%hs, xrefs: 00007FF7E0813A65
wil, xrefs: 00007FF7E0813B5E

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: CreateCurrentMutexProcess
String ID: Local\SM0:%d:%d:%hs$wil
API String ID: 3937467467-2303653343
Opcode ID: 1ac1e5daa802867f0d297b9617db5162381fd7c97ecd129e47ec86362a9d0668
Instruction ID: 00c9d7dcb0355d211d41addab961dfe6ccc51209c2acc0ac39ae7a971ce7637b
Opcode Fuzzy Hash: 1ac1e5daa802867f0d297b9617db5162381fd7c97ecd129e47ec86362a9d0668
Instruction Fuzzy Hash: 7241523261CA4186E710EB21E4407AAB3A0FF98784FC05132EA8E87B55DF7CE555C751

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E086EB7C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 83COMMON

Download Yara Rule

APIs

?_Xlength_error@std@@YAXPEBD@Z.MSVCP_WIN ref: 00007FF7E086EBC7
memmove.API-MS-WIN-CRT-PRIVATE-L1-1-0 ref: 00007FF7E086EC4A
memmove.API-MS-WIN-CRT-PRIVATE-L1-1-0 ref: 00007FF7E086EC61

Strings

vector<T> too long, xrefs: 00007FF7E086EBC0

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: memmove$Xlength_error@std@@
String ID: vector<T> too long
API String ID: 1743304318-3788999226
Opcode ID: ca11bb53e2e9e4cb5b149b0ae1a4b14ffd52ab9b5dcab0b90a5aa20ccf5a1832
Instruction ID: bf545e6db3c0993ef95ad687242893419e7dddc501b2d61378226aba43c9c900
Opcode Fuzzy Hash: ca11bb53e2e9e4cb5b149b0ae1a4b14ffd52ab9b5dcab0b90a5aa20ccf5a1832
Instruction Fuzzy Hash: CC31AC72718AC981CE04EFA6E8445AAA760F749FE4B948636DF6D17BD4CF38E061C305

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E0880328 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 80COMMON

Download Yara Rule

APIs

?_Xlength_error@std@@YAXPEBD@Z.MSVCP_WIN(?,00000000,?,00007FF7E08805BA), ref: 00007FF7E088036B
memmove.API-MS-WIN-CRT-PRIVATE-L1-1-0(?,00000000,?,00007FF7E08805BA), ref: 00007FF7E08803DA
memmove.API-MS-WIN-CRT-PRIVATE-L1-1-0(?,00000000,?,00007FF7E08805BA), ref: 00007FF7E08803EE

Strings

vector<T> too long, xrefs: 00007FF7E0880364

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: memmove$Xlength_error@std@@
String ID: vector<T> too long
API String ID: 1743304318-3788999226
Opcode ID: 5fe292c950ec2564095dffa19dec810ce4ba81e6c88e980435e5ae4fa8fbf61f
Instruction ID: 5ce9a038455ecb0f18d4d14449b5cc8be13444fa878f67d57e331ee3329e27a5
Opcode Fuzzy Hash: 5fe292c950ec2564095dffa19dec810ce4ba81e6c88e980435e5ae4fa8fbf61f
Instruction Fuzzy Hash: D521D123608BC582DB50EFA6E44407DA7A0FB45FD8BA48136DE6D17B99CE3CE052C311

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E0865ED0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 77COMMON

Download Yara Rule

APIs

_scwprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF7E0865F03
memset.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,00007FF7E0868719,?,?,?,00007FF7E0865C28), ref: 00007FF7E0865F39
_vsnwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF7E0865F86

Strings

onecore\windows\core\console\open\src\renderer\vt\state.cpp, xrefs: 00007FF7E0865F4C

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: _scwprintf_vsnwprintf_smemset
String ID: onecore\windows\core\console\open\src\renderer\vt\state.cpp
API String ID: 2187233866-1242362329
Opcode ID: 0534295f1e4cf70684d08c6f7ccdf6c10796c4a4be4332d8fbb1a7434c93f6ef
Instruction ID: e31bf73747f27d10c437d020a4301d86458d63ddc967007d34edaef903124455
Opcode Fuzzy Hash: 0534295f1e4cf70684d08c6f7ccdf6c10796c4a4be4332d8fbb1a7434c93f6ef
Instruction Fuzzy Hash: F1210432B09B4281FA00FB56B844AB9A351AF84BD0F954137EE4D07B91DF3CF4618711

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E08896AC Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 76COMMON

Download Yara Rule

APIs

DeleteObject.GDI32 ref: 00007FF7E088970F
DeleteObject.GDI32 ref: 00007FF7E0889746
DeleteObject.GDI32 ref: 00007FF7E088977D

Strings

onecore\windows\core\console\open\src\renderer\gdi\state.cpp, xrefs: 00007FF7E08896FE

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: DeleteObject
String ID: onecore\windows\core\console\open\src\renderer\gdi\state.cpp
API String ID: 1531683806-181080528
Opcode ID: 465b39cd52213b139b9236a39b353cfa7278afff628603bdb8fbb05a0891b044
Instruction ID: 7353d90a151fe73cdc734a872a53581ebdd2eb3a7012a4f48a4eb2e6451042f9
Opcode Fuzzy Hash: 465b39cd52213b139b9236a39b353cfa7278afff628603bdb8fbb05a0891b044
Instruction Fuzzy Hash: A931A732619A4686EB10AF51D0503B8A760FF94F98F884232DE4D8B795CF38F065C732

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E0828D5C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 72COMMON

Download Yara Rule

APIs

?_Xlength_error@std@@YAXPEBD@Z.MSVCP_WIN ref: 00007FF7E0828DA7
memmove.API-MS-WIN-CRT-PRIVATE-L1-1-0 ref: 00007FF7E0828E09
memmove.API-MS-WIN-CRT-PRIVATE-L1-1-0 ref: 00007FF7E0828E20

Strings

vector<T> too long, xrefs: 00007FF7E0828DA0

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: memmove$Xlength_error@std@@
String ID: vector<T> too long
API String ID: 1743304318-3788999226
Opcode ID: ac66d28fb5dcdb0df4219b9a9e30411432e5cf186c9a4bd56d8d444e0de5a3cf
Instruction ID: 4bafe69226ae210c435e1862a19136ffe940e487b4d2364dee6997d29490f185
Opcode Fuzzy Hash: ac66d28fb5dcdb0df4219b9a9e30411432e5cf186c9a4bd56d8d444e0de5a3cf
Instruction Fuzzy Hash: C621B222718AC581DE00DB66F8445A9E7A0F759FE8B848233EE6D177D9CF38E155C301

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E087FB2C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 72COMMON

Download Yara Rule

APIs

?_Xlength_error@std@@YAXPEBD@Z.MSVCP_WIN(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00007FF7E087D3FF), ref: 00007FF7E087FB73
memmove.API-MS-WIN-CRT-PRIVATE-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00007FF7E087D3FF), ref: 00007FF7E087FBDB
memmove.API-MS-WIN-CRT-PRIVATE-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00007FF7E087D3FF), ref: 00007FF7E087FBF1

Strings

vector<T> too long, xrefs: 00007FF7E087FB6C

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: memmove$Xlength_error@std@@
String ID: vector<T> too long
API String ID: 1743304318-3788999226
Opcode ID: d79f096436f27c39aa00e89a8b41da4bd81b8806b061882445443b32d41d2f50
Instruction ID: 578213906093f16d6701d499dd114e5b13bdd0c6ed5b040602588bab2d2403bb
Opcode Fuzzy Hash: d79f096436f27c39aa00e89a8b41da4bd81b8806b061882445443b32d41d2f50
Instruction Fuzzy Hash: A721B262614A8581DA00EB66E8441A9A790FB49BF8B948732EE7C177D6DF38E1A1C301

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E08857A4 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 66COMMON

Download Yara Rule

APIs

?_Xlength_error@std@@YAXPEBD@Z.MSVCP_WIN(?,?,?,?,?,?,?,00007FF7E088639F), ref: 00007FF7E08857D8
memset.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,00007FF7E088639F), ref: 00007FF7E0885852
memmove.API-MS-WIN-CRT-PRIVATE-L1-1-0(?,?,?,?,?,?,?,00007FF7E088639F), ref: 00007FF7E0885864

Strings

vector<T> too long, xrefs: 00007FF7E08857D1

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: Xlength_error@std@@memmovememset
String ID: vector<T> too long
API String ID: 1954582803-3788999226
Opcode ID: 34522a61d8399e3af1692f69cfd38b6ec49ccd941b4f5f339f295468e39a4d6a
Instruction ID: 9f1395019885079e13093a7703cb080f966da358407f0bae89530fdba84cabb7
Opcode Fuzzy Hash: 34522a61d8399e3af1692f69cfd38b6ec49ccd941b4f5f339f295468e39a4d6a
Instruction Fuzzy Hash: BC21CF62B18A8481DA10EB66A9000BAE760FB45FE0B948337DABD57BD4CF7CE0618350

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E088568C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

?_Xlength_error@std@@YAXPEBD@Z.MSVCP_WIN(?,?,?,?,?,?,?,00007FF7E088639F), ref: 00007FF7E08856C0
memset.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,00007FF7E088639F), ref: 00007FF7E0885738
memmove.API-MS-WIN-CRT-PRIVATE-L1-1-0(?,?,?,?,?,?,?,00007FF7E088639F), ref: 00007FF7E088574A

Strings

vector<T> too long, xrefs: 00007FF7E08856B9

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: Xlength_error@std@@memmovememset
String ID: vector<T> too long
API String ID: 1954582803-3788999226
Opcode ID: 817e659930ab263358c2f5a3c52ded7d0961b5ca94fa83cb9ec03ef62c2921b1
Instruction ID: ff23785511be53cae3894b644f10a876504f9bbd2f8537dead457f4420fd1bea
Opcode Fuzzy Hash: 817e659930ab263358c2f5a3c52ded7d0961b5ca94fa83cb9ec03ef62c2921b1
Instruction Fuzzy Hash: C5219262705A8481DA20DB56A9100AAE761F745FE0B948737DBBD57BD4DE7CE0518301

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E08858BC Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

?_Xlength_error@std@@YAXPEBD@Z.MSVCP_WIN(?,?,?,00007FF7E08870BD,?,?,?,?,?,?,?,00000000,?,00007FF7E0886371), ref: 00007FF7E08858F0
memset.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF7E08870BD,?,?,?,?,?,?,?,00000000,?,00007FF7E0886371), ref: 00007FF7E088594C
memmove.API-MS-WIN-CRT-PRIVATE-L1-1-0(?,?,?,00007FF7E08870BD,?,?,?,?,?,?,?,00000000,?,00007FF7E0886371), ref: 00007FF7E088595E

Strings

vector<T> too long, xrefs: 00007FF7E08858E9

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: Xlength_error@std@@memmovememset
String ID: vector<T> too long
API String ID: 1954582803-3788999226
Opcode ID: a21047738fcf2c33d8fd9ecf82878716fff406830476c2378074e14deaa61d1d
Instruction ID: 6b8f7364e3b9d98a916831d2fe8bc54b0f2c0a3e9785ffd5b5ae681c0ae99dab
Opcode Fuzzy Hash: a21047738fcf2c33d8fd9ecf82878716fff406830476c2378074e14deaa61d1d
Instruction Fuzzy Hash: 0D21AE32619A8481EB00EF65E50016DB7A5FB88FE47908237DA6C17B98DF3CE0628311

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E08859CC Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

?_Xlength_error@std@@YAXPEBD@Z.MSVCP_WIN ref: 00007FF7E0885A00
memset.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7E0885A74
memmove.API-MS-WIN-CRT-PRIVATE-L1-1-0 ref: 00007FF7E0885A86

Strings

vector<T> too long, xrefs: 00007FF7E08859F9

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: Xlength_error@std@@memmovememset
String ID: vector<T> too long
API String ID: 1954582803-3788999226
Opcode ID: 2c8d6599c73a1154bd10e1b7d57d41d53130b6c38565220439def9d1e7870d25
Instruction ID: d6031a25052091759e4aa2f3ddeca6d5e1bf3da3e3687b55abbde39dfa055637
Opcode Fuzzy Hash: 2c8d6599c73a1154bd10e1b7d57d41d53130b6c38565220439def9d1e7870d25
Instruction Fuzzy Hash: B521C262709A8081DA14DB6AE9400B9E760FB45FE4B944737DBAD17BC4DE7CE1618310

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E0801BBC Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 54COMMON

Download Yara Rule

APIs

_o_terminate.API-MS-WIN-CRT-PRIVATE-L1-1-0(?,?,?,?,?,?,?,?,00007FF7E08578DD,?,?,?,00007FF7E081FCFE), ref: 00007FF7E0820B6A
_o_terminate.API-MS-WIN-CRT-PRIVATE-L1-1-0(?,?,?,?,?,?,?,?,00007FF7E081F836), ref: 00007FF7E0820B8C

Strings

onecore\windows\core\console\open\src\types\viewport.cpp, xrefs: 00007FF7E0820B9F, 00007FF7E0820BBC, 00007FF7E0820BD9, 00007FF7E0820BF6
onecore\windows\core\console\open\src\renderer\base\renderer.cpp, xrefs: 00007FF7E0820C13

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: _o_terminate
String ID: onecore\windows\core\console\open\src\renderer\base\renderer.cpp$onecore\windows\core\console\open\src\types\viewport.cpp
API String ID: 882196631-4274426706
Opcode ID: 6ff11addec043debe3cfcdaa0282ebe8a6e3421852f5dcbd5dfcad4d8e6325e1
Instruction ID: 6cf73d136d4ccac2d93a0c46579833b9e1269b2e83559b9cb88eb4fde94ea60c
Opcode Fuzzy Hash: 6ff11addec043debe3cfcdaa0282ebe8a6e3421852f5dcbd5dfcad4d8e6325e1
Instruction Fuzzy Hash: 7721A731E08B4BC2E720BB54A4442A99724FBA8758FE44233D64C17F65DE3CF6A58321

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E0806B8C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 52libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0 ref: 00007FF7E0806C00
AdjustWindowRectEx.USER32 ref: 00007FF7E08226F5

Strings

AdjustWindowRectExForDpi, xrefs: 00007FF7E0806BF9

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: AddressAdjustProcRectWindow
String ID: AdjustWindowRectExForDpi
API String ID: 1468628330-2659676865
Opcode ID: dfe8ed26ccaeb82f883efdb104d4e9128cb7bd261fe8d8bcc86d55da8266976e
Instruction ID: 8cd6096e43c796538c81baff49b507f1fd4f0672d6c9c3df525f02bed1103f6d
Opcode Fuzzy Hash: dfe8ed26ccaeb82f883efdb104d4e9128cb7bd261fe8d8bcc86d55da8266976e
Instruction Fuzzy Hash: 54214F35A0DA5296E710AB15A800739FBA0FB9AB84FD44032D94D47B64CF3CF461DB21

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E07F5CAC Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 50COMMON

Download Yara Rule

APIs

_o_wcscpy_s.API-MS-WIN-CRT-PRIVATE-L1-1-0(?,?,?,?,?,00007FF7E07F4BFA), ref: 00007FF7E07F5CF5
_o_terminate.API-MS-WIN-CRT-PRIVATE-L1-1-0(?,?,?,?,?,00007FF7E07F4BFA), ref: 00007FF7E081C08A

Strings

onecore\windows\core\console\open\src\renderer\base\renderer.cpp, xrefs: 00007FF7E081C0A0
__DefaultTTFont__, xrefs: 00007FF7E07F5CD6

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: _o_terminate_o_wcscpy_s
String ID: __DefaultTTFont__$onecore\windows\core\console\open\src\renderer\base\renderer.cpp
API String ID: 1762320008-1480924436
Opcode ID: e7f67eefd72b822ae0c845b46a20c0f35f4c76835fc42122b955d5a5104ef11e
Instruction ID: aaf99f0cc309c831d00aa0586f15270b048af30a09061c56d5b874fbd96f990e
Opcode Fuzzy Hash: e7f67eefd72b822ae0c845b46a20c0f35f4c76835fc42122b955d5a5104ef11e
Instruction Fuzzy Hash: F0211972508741DAE7009F24E004399BBA0FB48B4CF94453ADB880B76ADBB9E169CB61

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E0802114 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 43COMMON

Download Yara Rule

APIs

?_Xout_of_range@std@@YAXPEBD@Z.MSVCP_WIN(?,?,?,?,00007FF7E080246C), ref: 00007FF7E081AF53
DestroyCursor.USER32 ref: 00007FF7E081AF77

Strings

onecore\windows\core\console\open\src\interactivity\win32\icon.cpp, xrefs: 00007FF7E081AF65
invalid deque<T> subscript, xrefs: 00007FF7E081AF4C

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: CursorDestroyXout_of_range@std@@
String ID: invalid deque<T> subscript$onecore\windows\core\console\open\src\interactivity\win32\icon.cpp
API String ID: 4209192844-1509472713
Opcode ID: 4d4b065a0e086f9a4aa2fe284d66a17472bf7719c4109242def29a7cbf9b1dcd
Instruction ID: e46f1d32de0e1c6258cf0720c3af961093d8b1e5061e871e80d7d9a00c819e7b
Opcode Fuzzy Hash: 4d4b065a0e086f9a4aa2fe284d66a17472bf7719c4109242def29a7cbf9b1dcd
Instruction Fuzzy Hash: 78110A72A06A46C5EF19AB59D4603B8B7A0FF98B88F944537CA1D53350CF3CE4658312

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E0817C8C Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 38threadCOMMON

Download Yara Rule

APIs

CreateThread.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0(?,?,?,?,?,?,?,?,?,?,00007FF7E080110C), ref: 00007FF7E0817CB1
SetThreadDescription.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-3(?,?,?,?,?,?,?,?,?,?,00007FF7E080110C), ref: 00007FF7E0817CF2

Strings

Host Signal Handler Thread, xrefs: 00007FF7E0817CEB
onecore\windows\core\console\open\src\interactivity\base\hostsignalinputthread.cpp, xrefs: 00007FF7E0817CD5, 00007FF7E0817D07

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: Thread$CreateDescription
String ID: Host Signal Handler Thread$onecore\windows\core\console\open\src\interactivity\base\hostsignalinputthread.cpp
API String ID: 1572939561-3636843087
Opcode ID: 05a15f5b649f8f41e1f7fb400bdca53d171c26ca487898e89c49452f5584f64b
Instruction ID: 7e642c881fa7091716bc016c1500093fa2cf02f7af6089c8f0106ffd8504e882
Opcode Fuzzy Hash: 05a15f5b649f8f41e1f7fb400bdca53d171c26ca487898e89c49452f5584f64b
Instruction Fuzzy Hash: D5019266A18A0386FB00AB10E4107B5A7A1BF98B94FD48433C94E87754CF3CF165C722

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E08733FC Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 37COMMON

Download Yara Rule

APIs

GetWindowRect.USER32 ref: 00007FF7E087342F
MonitorFromWindow.USER32 ref: 00007FF7E087344E
GetMonitorInfoW.USER32 ref: 00007FF7E087346A

Strings

(, xrefs: 00007FF7E087345F

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: MonitorWindow$FromInfoRect
String ID: (
API String ID: 1973172141-3887548279
Opcode ID: f0b1d1e8fd30342a5bba7561a028de92a06d02729235c11ab45030191d2f521b
Instruction ID: e1e2303aa6ad98924ec25b8d5d09e51638d91723673a5cca9deaa1aa622de1f7
Opcode Fuzzy Hash: f0b1d1e8fd30342a5bba7561a028de92a06d02729235c11ab45030191d2f521b
Instruction Fuzzy Hash: D9018662D1978586FB549B20E04427AE760FBE9B48F446226DE8D06315DF3CE0D5CB12

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E087F460 Relevance: 6.4, APIs: 5, Instructions: 163COMMON

Download Yara Rule

APIs

memmove.API-MS-WIN-CRT-PRIVATE-L1-1-0 ref: 00007FF7E087F56C
memmove.API-MS-WIN-CRT-PRIVATE-L1-1-0 ref: 00007FF7E087F583
memmove.API-MS-WIN-CRT-PRIVATE-L1-1-0 ref: 00007FF7E087F5FE
memmove.API-MS-WIN-CRT-PRIVATE-L1-1-0 ref: 00007FF7E087F633
memmove.API-MS-WIN-CRT-PRIVATE-L1-1-0 ref: 00007FF7E087F653

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: memmove
String ID:
API String ID: 2162964266-0
Opcode ID: 26b66c48060921c89e964ad289f2ccbd4ac3545894f75dcc05ede4bd70e339e7
Instruction ID: cdf918ed1c7607232400c1f65f121d0383793ed321383c0ce7849ea94197da7f
Opcode Fuzzy Hash: 26b66c48060921c89e964ad289f2ccbd4ac3545894f75dcc05ede4bd70e339e7
Instruction Fuzzy Hash: 1951F662B096C282DE20DE66E4052BAE790FB44BD4F588133CF9E57BA9DF3CE4518311

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E0834DF0 Relevance: 6.1, APIs: 4, Instructions: 136COMMON

Download Yara Rule

APIs

_o_towupper.API-MS-WIN-CRT-PRIVATE-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,00000000,00000001,?,?,00007FF7E0834B9D), ref: 00007FF7E0834ED0
_o_towupper.API-MS-WIN-CRT-PRIVATE-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,00000000,00000001,?,?,00007FF7E0834B9D), ref: 00007FF7E0834EEE
_o_towupper.API-MS-WIN-CRT-PRIVATE-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,00000000,00000001,?,?,00007FF7E0834B9D), ref: 00007FF7E0834F0C
_o_towupper.API-MS-WIN-CRT-PRIVATE-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,00000000,00000001,?,?,00007FF7E0834B9D), ref: 00007FF7E0834F2A

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: _o_towupper
String ID:
API String ID: 3866689482-0
Opcode ID: 0a2e8564e7a4e36e1d46d29561d14008382f1a4eb2758f1f6a4e2d4450d74877
Instruction ID: d085a64f7ececa88fbf50c89fd8a0bd529910216829b7e479a19d78711d10758
Opcode Fuzzy Hash: 0a2e8564e7a4e36e1d46d29561d14008382f1a4eb2758f1f6a4e2d4450d74877
Instruction Fuzzy Hash: 9F519222E18A6685FB10AB15D8403BDA371FB94B48F84A132DF4D17795EF3CB5A4C361

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E07FB830 Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 127COMMON

Download Yara Rule

APIs

EnterCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FF7E07FB850

Strings

onecore\windows\core\console\open\src\host\getset.cpp, xrefs: 00007FF7E081E341
Ground, xrefs: 00007FF7E07FB957

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: CriticalEnterSection
String ID: Ground$onecore\windows\core\console\open\src\host\getset.cpp
API String ID: 1904992153-3105179758
Opcode ID: 88212eb62bd6bf02725f51b06932c0a3e15bfbf10a9b265304e64d5665572eb1
Instruction ID: 7501389e81226dffc1e7fa6658f86a747ed29e22748923b341cfd5603e25537d
Opcode Fuzzy Hash: 88212eb62bd6bf02725f51b06932c0a3e15bfbf10a9b265304e64d5665572eb1
Instruction Fuzzy Hash: 1F51AE65E0C64299FF64BB21A440379ABA4AF59794FD45133CA0E073A5CE3CF8709732

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E0802BCC Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 106COMMON

Download Yara Rule

APIs

LeaveCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,00000001,?,00000000,00007FF7E0875ED6,?,?,?,?,00000000,00007FF7E0824487), ref: 00007FF7E0802BFC
LeaveCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,00000001,?,00000000,00007FF7E0875ED6,?,?,?,?,00000000,00007FF7E0824487), ref: 00007FF7E08212C1
CloseHandle.API-MS-WIN-CORE-HANDLE-L1-1-0(?,?,00000001,?,00000000,00007FF7E0875ED6,?,?,?,?,00000000,00007FF7E0824487), ref: 00007FF7E0821353

Strings

onecore\windows\core\console\open\src\host\input.cpp, xrefs: 00007FF7E08212A1

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: CriticalLeaveSection$CloseHandle
String ID: onecore\windows\core\console\open\src\host\input.cpp
API String ID: 3647471834-1659879473
Opcode ID: e2dc0b69ee529b19067d720e71539113908e6aac7d6b0ac7bb4699bd937bd2f1
Instruction ID: a8029066e9ab52550a2af7d63d9e792457487a01ac1e4f623faf42f2a4ffc10f
Opcode Fuzzy Hash: e2dc0b69ee529b19067d720e71539113908e6aac7d6b0ac7bb4699bd937bd2f1
Instruction Fuzzy Hash: 61419E35A0864286FA20EF25E45437AE7A1FF65B94FD04132DA4D43BA5CE3CF4258722

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E0889D1C Relevance: 6.1, APIs: 4, Instructions: 105COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7E088A910: HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0 ref: 00007FF7E088A970

_o_calloc.API-MS-WIN-CRT-PRIVATE-L1-1-0(?,?,?,00007FF7E0877509), ref: 00007FF7E0889D8B
_o_calloc.API-MS-WIN-CRT-PRIVATE-L1-1-0(?,?,?,00007FF7E0877509), ref: 00007FF7E0889DB9
_o_calloc.API-MS-WIN-CRT-PRIVATE-L1-1-0(?,?,?,00007FF7E0877509), ref: 00007FF7E0889DED
_o_calloc.API-MS-WIN-CRT-PRIVATE-L1-1-0(?,?,?,00007FF7E0877509), ref: 00007FF7E0889E0E

Part of subcall function 00007FF7E088AC1C: HeapFree.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,00000000,00007FF7E088ABE4), ref: 00007FF7E088AC96
Part of subcall function 00007FF7E088AC1C: HeapFree.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,00000000,00007FF7E088ABE4), ref: 00007FF7E088ACB4

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: _o_calloc$Heap$Free$Alloc
String ID:
API String ID: 2629698466-0
Opcode ID: d31677bb11ee4fb32328e293b12ca9f0600390006ff5caf3a6d6ac6654ab59a4
Instruction ID: 5442f1c39580ee737d09cbf85b377d2192cd72104c6150d2dd302e64df4f86ed
Opcode Fuzzy Hash: d31677bb11ee4fb32328e293b12ca9f0600390006ff5caf3a6d6ac6654ab59a4
Instruction Fuzzy Hash: 8F41D132608B42C6EB14EF11E440279BBA0FB49F94B989132DF5E5B790CF79E861C365

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E07FBA40 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 104COMMON

Download Yara Rule

APIs

LeaveCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,?,?,00000000,00007FF7E07FA612), ref: 00007FF7E07FBA67
LeaveCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,?,?,00000000,00007FF7E07FA612), ref: 00007FF7E081E45F
CloseHandle.API-MS-WIN-CORE-HANDLE-L1-1-0(?,?,?,?,00000000,00007FF7E07FA612), ref: 00007FF7E081E4F1

Strings

onecore\windows\core\console\open\src\host\input.cpp, xrefs: 00007FF7E081E43F

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: CriticalLeaveSection$CloseHandle
String ID: onecore\windows\core\console\open\src\host\input.cpp
API String ID: 3647471834-1659879473
Opcode ID: 8d7cc261953b2286dd5d48e0e15b69c74ec6ccd383cf60fd6b7a9eb00a9e947b
Instruction ID: 9839c1d299ba28edb728222345e1c4a7531d60d09d270e32e00ccf226a9aa1e2
Opcode Fuzzy Hash: 8d7cc261953b2286dd5d48e0e15b69c74ec6ccd383cf60fd6b7a9eb00a9e947b
Instruction Fuzzy Hash: 1641A135B08A0286F620AF15E444379EB90FF99B94FC04232DE4D537A9CE3CF4618726

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E083B270 Relevance: 6.1, APIs: 4, Instructions: 85COMMON

Download Yara Rule

APIs

EnterCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FF7E083B294
default_delete.LIBCPMT ref: 00007FF7E083B2FD
default_delete.LIBCPMT ref: 00007FF7E083B335
default_delete.LIBCPMT ref: 00007FF7E083B35E

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: default_delete$CriticalEnterSection
String ID:
API String ID: 739439809-0
Opcode ID: 0e3a6a151d95a38910e8470d6ed94dbc7687136a5009f3ca37cca61ef23b2ca2
Instruction ID: 0add3de96749c9a540f3071f9d609a242a64e45b6f176f7d209c97223d4a3f80
Opcode Fuzzy Hash: 0e3a6a151d95a38910e8470d6ed94dbc7687136a5009f3ca37cca61ef23b2ca2
Instruction Fuzzy Hash: B8317862A0D68183FA21AB25E0413ABE3A0FB95784F945132EB8D57746DF3CE515C721

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E0850534 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 72COMMON

Download Yara Rule

APIs

MultiByteToWideChar.API-MS-WIN-CORE-STRING-L1-1-0(?,?,00000000,00000000,00000000,00007FF7E08501F1), ref: 00007FF7E085056A
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,00000000,00000000,00000000,00007FF7E08501F1), ref: 00007FF7E085057D
MultiByteToWideChar.API-MS-WIN-CORE-STRING-L1-1-0(?,?,00000000,00000000,00000000,00007FF7E08501F1), ref: 00007FF7E08505E6

Strings

onecore\windows\core\console\open\src\host\utf8towidecharparser.cpp, xrefs: 00007FF7E08505FD

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: ByteCharMultiWide$ErrorLast
String ID: onecore\windows\core\console\open\src\host\utf8towidecharparser.cpp
API String ID: 1717984340-2572910317
Opcode ID: a82dfdec6448dfee8d531615711da9c0ee22efb983a5d8cfe60f02e57e4a11e5
Instruction ID: 4fe5482c84f5f04a89da26293b5bce387dbd033774f6eb235434103194a6808a
Opcode Fuzzy Hash: a82dfdec6448dfee8d531615711da9c0ee22efb983a5d8cfe60f02e57e4a11e5
Instruction Fuzzy Hash: 1D218F72A08B418AE710AF52E80026DFBA0FBD8BD4F844536EE4D53B65DF78E461CB51

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E08068A0 Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

SetRectEmpty.USER32 ref: 00007FF7E08068C6

Part of subcall function 00007FF7E08069CC: SetRectEmpty.USER32 ref: 00007FF7E0806A06
Part of subcall function 00007FF7E08069CC: EqualRect.USER32 ref: 00007FF7E0806A29
Part of subcall function 00007FF7E08069CC: MonitorFromWindow.USER32 ref: 00007FF7E0806A56
Part of subcall function 00007FF7E08069CC: GetMonitorInfoW.USER32 ref: 00007FF7E0806A8D
Part of subcall function 00007FF7E08069CC: GetWindowInfo.USER32 ref: 00007FF7E0806AD4

GetWindowLongW.USER32 ref: 00007FF7E080690A
GetWindowLongW.USER32 ref: 00007FF7E0806930
SetRectEmpty.USER32 ref: 00007FF7E0806943

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: RectWindow$Empty$InfoLongMonitor$EqualFrom
String ID:
API String ID: 3368657190-0
Opcode ID: 49dc82c313256515491611460b89d7f42fef9167657f20c27d9934b79553b972
Instruction ID: 28fce7c527846167cc6983084f3042efe7dd643ab54a5f2c844b40b6594af346
Opcode Fuzzy Hash: 49dc82c313256515491611460b89d7f42fef9167657f20c27d9934b79553b972
Instruction Fuzzy Hash: EC31B572618B8287EB00AF25E440279FBA0FB89BD0B854133DA4D47B54DF3CE424CB51

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E0889BCC Relevance: 6.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

_o_free.API-MS-WIN-CRT-PRIVATE-L1-1-0(?,?,?,00007FF7E0889E5B,?,?,?,00007FF7E0877509), ref: 00007FF7E0889C07
_o_free.API-MS-WIN-CRT-PRIVATE-L1-1-0(?,?,?,00007FF7E0889E5B,?,?,?,00007FF7E0877509), ref: 00007FF7E0889C26
_o_free.API-MS-WIN-CRT-PRIVATE-L1-1-0(?,?,?,00007FF7E0889E5B,?,?,?,00007FF7E0877509), ref: 00007FF7E0889C3A
_o_free.API-MS-WIN-CRT-PRIVATE-L1-1-0(?,?,?,00007FF7E0889E5B,?,?,?,00007FF7E0877509), ref: 00007FF7E0889C54

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: _o_free
String ID:
API String ID: 1736097121-0
Opcode ID: 18cc9f161fd3a264945d9532672339430a972a18d4bc4c0ee4c85333e345ad70
Instruction ID: 1e72b9220a9b4642d210d2220fb75fa7ec9cf3d5c1e40fe837f91eeab66371b6
Opcode Fuzzy Hash: 18cc9f161fd3a264945d9532672339430a972a18d4bc4c0ee4c85333e345ad70
Instruction Fuzzy Hash: E221ED32A04A41C2EB549F16D454338ABA1FB89F65FD84336DE6E473D4DF39E861C221

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E08596E0 Relevance: 6.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ.MSVCP_WIN ref: 00007FF7E08596F9
?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ.MSVCP_WIN ref: 00007FF7E0859710
?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z.MSVCP_WIN ref: 00007FF7E085973A
?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ.MSVCP_WIN ref: 00007FF7E085974E

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: D@std@@@std@@U?$char_traits@$?gptr@?$basic_streambuf@$?eback@?$basic_streambuf@?gbump@?$basic_streambuf@
String ID:
API String ID: 3536508186-0
Opcode ID: 1f1763359bcdafe3711c9531051113ce51257a2baef9e42efb58e1c297cabd03
Instruction ID: eac2d74ba334c2f2884cf1a396df8e77ef07d1eafc2fe98fbcb5a0ba4ea68b2c
Opcode Fuzzy Hash: 1f1763359bcdafe3711c9531051113ce51257a2baef9e42efb58e1c297cabd03
Instruction Fuzzy Hash: B9115421A18A8186E7506F25A444278FA90EB4EB60FD85232EAAD067D5CF3CF456C721

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E0881CE0 Relevance: 6.0, APIs: 4, Instructions: 44COMMON

Download Yara Rule

APIs

_o_floor.API-MS-WIN-CRT-PRIVATE-L1-1-0(?), ref: 00007FF7E0881D05

Part of subcall function 00007FF7E0881250: _o_terminate.API-MS-WIN-CRT-PRIVATE-L1-1-0 ref: 00007FF7E088127F

_o_floor.API-MS-WIN-CRT-PRIVATE-L1-1-0(?,?), ref: 00007FF7E0881D28
_o_floor.API-MS-WIN-CRT-PRIVATE-L1-1-0(?,?,?), ref: 00007FF7E0881D4A
_o_floor.API-MS-WIN-CRT-PRIVATE-L1-1-0(?,?,?,?), ref: 00007FF7E0881D6D

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: _o_floor$_o_terminate
String ID:
API String ID: 1703617362-0
Opcode ID: 1ccd3c46f1c52993795332463777db3da059fc595898edab22ace026a9d9976f
Instruction ID: ec5394cfa71eea716266d96a44aafaf9539f4e1d3575e3c3e24aac4802caac76
Opcode Fuzzy Hash: 1ccd3c46f1c52993795332463777db3da059fc595898edab22ace026a9d9976f
Instruction Fuzzy Hash: DD0130225681C1CED300BFB5814179CF364EF08798F548232EA089B657FB34B4A18726

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E0815614 Relevance: 6.0, APIs: 4, Instructions: 39COMMON

Download Yara Rule

APIs

EnterCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,?,00007FF7E08156D8,?,?,?,?,?,?,?,?,00007FF7E080F431), ref: 00007FF7E0815635
AcquireSRWLockExclusive.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,?,00007FF7E08156D8,?,?,?,?,?,?,?,?,00007FF7E080F431), ref: 00007FF7E0815644
ReleaseSRWLockExclusive.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,?,00007FF7E08156D8,?,?,?,?,?,?,?,?,00007FF7E080F431), ref: 00007FF7E081567B
LeaveCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,?,00007FF7E08156D8,?,?,?,?,?,?,?,?,00007FF7E080F431), ref: 00007FF7E081568F

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: CriticalExclusiveLockSection$AcquireEnterLeaveRelease
String ID:
API String ID: 1115728412-0
Opcode ID: 957058e025f2f2586605fe32f381293dd56a3aba5a0829e49609dac9d3677142
Instruction ID: adeafac3db17a42f7fc274ff08b2506b2437fd1bbd3b7ad61e9b7585bde0a7bd
Opcode Fuzzy Hash: 957058e025f2f2586605fe32f381293dd56a3aba5a0829e49609dac9d3677142
Instruction Fuzzy Hash: C7018062B18B82C2EA149B11E144238F760FF9EF80BD89132DE4E17714DF3CE4908711

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E0837C60 Relevance: 6.0, APIs: 4, Instructions: 39COMMON

Download Yara Rule

APIs

_Mtx_lock.MSVCP_WIN ref: 00007FF7E0837C79
?_Throw_C_error@std@@YAXH@Z.MSVCP_WIN ref: 00007FF7E0837C8B
_Mtx_unlock.MSVCP_WIN ref: 00007FF7E0837CCB
?_Throw_C_error@std@@YAXH@Z.MSVCP_WIN ref: 00007FF7E0837CDD

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: C_error@std@@Throw_$Mtx_lockMtx_unlock
String ID:
API String ID: 973703179-0
Opcode ID: 3aa3c202e5b15ed1bcbfd8a6d68aa4a793de144a32905b4c78550d23903fa68b
Instruction ID: 83b47c43e2ac2f69c04d3ab3a6a4d33dafdb3dca48154c21d8ffd3ea35562d60
Opcode Fuzzy Hash: 3aa3c202e5b15ed1bcbfd8a6d68aa4a793de144a32905b4c78550d23903fa68b
Instruction Fuzzy Hash: 01010421A04B4286EB04AB21E454379EBA0FF8AB51FD99131CA0E47351DF3CF469C721

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E08565EC Relevance: 6.0, APIs: 4, Instructions: 37COMMON

Download Yara Rule

APIs

?uncaught_exception@std@@YA_NXZ.MSVCP_WIN ref: 00007FF7E08565F5
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ.MSVCP_WIN ref: 00007FF7E0856609
?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ.MSVCP_WIN ref: 00007FF7E0856623
?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ.MSVCP_WIN ref: 00007FF7E0856642

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: U?$char_traits@$D@std@@@std@@$?rdbuf@?$basic_ios@D@std@@@2@V?$basic_streambuf@$?uncaught_exception@std@@Osfx@?$basic_ostream@
String ID:
API String ID: 1787288787-0
Opcode ID: 180668e569c939012f3c587a25f02c8ad867e106bc42a0a8f8c691e6055a2711
Instruction ID: 13bfabe263d39e124c876ba2785418950ebe675e48a518ccfbdbf4cc0aa9c089
Opcode Fuzzy Hash: 180668e569c939012f3c587a25f02c8ad867e106bc42a0a8f8c691e6055a2711
Instruction Fuzzy Hash: 5801E866604E46C6DB14AB15E494338ABA0FB8EF82795E032CA0E57325CF3CE469C321

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E0837BC0 Relevance: 6.0, APIs: 4, Instructions: 36COMMON

Download Yara Rule

APIs

_Mtx_lock.MSVCP_WIN ref: 00007FF7E0837BD9
?_Throw_C_error@std@@YAXH@Z.MSVCP_WIN ref: 00007FF7E0837BEB
_Mtx_unlock.MSVCP_WIN ref: 00007FF7E0837C1D
?_Throw_C_error@std@@YAXH@Z.MSVCP_WIN ref: 00007FF7E0837C2F

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: C_error@std@@Throw_$Mtx_lockMtx_unlock
String ID:
API String ID: 973703179-0
Opcode ID: fee24b636b6697896b46d8abe2d47511341287c58640f8bfdccf4ac25e940e1c
Instruction ID: 5418141985ae0e2b605a0ff6c485ba94eaaf3ea16162ef8c9bbe4fdcfd69d977
Opcode Fuzzy Hash: fee24b636b6697896b46d8abe2d47511341287c58640f8bfdccf4ac25e940e1c
Instruction Fuzzy Hash: 41014F21604B4287EB546B21E80437DF6A0FF8AB81FC8A131CA5E47341DF3CE4658721

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E0816670 Relevance: 6.0, APIs: 4, Instructions: 29COMMON

Download Yara Rule

APIs

_o__errno.API-MS-WIN-CRT-PRIVATE-L1-1-0(?,?,?,00007FF7E0814DA9,?,?,?,?,?,?,?,?,?), ref: 00007FF7E0816683
_o__invalid_parameter_noinfo.API-MS-WIN-CRT-PRIVATE-L1-1-0(?,?,?,00007FF7E0814DA9,?,?,?,?,?,?,?,?,?), ref: 00007FF7E0816696
_o__errno.API-MS-WIN-CRT-PRIVATE-L1-1-0(?,?,?,00007FF7E0814DA9,?,?,?,?,?,?,?,?,?), ref: 00007FF7E08166A9
memmove.API-MS-WIN-CRT-PRIVATE-L1-1-0(?,?,?,00007FF7E0814DA9,?,?,?,?,?,?,?,?,?), ref: 00007FF7E08166C2

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: _o__errno$_o__invalid_parameter_noinfomemmove
String ID:
API String ID: 2571840558-0
Opcode ID: 90be3c5a7eea0bda27790c06953b07fc783528dd1b565281ab5077c640e10c11
Instruction ID: 2e8d2b67e24bca0a4ff145fb3a71d67b92b79493bd98311e91522ad0597b6145
Opcode Fuzzy Hash: 90be3c5a7eea0bda27790c06953b07fc783528dd1b565281ab5077c640e10c11
Instruction Fuzzy Hash: F9F0F890E0974786EE547BA09844779E7909F29741FD45436CD4E0A387EE3C78748632

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E07F82F0 Relevance: 6.0, APIs: 4, Instructions: 22COMMON

Download Yara Rule

APIs

_o_terminate.API-MS-WIN-CRT-PRIVATE-L1-1-0(?,?,?,?,00007FF7E07F6E2E), ref: 00007FF7E081C420
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,?,?,00007FF7E07F6E2E), ref: 00007FF7E081C42E
DeleteObject.GDI32 ref: 00007FF7E081C43F
SetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,?,?,00007FF7E07F6E2E), ref: 00007FF7E081C44D

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: ErrorLast$DeleteObject_o_terminate
String ID:
API String ID: 3671834921-0
Opcode ID: cc03395ad6cdc716912128db9ec960ab1e2288e1260e27081bfd36774ca31ae6
Instruction ID: b741c2b66f2d6807c66c0e8d79330dfc9a39d875dad412a697915bf95d6c5611
Opcode Fuzzy Hash: cc03395ad6cdc716912128db9ec960ab1e2288e1260e27081bfd36774ca31ae6
Instruction Fuzzy Hash: 44F01C31A08A42CBEA042B10E84417CEB60FB8EB46BD49572C60E02350DF3CA069C711

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E086CB40 Relevance: 5.7, APIs: 2, Strings: 1, Instructions: 477COMMON

Download Yara Rule

Strings

onecore\windows\core\console\open\src\server\apidispatchers.cpp, xrefs: 00007FF7E086CB6F, 00007FF7E086CDDA, 00007FF7E086CE61, 00007FF7E086CF51, 00007FF7E086D0E7, 00007FF7E086D11F

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID:
String ID: onecore\windows\core\console\open\src\server\apidispatchers.cpp
API String ID: 0-3284698556
Opcode ID: f936ae79458f4efd643d5045bf2301a738dd9824c82ffba61fa4e19652970904
Instruction ID: 8c38e8fd814a55b57dff41c9229c19494a7b408b95b391a1b2fc346caeacaf3b
Opcode Fuzzy Hash: f936ae79458f4efd643d5045bf2301a738dd9824c82ffba61fa4e19652970904
Instruction Fuzzy Hash: 4512A076B08B428AEB10AF65D4403BCA7A1FB44B88F918133DA4D57799DF38F561C362

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E0888B20 Relevance: 5.6, APIs: 2, Strings: 1, Instructions: 394COMMON

Download Yara Rule

APIs

_o_terminate.API-MS-WIN-CRT-PRIVATE-L1-1-0 ref: 00007FF7E0888BA6

Strings

onecore\windows\core\console\open\src\renderer\dx\customtextrenderer.cpp, xrefs: 00007FF7E0888D24, 00007FF7E0888D68, 00007FF7E0888E24, 00007FF7E088907F, 00007FF7E0889104

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: _o_terminate
String ID: onecore\windows\core\console\open\src\renderer\dx\customtextrenderer.cpp
API String ID: 882196631-1094745302
Opcode ID: 2fcc11a7708290774bf028d5b5345432a8981e027a312f193b5946a3989279ea
Instruction ID: 258e531e02a0173e5a0a02e6a43b5098625db6a7c5f18003ddc005c1ceb07b79
Opcode Fuzzy Hash: 2fcc11a7708290774bf028d5b5345432a8981e027a312f193b5946a3989279ea
Instruction Fuzzy Hash: 67028F32B08F8686EB10AB65E4402ADB371FB88B88F944132DE4D57B65DF38F465C761

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E07F8538 Relevance: 5.6, APIs: 2, Strings: 1, Instructions: 327COMMON

Download Yara Rule

APIs

CommandLineToArgvW.API-MS-WIN-SHCORE-OBSOLETE-L1-1-0 ref: 00007FF7E07F85B6
LocalFree.API-MS-WIN-CORE-HEAP-L2-1-0 ref: 00007FF7E07F876A

Strings

onecore\windows\core\console\open\src\host\consolearguments.cpp, xrefs: 00007FF7E081C48A, 00007FF7E081C6FE

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: ArgvCommandFreeLineLocal
String ID: onecore\windows\core\console\open\src\host\consolearguments.cpp
API String ID: 1203019955-3802082478
Opcode ID: b6c8c666e2973443bf57e9abeed9bdc3f3bf3aed5afe4f0a8b458ee53f472e20
Instruction ID: 1bbc4ac44109c9530875f16a225f2dbb589d36375a85d96f1df3fadaab170d71
Opcode Fuzzy Hash: b6c8c666e2973443bf57e9abeed9bdc3f3bf3aed5afe4f0a8b458ee53f472e20
Instruction Fuzzy Hash: E4E12E62B08A429AEF10EB64D4413EDA361BF58388FD05033DA4D57B9ADF38F525C761

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E0831690 Relevance: 5.6, APIs: 2, Strings: 1, Instructions: 303COMMON

Download Yara Rule

APIs

EnterCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FF7E08316E8

Part of subcall function 00007FF7E0802BCC: LeaveCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,00000001,?,00000000,00007FF7E0875ED6,?,?,?,?,00000000,00007FF7E0824487), ref: 00007FF7E0802BFC

Strings

onecore\windows\core\console\open\src\host\alias.cpp, xrefs: 00007FF7E08317F5, 00007FF7E0831878, 00007FF7E08318DB, 00007FF7E0831A12, 00007FF7E0831AD9

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: onecore\windows\core\console\open\src\host\alias.cpp
API String ID: 3168844106-1127424212
Opcode ID: 93fa2d0f02c8afa8a8e320999b1e07d58fbca9ddc8031b81249c9e9669d0bcfe
Instruction ID: d298665de9ea1d8505027cf6954f4e782e0e9dba370c33c55ca0f44db96cacda
Opcode Fuzzy Hash: 93fa2d0f02c8afa8a8e320999b1e07d58fbca9ddc8031b81249c9e9669d0bcfe
Instruction Fuzzy Hash: 47D1922260DBC685EA70AB24E4513EAE360FBD9744F905132EACD53B5AEF3CE454CB11

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E08693A0 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 269COMMON

Download Yara Rule

Strings

invalid string position, xrefs: 00007FF7E08695CF
onecore\windows\core\console\open\src\renderer\vt\paint.cpp, xrefs: 00007FF7E0869409, 00007FF7E0869588, 00007FF7E08695B8, 00007FF7E0869680, 00007FF7E086974D

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID:
String ID: invalid string position$onecore\windows\core\console\open\src\renderer\vt\paint.cpp
API String ID: 0-2687595187
Opcode ID: 2575b854b49949d4729eb44cedd83268c9b8cde82555cef9037fc09b0d9d97ba
Instruction ID: b38531a800eaaabe7d5df7c8c35c65dcef2df83c47f4d110538ee21b5e07b66e
Opcode Fuzzy Hash: 2575b854b49949d4729eb44cedd83268c9b8cde82555cef9037fc09b0d9d97ba
Instruction Fuzzy Hash: 39B1D716A1C68292EA10AB35E4003FAE364FB98754F805033DA8D93795EF3CF565C722

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E086BC30 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 234COMMON

Download Yara Rule

Strings

onecore\windows\core\console\open\src\server\apidispatchers.cpp, xrefs: 00007FF7E086BC79, 00007FF7E086BD55, 00007FF7E086BE90, 00007FF7E086BF05

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID:
String ID: onecore\windows\core\console\open\src\server\apidispatchers.cpp
API String ID: 0-3284698556
Opcode ID: 31d2f3a65c3d7ba4057113b286be5a72a497d8e963d82bc4fcf91a435ddb88ac
Instruction ID: 2379192770da7dc5096bede4fe5e0cfce6fe0716e0534b857448aee95b89bd64
Opcode Fuzzy Hash: 31d2f3a65c3d7ba4057113b286be5a72a497d8e963d82bc4fcf91a435ddb88ac
Instruction Fuzzy Hash: DEA18F76B04B468AEB10AB64D8003FC67A1FB4478CF958532DE4D57799EE38E5A18322

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E086BFA0 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 219COMMON

Download Yara Rule

Strings

onecore\windows\core\console\open\src\server\apidispatchers.cpp, xrefs: 00007FF7E086BFCA, 00007FF7E086C0A6, 00007FF7E086C1C1, 00007FF7E086C236

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID:
String ID: onecore\windows\core\console\open\src\server\apidispatchers.cpp
API String ID: 0-3284698556
Opcode ID: 062e961c0b42a767a611c8cc304bc9b84865ae6aae65f7d6cf4344e917694254
Instruction ID: 97f4006d32cedf9c7a13f9fd0fb34dde093d8fe427106911b1664bbc2e79daa7
Opcode Fuzzy Hash: 062e961c0b42a767a611c8cc304bc9b84865ae6aae65f7d6cf4344e917694254
Instruction Fuzzy Hash: 5E917176B04B468AEB109B74D8002FC67A1FB88788F958533DE4C57B59DF38E561C362

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E084F1D0 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 213COMMON

Download Yara Rule

APIs

default_delete.LIBCPMT ref: 00007FF7E084F30B
default_delete.LIBCPMT ref: 00007FF7E084F48E

Strings

onecore\windows\core\console\open\src\host\readdatadirect.cpp, xrefs: 00007FF7E084F20F, 00007FF7E084F239, 00007FF7E084F268, 00007FF7E084F4B1

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: default_delete
String ID: onecore\windows\core\console\open\src\host\readdatadirect.cpp
API String ID: 3712186324-866399598
Opcode ID: 40702a7dcd8f9ccd59058cd8804d37997dd7d1a160abb02b76e421b39be6ed91
Instruction ID: fcf9cb7013ae36abaeb43c281b50246156db8fb4f3b58346c4c6810cedf5a994
Opcode Fuzzy Hash: 40702a7dcd8f9ccd59058cd8804d37997dd7d1a160abb02b76e421b39be6ed91
Instruction Fuzzy Hash: FB916E32508B4185EA20EB15E4513AEE7A4FB95784F904037DB8D53BA6DF3DF861C722

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E083C05C Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 212COMMON

Download Yara Rule

Strings

onecore\windows\core\console\open\src\host\directio.cpp, xrefs: 00007FF7E083C105, 00007FF7E083C136, 00007FF7E083C165

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID:
String ID: onecore\windows\core\console\open\src\host\directio.cpp
API String ID: 0-2458865805
Opcode ID: 2357d1e325e7c0a0598c659240a6da3134c6c514f8dc77dc2075df18d5451190
Instruction ID: 1007f35ee49ccbd1d68acc0d622b40d3bccef6d68d16803694949be66ef94137
Opcode Fuzzy Hash: 2357d1e325e7c0a0598c659240a6da3134c6c514f8dc77dc2075df18d5451190
Instruction Fuzzy Hash: 6A91603261C69281E620EB11E0406BEF3A1FBC9794F806136EA8D53B59EF3CE655CB15

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E0801E60 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 186COMMON

Download Yara Rule

Strings

onecore\windows\core\console\open\src\interactivity\win32\window.cpp, xrefs: 00007FF7E0820CB4
invalid deque<T> subscript, xrefs: 00007FF7E0820C82

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID:
String ID: invalid deque<T> subscript$onecore\windows\core\console\open\src\interactivity\win32\window.cpp
API String ID: 0-908316100
Opcode ID: caa376d4d77fc618ee5f01900fb632285f5dab8b25634dac13ab5ba65aafd90f
Instruction ID: d2786cfc560f5a0377cf89e8f7c8de84179a32c23126742d3bb3f7291f45a03c
Opcode Fuzzy Hash: caa376d4d77fc618ee5f01900fb632285f5dab8b25634dac13ab5ba65aafd90f
Instruction Fuzzy Hash: B8817266A19A8285EB08FFA5C4502BDB3A1FF54B58F804437EA0D47B95EF78F464C321

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E0800CE0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 181COMMON

Download Yara Rule

APIs

?_Xlength_error@std@@YAXPEBD@Z.MSVCP_WIN(00000000,?,?,00000000,?,00007FF7E08652F1), ref: 00007FF7E081FE6F
_o__invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-PRIVATE-L1-1-0(00000000,?,?,00000000,?,00007FF7E08652F1), ref: 00007FF7E081FEC8

Part of subcall function 00007FF7E080FD8C: _o_malloc.API-MS-WIN-CRT-PRIVATE-L1-1-0(?,?,00000000,00007FF7E080393E,?,?,?,?,00007FF7E082A040,?,?,?,?,?,?,?), ref: 00007FF7E080FDA6

Strings

vector<T> too long, xrefs: 00007FF7E081FE68

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: Xlength_error@std@@_o__invalid_parameter_noinfo_noreturn_o_malloc
String ID: vector<T> too long
API String ID: 3132977491-3788999226
Opcode ID: 80c951497960cd4891ecb04f2f00baf0ae1ea29444e937f70285b7a0770113fb
Instruction ID: 8cfd9b4b7f828452eef4e9360da61b9804abf26c811f7ba477bb40665e9df640
Opcode Fuzzy Hash: 80c951497960cd4891ecb04f2f00baf0ae1ea29444e937f70285b7a0770113fb
Instruction Fuzzy Hash: 5161C272A04B4982DE14DB19E500279A3E1FB58BD8F908632DE5D1B7A6EF7CF4A1C310

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E0809F90 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 175COMMON

Download Yara Rule

APIs

GetClientRect.USER32 ref: 00007FF7E080A0AA

Strings

onecore\windows\core\console\open\src\renderer\gdi\math.cpp, xrefs: 00007FF7E0824ADE
onecore\windows\core\console\open\src\renderer\gdi\invalidate.cpp, xrefs: 00007FF7E0824A39, 00007FF7E0824A57, 00007FF7E0824A70, 00007FF7E0824AF7

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: ClientRect
String ID: onecore\windows\core\console\open\src\renderer\gdi\invalidate.cpp$onecore\windows\core\console\open\src\renderer\gdi\math.cpp
API String ID: 846599473-1022252393
Opcode ID: e47de121780c7d0f040a452692a9558b6e13f861b61fe627d7871cc0012473d0
Instruction ID: e37399b1e9ec29b8fcb5e937f750d8a9b98cb8501bd767f9d07f5b8cc6af5d74
Opcode Fuzzy Hash: e47de121780c7d0f040a452692a9558b6e13f861b61fe627d7871cc0012473d0
Instruction Fuzzy Hash: E9818732A08681CAE710EF24D0806ADB7A5FB44B48FD45136EA0E87795DB3CF961C722

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E07FCB60 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 167COMMON

Download Yara Rule

APIs

?_Xlength_error@std@@YAXPEBD@Z.MSVCP_WIN(?,?,00000000,00007FF7E07FCF29,?,?,00000000,00000000,?,?,001E0078,00000000,?,001E007823290078,00007FF7E07F59D3), ref: 00007FF7E081EB7B

Strings

vector<T> too long, xrefs: 00007FF7E081EB74

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: Xlength_error@std@@
String ID: vector<T> too long
API String ID: 1004598685-3788999226
Opcode ID: 951de1a6d9ea06dcb7db006de0b07bf7a060a5f502b9bb6d3b626a0bbf04b1a2
Instruction ID: 09b4c2e059865b314081206dc8e5e512f9da91dd1ea2d4785a4698aa199580b9
Opcode Fuzzy Hash: 951de1a6d9ea06dcb7db006de0b07bf7a060a5f502b9bb6d3b626a0bbf04b1a2
Instruction Fuzzy Hash: 5951A1B2B09B4982DE14DF19D544279A3A0FB58BD4B809732DA6E0B795EF7CF0A1C311

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E0817DE8 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 142fileCOMMON

Download Yara Rule

APIs

ReadFile.API-MS-WIN-CORE-FILE-L1-1-0(?,?,?,?,?,?,?,?,?,00007FF7E0817B83), ref: 00007FF7E0817E0C
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,?,?,?,?,?,?,?,00007FF7E0817B83), ref: 00007FF7E0817E1C

Strings

onecore\windows\core\console\open\src\interactivity\base\hostsignalinputthread.cpp, xrefs: 00007FF7E0817E51, 00007FF7E0817F99, 00007FF7E0817FDB

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: ErrorFileLastRead
String ID: onecore\windows\core\console\open\src\interactivity\base\hostsignalinputthread.cpp
API String ID: 1948546556-3640217669
Opcode ID: fd2c96b42c3bcc5fddc5e92b90dbc4dfd08cdbd373a58c798c3ba3b4a85bdd1f
Instruction ID: 57d000f2bab7731b2005aafa5b679bc6b9e007e86e2d7492ae907c2e5f09aa16
Opcode Fuzzy Hash: fd2c96b42c3bcc5fddc5e92b90dbc4dfd08cdbd373a58c798c3ba3b4a85bdd1f
Instruction Fuzzy Hash: 15518422B08A4289EB10BB65D4503B9A3A1EF48B48FD05036EA4D47B96DF3CF565C322

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E08475BC Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 134COMMON

Download Yara Rule

APIs

?_Xout_of_range@std@@YAXPEBD@Z.MSVCP_WIN ref: 00007FF7E0847704

Part of subcall function 00007FF7E085A170: ?_Xout_of_range@std@@YAXPEBD@Z.MSVCP_WIN(?,?,?,00007FF7E0847645), ref: 00007FF7E085A1C4

Strings

invalid vector<T> subscript, xrefs: 00007FF7E08476FD
onecore\windows\core\console\open\src\host\screeninfo.cpp, xrefs: 00007FF7E084778F

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: Xout_of_range@std@@
String ID: invalid vector<T> subscript$onecore\windows\core\console\open\src\host\screeninfo.cpp
API String ID: 1960685668-2524403630
Opcode ID: f2de62f828aa6e173bde98e35a014a80e75348baaf9da77373047cd2e9299a39
Instruction ID: e138f08d657b72bf3b7308ec72e5e65dbbfc8e3339b8c594a2afb03e58e74228
Opcode Fuzzy Hash: f2de62f828aa6e173bde98e35a014a80e75348baaf9da77373047cd2e9299a39
Instruction Fuzzy Hash: C051D732A14AD499E711DF69E8416E9A3B0FF98798F845122FF8C17B14EF38E596C340

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E08552C8 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 133COMMON

Download Yara Rule

APIs

_CxxThrowException.API-MS-WIN-CRT-PRIVATE-L1-1-0 ref: 00007FF7E08552EA
?_Xlength_error@std@@YAXPEBD@Z.MSVCP_WIN ref: 00007FF7E0855369

Strings

vector<T> too long, xrefs: 00007FF7E0855362

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: ExceptionThrowXlength_error@std@@
String ID: vector<T> too long
API String ID: 2465630161-3788999226
Opcode ID: afce5f52707cbeda7a51dd0faa106f2cf9b5bdd9c12d03d068b4eb5e27b7294c
Instruction ID: 08614707ac10c47b7aba994c531dd0cb150f00949a1f517e427ca0b39f469939
Opcode Fuzzy Hash: afce5f52707cbeda7a51dd0faa106f2cf9b5bdd9c12d03d068b4eb5e27b7294c
Instruction Fuzzy Hash: C64181B2715F4982DE14DF1AE8540AAA3E5FB48BD4B548137DE9D4B7A4EF38E052C300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E0808838 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 132COMMON

Download Yara Rule

APIs

GetWindowsDirectoryW.API-MS-WIN-CORE-SYSINFO-L1-1-0(?,?,?,?,?,00000000,?,00007FF7E080836D), ref: 00007FF7E0808887
CompareStringOrdinal.API-MS-WIN-CORE-STRING-L1-1-0 ref: 00007FF7E0808900

Strings

%SystemRoot%, xrefs: 00007FF7E0808959

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: CompareDirectoryOrdinalStringWindows
String ID: %SystemRoot%
API String ID: 2837938056-4275961626
Opcode ID: 5bc732bcb436b96198102e36ef39281611e5bf909846b75e868cfff85eb770de
Instruction ID: 9d24e6b9ac8af60e70bf57876dd291e718dbbf5bb5bc509d2c1e3dc0aaa79e23
Opcode Fuzzy Hash: 5bc732bcb436b96198102e36ef39281611e5bf909846b75e868cfff85eb770de
Instruction Fuzzy Hash: F6419E22B19642C2FA11BF1594003BAAAA1BF44B88FD44037DE8D07785EF7DF4A5C322

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E0879084 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 127COMMON

Download Yara Rule

APIs

WideCharToMultiByte.API-MS-WIN-CORE-STRING-L1-1-0 ref: 00007FF7E087912F
WideCharToMultiByte.API-MS-WIN-CORE-STRING-L1-1-0 ref: 00007FF7E08791E2

Strings

onecore\windows\core\console\open\src\types\convert.cpp, xrefs: 00007FF7E08790FD, 00007FF7E087914D, 00007FF7E0879177, 00007FF7E08791FB

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: ByteCharMultiWide
String ID: onecore\windows\core\console\open\src\types\convert.cpp
API String ID: 626452242-4041387901
Opcode ID: 556fb81a1586239f75fe6d00e3904eaae09d43a3f530a8023bf48048cd107811
Instruction ID: db3f8ab491b5e25888265af59dccc7056a4c24d40c223d767cc2f6d991771e6b
Opcode Fuzzy Hash: 556fb81a1586239f75fe6d00e3904eaae09d43a3f530a8023bf48048cd107811
Instruction Fuzzy Hash: 1B410632A08B4185E710DB65E8403A9BBA1FB887A8F945136DE9D53B99CF3CE4A1C351

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E080B270 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 125COMMON

Download Yara Rule

APIs

ReleaseDC.USER32 ref: 00007FF7E080B32D

Strings

onecore\windows\core\console\open\src\renderer\gdi\paint.cpp, xrefs: 00007FF7E0825AFD, 00007FF7E0825B22, 00007FF7E0825B3B, 00007FF7E0825B5A, 00007FF7E0825B79, 00007FF7E0825B98
, xrefs: 00007FF7E080B2C2

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: Release
String ID: $onecore\windows\core\console\open\src\renderer\gdi\paint.cpp
API String ID: 1375353473-3907913552
Opcode ID: 9be9f4f98344f53a14120652cd680e30dfaf3658a490294c66d2319984288d7e
Instruction ID: e3153f0a7f36c4f67da6f45ad631214287c21000878a02cb732adf624e468aff
Opcode Fuzzy Hash: 9be9f4f98344f53a14120652cd680e30dfaf3658a490294c66d2319984288d7e
Instruction Fuzzy Hash: DB51A132A0868686F710AF65E0407B9BBA0FB88B88F945137DA4D47765CF3CF465C721

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E08774B8 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112fileCOMMON

Download Yara Rule

APIs

WriteFile.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF7E087764F

Strings

onecore\windows\core\console\open\src\renderer\wddmcon\wddmconrenderer.cpp, xrefs: 00007FF7E0877595, 00007FF7E08775FC
onecore\windows\core\console\open\src\interactivity\onecore\coniosrvcomm.cpp, xrefs: 00007FF7E0877517, 00007FF7E0877623

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: FileWrite
String ID: onecore\windows\core\console\open\src\interactivity\onecore\coniosrvcomm.cpp$onecore\windows\core\console\open\src\renderer\wddmcon\wddmconrenderer.cpp
API String ID: 3934441357-3505446033
Opcode ID: 28a0d9db8930b9e83d2cb568f2637e4a6fda957643cbb4bc667b34b13d5b9403
Instruction ID: 27dd7dafaf2bf0654e2454243f9747150d3881da9b5bc544cb2a3bc12db91799
Opcode Fuzzy Hash: 28a0d9db8930b9e83d2cb568f2637e4a6fda957643cbb4bc667b34b13d5b9403
Instruction Fuzzy Hash: 7F51B622A08A4282FB50E719D444779E760EB94BA4F944333D6AD437E9DF3CF4A5C722

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E07FBA90 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 111COMMON

Download Yara Rule

Strings

invalid deque<T> subscript, xrefs: 00007FF7E081E58E

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID:
String ID: invalid deque<T> subscript
API String ID: 0-2228476695
Opcode ID: c32465e383e2c5e0a01112c40a2e6af17bc35da84f597ed5915a3e7c608b9b60
Instruction ID: 3676ffaa222dfbab5c2bb1d170ffa904d743eb81529b53e6f17ff7f2648e178a
Opcode Fuzzy Hash: c32465e383e2c5e0a01112c40a2e6af17bc35da84f597ed5915a3e7c608b9b60
Instruction Fuzzy Hash: 6B418AA1A1878285EE25AF159454379E7A1FF48B84FE48137C94D137A8EF3CF5708322

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E08443E0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 108COMMON

Download Yara Rule

APIs

memmove.API-MS-WIN-CRT-PRIVATE-L1-1-0 ref: 00007FF7E0844446
default_delete.LIBCPMT ref: 00007FF7E084454E

Part of subcall function 00007FF7E08408FC: WideCharToMultiByte.API-MS-WIN-CORE-STRING-L1-1-0 ref: 00007FF7E0840942

Strings

onecore\windows\core\console\open\src\server\objecthandle.cpp, xrefs: 00007FF7E08443F0

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: ByteCharMultiWidedefault_deletememmove
String ID: onecore\windows\core\console\open\src\server\objecthandle.cpp
API String ID: 1922133517-459684902
Opcode ID: 8e1f713631cc1f6c6dceed86ca41d70ca0407c58298b84c47ef3885ee79c6052
Instruction ID: 0a41593f91b45ecf93d425e53d2290379137ebcb35a5880b5865c91dcd123629
Opcode Fuzzy Hash: 8e1f713631cc1f6c6dceed86ca41d70ca0407c58298b84c47ef3885ee79c6052
Instruction Fuzzy Hash: D241CA2650C7818AE711EF29A44037AFBA2FB44784F946137EA9D03796CE3CF461CB61

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E083B670 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 104COMMON

Download Yara Rule

APIs

EnterCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FF7E083B68F

Part of subcall function 00007FF7E0839F94: _o_terminate.API-MS-WIN-CRT-PRIVATE-L1-1-0(?,?,?,?,?,?,?,?,00007FF7E0839BE9), ref: 00007FF7E0839FB7

_o_terminate.API-MS-WIN-CRT-PRIVATE-L1-1-0 ref: 00007FF7E083B786

Strings

onecore\windows\core\console\open\src\host\directio.cpp, xrefs: 00007FF7E083B74D, 00007FF7E083B7B2

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: _o_terminate$CriticalEnterSection
String ID: onecore\windows\core\console\open\src\host\directio.cpp
API String ID: 1354191923-2458865805
Opcode ID: c2226e2c0dcf2ce74df08c7a8fa8c5e3789b5850acc6bfb86ccc25749755da85
Instruction ID: 5331689f6c0b08547f336d6394a5c727e0beaad421cd44414d7d79aab5e7ee8a
Opcode Fuzzy Hash: c2226e2c0dcf2ce74df08c7a8fa8c5e3789b5850acc6bfb86ccc25749755da85
Instruction Fuzzy Hash: A3418E22B1C78282E640AB25E4507BAE790EBD6784F945032EB8D53B56DE3CF524C622

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E084FAD0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 93COMMON

Download Yara Rule

APIs

default_delete.LIBCPMT ref: 00007FF7E084FB8A

Strings

onecore\windows\core\console\open\src\host\writedata.cpp, xrefs: 00007FF7E084FB34

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: default_delete
String ID: onecore\windows\core\console\open\src\host\writedata.cpp
API String ID: 3712186324-3632423436
Opcode ID: 85fcf6c899e0dc61e69e6cea0954e9a1cedfdfa90d649687fa540f2e32c39cb2
Instruction ID: efb48fac4c911c23b0b3937ec112b6e69e10edef84d71a04384d20e26b4634ac
Opcode Fuzzy Hash: 85fcf6c899e0dc61e69e6cea0954e9a1cedfdfa90d649687fa540f2e32c39cb2
Instruction Fuzzy Hash: 0641A362508B8595EA60AF15E1803A9B3A0FB48784F908136DF8D07B96DF3CE4A5CB11

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E0881B30 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 90COMMON

Download Yara Rule

APIs

SubtractRect.USER32 ref: 00007FF7E0881C0A
IsRectEmpty.USER32 ref: 00007FF7E0881C54

Strings

onecore\windows\core\console\open\src\renderer\dx\dxrenderer.cpp, xrefs: 00007FF7E0881B6C

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: Rect$EmptySubtract
String ID: onecore\windows\core\console\open\src\renderer\dx\dxrenderer.cpp
API String ID: 3474499642-3506895815
Opcode ID: c9d498d6a27276f3d9d379d09529990a3eba5e9bd269f46f75d629d6fc7a213a
Instruction ID: b595295d68b306dec8f47fa800bd0ebd218c7858bcc459d2ffbaaf01868e5bc4
Opcode Fuzzy Hash: c9d498d6a27276f3d9d379d09529990a3eba5e9bd269f46f75d629d6fc7a213a
Instruction Fuzzy Hash: 3541BB32A08BC287E7649B25E4403EAB7A0E789B84F949136DB9E07751DF7CF494C721

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E07FD6E0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 80COMMON

Download Yara Rule

APIs

?_Xout_of_range@std@@YAXPEBD@Z.MSVCP_WIN ref: 00007FF7E081F3A5
?_Xout_of_range@std@@YAXPEBD@Z.MSVCP_WIN ref: 00007FF7E081F3B9

Strings

invalid deque<T> subscript, xrefs: 00007FF7E081F39E, 00007FF7E081F3B2

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: Xout_of_range@std@@
String ID: invalid deque<T> subscript
API String ID: 1960685668-2228476695
Opcode ID: 651c1094f6287a8ae1c6b7ae08a47b192235778b733423dc389437bee79a9740
Instruction ID: c23e3b50b5546e8ef4fa8e019460aa2d442a2d59c79dfc1b7c1a77579368c2ac
Opcode Fuzzy Hash: 651c1094f6287a8ae1c6b7ae08a47b192235778b733423dc389437bee79a9740
Instruction Fuzzy Hash: 38315736A15A45DAEB10AF65D4806AD73B0FB49788F801036DE0C63B65DF38E469C321

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E0848970 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 72COMMON

Download Yara Rule

APIs

?_Xout_of_range@std@@YAXPEBD@Z.MSVCP_WIN ref: 00007FF7E0848A0D

Strings

invalid string position, xrefs: 00007FF7E0848A06
onecore\windows\core\console\open\src\host\_output.cpp, xrefs: 00007FF7E08489E5

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: Xout_of_range@std@@
String ID: invalid string position$onecore\windows\core\console\open\src\host\_output.cpp
API String ID: 1960685668-258750115
Opcode ID: 0c7608319e167f2a00a6bb8d3f963bf5364201700b8c05bf38f91ab97f859ed2
Instruction ID: 36cf2068613d7eed0fd38716eb7102d1b3c1289b2cbe5192b3d885373eece016
Opcode Fuzzy Hash: 0c7608319e167f2a00a6bb8d3f963bf5364201700b8c05bf38f91ab97f859ed2
Instruction Fuzzy Hash: 13218D32B14A859AE700EB65D8403EDA7A0FB59788F848132DE4C23B54DF38E565C761

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E080BA84 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 65COMMONLIBRARYCODE

Download Yara Rule

APIs

_o__invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-PRIVATE-L1-1-0(?,?,?,?,00007FF7E080BA6F,?,?,?,?,00007FF7E080338A,?,?,00000000,00007FF7E0840271), ref: 00007FF7E0826102

Strings

onecore\windows\core\console\conint\processpolicy.cpp, xrefs: 00007FF7E0826188
onecore\internal\minwin\priv_sdk\inc\appmodelpolicy.h, xrefs: 00007FF7E0826169

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: _o__invalid_parameter_noinfo_noreturn
String ID: onecore\internal\minwin\priv_sdk\inc\appmodelpolicy.h$onecore\windows\core\console\conint\processpolicy.cpp
API String ID: 38229942-1181345395
Opcode ID: b2211e6f4c7de6ef34c786951b6f847564f00f3c7ae5eadf1c43561cb2c325d5
Instruction ID: 0c6d44e8cfe4b6ea4eb18ee9bdf1d3045008c43c3ff2128ca7423de093816bbb
Opcode Fuzzy Hash: b2211e6f4c7de6ef34c786951b6f847564f00f3c7ae5eadf1c43561cb2c325d5
Instruction Fuzzy Hash: 0E21A162E5864783FA186A259175778B690FF423B8FD05237C65E02BDACD3DF4708222

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E07F633C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 61threadCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7E07F8F28: GetCurrentThreadId.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0(?,?,00000000,00007FF7E07F635D,?,?,?,?,00000000,00007FF7E07F3128,?,?,00000000,00007FF7E07F2F43), ref: 00007FF7E07F8F31

GetCurrentProcessId.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0(?,?,?,?,00000000,00007FF7E07F3128,?,?,00000000,00007FF7E07F2F43), ref: 00007FF7E07F6382
GetCurrentThreadId.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0(?,?,?,?,00000000,00007FF7E07F3128,?,?,00000000,00007FF7E07F2F43), ref: 00007FF7E07F6390

Strings

onecore\windows\core\console\open\src\interactivity\win32\windowio.cpp, xrefs: 00007FF7E081C183, 00007FF7E081C1BC

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: Current$Thread$Process
String ID: onecore\windows\core\console\open\src\interactivity\win32\windowio.cpp
API String ID: 3664162594-1145931909
Opcode ID: 6f87d51dd03eb88d6566ea3d52b00c7344ec63e68ed39a1d217927ba599edf16
Instruction ID: 1b2cf0a2ea0d5382e38353b6783c6830f5c55dcb7fd53f39b487433ee2f4165a
Opcode Fuzzy Hash: 6f87d51dd03eb88d6566ea3d52b00c7344ec63e68ed39a1d217927ba599edf16
Instruction Fuzzy Hash: 86218235A0C64286EA10AB15E0002B9F7B0FF98B84FA44133EA4D53756DF3CF462CB62

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E08445C8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 61COMMON

Download Yara Rule

APIs

_o_terminate.API-MS-WIN-CRT-PRIVATE-L1-1-0 ref: 00007FF7E0844625
memset.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7E0844651

Strings

onecore\windows\core\console\open\src\host\dbcs.cpp, xrefs: 00007FF7E084466C

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: _o_terminatememset
String ID: onecore\windows\core\console\open\src\host\dbcs.cpp
API String ID: 1963963490-3591230717
Opcode ID: 2682f5e4deafb082c503c9a93db6f141e00bc98e7d386b1003f19d7d77503dc4
Instruction ID: 5c15321e7334df2e71aa62d71b32c3094970ee9a93bab8dc9767c54f53e53131
Opcode Fuzzy Hash: 2682f5e4deafb082c503c9a93db6f141e00bc98e7d386b1003f19d7d77503dc4
Instruction Fuzzy Hash: C3210436A08A8186EB10FF59E09523DE362FB89B94F95A037DB4E43754DF38E422C711

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E085F424 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 59COMMON

Download Yara Rule

APIs

memset.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7E085F451
swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF7E085F4D6

Strings

`, xrefs: 00007FF7E085F45A

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: memsetswprintf
String ID: `
API String ID: 3661171589-2679148245
Opcode ID: b0165670da96331bbdb91b9d7467daeff5a1e819b143d35306697cc8ee21aedd
Instruction ID: 554c62668f1f1575545f89a8481baf8931b8c00851f2d4faf8f6cb88ddabdfd6
Opcode Fuzzy Hash: b0165670da96331bbdb91b9d7467daeff5a1e819b143d35306697cc8ee21aedd
Instruction Fuzzy Hash: FD21B73261CA8581EB10AB25E4503FEA360FB88B54F804532DB9D47B95DF7CE465CB11

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E080670C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 57COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32 ref: 00007FF7E080678C
GetWindowLongW.USER32 ref: 00007FF7E08067B2

Strings

onecore\windows\core\console\open\src\interactivity\win32\windowmetrics.cpp, xrefs: 00007FF7E0822689

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: LongWindow
String ID: onecore\windows\core\console\open\src\interactivity\win32\windowmetrics.cpp
API String ID: 1378638983-926436646
Opcode ID: a4b6d573f5b16623fe60c8cfc5add4e18bb71a82db521b430c711bc4c59f8489
Instruction ID: 2f19c30fc3d1d41a542c538529ed585bddeb1fd4de80355ec228f1a59cda0aab
Opcode Fuzzy Hash: a4b6d573f5b16623fe60c8cfc5add4e18bb71a82db521b430c711bc4c59f8489
Instruction Fuzzy Hash: 3C21C335B08A4283EB14AB16E440239E7A0FF99FD4F904236DE0D07B65CF3DE4619B15

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E0851144 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 56COMMON

Download Yara Rule

APIs

?_Xlength_error@std@@YAXPEBD@Z.MSVCP_WIN(?,?,?,00007FF7E0851584), ref: 00007FF7E085117B
memmove.API-MS-WIN-CRT-PRIVATE-L1-1-0(?,?,?,00007FF7E0851584), ref: 00007FF7E08511D1

Strings

string too long, xrefs: 00007FF7E0851174

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: Xlength_error@std@@memmove
String ID: string too long
API String ID: 1146228739-2556327735
Opcode ID: 0a3b7f3ee41e008f8268290e914ef0819c4d9e3202da2d2fe4c5bd2ff86697dc
Instruction ID: e51db6699f6c8caca4d0416d1bbc34186b411b5f9ad82ca3d37fae34b58846eb
Opcode Fuzzy Hash: 0a3b7f3ee41e008f8268290e914ef0819c4d9e3202da2d2fe4c5bd2ff86697dc
Instruction Fuzzy Hash: 3011B132708A8185EE04EF12E900169B7A6FB44FE0F848232DF6D07B99DE7CE461C311

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E085A7C0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

?_Xout_of_range@std@@YAXPEBD@Z.MSVCP_WIN ref: 00007FF7E085A809

Strings

invalid vector<T> subscript, xrefs: 00007FF7E085A802

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: Xout_of_range@std@@
String ID: invalid vector<T> subscript
API String ID: 1960685668-3016609489
Opcode ID: 798e44e9d674955d59db1a49f2075911c5a43d9247d33ba94d718322d0a4b64e
Instruction ID: f32254897f8da98203ad0a014386f526474996da8699b3fff9918fdeb5bd0e04
Opcode Fuzzy Hash: 798e44e9d674955d59db1a49f2075911c5a43d9247d33ba94d718322d0a4b64e
Instruction Fuzzy Hash: FD015272B04A8A82EE04AF15E6847B8E7E5EB54FC8F98C032DE0D07754DE3CE4618711

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E08385C4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 50fileCOMMON

Download Yara Rule

APIs

ReadFile.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF7E0838607
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF7E083861B

Strings

onecore\windows\core\console\open\src\host\vtinputthread.cpp, xrefs: 00007FF7E0838664

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: ErrorFileLastRead
String ID: onecore\windows\core\console\open\src\host\vtinputthread.cpp
API String ID: 1948546556-3316410220
Opcode ID: a9d8988349eae429be1a2e27f0d79c10af0b906a4c1cbf3d84babec6d9799f1e
Instruction ID: 7b679d7f38655fe18953876e3e57305ccdfaac3414c79a44bfa14d1d2bd88f90
Opcode Fuzzy Hash: a9d8988349eae429be1a2e27f0d79c10af0b906a4c1cbf3d84babec6d9799f1e
Instruction Fuzzy Hash: 27216331618682C6EB60AB21E4053BEB7A0FBD9784FC05136DA4D4B755DF3CE464CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E083434C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 48COMMON

Download Yara Rule

APIs

?_Xout_of_range@std@@YAXPEBD@Z.MSVCP_WIN(?,?,00000001,00007FF7E0834A63), ref: 00007FF7E0834387
memmove.API-MS-WIN-CRT-PRIVATE-L1-1-0(?,?,00000001,00007FF7E0834A63), ref: 00007FF7E08343CE

Strings

invalid string position, xrefs: 00007FF7E0834380

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: Xout_of_range@std@@memmove
String ID: invalid string position
API String ID: 1894236298-1799206989
Opcode ID: 79e48190ed937696b990e30e027891a77dd27d1db6d7f2a28a4aa7f18bf8148f
Instruction ID: 2537f8be4afa6965b8a3bc092a9f4e7de8a89ed6b01d237f25dcf4680a87ab8b
Opcode Fuzzy Hash: 79e48190ed937696b990e30e027891a77dd27d1db6d7f2a28a4aa7f18bf8148f
Instruction Fuzzy Hash: 5B11CE32B14B8990DE009F29E988198A3A2F758FC8BA49032DB4C07768CF3CF169C340

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E085B528 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 45COMMON

Download Yara Rule

APIs

?_Xout_of_range@std@@YAXPEBD@Z.MSVCP_WIN(?,?,00000001,00007FF7E0846693), ref: 00007FF7E085B59D

Strings

onecore\windows\core\console\open\src\buffer\out\attrrow.cpp, xrefs: 00007FF7E085B546
invalid vector<T> subscript, xrefs: 00007FF7E085B596

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: Xout_of_range@std@@
String ID: invalid vector<T> subscript$onecore\windows\core\console\open\src\buffer\out\attrrow.cpp
API String ID: 1960685668-1249968659
Opcode ID: 844253ac52ffa5520eab2f99b6d94a8dfd2ee8289bb7dc2ef34484d134c9aab8
Instruction ID: 3bb18c784e476ed51a8dbc9c4fc667c46bc2869299161446062d1bd78d9a85c5
Opcode Fuzzy Hash: 844253ac52ffa5520eab2f99b6d94a8dfd2ee8289bb7dc2ef34484d134c9aab8
Instruction Fuzzy Hash: C811E572B14A8582CF04EF65E5545B8A7E0EBA8BC4B94D033DE4D0B749DE3CE560C721

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E0801BF8 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 45COMMON

Download Yara Rule

APIs

_o_terminate.API-MS-WIN-CRT-PRIVATE-L1-1-0(?,?,?,?,?,?,?,?,00007FF7E081F836), ref: 00007FF7E0820B8C

Strings

onecore\windows\core\console\open\src\types\viewport.cpp, xrefs: 00007FF7E0820B9F, 00007FF7E0820BBC, 00007FF7E0820BD9, 00007FF7E0820BF6
onecore\windows\core\console\open\src\renderer\base\renderer.cpp, xrefs: 00007FF7E0820C13

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: _o_terminate
String ID: onecore\windows\core\console\open\src\renderer\base\renderer.cpp$onecore\windows\core\console\open\src\types\viewport.cpp
API String ID: 882196631-4274426706
Opcode ID: 52f2c7c151fad2dc831af892f40eb9b850137629a7ae68e8853eab1621c24504
Instruction ID: c65bf1f322fc48ed2a3d2a82b0de7f401ee96b5caf8d03aad3db11f845b16d6e
Opcode Fuzzy Hash: 52f2c7c151fad2dc831af892f40eb9b850137629a7ae68e8853eab1621c24504
Instruction Fuzzy Hash: 2011EB31E0860BD2E710BB94A4546AD9724EFE8798FE04133D94C13F65DD3CF2668321

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E084DC20 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 45libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7E084DA2C: LoadLibraryExW.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0 ref: 00007FF7E084DA70
Part of subcall function 00007FF7E084DA2C: _Init_thread_footer.LIBCMT ref: 00007FF7E084DA96

Part of subcall function 00007FF7E0810000: EnterCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,?,00007FF7E0803769,?,?,?,?,00007FF7E081B159), ref: 00007FF7E0810010

GetProcAddress.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0(?,?,?,?,?,00007FF7E084DB03), ref: 00007FF7E084DC85
_Init_thread_footer.LIBCMT ref: 00007FF7E084DC9F

Part of subcall function 00007FF7E080FF98: EnterCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,?,00007FF7E0803790,?,?,?,?,00007FF7E081B159), ref: 00007FF7E080FFA8
Part of subcall function 00007FF7E080FF98: LeaveCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,?,00007FF7E0803790,?,?,?,?,00007FF7E081B159), ref: 00007FF7E080FFE8

Strings

NtOpenProcess, xrefs: 00007FF7E084DC7B

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: CriticalSection$EnterInit_thread_footer$AddressLeaveLibraryLoadProc
String ID: NtOpenProcess
API String ID: 3281356286-3690168757
Opcode ID: f69586c9a2d81fc3eb902e5bf34a354c24e43ce7708fd1b04da5357c22ccc56a
Instruction ID: 06fd36f90ff0a4578f92a264ce4a7937aab6d63283ad46d59e55643925c4d591
Opcode Fuzzy Hash: f69586c9a2d81fc3eb902e5bf34a354c24e43ce7708fd1b04da5357c22ccc56a
Instruction Fuzzy Hash: 02111925A08B46C9EA00BB16E890365A3A0AF45B90FD84533DA5D077A5DF7CF461CB21

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E07F649C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0(?,?,?,00007FF7E07F63C5,?,?,?,?,00000000,00007FF7E07F3128,?,?,00000000,00007FF7E07F2F43), ref: 00007FF7E07F6533
_Init_thread_footer.LIBCMT ref: 00007FF7E07F654D

Strings

ConsoleControl, xrefs: 00007FF7E07F652C

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: AddressInit_thread_footerProc
String ID: ConsoleControl
API String ID: 904429856-3740886617
Opcode ID: a7f453ff901e87697cd4bd84f2f91b95d73da567a1be98584440f059c5dbff63
Instruction ID: 0d24edea764b6535d0c116ae3ac4d7279c9beadf799f80282ebd97360d7c0724
Opcode Fuzzy Hash: a7f453ff901e87697cd4bd84f2f91b95d73da567a1be98584440f059c5dbff63
Instruction Fuzzy Hash: 94113A25A0CA87C5EA20AB15E840364E360FB48B94FD84137DA1D477A5DF3CF8A5CB22

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E0886540 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 44COMMON

Download Yara Rule

APIs

?_Xout_of_range@std@@YAXPEBD@Z.MSVCP_WIN ref: 00007FF7E08865A1

Strings

invalid string position, xrefs: 00007FF7E088659A
onecore\windows\core\console\open\src\renderer\dx\customtextlayout.cpp, xrefs: 00007FF7E088655E

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: Xout_of_range@std@@
String ID: invalid string position$onecore\windows\core\console\open\src\renderer\dx\customtextlayout.cpp
API String ID: 1960685668-2152613991
Opcode ID: d50fa177d57d68cdf05483b1e78aaa63beb95cc120da0380cd21aed975d0f93a
Instruction ID: 6a6a2b8a20e0cd3769c87204f3dc74fdfc66467250d7a3d86399cde2abd09184
Opcode Fuzzy Hash: d50fa177d57d68cdf05483b1e78aaa63beb95cc120da0380cd21aed975d0f93a
Instruction Fuzzy Hash: 9911A032A08A4386EB50AF28E444368A7A0FB94B84FD54032D60D4B765EF3CE975C361

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E0828340 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43libraryloaderCOMMON

Download Yara Rule

APIs

_CxxThrowException.API-MS-WIN-CRT-PRIVATE-L1-1-0 ref: 00007FF7E0828348

Part of subcall function 00007FF7E080DD64: GetModuleHandleW.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0(?,?,?,?,00007FF7E080DD18), ref: 00007FF7E080DD7B

GetProcAddress.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0 ref: 00007FF7E0828383

Strings

RtlDllShutdownInProgress, xrefs: 00007FF7E082837C

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: AddressExceptionHandleModuleProcThrow
String ID: RtlDllShutdownInProgress
API String ID: 1273124314-2005622848
Opcode ID: 7b25091fba79d6d2c85bf7525825f11159b8eb447402ea106c5d11ee7dc576d8
Instruction ID: 9024ccf8b52910e646529ff8b5e549e59897109fffe72ab6858da8430c5c7701
Opcode Fuzzy Hash: 7b25091fba79d6d2c85bf7525825f11159b8eb447402ea106c5d11ee7dc576d8
Instruction Fuzzy Hash: BDF03024E0AB02C6FE19BBA1AC953B4A3A0AF19B00FD85037CD4D06361DF3C74658732

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E084DCE8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7E084DA2C: LoadLibraryExW.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0 ref: 00007FF7E084DA70
Part of subcall function 00007FF7E084DA2C: _Init_thread_footer.LIBCMT ref: 00007FF7E084DA96

Part of subcall function 00007FF7E0810000: EnterCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,?,00007FF7E0803769,?,?,?,?,00007FF7E081B159), ref: 00007FF7E0810010

GetProcAddress.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0(?,?,?,?,?,00007FF7E084DB25), ref: 00007FF7E084DD49
_Init_thread_footer.LIBCMT ref: 00007FF7E084DD63

Part of subcall function 00007FF7E080FF98: EnterCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,?,00007FF7E0803790,?,?,?,?,00007FF7E081B159), ref: 00007FF7E080FFA8
Part of subcall function 00007FF7E080FF98: LeaveCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,?,00007FF7E0803790,?,?,?,?,00007FF7E081B159), ref: 00007FF7E080FFE8

Strings

NtQueryInformationProcess, xrefs: 00007FF7E084DD3F

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: CriticalSection$EnterInit_thread_footer$AddressLeaveLibraryLoadProc
String ID: NtQueryInformationProcess
API String ID: 3281356286-2781105232
Opcode ID: 8a368f7bb160db630f5f6bc80dea80493078756c35dc0347b8ee9a10d8dac79c
Instruction ID: ca526b514c4bf113b2735a17b0330c6b1cf3406e110cbc220c014418c47b2ead
Opcode Fuzzy Hash: 8a368f7bb160db630f5f6bc80dea80493078756c35dc0347b8ee9a10d8dac79c
Instruction Fuzzy Hash: 5B112B25A08B4286FA10AB15F850376A7A0BF45B94FD44533DA4D077A5CF3DF462CB21

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E085AC7C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 41COMMON

Download Yara Rule

APIs

?_Xlength_error@std@@YAXPEBD@Z.MSVCP_WIN(?,?,?,00007FF7E085AA94,?,?,?,?,?,?,00000000,00000001,?,00007FF7E0855DFD), ref: 00007FF7E085ACB9

Strings

vector<T> too long, xrefs: 00007FF7E085ACB2
UUUUUUUU, xrefs: 00007FF7E085AC9A

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: Xlength_error@std@@
String ID: UUUUUUUU$vector<T> too long
API String ID: 1004598685-1961640351
Opcode ID: d21bdb6a11a04bc5bf8dec92e3ddd717f84cb0fbaa83c1ee2f192170330ec251
Instruction ID: fded5b64e2bd7427c73a32b9618611c80a19b2e6aa8e5a70a60cff2abf884afd
Opcode Fuzzy Hash: d21bdb6a11a04bc5bf8dec92e3ddd717f84cb0fbaa83c1ee2f192170330ec251
Instruction Fuzzy Hash: BD013976A05B9181DB14EF12E58022AF7B5FB59BC0B989132DA9D47B18EE3CE4A08710

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E07F6BD0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 40COMMON

Download Yara Rule

APIs

wcsncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7E07F6BC0), ref: 00007FF7E07F6C0E
_o_wcscpy_s.API-MS-WIN-CRT-PRIVATE-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7E07F6BC0), ref: 00007FF7E07F6C67

Strings

__DefaultTTFont__, xrefs: 00007FF7E07F6C04

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: _o_wcscpy_swcsncmp
String ID: __DefaultTTFont__
API String ID: 2955157898-894678944
Opcode ID: 439badd03b3ab9f446708a297ac780d270f1c6a92a11388ea119ad15094109fe
Instruction ID: 7e4194d2d0a057bc40d8a420c4c5f6d6d91711e356dec21ce6ece2005018018e
Opcode Fuzzy Hash: 439badd03b3ab9f446708a297ac780d270f1c6a92a11388ea119ad15094109fe
Instruction Fuzzy Hash: D8113961A08A4286FB50AB25E400379A7A0EB4DB55FC45033CA8E47762DF3DF479CB32

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E083E770 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 38COMMON

Download Yara Rule

APIs

EnterCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FF7E083E77F
IsValidCodePage.API-MS-WIN-CORE-LOCALIZATION-L1-2-0 ref: 00007FF7E083E793

Part of subcall function 00007FF7E0802BCC: LeaveCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,00000001,?,00000000,00007FF7E0875ED6,?,?,?,?,00000000,00007FF7E0824487), ref: 00007FF7E0802BFC

Strings

onecore\windows\core\console\open\src\host\getset.cpp, xrefs: 00007FF7E083E7B1

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: CriticalSection$CodeEnterLeavePageValid
String ID: onecore\windows\core\console\open\src\host\getset.cpp
API String ID: 2606172417-1703575416
Opcode ID: a126eadb2c6ba2e16eb676238f832a12d21c535c269bbf2bf2cc276b5ff78779
Instruction ID: 60af2aabad39dcd124b10578248030385915f149c5870a949fe10642e184bfa6
Opcode Fuzzy Hash: a126eadb2c6ba2e16eb676238f832a12d21c535c269bbf2bf2cc276b5ff78779
Instruction Fuzzy Hash: 1E01A221E0C203C7E7247B20A4903B9E690EFAA704FD42537D50E07382DE3CB864C632

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E083E840 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 38COMMON

Download Yara Rule

APIs

EnterCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FF7E083E84F
IsValidCodePage.API-MS-WIN-CORE-LOCALIZATION-L1-2-0 ref: 00007FF7E083E863

Part of subcall function 00007FF7E0802BCC: LeaveCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,00000001,?,00000000,00007FF7E0875ED6,?,?,?,?,00000000,00007FF7E0824487), ref: 00007FF7E0802BFC

Strings

onecore\windows\core\console\open\src\host\getset.cpp, xrefs: 00007FF7E083E881

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: CriticalSection$CodeEnterLeavePageValid
String ID: onecore\windows\core\console\open\src\host\getset.cpp
API String ID: 2606172417-1703575416
Opcode ID: 3ebe8d93e07041a40c6cf79dd9e0ff56f60d3fa1cfd4ce6b4b4e5f267b7f73d0
Instruction ID: bb030d9720aef5907c95d059985a428dbd07faf43a2b145ff693d8471f488522
Opcode Fuzzy Hash: 3ebe8d93e07041a40c6cf79dd9e0ff56f60d3fa1cfd4ce6b4b4e5f267b7f73d0
Instruction Fuzzy Hash: 0B018F20E08203CBF7107B60A4543B9E690EFAA704FD46537D60E033C2DE3CB8648A32

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E0884BA4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 38COMMON

Download Yara Rule

APIs

OffsetRect.USER32 ref: 00007FF7E0884BDE
IntersectRect.USER32 ref: 00007FF7E0884C21

Strings

onecore\windows\core\console\open\src\renderer\dx\dxrenderer.cpp, xrefs: 00007FF7E0884BF3

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: Rect$IntersectOffset
String ID: onecore\windows\core\console\open\src\renderer\dx\dxrenderer.cpp
API String ID: 2840374550-3506895815
Opcode ID: 558564877560829c95983dfdf9c63f11b6b73f98389d3e48f05b040c301d27c2
Instruction ID: 7ba502a25e0629189b84359731bb6d294b72433edf9b1b26a73ea55c50c469b7
Opcode Fuzzy Hash: 558564877560829c95983dfdf9c63f11b6b73f98389d3e48f05b040c301d27c2
Instruction Fuzzy Hash: CD118662918BC582E610AB64E4402FAF760FB99B48F84A232DA8D16715DF3CE195CB11

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E080B850 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 38libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0 ref: 00007FF7E0825D42
_Init_thread_footer.LIBCMT ref: 00007FF7E0825D5C

Strings

ConsoleControl, xrefs: 00007FF7E0825D3B

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: AddressInit_thread_footerProc
String ID: ConsoleControl
API String ID: 904429856-3740886617
Opcode ID: a71230bbec7c55631b59c0aa5ff82330859a80119c28394645f98aa3288d8fd2
Instruction ID: f40d944e2f87a6d7c29339410cf14c59523123d84e216e0dbb5ef614950bf78f
Opcode Fuzzy Hash: a71230bbec7c55631b59c0aa5ff82330859a80119c28394645f98aa3288d8fd2
Instruction Fuzzy Hash: A5113660A08A46C2FA20AB24E850378A7A4FB08789FD48137C54D467B1DF3CF5A5CB22

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E0885D1C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 38COMMON

Download Yara Rule

APIs

?_Xlength_error@std@@YAXPEBD@Z.MSVCP_WIN ref: 00007FF7E0885D5A
memset.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7E0885D8B

Strings

vector<T> too long, xrefs: 00007FF7E0885D53

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: Xlength_error@std@@memset
String ID: vector<T> too long
API String ID: 1527646195-3788999226
Opcode ID: f4a454fcbf3dfcfd1a783a2fe7a8ed26c99f1667c9a8c8374874f177993f29d1
Instruction ID: fefe809b10fa10ba080692afefd64a4f0859a2c410c38e1e1e1c7815a9d44dd3
Opcode Fuzzy Hash: f4a454fcbf3dfcfd1a783a2fe7a8ed26c99f1667c9a8c8374874f177993f29d1
Instruction Fuzzy Hash: B301B572A06F4582EB04AB15E5043A8E7E0FB48BA4F988736DA2D0B794DF7CE465C710

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E07F2FBC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0(?,?,00000000,00007FF7E07F2F93), ref: 00007FF7E07F303A
_Init_thread_footer.LIBCMT ref: 00007FF7E07F3054

Strings

TranslateMessageEx, xrefs: 00007FF7E07F3033

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: AddressInit_thread_footerProc
String ID: TranslateMessageEx
API String ID: 904429856-3229300106
Opcode ID: dc574be43af7f285d15f131261b88bbc7baa9dc0b048400edea56cc8a45c4a3c
Instruction ID: dbca965a1abd5369bb4cd86e9d3a8edd0f9456fd8dc345002ac51f5a9ba8c9bb
Opcode Fuzzy Hash: dc574be43af7f285d15f131261b88bbc7baa9dc0b048400edea56cc8a45c4a3c
Instruction Fuzzy Hash: AF113C65A09A42C9EE50BB15E940374A7A1EF48784FD88133D91D4B7A1DF3CF865C722

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E084DB7C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7E084DA2C: LoadLibraryExW.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0 ref: 00007FF7E084DA70
Part of subcall function 00007FF7E084DA2C: _Init_thread_footer.LIBCMT ref: 00007FF7E084DA96

Part of subcall function 00007FF7E0810000: EnterCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,?,00007FF7E0803769,?,?,?,?,00007FF7E081B159), ref: 00007FF7E0810010

GetProcAddress.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0(?,?,?,00007FF7E084DB30), ref: 00007FF7E084DBD1
_Init_thread_footer.LIBCMT ref: 00007FF7E084DBEB

Part of subcall function 00007FF7E080FF98: EnterCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,?,00007FF7E0803790,?,?,?,?,00007FF7E081B159), ref: 00007FF7E080FFA8
Part of subcall function 00007FF7E080FF98: LeaveCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,?,00007FF7E0803790,?,?,?,?,00007FF7E081B159), ref: 00007FF7E080FFE8

Strings

NtClose, xrefs: 00007FF7E084DBC7

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: CriticalSection$EnterInit_thread_footer$AddressLeaveLibraryLoadProc
String ID: NtClose
API String ID: 3281356286-218744656
Opcode ID: 480afb4a08e29612966375148544f08f4c86f7807d07a4d095395f08e8e1926c
Instruction ID: 7b140bab3279bf6704a91489f4e0769eadf73b8804d75857f5a42424fecca8e6
Opcode Fuzzy Hash: 480afb4a08e29612966375148544f08f4c86f7807d07a4d095395f08e8e1926c
Instruction Fuzzy Hash: 71010525A18A4289EA59BB15E890375B3A0EF45B94FD44137DA4D077A2DF3CF860CB22

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E08729E0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 35libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7E0810000: EnterCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,?,00007FF7E0803769,?,?,?,?,00007FF7E081B159), ref: 00007FF7E0810010

GetProcAddress.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0 ref: 00007FF7E0872A34
_Init_thread_footer.LIBCMT ref: 00007FF7E0872A4E

Part of subcall function 00007FF7E080FF98: EnterCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,?,00007FF7E0803790,?,?,?,?,00007FF7E081B159), ref: 00007FF7E080FFA8
Part of subcall function 00007FF7E080FF98: LeaveCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,?,00007FF7E0803790,?,?,?,?,00007FF7E081B159), ref: 00007FF7E080FFE8

Strings

EnterReaderModeHelper, xrefs: 00007FF7E0872A2D

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: CriticalSection$Enter$AddressInit_thread_footerLeaveProc
String ID: EnterReaderModeHelper
API String ID: 3610791082-2410284899
Opcode ID: 6408468371e059007db19b080bffcae9035abb3c54ebd5ce1f577aa1d0b52410
Instruction ID: 743e7530379746affd3f2c5ad42c8afcb05968b6d4b0e877f3f85a577902ca91
Opcode Fuzzy Hash: 6408468371e059007db19b080bffcae9035abb3c54ebd5ce1f577aa1d0b52410
Instruction Fuzzy Hash: 9F011E25A09A47C5EA54AB19E844379E3A0EF55B84FD48133D90D473A5CF3CF8A5CB22

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E07F83B4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 34libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0 ref: 00007FF7E07F83FE
GetProcAddress.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0 ref: 00007FF7E07F841F

Strings

GetWindowDPI, xrefs: 00007FF7E07F83F7

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: AddressProc
String ID: GetWindowDPI
API String ID: 190572456-1607898006
Opcode ID: 7963cc8ae5d42a880f6f4bb4dc426fd9a7a704e189a634b7059a7bb1a62bfdf9
Instruction ID: fcdcd2052aaf0bf0116e5a84b28a90c867e4672f3185ba6abd7d5f182b42e99e
Opcode Fuzzy Hash: 7963cc8ae5d42a880f6f4bb4dc426fd9a7a704e189a634b7059a7bb1a62bfdf9
Instruction Fuzzy Hash: 4D010C25A0DA869AFE95AB05E840338E760AF59B80FD94037C94D06761DF3CF8B5D722

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E0838B98 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 33fileCOMMON

Download Yara Rule

APIs

ReadFile.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF7E0838BB4
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF7E0838BC4

Strings

onecore\windows\core\console\open\src\host\ptysignalinputthread.cpp, xrefs: 00007FF7E0838BDA

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: ErrorFileLastRead
String ID: onecore\windows\core\console\open\src\host\ptysignalinputthread.cpp
API String ID: 1948546556-2623150832
Opcode ID: b24167ac88b1b39b30d1021e681d4306e257dd365b740657bbe55f44f84d8d54
Instruction ID: c3e7f020f08ea3cb58d98f232d5e2ed4f35b2553869b2969ec1a75d96991a3f8
Opcode Fuzzy Hash: b24167ac88b1b39b30d1021e681d4306e257dd365b740657bbe55f44f84d8d54
Instruction Fuzzy Hash: 5801AD62918282C7E7507B6090013BDE7A0FBC6305FC00132D64D47396CF3CF4248632

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E080E310 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 31libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0 ref: 00007FF7E080E332
GetProcAddress.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0 ref: 00007FF7E080E353

Strings

EnablePerMonitorDialogScaling, xrefs: 00007FF7E080E32B

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: AddressProc
String ID: EnablePerMonitorDialogScaling
API String ID: 190572456-2779642180
Opcode ID: 0079fc62416a13100da5c252f56f4719a30328b533a391102aec639347d7dfaa
Instruction ID: 1c12988ce1792c936fdea5c984626c74fe866769d61642dae069e2bddcc797b4
Opcode Fuzzy Hash: 0079fc62416a13100da5c252f56f4719a30328b533a391102aec639347d7dfaa
Instruction Fuzzy Hash: 0C012C24E0AB42A5FB116B50E840370EB90BF29704FD94137C90D46355DF3CB8A4D632

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E080DCAC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 27timeCOMMON

Download Yara Rule

APIs

DeleteTimerQueueTimer.API-MS-WIN-CORE-THREADPOOL-LEGACY-L1-1-0(?,?,?,00007FF7E082EC41,?,?,?,00007FF7E081D8A2), ref: 00007FF7E080DCCC

Strings

onecore\windows\core\console\open\src\host\cursorblinker.cpp, xrefs: 00007FF7E08270D6

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: Timer$DeleteQueue
String ID: onecore\windows\core\console\open\src\host\cursorblinker.cpp
API String ID: 672719580-1313982512
Opcode ID: 79a2b4b675a2aecf3e637692a4337ac872f0686dd98acaec53603e43800195b6
Instruction ID: 4475cf08754e5dc64d64d4db0b6ba5c2c1cee62d84ab81e18a0bb82688fd2923
Opcode Fuzzy Hash: 79a2b4b675a2aecf3e637692a4337ac872f0686dd98acaec53603e43800195b6
Instruction Fuzzy Hash: 8EF0626190894281F7206B65D410378E691EB49B78FD89332C97D423D0CF3CF451C636

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E084DA2C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24libraryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7E0810000: EnterCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,?,00007FF7E0803769,?,?,?,?,00007FF7E081B159), ref: 00007FF7E0810010

LoadLibraryExW.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0 ref: 00007FF7E084DA70

Part of subcall function 00007FF7E080FD30: _onexit.LIBCMT ref: 00007FF7E080FD34

_Init_thread_footer.LIBCMT ref: 00007FF7E084DA96

Part of subcall function 00007FF7E080FF98: EnterCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,?,00007FF7E0803790,?,?,?,?,00007FF7E081B159), ref: 00007FF7E080FFA8
Part of subcall function 00007FF7E080FF98: LeaveCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,?,00007FF7E0803790,?,?,?,?,00007FF7E081B159), ref: 00007FF7E080FFE8

Strings

ntdll.dll, xrefs: 00007FF7E084DA63

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: CriticalSection$Enter$Init_thread_footerLeaveLibraryLoad_onexit
String ID: ntdll.dll
API String ID: 626564473-2227199552
Opcode ID: 1a2441478f73351f8d3c7c190e8b51d6d46d8c46e0357a078076099465f3c9c3
Instruction ID: 3fd202fc6172dd04894e49fbdac0ba6b254a76434ea89630f6c9fa3186a6fa4b
Opcode Fuzzy Hash: 1a2441478f73351f8d3c7c190e8b51d6d46d8c46e0357a078076099465f3c9c3
Instruction Fuzzy Hash: 39F0C924A18A03C5EB40FB15EC91375B3A0BB85755FC09133D50D427A2DF3CB569CB22

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E07F3068 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

SetEvent.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,?,?,?,?,?,000001C82450C120,00007FF7E0807022), ref: 00007FF7E07F306C
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,?,?,?,?,?,000001C82450C120,00007FF7E0807022), ref: 00007FF7E081B15C

Strings

CreateWindowsWindow failed with status 0x%x, gle = 0x%x, xrefs: 00007FF7E081B16B

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: ErrorEventLast
String ID: CreateWindowsWindow failed with status 0x%x, gle = 0x%x
API String ID: 3848097054-2322296577
Opcode ID: 488acdefd44e3855263609e7cf5f2dc168a1e73e94e5fa4b2db815e81637fcfb
Instruction ID: a42a7830a67b61f3fd174a99bcb3ea9bb09c2d6ab07a2929e391eaad1ed71857
Opcode Fuzzy Hash: 488acdefd44e3855263609e7cf5f2dc168a1e73e94e5fa4b2db815e81637fcfb
Instruction Fuzzy Hash: C1E03065B0964386F9107715A401278DAA0AF89B90FD89032D90E47742DE3CF4608722

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E085B32C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 20COMMON

Download Yara Rule

APIs

?_Xout_of_range@std@@YAXPEBD@Z.MSVCP_WIN(?,?,?,?,00007FF7E0820557), ref: 00007FF7E085B360

Strings

invalid vector<T> subscript, xrefs: 00007FF7E085B359
VUUUUUUU, xrefs: 00007FF7E085B33A

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: Xout_of_range@std@@
String ID: VUUUUUUU$invalid vector<T> subscript
API String ID: 1960685668-3105710005
Opcode ID: 98cfa04ebded98f5afad50dee3c34c396a57aa3d8c235d8ab9d2f2bd380ad2e5
Instruction ID: b8cf8daf07acc1ddf551c09a5aa818be2b5f991c701035d6da6a6e1d2d91c027
Opcode Fuzzy Hash: 98cfa04ebded98f5afad50dee3c34c396a57aa3d8c235d8ab9d2f2bd380ad2e5
Instruction Fuzzy Hash: 44E086B5F11E8D82CA04AB19D845798D3A4FB69FC5BD08033DA4D17334EE3CA665C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E086FE20 Relevance: 5.2, APIs: 4, Instructions: 152COMMON

Download Yara Rule

APIs

EnterCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FF7E086FE3F
LeaveCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FF7E086FF17
LeaveCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FF7E086FFA6
LeaveCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FF7E0870061

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: CriticalSection$Leave$Enter
String ID:
API String ID: 2978645861-0
Opcode ID: 2c716912b7d65239af87600b58851e2715fb0953455623fe2a8201c418cc0109
Instruction ID: 203ef2b7a14bea55b66f4cf010b7053aa678d643a6da29bb6c61d72c15a34ebc
Opcode Fuzzy Hash: 2c716912b7d65239af87600b58851e2715fb0953455623fe2a8201c418cc0109
Instruction Fuzzy Hash: 1651DB36A1C68286E750EF20E4043BAE760FB89784F858432D98D97749DF3CF855CB61

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E08768E0 Relevance: 5.1, APIs: 4, Instructions: 132COMMON

Download Yara Rule

APIs

EnterCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FF7E0876914
LeaveCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FF7E08769A9
LeaveCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FF7E0876A37

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: CriticalSection$Leave$Enter
String ID:
API String ID: 2978645861-0
Opcode ID: 801f5be29e16ea4aa784275498de8b2104d85039a87f7e9569a178af70838083
Instruction ID: 1ad30747b26acc85cca6eabace535bf8b90929613c1f7626f0b1390f1c5fd623
Opcode Fuzzy Hash: 801f5be29e16ea4aa784275498de8b2104d85039a87f7e9569a178af70838083
Instruction Fuzzy Hash: 81518536618B4286E710EB15E44037AFBA0FB89B94F849132DE4E87758DF3CE465CB11

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E083078F Relevance: 5.1, APIs: 4, Instructions: 98COMMON

Download Yara Rule

APIs

_CxxThrowException.API-MS-WIN-CRT-PRIVATE-L1-1-0 ref: 00007FF7E08307B5
_CxxThrowException.API-MS-WIN-CRT-PRIVATE-L1-1-0 ref: 00007FF7E08307DD
memmove.API-MS-WIN-CRT-PRIVATE-L1-1-0 ref: 00007FF7E0830883

Part of subcall function 00007FF7E082B798: ?_Xlength_error@std@@YAXPEBD@Z.MSVCP_WIN(?,?,?,?,00007FF7E0805756,?,?,?,00007FF7E080524E,?,?,?,00007FF7E0805951), ref: 00007FF7E082B7A3

memmove.API-MS-WIN-CRT-PRIVATE-L1-1-0 ref: 00007FF7E08308A9

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: ExceptionThrowmemmove$Xlength_error@std@@
String ID:
API String ID: 3398810815-0
Opcode ID: 5e962fd1f47fb9a3aff22c556befd5b7f9e177a969863d3d70beab3284f45164
Instruction ID: 4c501ecd911e936f2b249d2c233e3f3c7ef810792cf5c7faedc5a309deb34eaa
Opcode Fuzzy Hash: 5e962fd1f47fb9a3aff22c556befd5b7f9e177a969863d3d70beab3284f45164
Instruction Fuzzy Hash: B731D062604B4186DA04EF6298011AAA761FB84BE0B548336EF7C4B7D5DF7CE162C340

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E08308E8 Relevance: 5.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

memmove.API-MS-WIN-CRT-PRIVATE-L1-1-0(?,?,?,00007FF7E082205D), ref: 00007FF7E0830989
memmove.API-MS-WIN-CRT-PRIVATE-L1-1-0(?,?,?,00007FF7E082205D), ref: 00007FF7E0830997

Part of subcall function 00007FF7E082B798: ?_Xlength_error@std@@YAXPEBD@Z.MSVCP_WIN(?,?,?,?,00007FF7E0805756,?,?,?,00007FF7E080524E,?,?,?,00007FF7E0805951), ref: 00007FF7E082B7A3

memmove.API-MS-WIN-CRT-PRIVATE-L1-1-0(?,?,?,00007FF7E082205D), ref: 00007FF7E08309B8
memmove.API-MS-WIN-CRT-PRIVATE-L1-1-0(?,?,?,00007FF7E082205D), ref: 00007FF7E08309C6

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: memmove$Xlength_error@std@@
String ID:
API String ID: 1743304318-0
Opcode ID: 1953338d2aa590173cdd92cc2939d58181b20cc250aae4e9ece25f184d8ebad0
Instruction ID: 750c491d253ac456526d2f0ecfc2490548067af7e35a0b10877c6536dd18c0e5
Opcode Fuzzy Hash: 1953338d2aa590173cdd92cc2939d58181b20cc250aae4e9ece25f184d8ebad0
Instruction Fuzzy Hash: FA21BC62704B4591EA00EF26A8051AAB765FB54BF0B904333EEBD4B7D6DE7CF0628315

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E0855A58 Relevance: 5.1, APIs: 4, Instructions: 65COMMON

Download Yara Rule

APIs

memmove.API-MS-WIN-CRT-PRIVATE-L1-1-0(?,00000000,?,00007FF7E085930A,?,?,?,?,?,00007FF7E0855124), ref: 00007FF7E0855AD8
memmove.API-MS-WIN-CRT-PRIVATE-L1-1-0(?,00000000,?,00007FF7E085930A,?,?,?,?,?,00007FF7E0855124), ref: 00007FF7E0855AE6

Part of subcall function 00007FF7E082B798: ?_Xlength_error@std@@YAXPEBD@Z.MSVCP_WIN(?,?,?,?,00007FF7E0805756,?,?,?,00007FF7E080524E,?,?,?,00007FF7E0805951), ref: 00007FF7E082B7A3

memmove.API-MS-WIN-CRT-PRIVATE-L1-1-0(?,00000000,?,00007FF7E085930A,?,?,?,?,?,00007FF7E0855124), ref: 00007FF7E0855B00
memmove.API-MS-WIN-CRT-PRIVATE-L1-1-0(?,00000000,?,00007FF7E085930A,?,?,?,?,?,00007FF7E0855124), ref: 00007FF7E0855B0E

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: memmove$Xlength_error@std@@
String ID:
API String ID: 1743304318-0
Opcode ID: 017907326591f0d0520ab236c7cb43a94def5834a608b486f2ac3cbead44069b
Instruction ID: df621daa690374c6e8824256c3707c76b1e33e94e8690cc241bd802cc4f1f596
Opcode Fuzzy Hash: 017907326591f0d0520ab236c7cb43a94def5834a608b486f2ac3cbead44069b
Instruction Fuzzy Hash: BF21D422608B8181DA10EF13A4412AAE751FB45FD0F844232DFAC0BB86CF7CF0628305

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E0878E0C Relevance: 5.1, APIs: 4, Instructions: 63COMMON

Download Yara Rule

APIs

memmove.API-MS-WIN-CRT-PRIVATE-L1-1-0(?,?,?,00007FF7E0879CDF,?,?,?,?,?,00007FF7E08791B3), ref: 00007FF7E0878E88
memset.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF7E0879CDF,?,?,?,?,?,00007FF7E08791B3), ref: 00007FF7E0878E95

Part of subcall function 00007FF7E082B798: ?_Xlength_error@std@@YAXPEBD@Z.MSVCP_WIN(?,?,?,?,00007FF7E0805756,?,?,?,00007FF7E080524E,?,?,?,00007FF7E0805951), ref: 00007FF7E082B7A3

memmove.API-MS-WIN-CRT-PRIVATE-L1-1-0(?,?,?,00007FF7E0879CDF,?,?,?,?,?,00007FF7E08791B3), ref: 00007FF7E0878EAF
memset.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF7E0879CDF,?,?,?,?,?,00007FF7E08791B3), ref: 00007FF7E0878EBC

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: memmovememset$Xlength_error@std@@
String ID:
API String ID: 4052520723-0
Opcode ID: 4c212326328f763e9787aafb0bb695f6ca2f842879b98c4516e607046bde80b4
Instruction ID: d7c400126e88bb263651272fdfd8850b534ec6bbca30c4361fa7f7be29e336f5
Opcode Fuzzy Hash: 4c212326328f763e9787aafb0bb695f6ca2f842879b98c4516e607046bde80b4
Instruction Fuzzy Hash: A121D422608B4181EA04EF5795452AEA755FB85FE0B884232DF9C17B96CF7CF0628302

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E0855BF8 Relevance: 5.1, APIs: 4, Instructions: 56COMMON

Download Yara Rule

APIs

memmove.API-MS-WIN-CRT-PRIVATE-L1-1-0(?,?,?,00007FF7E0859507), ref: 00007FF7E0855C70
memmove.API-MS-WIN-CRT-PRIVATE-L1-1-0(?,?,?,00007FF7E0859507), ref: 00007FF7E0855C7F

Part of subcall function 00007FF7E082B798: ?_Xlength_error@std@@YAXPEBD@Z.MSVCP_WIN(?,?,?,?,00007FF7E0805756,?,?,?,00007FF7E080524E,?,?,?,00007FF7E0805951), ref: 00007FF7E082B7A3

memmove.API-MS-WIN-CRT-PRIVATE-L1-1-0(?,?,?,00007FF7E0859507), ref: 00007FF7E0855C92
memmove.API-MS-WIN-CRT-PRIVATE-L1-1-0(?,?,?,00007FF7E0859507), ref: 00007FF7E0855CA1

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: memmove$Xlength_error@std@@
String ID:
API String ID: 1743304318-0
Opcode ID: b8113094cf135a0732a3d3e2425324adbc35465e090a28326cb28a86abdd2036
Instruction ID: ef1acf91cf6fa63b83a045829016368f0345ae5b87587e123763d8f6948acf57
Opcode Fuzzy Hash: b8113094cf135a0732a3d3e2425324adbc35465e090a28326cb28a86abdd2036
Instruction Fuzzy Hash: D8116D32608B41C5EA00EF12A5411AAA765FB45BD0B944633EEAD17B9ADF3CF1528311

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E08276EC Relevance: 5.0, APIs: 4, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,000001C8244F6718,00007FF7E0827503,?,?,?,00007FF7E0827FDB,?,?,?,?,?,00007FF7E080F3ED), ref: 00007FF7E082772A
HeapFree.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,000001C8244F6718,00007FF7E0827503,?,?,?,00007FF7E0827FDB,?,?,?,?,?,00007FF7E080F3ED), ref: 00007FF7E082773E
GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,000001C8244F6718,00007FF7E0827503,?,?,?,00007FF7E0827FDB,?,?,?,?,?,00007FF7E080F3ED), ref: 00007FF7E0827762
HeapFree.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,000001C8244F6718,00007FF7E0827503,?,?,?,00007FF7E0827FDB,?,?,?,?,?,00007FF7E080F3ED), ref: 00007FF7E0827776

Memory Dump Source

Source File: 00000000.00000002.2850072644.00007FF7E07F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E07F0000, based on PE: true

Associated: 00000000.00000002.2850058983.00007FF7E07F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850126338.00007FF7E088C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850150343.00007FF7E08B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2850178107.00007FF7E08B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e07f0000_conhost[1].jbxd

Similarity

API ID: Heap$FreeProcess
String ID:
API String ID: 3859560861-0
Opcode ID: f7b5aed4725566fb19b2371a8865856982d53bdb2b3084854420066a7382e902
Instruction ID: 6538b9e3f41b601472796e7eb2f81fb62f9216e672b07cb3c97d1d2cc8ad2227
Opcode Fuzzy Hash: f7b5aed4725566fb19b2371a8865856982d53bdb2b3084854420066a7382e902
Instruction Fuzzy Hash: 5811DA36604F81CAD7149F12E4401A9BBB4F789F81B999126DB8E27715CF38E566C710

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report conhost[1].exe

Overview

General Information

Detection

Signatures

Classification

Analysis Advice

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

Compliance

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

back

Behavior

System Behavior

Analysis Process: conhost[1].exePID: 6884, Parent PID: 2580

General

Chronological Activities

Analysis Process: cmd.exePID: 6948, Parent PID: 6884

General

Chronological Activities

Disassembly

Windows Analysis Report
conhost[1].exe

Function 00007FF7E086A2D4 Relevance: 60.0, APIs: 28, Strings: 6, Instructions: 483
COMMON

Function 00007FF7E08001E0 Relevance: 26.9, APIs: 9, Strings: 6, Instructions: 696
COMMON

Function 00007FF7E07F3840 Relevance: 21.3, APIs: 7, Strings: 5, Instructions: 268
COMMON

Function 00007FF7E07F4030 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 207
COMMON

Function 00007FF7E0807F10 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 144
memoryregistryCOMMON

Function 00007FF7E08024C0 Relevance: 14.3, APIs: 4, Strings: 4, Instructions: 310
COMMON

Function 00007FF7E080FD8C Relevance: 28.1, APIs: 11, Strings: 5, Instructions: 141
libraryloaderCOMMON

Function 00007FF7E0808200 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 110
registryCOMMON

Function 00007FF7E07F8AF4 Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 203
COMMON

Function 00007FF7E07F364C Relevance: 16.6, APIs: 11, Instructions: 117
windowCOMMON

Function 00007FF7E07F6740 Relevance: 16.0, APIs: 7, Strings: 2, Instructions: 242
COMMON

Function 00007FF7E0808318 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 169
registryCOMMON

Function 00007FF7E080F5D0 Relevance: 13.6, APIs: 9, Instructions: 106
COMMON

Function 00007FF7E0800ED0 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 161
COMMON

Function 00007FF7E0807980 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 117
threadCOMMON