Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
mine327.exe

Overview

General Information

Sample name:mine327.exe
Analysis ID:1417451
MD5:f3e70f68d7e2f644bcd312f1333094e1
SHA1:259dd00ddb8a08fb149c37254bfb865a74bb11b9
SHA256:6607d552accc951f2cd068bb394200987d7d1e90e34f8cdab3afe6e3ccedee4e
Infos:

Detection

Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Antivirus / Scanner detection for submitted sample
Benign windows process drops PE files
Detected unpacking (creates a PE file in dynamic memory)
Early bird code injection technique detected
Multi AV Scanner detection for submitted file
Sigma detected: Stop EventLog
Yara detected AntiVM3
Yara detected UAC Bypass using CMSTP
Allocates memory in foreign processes
Changes memory attributes in foreign processes to executable or writable
Contains functionality to compare user and computer (likely to detect sandboxes)
Contains functionality to inject code into remote processes
Creates a thread in another existing process (thread injection)
Creates files in the system32 config directory
Found direct / indirect Syscall (likely to bypass EDR)
Injects a PE file into a foreign processes
Injects code into the Windows Explorer (explorer.exe)
Machine Learning detection for sample
Modifies the context of a thread in another process (thread injection)
Queues an APC in another process (thread injection)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Writes to foreign memory regions
AV process strings found (often used to terminate AV products)
Allocates memory with a write watch (potentially for evading sandboxes)
Binary contains a suspicious time stamp
Checks if the current process is being debugged
Contains functionality to call native functions
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to check if a window is minimized (may be used to check if an application is visible)
Contains functionality to communicate with device drivers
Contains functionality to dynamically determine API calls
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Contains functionality to query CPU information (cpuid)
Contains functionality to query locales information (e.g. system language)
Contains functionality to record screenshots
Contains functionality to retrieve information about pressed keystrokes
Contains functionality to shutdown / reboot the system
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Creates a process in suspended mode (likely to inject code)
Creates files inside the system directory
Creates or modifies windows services
Detected potential crypto function
Drops PE files
Drops PE files to the application program directory (C:\ProgramData)
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found evasive API chain checking for process token information
Found inlined nop instructions (likely shell or obfuscated code)
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
May sleep (evasive loops) to hinder dynamic analysis
One or more processes crash
PE file does not import any functions
Potential key logger detected (key state polling based)
Queries the volume information (name, serial number etc) of a device
Queries time zone information
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Sigma detected: Explorer Process Tree Break
Sigma detected: Uncommon Svchost Parent Process
Tries to load missing DLLs
Uses code obfuscation techniques (call, push, ret)
Uses the system / local time for branch decision (may execute only at specific dates)

Classification

Process Tree

  • System is w7x64
  • mine327.exe (PID: 1436 cmdline: "C:\Users\user\Desktop\mine327.exe" MD5: F3E70F68D7E2F644BCD312F1333094E1)
    • explorer.exe (PID: 2996 cmdline: "C:\Windows\explorer.exe" MD5: 38AE1B3C38FAEF56FE4907922F0385BA)
      • dialer.exe (PID: 2096 cmdline: C:\Windows\system32\dialer.exe MD5: 46523E17EE0F6837746924EDA7E9BAC9)
        • services.exe (PID: 404 cmdline: C:\Windows\system32\services.exe MD5: 71C85477DF9347FE8E7BC55768473FCA)
          • svchost.exe (PID: 492 cmdline: C:\Windows\System32\svchost.exe -k WerSvcGroup MD5: C78655BC80301D76ED4FEF1C1EA40A7D)
            • WerFault.exe (PID: 1096 cmdline: C:\Windows\system32\WerFault.exe -u -p 1436 -s 724 MD5: 8784236EED5079493DA9FC95B28B89F8)
          • oapavmkbdsqp.exe (PID: 2360 cmdline: C:\ProgramData\jjfvbumjfczj\oapavmkbdsqp.exe MD5: 38AE1B3C38FAEF56FE4907922F0385BA)
        • winlogon.exe (PID: 412 cmdline: winlogon.exe MD5: 8CEBD9D0A0A879CDE9F36F4383B7CAEA)
        • conhost.exe (PID: 1640 cmdline: C:\Windows\system32\conhost.exe "-1634546190-146323334895602099619948307862079476161-1963036748880124969-1741426452" MD5: CE476F23405AADC46039AC13127DF473)
        • lsass.exe (PID: 448 cmdline: C:\Windows\system32\lsass.exe MD5: CA69E856332E2D85294665F6B7E97254)
        • lsm.exe (PID: 456 cmdline: C:\Windows\system32\lsm.exe MD5: 9662EE182644511439F1C53745DC1C88)
        • svchost.exe (PID: 564 cmdline: C:\Windows\system32\svchost.exe -k DcomLaunch MD5: C78655BC80301D76ED4FEF1C1EA40A7D)
        • svchost.exe (PID: 644 cmdline: C:\Windows\system32\svchost.exe -k RPCSS MD5: C78655BC80301D76ED4FEF1C1EA40A7D)
        • svchost.exe (PID: 732 cmdline: C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted MD5: C78655BC80301D76ED4FEF1C1EA40A7D)
        • svchost.exe (PID: 788 cmdline: C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted MD5: C78655BC80301D76ED4FEF1C1EA40A7D)
        • svchost.exe (PID: 832 cmdline: C:\Windows\system32\svchost.exe -k LocalService MD5: C78655BC80301D76ED4FEF1C1EA40A7D)
        • svchost.exe (PID: 884 cmdline: C:\Windows\system32\svchost.exe -k netsvcs MD5: C78655BC80301D76ED4FEF1C1EA40A7D)
        • svchost.exe (PID: 988 cmdline: C:\Windows\system32\svchost.exe -k GPSvcGroup MD5: C78655BC80301D76ED4FEF1C1EA40A7D)
        • svchost.exe (PID: 508 cmdline: C:\Windows\system32\svchost.exe -k NetworkService MD5: C78655BC80301D76ED4FEF1C1EA40A7D)
        • spoolsv.exe (PID: 1104 cmdline: C:\Windows\System32\spoolsv.exe MD5: B96C17B5DC1424D56EEA3A99E97428CD)
        • svchost.exe (PID: 1168 cmdline: C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork MD5: C78655BC80301D76ED4FEF1C1EA40A7D)
        • dwm.exe (PID: 1188 cmdline: "C:\Windows\system32\Dwm.exe" MD5: F162D5F5E845B9DC352DD1BAD8CEF1BC)
        • explorer.exe (PID: 1244 cmdline: C:\Windows\Explorer.EXE MD5: 38AE1B3C38FAEF56FE4907922F0385BA)
        • taskeng.exe (PID: 1476 cmdline: taskeng.exe {0261976F-A640-459E-8DC4-21A56BEEBB73} S-1-5-18:NT AUTHORITY\System:Service: MD5: 65EA57712340C09B1B0C427B4848AE05)
        • UI0Detect.exe (PID: 1528 cmdline: C:\Windows\system32\UI0Detect.exe MD5: 3CBDEC8D06B9968ABA702EBA076364A1)
        • WmiPrvSE.exe (PID: 1820 cmdline: C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding MD5: D683C112190F4B4C6D477D693EE88E35)
        • svchost.exe (PID: 2020 cmdline: C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted MD5: C78655BC80301D76ED4FEF1C1EA40A7D)
        • WmiPrvSE.exe (PID: 2776 cmdline: C:\Windows\system32\wbem\wmiprvse.exe -Embedding MD5: D683C112190F4B4C6D477D693EE88E35)
        • WmiPrvSE.exe (PID: 2032 cmdline: MD5: D683C112190F4B4C6D477D693EE88E35)
      • sc.exe (PID: 1440 cmdline: C:\Windows\system32\sc.exe delete "GVKQGWZS" MD5: 4EBBC2B0AD7F9075AE9D6835D2A62B6E)
      • sc.exe (PID: 1200 cmdline: C:\Windows\system32\sc.exe create "GVKQGWZS" binpath= "C:\ProgramData\jjfvbumjfczj\oapavmkbdsqp.exe" start= "auto" MD5: 4EBBC2B0AD7F9075AE9D6835D2A62B6E)
      • sc.exe (PID: 2572 cmdline: C:\Windows\system32\sc.exe stop eventlog MD5: 4EBBC2B0AD7F9075AE9D6835D2A62B6E)
      • sc.exe (PID: 980 cmdline: C:\Windows\system32\sc.exe start "GVKQGWZS" MD5: 4EBBC2B0AD7F9075AE9D6835D2A62B6E)
  • conhost.exe (PID: 2360 cmdline: C:\Windows\system32\conhost.exe "139732321118494632871898021326457884-543674567-14929065572102852035-708161083" MD5: CE476F23405AADC46039AC13127DF473)
  • explorer.exe (PID: 2192 cmdline: C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding MD5: 38AE1B3C38FAEF56FE4907922F0385BA)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

Memory Dumps

SourceRuleDescriptionAuthorStrings
00000000.00000002.377843630.00000000029FE000.00000004.00000800.00020000.00000000.sdmpJoeSecurity_UACBypassusingCMSTPYara detected UAC Bypass using CMSTPJoe Security
    Process Memory Space: mine327.exe PID: 1436JoeSecurity_AntiVM_3Yara detected AntiVM_3Joe Security
      Process Memory Space: mine327.exe PID: 1436JoeSecurity_UACBypassusingCMSTPYara detected UAC Bypass using CMSTPJoe Security

        Sigma Signatures

        Sigma detected: Explorer Process Tree Break
        Source: Process startedAuthor: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems), @gott_cyber: Data: Command: C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding, CommandLine: C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding, CommandLine|base64offset|contains: Iyb, Image: C:\Windows\explorer.exe, NewProcessName: C:\Windows\explorer.exe, OriginalFileName: C:\Windows\explorer.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 564, ProcessCommandLine: C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding, ProcessId: 2192, ProcessName: explorer.exe
        Sigma detected: Uncommon Svchost Parent Process
        Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: C:\Windows\system32\svchost.exe -k DcomLaunch, CommandLine: C:\Windows\system32\svchost.exe -k DcomLaunch, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: C:\Windows\system32\dialer.exe, ParentImage: C:\Windows\System32\dialer.exe, ParentProcessId: 2096, ParentProcessName: dialer.exe, ProcessCommandLine: C:\Windows\system32\svchost.exe -k DcomLaunch, ProcessId: 564, ProcessName: svchost.exe
        Sigma detected: New Service Creation Using Sc.EXE
        Source: Process startedAuthor: Timur Zinniatullin, Daniil Yugoslavskiy, oscd.community: Data: Command: C:\Windows\system32\sc.exe create "GVKQGWZS" binpath= "C:\ProgramData\jjfvbumjfczj\oapavmkbdsqp.exe" start= "auto", CommandLine: C:\Windows\system32\sc.exe create "GVKQGWZS" binpath= "C:\ProgramData\jjfvbumjfczj\oapavmkbdsqp.exe" start= "auto", CommandLine|base64offset|contains: r, Image: C:\Windows\System32\sc.exe, NewProcessName: C:\Windows\System32\sc.exe, OriginalFileName: C:\Windows\System32\sc.exe, ParentCommandLine: "C:\Windows\explorer.exe", ParentImage: C:\Windows\explorer.exe, ParentProcessId: 2996, ParentProcessName: explorer.exe, ProcessCommandLine: C:\Windows\system32\sc.exe create "GVKQGWZS" binpath= "C:\ProgramData\jjfvbumjfczj\oapavmkbdsqp.exe" start= "auto", ProcessId: 1200, ProcessName: sc.exe

        HIPS / PFW / Operating System Protection Evasion

        barindex
        Sigma detected: Stop EventLog
        Source: Process startedAuthor: Joe Security: Data: Command: C:\Windows\system32\sc.exe stop eventlog, CommandLine: C:\Windows\system32\sc.exe stop eventlog, CommandLine|base64offset|contains: ), Image: C:\Windows\System32\sc.exe, NewProcessName: C:\Windows\System32\sc.exe, OriginalFileName: C:\Windows\System32\sc.exe, ParentCommandLine: "C:\Windows\explorer.exe", ParentImage: C:\Windows\explorer.exe, ParentProcessId: 2996, ParentProcessName: explorer.exe, ProcessCommandLine: C:\Windows\system32\sc.exe stop eventlog, ProcessId: 2572, ProcessName: sc.exe

        Snort Signatures

        ⊘No Snort rule has matched

        Joe Sandbox Signatures

        Click to jump to signature section

        Show All Signature Results

        AV Detection

        barindex
        Antivirus / Scanner detection for submitted sample
        Source: mine327.exeAvira: detected
        Multi AV Scanner detection for submitted file
        Source: mine327.exeReversingLabs: Detection: 69%
        Source: mine327.exeVirustotal: Detection: 48%Perma Link
        Machine Learning detection for sample
        Source: mine327.exeJoe Sandbox ML: detected

        Exploits

        barindex
        Yara detected UAC Bypass using CMSTP
        Source: Yara matchFile source: 00000000.00000002.377843630.00000000029FE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
        Source: Yara matchFile source: Process Memory Space: mine327.exe PID: 1436, type: MEMORYSTR

        Compliance

        barindex
        Detected unpacking (creates a PE file in dynamic memory)
        Source: C:\ProgramData\jjfvbumjfczj\oapavmkbdsqp.exeUnpacked PE file: 16.2.oapavmkbdsqp.exe.280000.1.unpack
        Source: mine327.exeStatic PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
        Source: Binary string: .assembly\GAC_MSC:\Users\user\Desktop\Fallkyriya.pdb3fPwty0 source: mine327.exe, 00000000.00000002.377689220.00000000002E2000.00000004.00000010.00020000.00000000.sdmp
        Source: Binary string: ..pdb source: mine327.exe, 00000000.00000002.377689220.00000000002E2000.00000004.00000010.00020000.00000000.sdmp
        Source: Binary string: :\Windows\Containers\Confidential\DotnetGenerator\Stub\Projects\Fallkyriya\obj\Release\Fallkyriya.pdb.pdb source: mine327.exe, 00000000.00000002.377603583.000000000012A000.00000004.00000020.00020000.00000000.sdmp
        Source: Binary string: C:\Windows\Containers\Confidential\DotnetGenerator\Stub\Projects\Fallkyriya\obj\Release\Fallkyriya.pdb.pdb source: mine327.exe, 00000000.00000002.379248247.000000001B31E000.00000004.00000020.00020000.00000000.sdmp
        Source: Binary string: mscoree.pdbb source: WerFault.exe, 0000000A.00000002.372971964.000000000245F000.00000004.00000001.00020000.00000000.sdmp
        Source: Binary string: C:\Windows\Containers\Confidential\DotnetGenerator\Stub\Projects\Fallkyriya\obj\Release\Fallkyriya.pdb source: mine327.exe, 00000000.00000000.333303562.0000000001292000.00000020.00000001.01000000.00000003.sdmp
        Source: Binary string: al\DotnetGenerator\Stub\Projects\Fallkyriya\obj\Release\Fallkyriya.pdb source: mine327.exe, 00000000.00000002.377689220.00000000002E2000.00000004.00000010.00020000.00000000.sdmp
        Source: Binary string: .C:\Users\user\Desktop\mine327.PDB source: mine327.exe, 00000000.00000002.377689220.00000000002E2000.00000004.00000010.00020000.00000000.sdmp
        Source: Binary string: C:\Users\user\Desktop\mine327.PDB source: mine327.exe, 00000000.00000002.377689220.00000000002E2000.00000004.00000010.00020000.00000000.sdmp
        Source: Binary string: mscorlib.ni.pdb source: WerFault.exe, 0000000A.00000002.375318351.00000000026B8000.00000004.00000001.00020000.00000000.sdmp
        Source: Binary string: 2wmine327.PDB source: mine327.exe, 00000000.00000002.377689220.00000000002E2000.00000004.00000010.00020000.00000000.sdmp
        Source: Binary string: explorer.pdb source: explorer.exe, 00000002.00000003.341979658.0000000000430000.00000004.00000001.00020000.00000000.sdmp, oapavmkbdsqp.exe, oapavmkbdsqp.exe, 00000010.00000002.409921933.00000000FF621000.00000020.00000001.01000000.00000007.sdmp
        Source: Binary string: 8C:\Windows\Fallkyriya.pdb source: mine327.exe, 00000000.00000002.377689220.00000000002E2000.00000004.00000010.00020000.00000000.sdmp
        Source: Binary string: symbols\exe\Fallkyriya.pdbb4 source: mine327.exe, 00000000.00000002.377689220.00000000002E2000.00000004.00000010.00020000.00000000.sdmp
        Source: Binary string: explorer.pdbP source: explorer.exe, 00000002.00000003.341979658.0000000000430000.00000004.00000001.00020000.00000000.sdmp
        Source: Binary string: mscoree.pdb source: WerFault.exe, 0000000A.00000002.372971964.000000000245F000.00000004.00000001.00020000.00000000.sdmp
        Source: Binary string: C:\Windows\Containers\Confidential\DotnetGenerator\Stub\Projects\Fallkyriya\obj\Release\Fallkyriya.pdb/ source: mine327.exe, 00000000.00000002.377689220.00000000002E2000.00000004.00000010.00020000.00000000.sdmp
        Source: C:\Users\user\Desktop\mine327.exeCode function: 0_2_0057DCE0 FindFirstFileExW,0_2_0057DCE0
        Source: C:\Windows\System32\services.exeCode function: 6_2_001FDCE0 FindFirstFileExW,6_2_001FDCE0
        Source: C:\Windows\System32\WerFault.exeCode function: 10_2_0248DCE0 FindFirstFileExW,10_2_0248DCE0
        Source: C:\Windows\System32\winlogon.exeCode function: 12_2_0098DCE0 FindFirstFileExW,12_2_0098DCE0
        Source: C:\Windows\System32\sc.exeCode function: 13_2_0016DCE0 FindFirstFileExW,13_2_0016DCE0
        Source: C:\Windows\System32\conhost.exeCode function: 15_2_0020DCE0 FindFirstFileExW,15_2_0020DCE0
        Source: C:\ProgramData\jjfvbumjfczj\oapavmkbdsqp.exeCode function: 16_2_0028DCE0 FindFirstFileExW,16_2_0028DCE0
        Source: C:\ProgramData\jjfvbumjfczj\oapavmkbdsqp.exeCode function: 16_2_002FDCE0 FindFirstFileExW,16_2_002FDCE0
        Source: C:\ProgramData\jjfvbumjfczj\oapavmkbdsqp.exeCode function: 16_2_FF63F060 SHGetFolderPathEx,StrChrW,FindFirstFileW,PathRemoveFileSpecW,CompareStringOrdinal,lstrcmpiW,GetDesktopWindow,#292,FindNextFileW,FindClose,16_2_FF63F060
        Source: C:\Windows\System32\lsass.exeCode function: 17_2_009CDCE0 FindFirstFileExW,17_2_009CDCE0
        Source: C:\Windows\System32\lsm.exeCode function: 19_2_0026DCE0 FindFirstFileExW,19_2_0026DCE0
        Source: C:\Windows\System32\svchost.exeCode function: 20_2_006BDCE0 FindFirstFileExW,20_2_006BDCE0
        Source: C:\Windows\System32\svchost.exeCode function: 22_2_014ADCE0 FindFirstFileExW,22_2_014ADCE0
        Source: C:\Windows\System32\svchost.exeCode function: 23_2_00BCDCE0 FindFirstFileExW,23_2_00BCDCE0
        Source: C:\Windows\System32\svchost.exeCode function: 24_2_00A7DCE0 FindFirstFileExW,24_2_00A7DCE0
        Source: C:\Windows\System32\svchost.exeCode function: 25_2_00C6DCE0 FindFirstFileExW,25_2_00C6DCE0
        Source: C:\Windows\System32\svchost.exeCode function: 26_2_002CDCE0 FindFirstFileExW,26_2_002CDCE0
        Source: C:\ProgramData\jjfvbumjfczj\oapavmkbdsqp.exeCode function: 4x nop then mov qword ptr [rsp+10h], rbx16_2_FF625AF6
        Source: C:\ProgramData\jjfvbumjfczj\oapavmkbdsqp.exeCode function: 4x nop then mov rax, rsp16_2_FF62611B
        Source: C:\ProgramData\jjfvbumjfczj\oapavmkbdsqp.exeCode function: 4x nop then mov qword ptr [rsp+08h], rbx16_2_FF654044
        Source: WerFault.exe, 0000000A.00000002.376314972.0000000003A63000.00000004.00000001.00020000.00000000.sdmp, WerFault.exe, 0000000A.00000003.363740029.0000000003A63000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: www.login.yahoo.com0 equals www.yahoo.com (Yahoo)
        Source: WerFault.exe, 0000000A.00000002.376314972.0000000003A63000.00000004.00000001.00020000.00000000.sdmp, WerFault.exe, 0000000A.00000003.363740029.0000000003A63000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
        Source: WerFault.exe, 0000000A.00000002.376314972.0000000003A41000.00000004.00000001.00020000.00000000.sdmp, WerFault.exe, 0000000A.00000003.363740029.0000000003A41000.00000004.00000001.00020000.00000000.sdmp, WerFault.exe, 0000000A.00000003.363658371.000000000044C000.00000004.00000001.00020000.00000000.sdmp, WerFault.exe, 0000000A.00000002.367143979.000000000044C000.00000004.00000001.00020000.00000000.sdmp, WerFault.exe, 0000000A.00000002.376314972.0000000003A63000.00000004.00000001.00020000.00000000.sdmp, WerFault.exe, 0000000A.00000003.363740029.0000000003A63000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://crl.comodoca.com/UTN-USERFirst-Hardware.crl06
        Source: WerFault.exe, 0000000A.00000002.376314972.0000000003A41000.00000004.00000001.00020000.00000000.sdmp, WerFault.exe, 0000000A.00000003.363740029.0000000003A41000.00000004.00000001.00020000.00000000.sdmp, WerFault.exe, 0000000A.00000002.376314972.0000000003A63000.00000004.00000001.00020000.00000000.sdmp, WerFault.exe, 0000000A.00000003.363740029.0000000003A63000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://crl.entrust.net/2048ca.crl0
        Source: WerFault.exe, 0000000A.00000002.367143979.00000000003CF000.00000004.00000001.00020000.00000000.sdmp, WerFault.exe, 0000000A.00000003.363658371.00000000003C2000.00000004.00000001.00020000.00000000.sdmp, WerFault.exe, 0000000A.00000002.376314972.0000000003A63000.00000004.00000001.00020000.00000000.sdmp, WerFault.exe, 0000000A.00000003.363740029.0000000003A63000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://crl.entrust.net/server1.crl0
        Source: WerFault.exe, 0000000A.00000002.376314972.0000000003A63000.00000004.00000001.00020000.00000000.sdmp, WerFault.exe, 0000000A.00000003.363740029.0000000003A63000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://crl.globalsign.net/root-r2.crl0
        Source: lsass.exe, 00000011.00000000.343011330.0000000001220000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://crl.pki.goog/gsr1/gsr1.crl0;
        Source: lsass.exe, 00000011.00000002.606687725.0000000001220000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000011.00000000.343011330.000000000122E000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000011.00000000.343011330.0000000001220000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://crl.pki.goog/gtsr1/gtsr1.crl0W
        Source: WerFault.exe, 0000000A.00000002.375602362.00000000039FE000.00000004.00000001.00020000.00000000.sdmp, WerFault.exe, 0000000A.00000002.376314972.0000000003A63000.00000004.00000001.00020000.00000000.sdmp, WerFault.exe, 0000000A.00000003.363740029.0000000003A63000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0
        Source: WerFault.exe, 0000000A.00000002.376314972.0000000003A63000.00000004.00000001.00020000.00000000.sdmp, WerFault.exe, 0000000A.00000003.363740029.0000000003A63000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://crl.pkioverheid.nl/DomOvLatestCRL.crl0
        Source: lsass.exe, 00000011.00000002.606687725.0000000001220000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000011.00000000.343011330.000000000122E000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://crls.pki.goog/gts1c3/moVDfISia2k.crl0
        Source: explorer.exe, 0000001F.00000002.602714101.00000000001D6000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001F.00000000.349660283.00000000001D6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://java.sun.com
        Source: WerFault.exe, 0000000A.00000002.376314972.0000000003A63000.00000004.00000001.00020000.00000000.sdmp, WerFault.exe, 0000000A.00000003.363740029.0000000003A63000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://ocsp.comodoca.com0
        Source: WerFault.exe, 0000000A.00000003.363658371.000000000044C000.00000004.00000001.00020000.00000000.sdmp, WerFault.exe, 0000000A.00000002.367143979.000000000044C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://ocsp.comodoca.com0%
        Source: WerFault.exe, 0000000A.00000002.376314972.0000000003A63000.00000004.00000001.00020000.00000000.sdmp, WerFault.exe, 0000000A.00000003.363740029.0000000003A63000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://ocsp.comodoca.com0-
        Source: WerFault.exe, 0000000A.00000003.363658371.000000000044C000.00000004.00000001.00020000.00000000.sdmp, WerFault.exe, 0000000A.00000002.367143979.000000000044C000.00000004.00000001.00020000.00000000.sdmp, WerFault.exe, 0000000A.00000002.376314972.0000000003A63000.00000004.00000001.00020000.00000000.sdmp, WerFault.exe, 0000000A.00000003.363740029.0000000003A63000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://ocsp.comodoca.com0/
        Source: WerFault.exe, 0000000A.00000002.376314972.0000000003A41000.00000004.00000001.00020000.00000000.sdmp, WerFault.exe, 0000000A.00000003.363740029.0000000003A41000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://ocsp.comodoca.com05
        Source: WerFault.exe, 0000000A.00000002.367143979.00000000003CF000.00000004.00000001.00020000.00000000.sdmp, WerFault.exe, 0000000A.00000003.363658371.00000000003C2000.00000004.00000001.00020000.00000000.sdmp, WerFault.exe, 0000000A.00000002.376314972.0000000003A63000.00000004.00000001.00020000.00000000.sdmp, WerFault.exe, 0000000A.00000003.363740029.0000000003A63000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://ocsp.entrust.net03
        Source: WerFault.exe, 0000000A.00000002.376314972.0000000003A41000.00000004.00000001.00020000.00000000.sdmp, WerFault.exe, 0000000A.00000003.363740029.0000000003A41000.00000004.00000001.00020000.00000000.sdmp, WerFault.exe, 0000000A.00000002.376314972.0000000003A63000.00000004.00000001.00020000.00000000.sdmp, WerFault.exe, 0000000A.00000003.363740029.0000000003A63000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://ocsp.entrust.net0D
        Source: lsass.exe, 00000011.00000000.343011330.0000000001220000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://ocsp.pki.goog/gsr10)
        Source: lsass.exe, 00000011.00000002.606687725.0000000001220000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000011.00000000.343011330.000000000122E000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000011.00000000.342781591.000000000022B000.00000004.00000020.00020000.00000000.sdmp, lsass.exe, 00000011.00000002.603202980.000000000022B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.pki.goog/gts1c301
        Source: lsass.exe, 00000011.00000002.606687725.0000000001220000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000011.00000000.343011330.000000000122E000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000011.00000000.343011330.0000000001220000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://ocsp.pki.goog/gtsr100
        Source: lsass.exe, 00000011.00000000.343011330.0000000001220000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://pki.goog/gsr1/gsr1.crt02
        Source: lsass.exe, 00000011.00000002.606687725.0000000001220000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000011.00000000.343011330.000000000122E000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000011.00000000.342781591.000000000022B000.00000004.00000020.00020000.00000000.sdmp, lsass.exe, 00000011.00000002.603202980.000000000022B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://pki.goog/repo/certs/gts1c3.der0
        Source: lsass.exe, 00000011.00000002.606687725.0000000001220000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000011.00000000.343011330.000000000122E000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000011.00000000.343011330.0000000001220000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://pki.goog/repo/certs/gtsr1.der04
        Source: svchost.exe, 00000016.00000000.345782413.0000000001FFC000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000016.00000002.605131595.0000000001FFC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://schemas.com/win/2004/08/events
        Source: svchost.exe, 00000019.00000000.346998279.0000000001FD6000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000019.00000002.608643399.0000000001FD6000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://schemas.micro
        Source: explorer.exe, 0000001F.00000002.602714101.00000000001D6000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001F.00000000.349660283.00000000001D6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.autoitscript.com/autoit3
        Source: WerFault.exe, 0000000A.00000002.376314972.0000000003A41000.00000004.00000001.00020000.00000000.sdmp, WerFault.exe, 0000000A.00000003.363740029.0000000003A41000.00000004.00000001.00020000.00000000.sdmp, WerFault.exe, 0000000A.00000002.376314972.0000000003A63000.00000004.00000001.00020000.00000000.sdmp, WerFault.exe, 0000000A.00000003.363740029.0000000003A63000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.digicert.com.my/cps.htm02
        Source: WerFault.exe, 0000000A.00000002.375602362.00000000039FE000.00000004.00000001.00020000.00000000.sdmp, WerFault.exe, 0000000A.00000002.376314972.0000000003A63000.00000004.00000001.00020000.00000000.sdmp, WerFault.exe, 0000000A.00000003.363740029.0000000003A63000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.diginotar.nl/cps/pkioverheid0
        Source: explorer.exe, 0000001F.00000002.606706574.0000000003DB1000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001F.00000000.350381000.0000000003DB1000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001F.00000000.350097876.000000000260E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001F.00000002.608288265.0000000007AE8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001F.00000000.350702735.0000000007AE8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001F.00000002.606706574.0000000003E98000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001F.00000000.350381000.0000000003E98000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001F.00000002.604991513.000000000260E000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.piriform.com/ccleaner
        Source: explorer.exe, 0000001F.00000002.606706574.0000000003DB1000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001F.00000000.350381000.0000000003DB1000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001F.00000000.350097876.000000000260E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001F.00000002.608288265.0000000007AE8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001F.00000000.350702735.0000000007AE8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001F.00000002.606706574.0000000003E98000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001F.00000000.350381000.0000000003E98000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001F.00000002.604991513.000000000260E000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.piriform.com/ccleanerhttp://www.piriform.com/ccleanerv
        Source: explorer.exe, 0000001F.00000000.350097876.000000000260E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001F.00000002.604991513.000000000260E000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.piriform.com/ccleanerxe
        Source: lsass.exe, 00000011.00000002.606687725.0000000001220000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000011.00000000.343011330.000000000122E000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000011.00000000.343011330.0000000001220000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://pki.goog/repository/0
        Source: WerFault.exe, 0000000A.00000002.376314972.0000000003A41000.00000004.00000001.00020000.00000000.sdmp, WerFault.exe, 0000000A.00000003.363740029.0000000003A41000.00000004.00000001.00020000.00000000.sdmp, WerFault.exe, 0000000A.00000003.363658371.000000000044C000.00000004.00000001.00020000.00000000.sdmp, WerFault.exe, 0000000A.00000002.367143979.000000000044C000.00000004.00000001.00020000.00000000.sdmp, WerFault.exe, 0000000A.00000002.376314972.0000000003A63000.00000004.00000001.00020000.00000000.sdmp, WerFault.exe, 0000000A.00000003.363740029.0000000003A63000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://secure.comodo.com/CPS0
        Source: explorer.exe, 0000001F.00000002.602714101.00000000001D6000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001F.00000000.349660283.00000000001D6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://support.mozilla.org
        Source: svchost.exe, 00000018.00000002.603627532.0000000002668000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000018.00000000.346476637.0000000002668000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://update.googleapis.com/service/update2?cup2key=13:9PlIcYzJ7FuPKbYwS8xEdZ3KAlYn7hgULJcTQTtHhro
        Source: explorer.exe, 0000001F.00000002.602714101.00000000001D6000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001F.00000000.349660283.00000000001D6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.mozilla.org
        Source: explorer.exe, 0000001F.00000002.602714101.00000000001D6000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001F.00000000.349660283.00000000001D6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/firefox/52.0.1/releasenotes
        Source: C:\ProgramData\jjfvbumjfczj\oapavmkbdsqp.exeCode function: 16_2_FF650F00 GetDC,CreateCompatibleDC,GetClientRect,memset,CreateDIBSection,SelectObject,GdiAlphaBlend,SelectObject,DeleteObject,DeleteDC,ReleaseDC,GetClientRect,memset,CreateDIBSection,SelectObject,CreateCompatibleDC,SelectObject,BitBlt,GetObjectW,SelectObject,GdiAlphaBlend,SelectObject,DeleteDC,16_2_FF650F00
        Source: C:\ProgramData\jjfvbumjfczj\oapavmkbdsqp.exeCode function: 16_2_FF69BF78 #479,SetForegroundWindow,SendMessageW,SendMessageW,SetForegroundWindow,GetAsyncKeyState,SendMessageW,#479,SetFocus,16_2_FF69BF78
        Source: C:\ProgramData\jjfvbumjfczj\oapavmkbdsqp.exeCode function: 16_2_FF62F56C GetWindowRect,GetThemeBackgroundRegion,SendMessageW,NotifyWinEvent,GetFocus,GetKeyState,GetKeyState,GetKeyState,SendMessageW,NotifyWinEvent,16_2_FF62F56C
        Source: C:\ProgramData\jjfvbumjfczj\oapavmkbdsqp.exeCode function: 16_2_FF69C3C4 #618,#388,#60,GetKeyState,GetKeyState,GetKeyState,PostMessageW,16_2_FF69C3C4
        Source: C:\Users\user\Desktop\mine327.exeCode function: 0_2_005728C8 NtEnumerateValueKey,NtEnumerateValueKey,0_2_005728C8
        Source: C:\Users\user\Desktop\mine327.exeCode function: 0_2_000007FE93D6E460 NtUnmapViewOfSection,0_2_000007FE93D6E460
        Source: C:\Users\user\Desktop\mine327.exeCode function: 0_2_000007FE93D6FEF4 NtUnmapViewOfSection,0_2_000007FE93D6FEF4
        Source: C:\Users\user\Desktop\mine327.exeCode function: 0_2_000007FE93D6FE1A NtUnmapViewOfSection,0_2_000007FE93D6FE1A
        Source: C:\Windows\explorer.exeCode function: 2_2_0000000140001394 NtAlpcConnectPort,2_2_0000000140001394
        Source: C:\Windows\System32\dialer.exeCode function: 3_2_00000001400010C0 OpenProcess,OpenProcess,K32GetModuleFileNameExW,PathFindFileNameW,lstrlenW,StrCpyW,CloseHandle,StrCmpIW,NtQueryInformationProcess,OpenProcessToken,GetTokenInformation,GetLastError,LocalAlloc,GetTokenInformation,GetSidSubAuthorityCount,GetSidSubAuthority,LocalFree,CloseHandle,StrStrA,VirtualAllocEx,WriteProcessMemory,NtCreateThreadEx,WaitForSingleObject,GetExitCodeThread,CloseHandle,CloseHandle,3_2_00000001400010C0
        Source: C:\Windows\System32\services.exeCode function: 6_2_001F2244 GetProcessIdOfThread,GetCurrentProcessId,CreateFileW,WriteFile,ReadFile,CloseHandle,NtResumeThread,6_2_001F2244
        Source: C:\Windows\System32\services.exeCode function: 6_2_001F2330 NtQueryDirectoryFile,GetFileType,StrCpyW,6_2_001F2330
        Source: C:\Windows\System32\WerFault.exeCode function: 10_2_02482244 GetProcessIdOfThread,GetCurrentProcessId,CreateFileW,WriteFile,ReadFile,CloseHandle,NtResumeThread,10_2_02482244
        Source: C:\Windows\System32\WerFault.exeCode function: 10_2_02482330 NtQueryDirectoryFile,GetFileType,StrCpyW,10_2_02482330
        Source: C:\Windows\System32\WerFault.exeCode function: 10_2_0248202C NtQuerySystemInformation,StrCmpNIW,10_2_0248202C
        Source: C:\Windows\System32\winlogon.exeCode function: 12_2_009828C8 NtEnumerateValueKey,NtEnumerateValueKey,12_2_009828C8
        Source: C:\Windows\System32\sc.exeCode function: 13_2_001628C8 NtEnumerateValueKey,NtEnumerateValueKey,13_2_001628C8
        Source: C:\Windows\System32\sc.exeCode function: 13_2_00162244 GetProcessIdOfThread,GetCurrentProcessId,CreateFileW,WriteFile,ReadFile,CloseHandle,NtResumeThread,13_2_00162244
        Source: C:\Windows\System32\sc.exeCode function: 13_2_00162B2C NtDeviceIoControlFile,GetModuleHandleA,GetProcAddress,StrCmpNIW,lstrlenW,lstrlenW,13_2_00162B2C
        Source: C:\ProgramData\jjfvbumjfczj\oapavmkbdsqp.exeCode function: 16_2_0028202C NtQuerySystemInformation,StrCmpNIW,16_2_0028202C
        Source: C:\ProgramData\jjfvbumjfczj\oapavmkbdsqp.exeCode function: 16_2_002828C8 NtEnumerateValueKey,NtEnumerateValueKey,16_2_002828C8
        Source: C:\ProgramData\jjfvbumjfczj\oapavmkbdsqp.exeCode function: 16_2_00282244 GetProcessIdOfThread,GetCurrentProcessId,CreateFileW,WriteFile,ReadFile,CloseHandle,NtResumeThread,16_2_00282244
        Source: C:\ProgramData\jjfvbumjfczj\oapavmkbdsqp.exeCode function: 16_2_00282B2C NtDeviceIoControlFile,GetModuleHandleA,GetProcAddress,StrCmpNIW,lstrlenW,lstrlenW,16_2_00282B2C
        Source: C:\ProgramData\jjfvbumjfczj\oapavmkbdsqp.exeCode function: 16_2_FF64BC40 GetCommandLineW,PathGetArgsW,GetCurrentProcess,NtQueryInformationProcess,memset,#155,16_2_FF64BC40
        Source: C:\ProgramData\jjfvbumjfczj\oapavmkbdsqp.exeCode function: 16_2_FF63FD40 ResumeThread,GetPriorityClass,GetLastError,NtQueryInformationProcess,NtQueryInformationProcess,AssignProcessToJobObject,GetLastError,16_2_FF63FD40
        Source: C:\ProgramData\jjfvbumjfczj\oapavmkbdsqp.exeCode function: 16_2_FF63ED28 GetShellWindow,CoCreateInstance,CreateEventW,SetEvent,memset,NtSetSystemInformation,GetCurrentThreadId,SetTimer,16_2_FF63ED28
        Source: C:\ProgramData\jjfvbumjfczj\oapavmkbdsqp.exeCode function: 16_2_FF696DE0 SetPriorityClass,GetLastError,NtSetInformationProcess,NtSetInformationProcess,16_2_FF696DE0
        Source: C:\ProgramData\jjfvbumjfczj\oapavmkbdsqp.exeCode function: 16_2_FF64A550 NtOpenThreadToken,NtOpenProcessToken,NtQueryInformationToken,NtQueryInformationToken,NtClose,NtQueryInformationToken,16_2_FF64A550
        Source: C:\Windows\System32\lsass.exeCode function: 17_2_009C202C NtQuerySystemInformation,StrCmpNIW,17_2_009C202C
        Source: C:\Windows\System32\lsm.exeCode function: 19_2_002628C8 NtEnumerateValueKey,NtEnumerateValueKey,19_2_002628C8
        Source: C:\Windows\System32\svchost.exeCode function: 22_2_014A202C NtQuerySystemInformation,StrCmpNIW,22_2_014A202C
        Source: C:\Windows\System32\svchost.exeCode function: 25_2_00C62330 NtQueryDirectoryFile,GetFileType,StrCpyW,25_2_00C62330
        Source: C:\Windows\System32\sc.exeCode function: 13_2_00162B2C: NtDeviceIoControlFile,GetModuleHandleA,GetProcAddress,StrCmpNIW,lstrlenW,lstrlenW,13_2_00162B2C
        Source: C:\ProgramData\jjfvbumjfczj\oapavmkbdsqp.exeCode function: RegisterTraceGuidsW,RegDeleteKeyExW,GetCurrentProcess,SetPriorityClass,SystemParametersInfoW,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,RegCreateKeyW,CreateMutexW,WaitForSingleObject,#899,#188,SetProcessShutdownParameters,PeekMessageW,WaitForSingleObject,CloseHandle,OleInitialize,CoCreateInstance,#660,SHGetValueW,GetUserDefaultUILanguage,SHGetSpecialFolderPathW,SHGetSpecialFolderPathW,SHGetSpecialFolderPathW,GetSystemMetrics,CreateEventW,GetSystemMetrics,#885,CloseHandle,RegQueryValueExW,RegSetValueExW,#110,SHCreateThreadRef,SHSetThreadRef,#176,ReleaseMutex,CloseHandle,PostMessageW,#16,GetCurrentProcess,SetPriorityClass,RegisterApplicationRestart,CoCreateInstance,#201,ReleaseMutex,CloseHandle,GetCurrentProcess,SetPriorityClass,memset,SHGetKnownFolderIDList,ShellExecuteExW,#155,memset,GetCommandLineW,PathGetArgsW,CoCreateInstance,CoCreateInstance,CoCreateInstance,memset,GetStartupInfoW,#155,LoadLibraryW,GetProcAddress,FreeLibrary,SHSetThreadRef,GetMessageW,TranslateMessage,DispatchMessageW,RegSetValueExW,#111,OleUninitialize,#188,GetCommandLineW,PathGetArgsW,#158,#10,UnregisterTraceGuids,ExitProcess, CleanShutdown16_2_FF64020C
        Source: C:\ProgramData\jjfvbumjfczj\oapavmkbdsqp.exeCode function: RegisterTraceGuidsW,RegDeleteKeyExW,GetCurrentProcess,SetPriorityClass,SystemParametersInfoW,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,RegCreateKeyW,CreateMutexW,WaitForSingleObject,#899,#188,SetProcessShutdownParameters,PeekMessageW,WaitForSingleObject,CloseHandle,OleInitialize,CoCreateInstance,#660,SHGetValueW,GetUserDefaultUILanguage,SHGetSpecialFolderPathW,SHGetSpecialFolderPathW,SHGetSpecialFolderPathW,GetSystemMetrics,CreateEventW,GetSystemMetrics,#885,CloseHandle,RegQueryValueExW,RegSetValueExW,#110,SHCreateThreadRef,SHSetThreadRef,#176,ReleaseMutex,CloseHandle,PostMessageW,#16,GetCurrentProcess,SetPriorityClass,RegisterApplicationRestart,CoCreateInstance,#201,ReleaseMutex,CloseHandle,GetCurrentProcess,SetPriorityClass,memset,SHGetKnownFolderIDList,ShellExecuteExW,#155,memset,GetCommandLineW,PathGetArgsW,CoCreateInstance,CoCreateInstance,CoCreateInstance,memset,GetStartupInfoW,#155,LoadLibraryW,GetProcAddress,FreeLibrary,SHSetThreadRef,GetMessageW,TranslateMessage,DispatchMessageW,RegSetValueExW,#111,OleUninitialize,#188,GetCommandLineW,PathGetArgsW,#158,#10,UnregisterTraceGuids,ExitProcess, CleanShutdown16_2_FF64020C
        Source: C:\ProgramData\jjfvbumjfczj\oapavmkbdsqp.exeCode function: RegisterTraceGuidsW,RegDeleteKeyExW,GetCurrentProcess,SetPriorityClass,SystemParametersInfoW,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,RegCreateKeyW,CreateMutexW,WaitForSingleObject,#899,#188,SetProcessShutdownParameters,PeekMessageW,WaitForSingleObject,CloseHandle,OleInitialize,CoCreateInstance,#660,SHGetValueW,GetUserDefaultUILanguage,SHGetSpecialFolderPathW,SHGetSpecialFolderPathW,SHGetSpecialFolderPathW,GetSystemMetrics,CreateEventW,GetSystemMetrics,#885,CloseHandle,RegQueryValueExW,RegSetValueExW,#110,SHCreateThreadRef,SHSetThreadRef,#176,ReleaseMutex,CloseHandle,PostMessageW,#16,GetCurrentProcess,SetPriorityClass,RegisterApplicationRestart,CoCreateInstance,#201,ReleaseMutex,CloseHandle,GetCurrentProcess,SetPriorityClass,memset,SHGetKnownFolderIDList,ShellExecuteExW,#155,memset,GetCommandLineW,PathGetArgsW,CoCreateInstance,CoCreateInstance,CoCreateInstance,memset,GetStartupInfoW,#155,LoadLibraryW,GetProcAddress,FreeLibrary,SHSetThreadRef,GetMessageW,TranslateMessage,DispatchMessageW,RegSetValueExW,#111,OleUninitialize,#188,GetCommandLineW,PathGetArgsW,#158,#10,UnregisterTraceGuids,ExitProcess, CleanShutdown16_2_FF64020C
        Source: C:\ProgramData\jjfvbumjfczj\oapavmkbdsqp.exeCode function: GetWindowsDirectoryW,PathCombineW,memset,ShellExecuteExW, /Reboot Shutdown16_2_FF698DE8
        Source: C:\ProgramData\jjfvbumjfczj\oapavmkbdsqp.exeCode function: 16_2_FF621364 DefWindowProcW,#479,SetLastError,EnumChildWindows,#158,#158,BeginPaint,PostMessageW,GetClientRect,IsCompositionActive,#197,DrawThemeBackground,#8,#9,#10,PostMessageW,SendMessageW,PostMessageW,SendMessageW,SendMessageW,#479,LoadCursorW,SetCursor,UpdateWindow,GetClientRect,GetClipBox,IsCompositionActive,#197,DrawThemeBackground,EndPaint,#4,EnumDisplayMonitors,EnumChildWindows,EnumChildWindows,SendMessageW,#100,SendMessageW,SendMessageW,GetDoubleClickTime,TrackMouseEvent,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SetTimer,LoadCursorW,SetCursor,#127,EnumDisplayMonitors,ShowWindow,ShowWindow,DestroyWindow,GetClientRect,MapWindowPoints,PtInRect,PtInRect,PtInRect,PtInRect,GetWindowRect,GetMessagePos,PtInRect,DefWindowProcW,InflateRect,SendMessageW,SendMessageW,SendMessageW,GetFocus,#204,#165,GetSystemMenu,EnableMenuItem,EnableMenuItem,EnableMenuItem,EnableMenuItem,EnableMenuItem,SendMessageW,#165,KillTimer,SendMessageW,PostMessageW,SendMessageW,GetCursorPos,GetSystemMetrics,GetSystemMetrics,InflateRect,SendMessageW,SendMessageW,FillRect,MapWindowPoints,InflateRect,DrawEdge,GlobalGetAtomNameW,#190,UnregisterHotKey,#388,SetWindowPos,CoMarshalInterThreadInterfaceInStream,ExitWindowsEx,PostMessageW,PostMessageW,16_2_FF621364
        Source: C:\ProgramData\jjfvbumjfczj\oapavmkbdsqp.exeFile created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\ExplorerJump to behavior
        Source: C:\ProgramData\jjfvbumjfczj\oapavmkbdsqp.exeFile created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\ExplorerStartupLog.etlJump to behavior
        Source: C:\Users\user\Desktop\mine327.exeCode function: 0_2_0054D0E00_2_0054D0E0
        Source: C:\Users\user\Desktop\mine327.exeCode function: 0_2_005538A80_2_005538A8
        Source: C:\Users\user\Desktop\mine327.exeCode function: 0_2_00541F2C0_2_00541F2C
        Source: C:\Users\user\Desktop\mine327.exeCode function: 0_2_0057DCE00_2_0057DCE0
        Source: C:\Users\user\Desktop\mine327.exeCode function: 0_2_005844A80_2_005844A8
        Source: C:\Users\user\Desktop\mine327.exeCode function: 0_2_00572B2C0_2_00572B2C
        Source: C:\Users\user\Desktop\mine327.exeCode function: 0_2_000007FE93D5FC200_2_000007FE93D5FC20
        Source: C:\Users\user\Desktop\mine327.exeCode function: 0_2_000007FE93D6A3C50_2_000007FE93D6A3C5
        Source: C:\Users\user\Desktop\mine327.exeCode function: 0_2_000007FE93D5A9B00_2_000007FE93D5A9B0
        Source: C:\Users\user\Desktop\mine327.exeCode function: 0_2_000007FE93D5A9B80_2_000007FE93D5A9B8
        Source: C:\Users\user\Desktop\mine327.exeCode function: 0_2_000007FE93D5D8C90_2_000007FE93D5D8C9
        Source: C:\Users\user\Desktop\mine327.exeCode function: 0_2_000007FE93D667DA0_2_000007FE93D667DA
        Source: C:\Users\user\Desktop\mine327.exeCode function: 0_2_000007FE93D55EDC0_2_000007FE93D55EDC
        Source: C:\Users\user\Desktop\mine327.exeCode function: 0_2_000007FE93D606E00_2_000007FE93D606E0
        Source: C:\Users\user\Desktop\mine327.exeCode function: 0_2_000007FE93D546700_2_000007FE93D54670
        Source: C:\Users\user\Desktop\mine327.exeCode function: 0_2_000007FE93D5DD580_2_000007FE93D5DD58
        Source: C:\Users\user\Desktop\mine327.exeCode function: 0_2_000007FE93D6BD380_2_000007FE93D6BD38
        Source: C:\Users\user\Desktop\mine327.exeCode function: 0_2_000007FE93D6CCEE0_2_000007FE93D6CCEE
        Source: C:\Users\user\Desktop\mine327.exeCode function: 0_2_000007FE93D6220A0_2_000007FE93D6220A
        Source: C:\Users\user\Desktop\mine327.exeCode function: 0_2_000007FE93D510D00_2_000007FE93D510D0
        Source: C:\Users\user\Desktop\mine327.exeCode function: 0_2_000007FE93D510980_2_000007FE93D51098
        Source: C:\Users\user\Desktop\mine327.exeCode function: 0_2_000007FE93D69E840_2_000007FE93D69E84
        Source: C:\Users\user\Desktop\mine327.exeCode function: 0_2_000007FE93E50E250_2_000007FE93E50E25
        Source: C:\Windows\explorer.exeCode function: 2_2_0000000140003B302_2_0000000140003B30
        Source: C:\Windows\System32\dialer.exeCode function: 3_2_000000014000226C3_2_000000014000226C
        Source: C:\Windows\System32\dialer.exeCode function: 3_2_00000001400014D83_2_00000001400014D8
        Source: C:\Windows\System32\dialer.exeCode function: 3_2_00000001400025603_2_0000000140002560
        Source: C:\Windows\System32\services.exeCode function: 6_2_001D38A86_2_001D38A8
        Source: C:\Windows\System32\services.exeCode function: 6_2_001CD0E06_2_001CD0E0
        Source: C:\Windows\System32\services.exeCode function: 6_2_001C1F2C6_2_001C1F2C
        Source: C:\Windows\System32\services.exeCode function: 6_2_002044A86_2_002044A8
        Source: C:\Windows\System32\services.exeCode function: 6_2_001FDCE06_2_001FDCE0
        Source: C:\Windows\System32\services.exeCode function: 6_2_001F2B2C6_2_001F2B2C
        Source: C:\Windows\System32\WerFault.exeCode function: 10_2_02482B2C10_2_02482B2C
        Source: C:\Windows\System32\WerFault.exeCode function: 10_2_0248DCE010_2_0248DCE0
        Source: C:\Windows\System32\WerFault.exeCode function: 10_2_024944A810_2_024944A8
        Source: C:\Windows\System32\winlogon.exeCode function: 12_2_009638A812_2_009638A8
        Source: C:\Windows\System32\winlogon.exeCode function: 12_2_0095D0E012_2_0095D0E0
        Source: C:\Windows\System32\winlogon.exeCode function: 12_2_00951F2C12_2_00951F2C
        Source: C:\Windows\System32\winlogon.exeCode function: 12_2_009944A812_2_009944A8
        Source: C:\Windows\System32\winlogon.exeCode function: 12_2_0098DCE012_2_0098DCE0
        Source: C:\Windows\System32\winlogon.exeCode function: 12_2_00982B2C12_2_00982B2C
        Source: C:\Windows\System32\sc.exeCode function: 13_2_001438A813_2_001438A8
        Source: C:\Windows\System32\sc.exeCode function: 13_2_0013D0E013_2_0013D0E0
        Source: C:\Windows\System32\sc.exeCode function: 13_2_00131F2C13_2_00131F2C
        Source: C:\Windows\System32\sc.exeCode function: 13_2_00162B2C13_2_00162B2C
        Source: C:\Windows\System32\sc.exeCode function: 13_2_001744A813_2_001744A8
        Source: C:\Windows\System32\sc.exeCode function: 13_2_0016DCE013_2_0016DCE0
        Source: C:\Windows\System32\conhost.exeCode function: 15_2_001E38A815_2_001E38A8
        Source: C:\Windows\System32\conhost.exeCode function: 15_2_001DD0E015_2_001DD0E0
        Source: C:\Windows\System32\conhost.exeCode function: 15_2_001D1F2C15_2_001D1F2C
        Source: C:\Windows\System32\conhost.exeCode function: 15_2_002144A815_2_002144A8
        Source: C:\Windows\System32\conhost.exeCode function: 15_2_0020DCE015_2_0020DCE0
        Source: C:\Windows\System32\conhost.exeCode function: 15_2_00202B2C15_2_00202B2C
        Source: C:\ProgramData\jjfvbumjfczj\oapavmkbdsqp.exeCode function: 16_2_000F38A816_2_000F38A8
        Source: C:\ProgramData\jjfvbumjfczj\oapavmkbdsqp.exeCode function: 16_2_000ED0E016_2_000ED0E0
        Source: C:\ProgramData\jjfvbumjfczj\oapavmkbdsqp.exeCode function: 16_2_000E1F2C16_2_000E1F2C
        Source: C:\ProgramData\jjfvbumjfczj\oapavmkbdsqp.exeCode function: 16_2_00282B2C16_2_00282B2C
        Source: C:\ProgramData\jjfvbumjfczj\oapavmkbdsqp.exeCode function: 16_2_002944A816_2_002944A8
        Source: C:\ProgramData\jjfvbumjfczj\oapavmkbdsqp.exeCode function: 16_2_0028DCE016_2_0028DCE0
        Source: C:\ProgramData\jjfvbumjfczj\oapavmkbdsqp.exeCode function: 16_2_002D38A816_2_002D38A8
        Source: C:\ProgramData\jjfvbumjfczj\oapavmkbdsqp.exeCode function: 16_2_002CD0E016_2_002CD0E0
        Source: C:\ProgramData\jjfvbumjfczj\oapavmkbdsqp.exeCode function: 16_2_002C1F2C16_2_002C1F2C
        Source: C:\ProgramData\jjfvbumjfczj\oapavmkbdsqp.exeCode function: 16_2_003044A816_2_003044A8
        Source: C:\ProgramData\jjfvbumjfczj\oapavmkbdsqp.exeCode function: 16_2_002FDCE016_2_002FDCE0
        Source: C:\ProgramData\jjfvbumjfczj\oapavmkbdsqp.exeCode function: 16_2_002F2B2C16_2_002F2B2C
        Source: C:\ProgramData\jjfvbumjfczj\oapavmkbdsqp.exeCode function: 16_2_FF696FCC16_2_FF696FCC
        Source: C:\ProgramData\jjfvbumjfczj\oapavmkbdsqp.exeCode function: 16_2_FF64020C16_2_FF64020C
        Source: C:\ProgramData\jjfvbumjfczj\oapavmkbdsqp.exeCode function: 16_2_FF65CF7016_2_FF65CF70
        Source: C:\ProgramData\jjfvbumjfczj\oapavmkbdsqp.exeCode function: 16_2_FF631F5816_2_FF631F58
        Source: C:\ProgramData\jjfvbumjfczj\oapavmkbdsqp.exeCode function: 16_2_FF662F2016_2_FF662F20
        Source: C:\ProgramData\jjfvbumjfczj\oapavmkbdsqp.exeCode function: 16_2_FF646FC016_2_FF646FC0
        Source: C:\ProgramData\jjfvbumjfczj\oapavmkbdsqp.exeCode function: 16_2_FF6C6FB816_2_FF6C6FB8
        Source: C:\ProgramData\jjfvbumjfczj\oapavmkbdsqp.exeCode function: 16_2_FF644FBC16_2_FF644FBC
        Source: C:\ProgramData\jjfvbumjfczj\oapavmkbdsqp.exeCode function: 16_2_FF69EF9C16_2_FF69EF9C
        Source: C:\ProgramData\jjfvbumjfczj\oapavmkbdsqp.exeCode function: 16_2_FF655E7816_2_FF655E78
        Source: C:\ProgramData\jjfvbumjfczj\oapavmkbdsqp.exeCode function: 16_2_FF640E2416_2_FF640E24
        Source: C:\ProgramData\jjfvbumjfczj\oapavmkbdsqp.exeCode function: 16_2_FF6A9E9C16_2_FF6A9E9C
        Source: C:\ProgramData\jjfvbumjfczj\oapavmkbdsqp.exeCode function: 16_2_FF652D4816_2_FF652D48
        Source: C:\ProgramData\jjfvbumjfczj\oapavmkbdsqp.exeCode function: 16_2_FF643D5416_2_FF643D54
        Source: C:\ProgramData\jjfvbumjfczj\oapavmkbdsqp.exeCode function: 16_2_FF6C0D3016_2_FF6C0D30
        Source: C:\ProgramData\jjfvbumjfczj\oapavmkbdsqp.exeCode function: 16_2_FF630D0016_2_FF630D00
        Source: C:\ProgramData\jjfvbumjfczj\oapavmkbdsqp.exeCode function: 16_2_FF647DA016_2_FF647DA0
        Source: C:\ProgramData\jjfvbumjfczj\oapavmkbdsqp.exeCode function: 16_2_FF678D9016_2_FF678D90
        Source: C:\ProgramData\jjfvbumjfczj\oapavmkbdsqp.exeCode function: 16_2_FF631C1C16_2_FF631C1C
        Source: C:\ProgramData\jjfvbumjfczj\oapavmkbdsqp.exeCode function: 16_2_FF62BCCC16_2_FF62BCCC
        Source: C:\ProgramData\jjfvbumjfczj\oapavmkbdsqp.exeCode function: 16_2_FF635CD016_2_FF635CD0
        Source: C:\ProgramData\jjfvbumjfczj\oapavmkbdsqp.exeCode function: 16_2_FF65DCA816_2_FF65DCA8
        Source: C:\ProgramData\jjfvbumjfczj\oapavmkbdsqp.exeCode function: 16_2_FF641B7C16_2_FF641B7C
        Source: C:\ProgramData\jjfvbumjfczj\oapavmkbdsqp.exeCode function: 16_2_FF6A5BE816_2_FF6A5BE8
        Source: C:\ProgramData\jjfvbumjfczj\oapavmkbdsqp.exeCode function: 16_2_FF6A0BF016_2_FF6A0BF0
        Source: C:\ProgramData\jjfvbumjfczj\oapavmkbdsqp.exeCode function: 16_2_FF636BD416_2_FF636BD4
        Source: C:\ProgramData\jjfvbumjfczj\oapavmkbdsqp.exeCode function: 16_2_FF65FBA016_2_FF65FBA0
        Source: C:\ProgramData\jjfvbumjfczj\oapavmkbdsqp.exeCode function: 16_2_FF64FBB016_2_FF64FBB0
        Source: C:\ProgramData\jjfvbumjfczj\oapavmkbdsqp.exeCode function: 16_2_FF62AB8816_2_FF62AB88
        Source: C:\ProgramData\jjfvbumjfczj\oapavmkbdsqp.exeCode function: 16_2_FF66AB9416_2_FF66AB94
        Source: C:\ProgramData\jjfvbumjfczj\oapavmkbdsqp.exeCode function: 16_2_FF62AA7016_2_FF62AA70
        Source: C:\ProgramData\jjfvbumjfczj\oapavmkbdsqp.exeCode function: 16_2_FF626A4016_2_FF626A40
        Source: C:\ProgramData\jjfvbumjfczj\oapavmkbdsqp.exeCode function: 16_2_FF676A5416_2_FF676A54
        Source: C:\ProgramData\jjfvbumjfczj\oapavmkbdsqp.exeCode function: 16_2_FF638AF016_2_FF638AF0
        Source: C:\ProgramData\jjfvbumjfczj\oapavmkbdsqp.exeCode function: 16_2_FF652AC016_2_FF652AC0
        Source: C:\ProgramData\jjfvbumjfczj\oapavmkbdsqp.exeCode function: 16_2_FF6A3ADC16_2_FF6A3ADC
        Source: C:\ProgramData\jjfvbumjfczj\oapavmkbdsqp.exeCode function: 16_2_FF64BAA016_2_FF64BAA0
        Source: C:\ProgramData\jjfvbumjfczj\oapavmkbdsqp.exeCode function: 16_2_FF65CAA016_2_FF65CAA0
        Source: C:\ProgramData\jjfvbumjfczj\oapavmkbdsqp.exeCode function: 16_2_FF66EAB016_2_FF66EAB0
        Source: C:\ProgramData\jjfvbumjfczj\oapavmkbdsqp.exeCode function: 16_2_FF6C893C16_2_FF6C893C
        Source: C:\ProgramData\jjfvbumjfczj\oapavmkbdsqp.exeCode function: 16_2_FF62290416_2_FF622904
        Source: C:\ProgramData\jjfvbumjfczj\oapavmkbdsqp.exeCode function: 16_2_FF6AA91016_2_FF6AA910
        Source: C:\ProgramData\jjfvbumjfczj\oapavmkbdsqp.exeCode function: 16_2_FF6439D816_2_FF6439D8
        Source: C:\ProgramData\jjfvbumjfczj\oapavmkbdsqp.exeCode function: 16_2_FF69A81C16_2_FF69A81C
        Source: C:\ProgramData\jjfvbumjfczj\oapavmkbdsqp.exeCode function: 16_2_FF62A8E816_2_FF62A8E8
        Source: C:\ProgramData\jjfvbumjfczj\oapavmkbdsqp.exeCode function: 16_2_FF6A88D016_2_FF6A88D0
        Source: C:\ProgramData\jjfvbumjfczj\oapavmkbdsqp.exeCode function: 16_2_FF6A98A816_2_FF6A98A8
        Source: C:\ProgramData\jjfvbumjfczj\oapavmkbdsqp.exeCode function: 16_2_FF65D8B016_2_FF65D8B0
        Source: C:\ProgramData\jjfvbumjfczj\oapavmkbdsqp.exeCode function: 16_2_FF63F8B416_2_FF63F8B4
        Source: C:\ProgramData\jjfvbumjfczj\oapavmkbdsqp.exeCode function: 16_2_FF69788816_2_FF697888
        Source: C:\ProgramData\jjfvbumjfczj\oapavmkbdsqp.exeCode function: 16_2_FF65F75016_2_FF65F750
        Source: C:\ProgramData\jjfvbumjfczj\oapavmkbdsqp.exeCode function: 16_2_FF63B75C16_2_FF63B75C
        Source: C:\ProgramData\jjfvbumjfczj\oapavmkbdsqp.exeCode function: 16_2_FF65E72016_2_FF65E720
        Source: C:\ProgramData\jjfvbumjfczj\oapavmkbdsqp.exeCode function: 16_2_FF66A72016_2_FF66A720
        Source: C:\ProgramData\jjfvbumjfczj\oapavmkbdsqp.exeCode function: 16_2_FF62470816_2_FF624708
        Source: C:\ProgramData\jjfvbumjfczj\oapavmkbdsqp.exeCode function: 16_2_FF65770816_2_FF657708
        Source: C:\ProgramData\jjfvbumjfczj\oapavmkbdsqp.exeCode function: 16_2_FF6377D616_2_FF6377D6
        Source: C:\ProgramData\jjfvbumjfczj\oapavmkbdsqp.exeCode function: 16_2_FF6A47A816_2_FF6A47A8
        Source: C:\ProgramData\jjfvbumjfczj\oapavmkbdsqp.exeCode function: 16_2_FF63A7BC16_2_FF63A7BC
        Source: C:\ProgramData\jjfvbumjfczj\oapavmkbdsqp.exeCode function: 16_2_FF65A66416_2_FF65A664
        Source: C:\ProgramData\jjfvbumjfczj\oapavmkbdsqp.exeCode function: 16_2_FF62E67016_2_FF62E670
        Source: C:\ProgramData\jjfvbumjfczj\oapavmkbdsqp.exeCode function: 16_2_FF6A165416_2_FF6A1654
        Source: C:\ProgramData\jjfvbumjfczj\oapavmkbdsqp.exeCode function: 16_2_FF62360416_2_FF623604
        Source: C:\ProgramData\jjfvbumjfczj\oapavmkbdsqp.exeCode function: 16_2_FF64661816_2_FF646618
        Source: C:\ProgramData\jjfvbumjfczj\oapavmkbdsqp.exeCode function: 16_2_FF66B6F016_2_FF66B6F0
        Source: C:\ProgramData\jjfvbumjfczj\oapavmkbdsqp.exeCode function: 16_2_FF64D6A016_2_FF64D6A0
        Source: C:\ProgramData\jjfvbumjfczj\oapavmkbdsqp.exeCode function: 16_2_FF65169C16_2_FF65169C
        Source: C:\ProgramData\jjfvbumjfczj\oapavmkbdsqp.exeCode function: 16_2_FF62F56C16_2_FF62F56C
        Source: C:\ProgramData\jjfvbumjfczj\oapavmkbdsqp.exeCode function: 16_2_FF6B157C16_2_FF6B157C
        Source: C:\ProgramData\jjfvbumjfczj\oapavmkbdsqp.exeCode function: 16_2_FF6585A016_2_FF6585A0
        Source: C:\ProgramData\jjfvbumjfczj\oapavmkbdsqp.exeCode function: 16_2_FF6215B416_2_FF6215B4
        Source: C:\ProgramData\jjfvbumjfczj\oapavmkbdsqp.exeCode function: 16_2_FF65546816_2_FF655468
        Source: C:\ProgramData\jjfvbumjfczj\oapavmkbdsqp.exeCode function: 16_2_FF62E47816_2_FF62E478
        Source: C:\ProgramData\jjfvbumjfczj\oapavmkbdsqp.exeCode function: 16_2_FF66C45016_2_FF66C450
        Source: C:\ProgramData\jjfvbumjfczj\oapavmkbdsqp.exeCode function: 16_2_FF63E45C16_2_FF63E45C
        Source: C:\ProgramData\jjfvbumjfczj\oapavmkbdsqp.exeCode function: 16_2_FF6AA43416_2_FF6AA434
        Source: C:\ProgramData\jjfvbumjfczj\oapavmkbdsqp.exeCode function: 16_2_FF62241C16_2_FF62241C
        Source: C:\ProgramData\jjfvbumjfczj\oapavmkbdsqp.exeCode function: 16_2_FF6A24D816_2_FF6A24D8
        Source: C:\ProgramData\jjfvbumjfczj\oapavmkbdsqp.exeCode function: 16_2_FF66B48816_2_FF66B488
        Source: C:\ProgramData\jjfvbumjfczj\oapavmkbdsqp.exeCode function: 16_2_FF63F48C16_2_FF63F48C
        Source: C:\ProgramData\jjfvbumjfczj\oapavmkbdsqp.exeCode function: 16_2_FF65236016_2_FF652360
        Source: C:\ProgramData\jjfvbumjfczj\oapavmkbdsqp.exeCode function: 16_2_FF62136416_2_FF621364
        Source: C:\ProgramData\jjfvbumjfczj\oapavmkbdsqp.exeCode function: 16_2_FF65B32816_2_FF65B328
        Source: C:\ProgramData\jjfvbumjfczj\oapavmkbdsqp.exeCode function: 16_2_FF6A633416_2_FF6A6334
        Source: C:\ProgramData\jjfvbumjfczj\oapavmkbdsqp.exeCode function: 16_2_FF64630816_2_FF646308
        Source: C:\ProgramData\jjfvbumjfczj\oapavmkbdsqp.exeCode function: 16_2_FF62931016_2_FF629310
        Source: C:\ProgramData\jjfvbumjfczj\oapavmkbdsqp.exeCode function: 16_2_FF6BC3E016_2_FF6BC3E0
        Source: C:\ProgramData\jjfvbumjfczj\oapavmkbdsqp.exeCode function: 16_2_FF6483A816_2_FF6483A8
        Source: C:\ProgramData\jjfvbumjfczj\oapavmkbdsqp.exeCode function: 16_2_FF64939C16_2_FF64939C
        Source: C:\ProgramData\jjfvbumjfczj\oapavmkbdsqp.exeCode function: 16_2_FF62C2AC16_2_FF62C2AC
        Source: C:\ProgramData\jjfvbumjfczj\oapavmkbdsqp.exeCode function: 16_2_FF69B11016_2_FF69B110
        Source: C:\ProgramData\jjfvbumjfczj\oapavmkbdsqp.exeCode function: 16_2_FF63A1E816_2_FF63A1E8
        Source: C:\ProgramData\jjfvbumjfczj\oapavmkbdsqp.exeCode function: 16_2_FF62C1D016_2_FF62C1D0
        Source: C:\ProgramData\jjfvbumjfczj\oapavmkbdsqp.exeCode function: 16_2_FF62D0C816_2_FF62D0C8
        Source: C:\ProgramData\jjfvbumjfczj\oapavmkbdsqp.exeCode function: 16_2_FF65E0B016_2_FF65E0B0
        Source: C:\Windows\System32\lsass.exeCode function: 17_2_001038A817_2_001038A8
        Source: C:\Windows\System32\lsass.exeCode function: 17_2_000FD0E017_2_000FD0E0
        Source: C:\Windows\System32\lsass.exeCode function: 17_2_000F1F2C17_2_000F1F2C
        Source: C:\Windows\System32\lsass.exeCode function: 17_2_009D44A817_2_009D44A8
        Source: C:\Windows\System32\lsass.exeCode function: 17_2_009CDCE017_2_009CDCE0
        Source: C:\Windows\System32\lsass.exeCode function: 17_2_009C2B2C17_2_009C2B2C
        Source: C:\Windows\System32\lsm.exeCode function: 19_2_001C38A819_2_001C38A8
        Source: C:\Windows\System32\lsm.exeCode function: 19_2_001BD0E019_2_001BD0E0
        Source: C:\Windows\System32\lsm.exeCode function: 19_2_001B1F2C19_2_001B1F2C
        Source: C:\Windows\System32\lsm.exeCode function: 19_2_002744A819_2_002744A8
        Source: C:\Windows\System32\lsm.exeCode function: 19_2_0026DCE019_2_0026DCE0
        Source: C:\Windows\System32\lsm.exeCode function: 19_2_00262B2C19_2_00262B2C
        Source: C:\Windows\System32\svchost.exeCode function: 20_2_0068D0E020_2_0068D0E0
        Source: C:\Windows\System32\svchost.exeCode function: 20_2_006938A820_2_006938A8
        Source: C:\Windows\System32\svchost.exeCode function: 20_2_00681F2C20_2_00681F2C
        Source: C:\Windows\System32\svchost.exeCode function: 20_2_006BDCE020_2_006BDCE0
        Source: C:\Windows\System32\svchost.exeCode function: 20_2_006C44A820_2_006C44A8
        Source: C:\Windows\System32\svchost.exeCode function: 20_2_006B2B2C20_2_006B2B2C
        Source: C:\Windows\System32\svchost.exeCode function: 22_2_014ADCE022_2_014ADCE0
        Source: C:\Windows\System32\svchost.exeCode function: 22_2_014B44A822_2_014B44A8
        Source: C:\Windows\System32\svchost.exeCode function: 22_2_014A2B2C22_2_014A2B2C
        Source: C:\Windows\System32\svchost.exeCode function: 23_2_00BD44A823_2_00BD44A8
        Source: C:\Windows\System32\svchost.exeCode function: 23_2_00BCDCE023_2_00BCDCE0
        Source: C:\Windows\System32\svchost.exeCode function: 23_2_00BC2B2C23_2_00BC2B2C
        Source: C:\Windows\System32\svchost.exeCode function: 24_2_00A844A824_2_00A844A8
        Source: C:\Windows\System32\svchost.exeCode function: 24_2_00A7DCE024_2_00A7DCE0
        Source: C:\Windows\System32\svchost.exeCode function: 24_2_00A72B2C24_2_00A72B2C
        Source: C:\Windows\System32\svchost.exeCode function: 25_2_00C6DCE025_2_00C6DCE0
        Source: C:\Windows\System32\svchost.exeCode function: 25_2_00C744A825_2_00C744A8
        Source: C:\Windows\System32\svchost.exeCode function: 25_2_00C62B2C25_2_00C62B2C
        Source: C:\Windows\System32\svchost.exeCode function: 26_2_001238A826_2_001238A8
        Source: C:\Windows\System32\svchost.exeCode function: 26_2_0011D0E026_2_0011D0E0
        Source: C:\Windows\System32\svchost.exeCode function: 26_2_00111F2C26_2_00111F2C
        Source: C:\Windows\System32\svchost.exeCode function: 26_2_002D44A826_2_002D44A8
        Source: C:\Windows\System32\svchost.exeCode function: 26_2_002CDCE026_2_002CDCE0
        Source: C:\Windows\System32\svchost.exeCode function: 26_2_002C2B2C26_2_002C2B2C
        Source: C:\Windows\explorer.exeCode function: String function: 0000000140001394 appears 32 times
        Source: C:\Windows\System32\svchost.exeProcess created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 1436 -s 724
        Source: mine327.exeStatic PE information: No import functions for PE file found
        Source: mine327.exe, 00000000.00000000.333307470.000000000129A000.00000002.00000001.01000000.00000003.sdmpBinary or memory string: OriginalFilenameUkedopegude> vs mine327.exe
        Source: mine327.exe, 00000000.00000002.377603583.00000000000CD000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameclr.dllT vs mine327.exe
        Source: C:\Users\user\Desktop\mine327.exeSection loaded: version.dllJump to behavior
        Source: C:\Users\user\Desktop\mine327.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
        Source: C:\Users\user\Desktop\mine327.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
        Source: C:\Users\user\Desktop\mine327.exeSection loaded: cryptbase.dllJump to behavior
        Source: C:\Users\user\Desktop\mine327.exeSection loaded: bcrypt.dllJump to behavior
        Source: C:\Users\user\Desktop\mine327.exeSection loaded: cryptsp.dllJump to behavior
        Source: C:\Users\user\Desktop\mine327.exeSection loaded: shfolder.dllJump to behavior
        Source: C:\Users\user\Desktop\mine327.exeSection loaded: amsi.dllJump to behavior
        Source: C:\Users\user\Desktop\mine327.exeSection loaded: amsi.dllJump to behavior
        Source: C:\Windows\System32\dialer.exeSection loaded: cryptbase.dllJump to behavior
        Source: C:\Windows\System32\dialer.exeSection loaded: ntmarta.dllJump to behavior
        Source: C:\Windows\System32\sc.exeSection loaded: cryptbase.dllJump to behavior
        Source: C:\Windows\System32\sc.exeSection loaded: cryptbase.dllJump to behavior
        Source: C:\Windows\System32\svchost.exeSection loaded: cryptbase.dllJump to behavior
        Source: C:\Windows\System32\svchost.exeSection loaded: faultrep.dllJump to behavior
        Source: C:\Windows\System32\svchost.exeSection loaded: wer.dllJump to behavior
        Source: C:\Windows\System32\svchost.exeSection loaded: sspicli.dllJump to behavior
        Source: C:\Windows\System32\sc.exeSection loaded: cryptbase.dllJump to behavior
        Source: C:\Windows\System32\sc.exeSection loaded: cryptbase.dllJump to behavior
        Source: C:\ProgramData\jjfvbumjfczj\oapavmkbdsqp.exeSection loaded: explorerframe.dllJump to behavior
        Source: C:\ProgramData\jjfvbumjfczj\oapavmkbdsqp.exeSection loaded: duser.dllJump to behavior
        Source: C:\ProgramData\jjfvbumjfczj\oapavmkbdsqp.exeSection loaded: dui70.dllJump to behavior
        Source: C:\ProgramData\jjfvbumjfczj\oapavmkbdsqp.exeSection loaded: uxtheme.dllJump to behavior
        Source: C:\ProgramData\jjfvbumjfczj\oapavmkbdsqp.exeSection loaded: powrprof.dllJump to behavior
        Source: C:\ProgramData\jjfvbumjfczj\oapavmkbdsqp.exeSection loaded: dwmapi.dllJump to behavior
        Source: C:\ProgramData\jjfvbumjfczj\oapavmkbdsqp.exeSection loaded: slc.dllJump to behavior
        Source: C:\ProgramData\jjfvbumjfczj\oapavmkbdsqp.exeSection loaded: secur32.dllJump to behavior
        Source: C:\ProgramData\jjfvbumjfczj\oapavmkbdsqp.exeSection loaded: sspicli.dllJump to behavior
        Source: C:\ProgramData\jjfvbumjfczj\oapavmkbdsqp.exeSection loaded: propsys.dllJump to behavior
        Source: C:\ProgramData\jjfvbumjfczj\oapavmkbdsqp.exeSection loaded: winsta.dllJump to behavior
        Source: C:\ProgramData\jjfvbumjfczj\oapavmkbdsqp.exeSection loaded: cryptbase.dllJump to behavior
        Source: C:\ProgramData\jjfvbumjfczj\oapavmkbdsqp.exeSection loaded: cryptsp.dllJump to behavior
        Source: C:\ProgramData\jjfvbumjfczj\oapavmkbdsqp.exeSection loaded: rpcrtremote.dllJump to behavior
        Source: C:\Windows\explorer.exeSection loaded: explorerframe.dllJump to behavior
        Source: C:\Windows\explorer.exeSection loaded: duser.dllJump to behavior
        Source: C:\Windows\explorer.exeSection loaded: dui70.dllJump to behavior
        Source: C:\Windows\explorer.exeSection loaded: uxtheme.dllJump to behavior
        Source: C:\Windows\explorer.exeSection loaded: powrprof.dllJump to behavior
        Source: C:\Windows\explorer.exeSection loaded: dwmapi.dllJump to behavior
        Source: C:\Windows\explorer.exeSection loaded: slc.dllJump to behavior
        Source: C:\Windows\explorer.exeSection loaded: secur32.dllJump to behavior
        Source: C:\Windows\explorer.exeSection loaded: sspicli.dllJump to behavior
        Source: C:\Windows\explorer.exeSection loaded: propsys.dllJump to behavior
        Source: C:\Windows\System32\svchost.exeSection loaded: rasapi32.dllJump to behavior
        Source: C:\Windows\System32\svchost.exeSection loaded: rasman.dllJump to behavior
        Source: classification engineClassification label: mal100.expl.evad.winEXE@23/1@0/0
        Source: C:\Windows\System32\dialer.exeCode function: 3_2_000000014000226C GetCurrentProcessId,OpenProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,CloseHandle,FindResourceA,SizeofResource,LoadResource,LockResource,GetCurrentProcessId,RegCreateKeyExW,ConvertStringSecurityDescriptorToSecurityDescriptorW,RegSetKeySecurity,LocalFree,RegCreateKeyExW,GetCurrentProcessId,RegSetValueExW,RegCloseKey,RegCloseKey,CreateThread,GetProcessHeap,HeapAlloc,CreateThread,CreateThread,SleepEx,3_2_000000014000226C
        Source: C:\Windows\System32\dialer.exeCode function: 3_2_00000001400019C4 SysAllocString,SysAllocString,CoInitializeEx,CoInitializeSecurity,CoCreateInstance,VariantInit,CoUninitialize,SysFreeString,SysFreeString,3_2_00000001400019C4
        Source: C:\Windows\System32\dialer.exeCode function: 3_2_000000014000226C GetCurrentProcessId,OpenProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,CloseHandle,FindResourceA,SizeofResource,LoadResource,LockResource,GetCurrentProcessId,RegCreateKeyExW,ConvertStringSecurityDescriptorToSecurityDescriptorW,RegSetKeySecurity,LocalFree,RegCreateKeyExW,GetCurrentProcessId,RegSetValueExW,RegCloseKey,RegCloseKey,CreateThread,GetProcessHeap,HeapAlloc,CreateThread,CreateThread,SleepEx,3_2_000000014000226C
        Source: C:\ProgramData\jjfvbumjfczj\oapavmkbdsqp.exeCode function: 16_2_FF6B9DF0 OpenSCManagerW,GetLastError,OpenServiceW,StartServiceW,GetLastError,QueryServiceStatus,Sleep,GetLastError,CloseServiceHandle,CloseServiceHandle,16_2_FF6B9DF0
        Source: C:\Users\user\Desktop\mine327.exeFile created: C:\Users\user\AppData\Local\GDIPFONTCACHEV1.DATJump to behavior
        Source: C:\Windows\System32\conhost.exeMutant created: NULL
        Source: C:\Windows\System32\WerFault.exeMutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess1436
        Source: C:\Windows\System32\WerFault.exeFile created: C:\Users\user\AppData\Local\Temp\WER6893.tmpJump to behavior
        Source: C:\Windows\System32\sc.exeConsole Write: .................0E.....................(.P.....8.......H.......................................................................$...............Jump to behavior
        Source: C:\Windows\System32\sc.exeConsole Write: ............:....1..............[.S.C.]. .C.r.e.a.t.e.S.e.r.v.i.c.e. .S.U.C.C.E.S.S..............97.............h.......8.......................Jump to behavior
        Source: C:\Windows\System32\sc.exeConsole Write: .................^......................(.P.....................H...............................$...............................................Jump to behavior
        Source: C:\Windows\System32\sc.exeConsole Write: ................0.4.....................(.P.....h...............<........7......................"...............................................Jump to behavior
        Source: C:\Users\user\Desktop\mine327.exeProcess created: C:\Windows\explorer.exe
        Source: unknownProcess created: C:\Windows\explorer.exe
        Source: C:\Users\user\Desktop\mine327.exeProcess created: C:\Windows\explorer.exeJump to behavior
        Source: mine327.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
        Source: C:\Windows\System32\WerFault.exeFile read: C:\Windows\win.iniJump to behavior
        Source: C:\Users\user\Desktop\mine327.exeKey opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
        Source: C:\Windows\System32\WerFault.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
        Source: C:\Windows\System32\WerFault.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
        Source: C:\Windows\System32\WerFault.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
        Source: C:\Windows\System32\WerFault.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
        Source: C:\Windows\System32\svchost.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
        Source: C:\Windows\System32\svchost.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
        Source: C:\Windows\System32\svchost.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
        Source: C:\Windows\System32\svchost.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
        Source: C:\Windows\System32\svchost.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
        Source: svchost.exe, 00000019.00000002.609571037.000000000366F000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000019.00000000.347207490.0000000003658000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99;
        Source: svchost.exe, 00000019.00000002.609571037.00000000036C0000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000019.00000000.347207490.00000000036C0000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: select * from __SystemEvent;
        Source: mine327.exeReversingLabs: Detection: 69%
        Source: mine327.exeVirustotal: Detection: 48%
        Source: C:\Users\user\Desktop\mine327.exeFile read: C:\Users\user\Desktop\mine327.exeJump to behavior
        Source: unknownProcess created: C:\Users\user\Desktop\mine327.exe "C:\Users\user\Desktop\mine327.exe"
        Source: C:\Users\user\Desktop\mine327.exeProcess created: C:\Windows\explorer.exe "C:\Windows\explorer.exe"
        Source: C:\Windows\explorer.exeProcess created: C:\Windows\System32\dialer.exe C:\Windows\system32\dialer.exe
        Source: C:\Windows\explorer.exeProcess created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe delete "GVKQGWZS"
        Source: unknownProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe "139732321118494632871898021326457884-543674567-14929065572102852035-708161083"
        Source: C:\Windows\explorer.exeProcess created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe create "GVKQGWZS" binpath= "C:\ProgramData\jjfvbumjfczj\oapavmkbdsqp.exe" start= "auto"
        Source: C:\Windows\System32\services.exeProcess created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k WerSvcGroup
        Source: C:\Windows\System32\svchost.exeProcess created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 1436 -s 724
        Source: C:\Windows\explorer.exeProcess created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop eventlog
        Source: C:\Windows\explorer.exeProcess created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe start "GVKQGWZS"
        Source: C:\Windows\System32\dialer.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe "-1634546190-146323334895602099619948307862079476161-1963036748880124969-1741426452"
        Source: C:\Windows\System32\services.exeProcess created: C:\ProgramData\jjfvbumjfczj\oapavmkbdsqp.exe C:\ProgramData\jjfvbumjfczj\oapavmkbdsqp.exe
        Source: unknownProcess created: C:\Windows\explorer.exe C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
        Source: C:\Users\user\Desktop\mine327.exeProcess created: C:\Windows\explorer.exe "C:\Windows\explorer.exe"Jump to behavior
        Source: C:\Windows\explorer.exeProcess created: C:\Windows\System32\dialer.exe C:\Windows\system32\dialer.exeJump to behavior
        Source: C:\Windows\explorer.exeProcess created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe delete "GVKQGWZS"Jump to behavior
        Source: C:\Windows\explorer.exeProcess created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe create "GVKQGWZS" binpath= "C:\ProgramData\jjfvbumjfczj\oapavmkbdsqp.exe" start= "auto"Jump to behavior
        Source: C:\Windows\explorer.exeProcess created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop eventlogJump to behavior
        Source: C:\Windows\explorer.exeProcess created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe start "GVKQGWZS"Jump to behavior
        Source: C:\Windows\System32\services.exeProcess created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k WerSvcGroupJump to behavior
        Source: C:\Windows\System32\services.exeProcess created: C:\ProgramData\jjfvbumjfczj\oapavmkbdsqp.exe C:\ProgramData\jjfvbumjfczj\oapavmkbdsqp.exeJump to behavior
        Source: C:\Windows\System32\svchost.exeProcess created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 1436 -s 724Jump to behavior
        Source: C:\Windows\System32\svchost.exeProcess created: unknown unknownJump to behavior
        Source: C:\Users\user\Desktop\mine327.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\InprocServer32Jump to behavior
        Source: C:\Users\user\Desktop\mine327.exeFile opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dllJump to behavior
        Source: mine327.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
        Source: mine327.exeStatic file information: File size 3249284 > 1048576
        Source: mine327.exeStatic PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
        Source: mine327.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
        Source: Binary string: .assembly\GAC_MSC:\Users\user\Desktop\Fallkyriya.pdb3fPwty0 source: mine327.exe, 00000000.00000002.377689220.00000000002E2000.00000004.00000010.00020000.00000000.sdmp
        Source: Binary string: ..pdb source: mine327.exe, 00000000.00000002.377689220.00000000002E2000.00000004.00000010.00020000.00000000.sdmp
        Source: Binary string: :\Windows\Containers\Confidential\DotnetGenerator\Stub\Projects\Fallkyriya\obj\Release\Fallkyriya.pdb.pdb source: mine327.exe, 00000000.00000002.377603583.000000000012A000.00000004.00000020.00020000.00000000.sdmp
        Source: Binary string: C:\Windows\Containers\Confidential\DotnetGenerator\Stub\Projects\Fallkyriya\obj\Release\Fallkyriya.pdb.pdb source: mine327.exe, 00000000.00000002.379248247.000000001B31E000.00000004.00000020.00020000.00000000.sdmp
        Source: Binary string: mscoree.pdbb source: WerFault.exe, 0000000A.00000002.372971964.000000000245F000.00000004.00000001.00020000.00000000.sdmp
        Source: Binary string: C:\Windows\Containers\Confidential\DotnetGenerator\Stub\Projects\Fallkyriya\obj\Release\Fallkyriya.pdb source: mine327.exe, 00000000.00000000.333303562.0000000001292000.00000020.00000001.01000000.00000003.sdmp
        Source: Binary string: al\DotnetGenerator\Stub\Projects\Fallkyriya\obj\Release\Fallkyriya.pdb source: mine327.exe, 00000000.00000002.377689220.00000000002E2000.00000004.00000010.00020000.00000000.sdmp
        Source: Binary string: .C:\Users\user\Desktop\mine327.PDB source: mine327.exe, 00000000.00000002.377689220.00000000002E2000.00000004.00000010.00020000.00000000.sdmp
        Source: Binary string: C:\Users\user\Desktop\mine327.PDB source: mine327.exe, 00000000.00000002.377689220.00000000002E2000.00000004.00000010.00020000.00000000.sdmp
        Source: Binary string: mscorlib.ni.pdb source: WerFault.exe, 0000000A.00000002.375318351.00000000026B8000.00000004.00000001.00020000.00000000.sdmp
        Source: Binary string: 2wmine327.PDB source: mine327.exe, 00000000.00000002.377689220.00000000002E2000.00000004.00000010.00020000.00000000.sdmp
        Source: Binary string: explorer.pdb source: explorer.exe, 00000002.00000003.341979658.0000000000430000.00000004.00000001.00020000.00000000.sdmp, oapavmkbdsqp.exe, oapavmkbdsqp.exe, 00000010.00000002.409921933.00000000FF621000.00000020.00000001.01000000.00000007.sdmp
        Source: Binary string: 8C:\Windows\Fallkyriya.pdb source: mine327.exe, 00000000.00000002.377689220.00000000002E2000.00000004.00000010.00020000.00000000.sdmp
        Source: Binary string: symbols\exe\Fallkyriya.pdbb4 source: mine327.exe, 00000000.00000002.377689220.00000000002E2000.00000004.00000010.00020000.00000000.sdmp
        Source: Binary string: explorer.pdbP source: explorer.exe, 00000002.00000003.341979658.0000000000430000.00000004.00000001.00020000.00000000.sdmp
        Source: Binary string: mscoree.pdb source: WerFault.exe, 0000000A.00000002.372971964.000000000245F000.00000004.00000001.00020000.00000000.sdmp
        Source: Binary string: C:\Windows\Containers\Confidential\DotnetGenerator\Stub\Projects\Fallkyriya\obj\Release\Fallkyriya.pdb/ source: mine327.exe, 00000000.00000002.377689220.00000000002E2000.00000004.00000010.00020000.00000000.sdmp

        Data Obfuscation

        barindex
        Detected unpacking (creates a PE file in dynamic memory)
        Source: C:\ProgramData\jjfvbumjfczj\oapavmkbdsqp.exeUnpacked PE file: 16.2.oapavmkbdsqp.exe.280000.1.unpack
        Source: mine327.exeStatic PE information: 0xFC4D4CA1 [Wed Feb 20 04:18:41 2104 UTC]
        Source: C:\ProgramData\jjfvbumjfczj\oapavmkbdsqp.exeCode function: 16_2_FF64020C RegisterTraceGuidsW,RegDeleteKeyExW,GetCurrentProcess,SetPriorityClass,SystemParametersInfoW,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,RegCreateKeyW,CreateMutexW,WaitForSingleObject,#899,#188,SetProcessShutdownParameters,PeekMessageW,WaitForSingleObject,CloseHandle,OleInitialize,CoCreateInstance,#660,SHGetValueW,GetUserDefaultUILanguage,SHGetSpecialFolderPathW,SHGetSpecialFolderPathW,SHGetSpecialFolderPathW,GetSystemMetrics,CreateEventW,GetSystemMetrics,#885,CloseHandle,RegQueryValueExW,RegSetValueExW,#110,SHCreateThreadRef,SHSetThreadRef,#176,ReleaseMutex,CloseHandle,PostMessageW,#16,GetCurrentProcess,SetPriorityClass,RegisterApplicationRestart,CoCreateInstance,#201,ReleaseMutex,CloseHandle,GetCurrentProcess,SetPriorityClass,memset,SHGetKnownFolderIDList,ShellExecuteExW,#155,memset,GetCommandLineW,PathGetArgsW,CoCreateInstance,CoCreateInstance,CoCreateInstance,memset,GetStartupInfoW,#155,LoadLibraryW,GetProcAddress,FreeLibrary,SHSetThreadRef,GetMessageW,TranslateMessage,DispatchMessageW,RegSetValueExW,#111,OleUninitialize,#188,GetCommandLineW,PathGetArgsW,#158,#10,UnregisterTraceGuids,ExitProcess,16_2_FF64020C
        Source: C:\Users\user\Desktop\mine327.exeCode function: 0_2_0055ACDD push rcx; retf 003Fh0_2_0055ACDE
        Source: C:\Users\user\Desktop\mine327.exeCode function: 0_2_0058C6DD push rcx; retf 003Fh0_2_0058C6DE
        Source: C:\Users\user\Desktop\mine327.exeCode function: 0_2_000007FE93D5DD58 push eax; retf 0_2_000007FE93D5E039
        Source: C:\Users\user\Desktop\mine327.exeCode function: 0_2_000007FE93D500BD pushad ; iretd 0_2_000007FE93D500C1
        Source: C:\Users\user\Desktop\mine327.exeCode function: 0_2_000007FE93D51E6D pushad ; retf 0_2_000007FE93D51E81
        Source: C:\Users\user\Desktop\mine327.exeCode function: 0_2_000007FE93D505F5 pushad ; retf 0_2_000007FE93D505F9
        Source: C:\Users\user\Desktop\mine327.exeCode function: 0_2_000007FE93E5026B push esp; retf 4810h0_2_000007FE93E50312
        Source: C:\Windows\explorer.exeCode function: 2_2_0000000140001394 push qword ptr [000000014000A004h]; ret 2_2_0000000140001403
        Source: C:\Windows\System32\services.exeCode function: 6_2_001DACDD push rcx; retf 003Fh6_2_001DACDE
        Source: C:\Windows\System32\services.exeCode function: 6_2_0020C6DD push rcx; retf 003Fh6_2_0020C6DE
        Source: C:\Windows\System32\WerFault.exeCode function: 10_2_0249C6DD push rcx; retf 003Fh10_2_0249C6DE
        Source: C:\Windows\System32\winlogon.exeCode function: 12_2_0096ACDD push rcx; retf 003Fh12_2_0096ACDE
        Source: C:\Windows\System32\winlogon.exeCode function: 12_2_0099C6DD push rcx; retf 003Fh12_2_0099C6DE
        Source: C:\Windows\System32\sc.exeCode function: 13_2_0014ACDD push rcx; retf 003Fh13_2_0014ACDE
        Source: C:\Windows\System32\sc.exeCode function: 13_2_0017C6DD push rcx; retf 003Fh13_2_0017C6DE
        Source: C:\Windows\System32\conhost.exeCode function: 15_2_001EACDD push rcx; retf 003Fh15_2_001EACDE
        Source: C:\Windows\System32\conhost.exeCode function: 15_2_0021C6DD push rcx; retf 003Fh15_2_0021C6DE
        Source: C:\ProgramData\jjfvbumjfczj\oapavmkbdsqp.exeCode function: 16_2_000FACDD push rcx; retf 003Fh16_2_000FACDE
        Source: C:\ProgramData\jjfvbumjfczj\oapavmkbdsqp.exeCode function: 16_2_0029C6DD push rcx; retf 003Fh16_2_0029C6DE
        Source: C:\ProgramData\jjfvbumjfczj\oapavmkbdsqp.exeCode function: 16_2_002DACDD push rcx; retf 003Fh16_2_002DACDE
        Source: C:\ProgramData\jjfvbumjfczj\oapavmkbdsqp.exeCode function: 16_2_0030C6DD push rcx; retf 003Fh16_2_0030C6DE
        Source: C:\Windows\System32\lsass.exeCode function: 17_2_0010ACDD push rcx; retf 003Fh17_2_0010ACDE
        Source: C:\Windows\System32\lsass.exeCode function: 17_2_009DC6DD push rcx; retf 003Fh17_2_009DC6DE
        Source: C:\Windows\System32\lsm.exeCode function: 19_2_001CACDD push rcx; retf 003Fh19_2_001CACDE
        Source: C:\Windows\System32\lsm.exeCode function: 19_2_0027C6DD push rcx; retf 003Fh19_2_0027C6DE
        Source: C:\Windows\System32\svchost.exeCode function: 20_2_0069ACDD push rcx; retf 003Fh20_2_0069ACDE
        Source: C:\Windows\System32\svchost.exeCode function: 20_2_006CC6DD push rcx; retf 003Fh20_2_006CC6DE
        Source: C:\Windows\System32\svchost.exeCode function: 22_2_014BC6DD push rcx; retf 003Fh22_2_014BC6DE
        Source: C:\Windows\System32\svchost.exeCode function: 23_2_00BDC6DD push rcx; retf 003Fh23_2_00BDC6DE
        Source: C:\Windows\System32\svchost.exeCode function: 24_2_00A8C6DD push rcx; retf 003Fh24_2_00A8C6DE
        Source: C:\Windows\System32\svchost.exeCode function: 25_2_00C7C6DD push rcx; retf 003Fh25_2_00C7C6DE

        Persistence and Installation Behavior

        barindex
        Creates files in the system32 config directory
        Source: C:\ProgramData\jjfvbumjfczj\oapavmkbdsqp.exeFile created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\ExplorerJump to behavior
        Source: C:\ProgramData\jjfvbumjfczj\oapavmkbdsqp.exeFile created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\ExplorerStartupLog.etlJump to behavior
        Source: C:\Windows\explorer.exeFile created: C:\ProgramData\jjfvbumjfczj\oapavmkbdsqp.exeJump to dropped file
        Source: C:\Windows\explorer.exeFile created: C:\ProgramData\jjfvbumjfczj\oapavmkbdsqp.exeJump to dropped file
        Source: C:\ProgramData\jjfvbumjfczj\oapavmkbdsqp.exeCode function: 16_2_FF64BCF8 GetModuleFileNameW,PathFindFileNameW,GetPrivateProfileStringW,PathRemoveArgsW,PathRemoveBlanksW,PathFindFileNameW,lstrlenW,StrCmpNIW,#158,16_2_FF64BCF8
        Source: C:\Windows\System32\services.exeRegistry key created: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\GVKQGWZSJump to behavior
        Source: C:\ProgramData\jjfvbumjfczj\oapavmkbdsqp.exeCode function: 16_2_FF6B9DF0 OpenSCManagerW,GetLastError,OpenServiceW,StartServiceW,GetLastError,QueryServiceStatus,Sleep,GetLastError,CloseServiceHandle,CloseServiceHandle,16_2_FF6B9DF0
        Source: C:\Windows\explorer.exeProcess created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe delete "GVKQGWZS"
        Source: C:\ProgramData\jjfvbumjfczj\oapavmkbdsqp.exeCode function: 16_2_FF675F80 IsWindowVisible,IsIconic,IsWindowEnabled,GetWindowLongW,GetSystemMenu,GetMenuState,16_2_FF675F80
        Source: C:\ProgramData\jjfvbumjfczj\oapavmkbdsqp.exeCode function: 16_2_FF664D94 SendMessageW,SendMessageW,GetAncestor,GetLastActivePopup,IsIconic,IsWindowEnabled,SwitchToThisWindow,IsWindowVisible,IsWindowEnabled,GetWindow,IsIconic,ShowWindowAsync,16_2_FF664D94
        Source: C:\ProgramData\jjfvbumjfczj\oapavmkbdsqp.exeCode function: 16_2_FF664D94 SendMessageW,SendMessageW,GetAncestor,GetLastActivePopup,IsIconic,IsWindowEnabled,SwitchToThisWindow,IsWindowVisible,IsWindowEnabled,GetWindow,IsIconic,ShowWindowAsync,16_2_FF664D94
        Source: C:\ProgramData\jjfvbumjfczj\oapavmkbdsqp.exeCode function: 16_2_FF62ACE8 IsIconic,16_2_FF62ACE8
        Source: C:\ProgramData\jjfvbumjfczj\oapavmkbdsqp.exeCode function: 16_2_FF664CFC IsWindow,IsIconic,GetForegroundWindow,ShowWindowAsync,PostMessageW,16_2_FF664CFC
        Source: C:\ProgramData\jjfvbumjfczj\oapavmkbdsqp.exeCode function: 16_2_FF65BB9C ShowWindow,IsIconic,SendMessageW,PostMessageW,PostMessageW,EventEnabled,16_2_FF65BB9C
        Source: C:\ProgramData\jjfvbumjfczj\oapavmkbdsqp.exeCode function: 16_2_FF676530 ShowWindow,IsIconic,SendMessageW,PostMessageW,PostMessageW,IsCompositionActive,16_2_FF676530
        Source: C:\ProgramData\jjfvbumjfczj\oapavmkbdsqp.exeCode function: 16_2_FF65F410 IsIconic,GetWindowLongW,IsWindowVisible,16_2_FF65F410
        Source: C:\ProgramData\jjfvbumjfczj\oapavmkbdsqp.exeCode function: 16_2_FF65B328 GetMonitorInfoW,IntersectRect,SetPropW,GetModuleHandleW,LoadIconW,SendMessageW,#100,SHGetKnownFolderIDList,#155,RemovePropW,DestroyWindow,SystemParametersInfoW,OffsetRect,IsIconic,GetCurrentProcessId,SendMessageTimeoutW,GetCurrentProcessId,#8,#9,GetCurrentProcessId,#10,16_2_FF65B328
        Source: C:\ProgramData\jjfvbumjfczj\oapavmkbdsqp.exeCode function: 16_2_FF65F3D3 IsIconic,GetWindowLongW,16_2_FF65F3D3
        Source: C:\Users\user\Desktop\mine327.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\mine327.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\mine327.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\mine327.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\mine327.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\mine327.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\mine327.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\mine327.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\mine327.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\mine327.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\mine327.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\mine327.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\mine327.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\mine327.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\mine327.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\mine327.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\mine327.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\mine327.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\mine327.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\mine327.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\mine327.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\mine327.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\mine327.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\mine327.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\mine327.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\mine327.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\mine327.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\mine327.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\mine327.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\mine327.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\mine327.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\mine327.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\mine327.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\mine327.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\mine327.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\mine327.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\mine327.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\mine327.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\mine327.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\services.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\services.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\services.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\services.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\services.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOXJump to behavior
        Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
        Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX

        Malware Analysis System Evasion

        barindex
        Yara detected AntiVM3
        Source: Yara matchFile source: Process Memory Space: mine327.exe PID: 1436, type: MEMORYSTR
        Contains functionality to compare user and computer (likely to detect sandboxes)
        Source: C:\Windows\System32\dialer.exeCode function: OpenProcess,OpenProcess,K32GetModuleFileNameExW,PathFindFileNameW,lstrlenW,StrCpyW,CloseHandle,StrCmpIW,NtQueryInformationProcess,OpenProcessToken,GetTokenInformation,GetLastError,LocalAlloc,GetTokenInformation,GetSidSubAuthorityCount,GetSidSubAuthority,LocalFree,CloseHandle,StrStrA,VirtualAllocEx,WriteProcessMemory,NtCreateThreadEx,WaitForSingleObject,GetExitCodeThread,CloseHandle,CloseHandle,3_2_00000001400010C0
        Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
        Source: mine327.exe, 00000000.00000002.377843630.00000000029FE000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: WINE_GET_UNIX_FILE_NAME
        Source: mine327.exe, 00000000.00000002.377843630.00000000029FE000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: SBIEDLL.DLL
        Source: C:\Users\user\Desktop\mine327.exeMemory allocated: 1D0000 memory reserve | memory write watchJump to behavior
        Source: C:\Users\user\Desktop\mine327.exeMemory allocated: DC0000 memory reserve | memory write watchJump to behavior
        Source: C:\Windows\System32\dialer.exeWindow / User API: threadDelayed 917Jump to behavior
        Source: C:\Windows\System32\services.exeWindow / User API: threadDelayed 7129Jump to behavior
        Source: C:\Windows\System32\services.exeWindow / User API: threadDelayed 1873Jump to behavior
        Source: C:\Windows\System32\winlogon.exeWindow / User API: threadDelayed 7690Jump to behavior
        Source: C:\Windows\System32\winlogon.exeWindow / User API: threadDelayed 901Jump to behavior
        Source: C:\Windows\System32\lsass.exeWindow / User API: threadDelayed 5563Jump to behavior
        Source: C:\Windows\System32\lsass.exeWindow / User API: threadDelayed 3625Jump to behavior
        Source: C:\Windows\System32\lsm.exeWindow / User API: threadDelayed 5071Jump to behavior
        Source: C:\Windows\System32\svchost.exeWindow / User API: threadDelayed 6772Jump to behavior
        Source: C:\Windows\System32\svchost.exeWindow / User API: threadDelayed 6568Jump to behavior
        Source: C:\Windows\System32\svchost.exeWindow / User API: threadDelayed 3236Jump to behavior
        Source: C:\Windows\System32\svchost.exeWindow / User API: threadDelayed 2293Jump to behavior
        Source: C:\Windows\System32\svchost.exeWindow / User API: threadDelayed 5696Jump to behavior
        Source: C:\Windows\System32\svchost.exeWindow / User API: threadDelayed 3706Jump to behavior
        Source: C:\Windows\System32\svchost.exeWindow / User API: threadDelayed 2268
        Source: C:\Windows\System32\svchost.exeWindow / User API: threadDelayed 5480
        Source: C:\Windows\System32\spoolsv.exeWindow / User API: threadDelayed 4975
        Source: C:\Windows\System32\svchost.exeWindow / User API: threadDelayed 2279
        Source: C:\Windows\System32\dwm.exeWindow / User API: threadDelayed 5066
        Source: C:\Windows\explorer.exeWindow / User API: threadDelayed 9733
        Source: C:\Windows\System32\UI0Detect.exeWindow / User API: threadDelayed 2826
        Source: C:\Windows\System32\svchost.exeWindow / User API: threadDelayed 2262
        Source: C:\Windows\System32\wbem\WmiPrvSE.exeWindow / User API: threadDelayed 1931
        Source: C:\Windows\System32\dialer.exeCheck user administrative privileges: GetTokenInformation,DecisionNodesgraph_3-536
        Source: C:\Windows\explorer.exeAPI coverage: 3.6 %
        Source: C:\Windows\System32\conhost.exeAPI coverage: 9.1 %
        Source: C:\ProgramData\jjfvbumjfczj\oapavmkbdsqp.exeAPI coverage: 1.9 %
        Source: C:\Windows\System32\lsass.exeAPI coverage: 9.2 %
        Source: C:\Windows\System32\svchost.exeAPI coverage: 7.7 %
        Source: C:\Windows\System32\svchost.exeAPI coverage: 7.6 %
        Source: C:\Windows\System32\svchost.exeAPI coverage: 7.5 %
        Source: C:\Windows\System32\svchost.exeAPI coverage: 7.7 %
        Source: C:\Windows\System32\svchost.exeAPI coverage: 8.6 %
        Source: C:\Windows\System32\svchost.exeAPI coverage: 7.9 %
        Source: C:\Windows\System32\dialer.exe TID: 1036Thread sleep count: 917 > 30Jump to behavior
        Source: C:\Windows\System32\dialer.exe TID: 1036Thread sleep time: -91700s >= -30000sJump to behavior
        Source: C:\Windows\System32\services.exe TID: 2912Thread sleep count: 7129 > 30Jump to behavior
        Source: C:\Windows\System32\services.exe TID: 2912Thread sleep time: -7129000s >= -30000sJump to behavior
        Source: C:\Windows\System32\services.exe TID: 2912Thread sleep count: 1873 > 30Jump to behavior
        Source: C:\Windows\System32\services.exe TID: 2912Thread sleep time: -1873000s >= -30000sJump to behavior
        Source: C:\Windows\System32\winlogon.exe TID: 1292Thread sleep count: 7690 > 30Jump to behavior
        Source: C:\Windows\System32\winlogon.exe TID: 1292Thread sleep time: -7690000s >= -30000sJump to behavior
        Source: C:\Windows\System32\winlogon.exe TID: 1292Thread sleep count: 901 > 30Jump to behavior
        Source: C:\Windows\System32\winlogon.exe TID: 1292Thread sleep time: -901000s >= -30000sJump to behavior
        Source: C:\ProgramData\jjfvbumjfczj\oapavmkbdsqp.exe TID: 2008Thread sleep time: -60000s >= -30000sJump to behavior
        Source: C:\Windows\System32\lsass.exe TID: 1416Thread sleep count: 5563 > 30Jump to behavior
        Source: C:\Windows\System32\lsass.exe TID: 1416Thread sleep time: -5563000s >= -30000sJump to behavior
        Source: C:\Windows\System32\lsass.exe TID: 1416Thread sleep count: 3625 > 30Jump to behavior
        Source: C:\Windows\System32\lsass.exe TID: 1416Thread sleep time: -3625000s >= -30000sJump to behavior
        Source: C:\Windows\System32\lsm.exe TID: 1200Thread sleep count: 5071 > 30Jump to behavior
        Source: C:\Windows\System32\lsm.exe TID: 1200Thread sleep time: -5071000s >= -30000sJump to behavior
        Source: C:\Windows\System32\svchost.exe TID: 2572Thread sleep count: 6772 > 30Jump to behavior
        Source: C:\Windows\System32\svchost.exe TID: 2572Thread sleep time: -6772000s >= -30000sJump to behavior
        Source: C:\Windows\System32\svchost.exe TID: 2436Thread sleep count: 6568 > 30Jump to behavior
        Source: C:\Windows\System32\svchost.exe TID: 2436Thread sleep time: -6568000s >= -30000sJump to behavior
        Source: C:\Windows\System32\svchost.exe TID: 2228Thread sleep count: 3236 > 30Jump to behavior
        Source: C:\Windows\System32\svchost.exe TID: 2228Thread sleep time: -3236000s >= -30000sJump to behavior
        Source: C:\Windows\System32\svchost.exe TID: 1736Thread sleep time: -60000s >= -30000sJump to behavior
        Source: C:\Windows\System32\svchost.exe TID: 2924Thread sleep count: 2293 > 30Jump to behavior
        Source: C:\Windows\System32\svchost.exe TID: 2924Thread sleep time: -2293000s >= -30000sJump to behavior
        Source: C:\Windows\System32\svchost.exe TID: 2872Thread sleep count: 5696 > 30Jump to behavior
        Source: C:\Windows\System32\svchost.exe TID: 2872Thread sleep time: -5696000s >= -30000sJump to behavior
        Source: C:\Windows\System32\svchost.exe TID: 2172Thread sleep count: 3706 > 30Jump to behavior
        Source: C:\Windows\System32\svchost.exe TID: 2172Thread sleep time: -3706000s >= -30000sJump to behavior
        Source: C:\Windows\System32\svchost.exe TID: 264Thread sleep time: -120000s >= -30000sJump to behavior
        Source: C:\Windows\System32\svchost.exe TID: 2260Thread sleep count: 2268 > 30
        Source: C:\Windows\System32\svchost.exe TID: 2260Thread sleep time: -2268000s >= -30000s
        Source: C:\Windows\System32\svchost.exe TID: 2728Thread sleep count: 5480 > 30
        Source: C:\Windows\System32\svchost.exe TID: 2728Thread sleep time: -5480000s >= -30000s
        Source: C:\Windows\System32\spoolsv.exe TID: 2192Thread sleep count: 4975 > 30
        Source: C:\Windows\System32\spoolsv.exe TID: 2192Thread sleep time: -4975000s >= -30000s
        Source: C:\Windows\System32\svchost.exe TID: 3076Thread sleep count: 2279 > 30
        Source: C:\Windows\System32\svchost.exe TID: 3076Thread sleep time: -2279000s >= -30000s
        Source: C:\Windows\System32\dwm.exe TID: 3084Thread sleep count: 5066 > 30
        Source: C:\Windows\System32\dwm.exe TID: 3084Thread sleep time: -5066000s >= -30000s
        Source: C:\Windows\explorer.exe TID: 3100Thread sleep count: 9733 > 30
        Source: C:\Windows\explorer.exe TID: 3100Thread sleep time: -9733000s >= -30000s
        Source: C:\Windows\explorer.exe TID: 1340Thread sleep time: -420000s >= -30000s
        Source: C:\Windows\System32\UI0Detect.exe TID: 3116Thread sleep count: 2826 > 30
        Source: C:\Windows\System32\UI0Detect.exe TID: 3116Thread sleep time: -2826000s >= -30000s
        Source: C:\Windows\System32\wbem\WmiPrvSE.exe TID: 1876Thread sleep time: -60000s >= -30000s
        Source: C:\Windows\System32\svchost.exe TID: 3152Thread sleep count: 2262 > 30
        Source: C:\Windows\System32\svchost.exe TID: 3152Thread sleep time: -2262000s >= -30000s
        Source: C:\Windows\System32\wbem\WmiPrvSE.exe TID: 3160Thread sleep count: 1931 > 30
        Source: C:\Windows\System32\wbem\WmiPrvSE.exe TID: 3160Thread sleep time: -1931000s >= -30000s
        Source: C:\Windows\System32\wbem\WmiPrvSE.exe TID: 2808Thread sleep time: -180000s >= -30000s
        Source: C:\Windows\System32\wbem\WmiPrvSE.exe TID: 2208Thread sleep time: -120000s >= -30000s
        Source: C:\Windows\System32\dialer.exeLast function: Thread delayed
        Source: C:\Windows\System32\dialer.exeLast function: Thread delayed
        Source: C:\Windows\System32\services.exeLast function: Thread delayed
        Source: C:\Windows\System32\services.exeLast function: Thread delayed
        Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
        Source: C:\ProgramData\jjfvbumjfczj\oapavmkbdsqp.exeLast function: Thread delayed
        Source: C:\Windows\System32\lsass.exeLast function: Thread delayed
        Source: C:\Windows\System32\lsass.exeLast function: Thread delayed
        Source: C:\Windows\System32\svchost.exeLast function: Thread delayed
        Source: C:\Windows\System32\svchost.exeLast function: Thread delayed
        Source: C:\Windows\System32\svchost.exeLast function: Thread delayed
        Source: C:\Windows\System32\svchost.exeLast function: Thread delayed
        Source: C:\Windows\System32\svchost.exeLast function: Thread delayed
        Source: C:\Windows\System32\svchost.exeLast function: Thread delayed
        Source: C:\Windows\System32\svchost.exeLast function: Thread delayed
        Source: C:\Windows\System32\svchost.exeLast function: Thread delayed
        Source: C:\Windows\System32\svchost.exeLast function: Thread delayed
        Source: C:\Windows\System32\svchost.exeLast function: Thread delayed
        Source: C:\Windows\System32\svchost.exeLast function: Thread delayed
        Source: C:\Windows\System32\svchost.exeLast function: Thread delayed
        Source: C:\Windows\System32\svchost.exeLast function: Thread delayed
        Source: C:\Windows\System32\svchost.exeLast function: Thread delayed
        Source: C:\Windows\System32\svchost.exeLast function: Thread delayed
        Source: C:\Windows\System32\svchost.exeLast function: Thread delayed
        Source: C:\Windows\System32\svchost.exeLast function: Thread delayed
        Source: C:\Windows\System32\svchost.exeLast function: Thread delayed
        Source: C:\Windows\System32\wbem\WmiPrvSE.exeLast function: Thread delayed
        Source: C:\Windows\System32\wbem\WmiPrvSE.exeLast function: Thread delayed
        Source: C:\Windows\System32\svchost.exeLast function: Thread delayed
        Source: C:\Windows\System32\svchost.exeLast function: Thread delayed
        Source: C:\Windows\System32\wbem\WmiPrvSE.exeLast function: Thread delayed
        Source: C:\Windows\System32\wbem\WmiPrvSE.exeLast function: Thread delayed
        Source: C:\Windows\System32\wbem\WmiPrvSE.exeLast function: Thread delayed
        Source: C:\Windows\System32\wbem\WmiPrvSE.exeLast function: Thread delayed
        Source: C:\ProgramData\jjfvbumjfczj\oapavmkbdsqp.exeCode function: 16_2_FF652F95 GetLocalTime followed by cmp: cmp eax, 01h and CTI: jne FF6551F6h16_2_FF652F95
        Source: C:\ProgramData\jjfvbumjfczj\oapavmkbdsqp.exeCode function: 16_2_FF63E858 GetLocalTime followed by cmp: cmp di, 000ch and CTI: jbe FF680741h16_2_FF63E858
        Source: C:\ProgramData\jjfvbumjfczj\oapavmkbdsqp.exeCode function: 16_2_FF66D630 GetSystemTimeAsFileTime followed by cmp: cmp al, 04h and CTI: jc FF68D097h16_2_FF66D630
        Source: C:\Users\user\Desktop\mine327.exeCode function: 0_2_0057DCE0 FindFirstFileExW,0_2_0057DCE0
        Source: C:\Windows\System32\services.exeCode function: 6_2_001FDCE0 FindFirstFileExW,6_2_001FDCE0
        Source: C:\Windows\System32\WerFault.exeCode function: 10_2_0248DCE0 FindFirstFileExW,10_2_0248DCE0
        Source: C:\Windows\System32\winlogon.exeCode function: 12_2_0098DCE0 FindFirstFileExW,12_2_0098DCE0
        Source: C:\Windows\System32\sc.exeCode function: 13_2_0016DCE0 FindFirstFileExW,13_2_0016DCE0
        Source: C:\Windows\System32\conhost.exeCode function: 15_2_0020DCE0 FindFirstFileExW,15_2_0020DCE0
        Source: C:\ProgramData\jjfvbumjfczj\oapavmkbdsqp.exeCode function: 16_2_0028DCE0 FindFirstFileExW,16_2_0028DCE0
        Source: C:\ProgramData\jjfvbumjfczj\oapavmkbdsqp.exeCode function: 16_2_002FDCE0 FindFirstFileExW,16_2_002FDCE0
        Source: C:\ProgramData\jjfvbumjfczj\oapavmkbdsqp.exeCode function: 16_2_FF63F060 SHGetFolderPathEx,StrChrW,FindFirstFileW,PathRemoveFileSpecW,CompareStringOrdinal,lstrcmpiW,GetDesktopWindow,#292,FindNextFileW,FindClose,16_2_FF63F060
        Source: C:\Windows\System32\lsass.exeCode function: 17_2_009CDCE0 FindFirstFileExW,17_2_009CDCE0
        Source: C:\Windows\System32\lsm.exeCode function: 19_2_0026DCE0 FindFirstFileExW,19_2_0026DCE0
        Source: C:\Windows\System32\svchost.exeCode function: 20_2_006BDCE0 FindFirstFileExW,20_2_006BDCE0
        Source: C:\Windows\System32\svchost.exeCode function: 22_2_014ADCE0 FindFirstFileExW,22_2_014ADCE0
        Source: C:\Windows\System32\svchost.exeCode function: 23_2_00BCDCE0 FindFirstFileExW,23_2_00BCDCE0
        Source: C:\Windows\System32\svchost.exeCode function: 24_2_00A7DCE0 FindFirstFileExW,24_2_00A7DCE0
        Source: C:\Windows\System32\svchost.exeCode function: 25_2_00C6DCE0 FindFirstFileExW,25_2_00C6DCE0
        Source: C:\Windows\System32\svchost.exeCode function: 26_2_002CDCE0 FindFirstFileExW,26_2_002CDCE0
        Source: WmiPrvSE.exe, 00000022.00000003.441341124.00000000003FF000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: VMware Virtual Platform
        Source: WmiPrvSE.exe, 00000022.00000003.441341124.00000000003FF000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: VMware-42 35 04 92 67 3a 19 1e-bc 53 01 84 57 2e e5 5c
        Source: mine327.exe, 00000000.00000002.377843630.00000000029FE000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: VMware
        Source: svchost.exe, 00000019.00000000.346906062.0000000001170000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \\?\IDE#CdRomNECVMWar_VMware_SATA_CD01_______________1.00____#6&373888b8&0&1.0.0#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}u
        Source: svchost.exe, 00000014.00000000.343474746.0000000000673000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: ;;SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\5&22BE343F&0&000000
        Source: svchost.exe, 00000019.00000000.346906062.0000000001170000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \\?\IDE#CdRomNECVMWar_VMware_SATA_CD01_______________1.00____#6&373888b8&0&1.0.0#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}r
        Source: spoolsv.exe, 0000001C.00000000.348519570.00000000027AE000.00000004.00000010.00020000.00000000.sdmpBinary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\5&22BE343F&0&000000P
        Source: svchost.exe, 00000019.00000000.346906062.0000000001170000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \\?\SCSI#Disk&Ven_VMware&Prod_Virtual_disk#5&22be343f&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}u
        Source: services.exe, 00000006.00000002.607282545.0000000000FAB000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: 53f5630d-b6bf-11d0-94f2-00a0c91efb8b\\?\IDE#CdRomNECVMWar_VMware_SATA_CD01_______________1.00____#6&373888b8&0&1.0.0#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}IDE\CdRomNECVMWar_VMware_SATA_CD01_______________1.00____IDE\NECVMWar_VMware_SATA_CD01_______________1.00____IDE\CdRo
        Source: svchost.exe, 00000014.00000002.606686716.0000000000F67000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: CdRomNECVMWar_VMware_SATA_CD01_______________1.00____#6&373888b8&0&1.0.0#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{8a079453-cd11-11ea-a1d0-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{8a079453-cd11-11ea-a1d0-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}LMEM
        Source: mine327.exe, 00000000.00000002.377843630.00000000029FE000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
        Source: svchost.exe, 00000019.00000000.346906062.0000000001170000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \\?\IDE#CdRomNECVMWar_VMware_SATA_CD01_______________1.00____#6&373888b8&0&1.0.0#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}}
        Source: svchost.exe, 00000014.00000002.606686716.0000000000F67000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\5&22be343f&0&000000
        Source: mine327.exe, 00000000.00000002.377843630.00000000029FE000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: VMWARE
        Source: mine327.exe, 00000000.00000002.377843630.00000000029FE000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: InstallPath%C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\'C:\WINDOWS\system32\drivers\vmmouse.sys&C:\WINDOWS\system32\drivers\vmhgfs.sys
        Source: svchost.exe, 00000014.00000002.602992913.00000000001E3000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: ide\cdromnecvmwar_vmware_sata_cd01_______________1.00____\6&373888b8&0&1.0.0
        Source: svchost.exe, 00000019.00000002.610594695.0000000004884000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\5&22be343f&0&000000_0-{05901221-D566-11d1-B2F0-00A0C9062910}
        Source: svchost.exe, 00000019.00000003.533428455.000000000378A000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: stringComputer System ProductComputer System Product9BUL1B92043542-3A67-1E19-BC53-0184572EE55CVMware, Inc.None
        Source: spoolsv.exe, 0000001C.00000000.348519570.00000000027AE000.00000004.00000010.00020000.00000000.sdmpBinary or memory string: \DISK&VEN_VMWARE&PRO
        Source: WmiPrvSE.exe, 00000022.00000003.441341124.00000000003FF000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: VMware, Inc.VMware Virtual PlatformNoneVMware-42 35 04 92 67 3a 19 1e-bc 53 01 84 57 2e e5 5c
        Source: services.exe, 00000006.00000000.341821779.0000000001783000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: 53f56308-b6bf-11d0-94f2-00a0c91efb8b\\?\IDE#CdRomNECVMWar_VMware_SATA_CD01_______________1.00____#6&373888b8&0&1.0.0#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}IDE\CdRomNECVMWar_VMware_SATA_CD01_______________1.00____IDE\NECVMWar_VMware_SATA_CD01_______________1.00____IDE\CdRomNECVMWar_VMware_SATA_CD01_______________NECVMWar_VMware_SATA_CD01_______________1.00____GenCdRomGenCdRomb8
        Source: svchost.exe, 00000019.00000002.609571037.0000000003658000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: WMIBinaryMofResourceSCSI\Disk&Ven_VMware&Prod_Virtual_disk\5&22be343f&0&000000_0-{05901221-D566-11d1-B2F0-00A0C9062910}
        Source: services.exe, 00000006.00000002.608272793.000000000179C000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: ______________1.00____#6&373888b8&0&1.0.0#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}IDE\CdRomNECVMWar_VMware_SATA_CD01_______________1.00____IDE\NECVMWar_VMware_SATA_CD01_______________1.00____IDE\CdRomNECVMWar_VMware_SATA_CD01_______________NECVMWar_VMware_SATA_CD01_______________1.00____GenCdRomGenCdRom2accfe60-c130-11d2-b082-00a0c91efb8b\\?\PCIIDE#IDEChannel#5&35c44269&0&4#{2accfe60-c130-11d2-b082-00a0c91efb8b}15ad-07e0Internal_IDE_Channel*PNP06008
        Source: svchost.exe, 00000016.00000002.605131595.0000000002100000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: $value = $pr.Value.replace("VBOX", $value).replace("VBox", $value).replace("VMWARE", $value).replace("VMware Virtual disk", $value).replace("VMware", $value).replace("HARDDISK", "WDC").replace("VIRTUAL_DISK", $value)
        Source: services.exe, 00000006.00000000.341821779.0000000001783000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: 53f56307-b6bf-11d0-94f2-00a0c91efb8b\\?\SCSI#Disk&Ven_VMware&Prod_Virtual_disk#5&22be343f&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}SCSI\DiskVMware__Virtual_disk____1.0_SCSI\DiskVMware__Virtual_disk____SCSI\DiskVMware__SCSI\VMware__Virtual_disk____1VMware__Virtual_disk____1GenDiskSCSI\DiskSCSI\RAW3
        Source: svchost.exe, 00000019.00000002.603306949.00000000002EF000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: zSCSI\Disk&Ven_VMware&Prod_Virtual_disk\5&22be343f&0&000000_0r
        Source: WmiPrvSE.exe, 00000022.00000003.441760961.00000000003AB000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: IDE\CDROMNECVMWAR_VMWARE_SATA_CD01_______________1.00____\6&373888B8&0&1.0.0y
        Source: services.exe, 00000006.00000000.341821779.0000000001783000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: 53f56308-b6bf-11d0-94f2-00a0c91efb8b\\?\IDE#CdRomNECVMWar_VMware_SATA_CD01_______________1.00____#6&373888b8&0&1.0.0#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}IDE\CdRomNECVMWar_VMware_SATA_CD01_______________1.00____IDE\NECVMWar_VMware_SATA_CD01_______________1.00____IDE\CdRomNECVMWar_VMware_SATA_CD01_______________NECVMWar_VMware_SATA_CD01_______________1.00____GenCdRomGenCdRoml8
        Source: svchost.exe, 00000019.00000000.347320164.0000000003E48000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: Win32_ComputerSystemuser-PCWin32_ComputerSystemuser-PCOKuser-PC\userx64-based PCNormal bootVMware, Inc.VMware Virtual Platform
        Source: mine327.exe, 00000000.00000002.377843630.00000000029FE000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: C:\WINDOWS\system32\drivers\vmmouse.sys
        Source: mine327.exe, 00000000.00000002.377843630.00000000029FE000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: vmware
        Source: mine327.exe, 00000000.00000002.377843630.00000000029FE000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: C:\WINDOWS\system32\drivers\vmhgfs.sys
        Source: explorer.exe, 0000001F.00000002.606706574.0000000003E59000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: IDE\CDROMNECVMWAR_VMWARE_SATA_CD01_______________1.00____\6&373888B8&0&1.0.0
        Source: svchost.exe, 00000014.00000002.602992913.00000000001E3000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: ide\cdromnecvmwar_vmware_sata_cd01_______________1.00____\6&2848384c&0&1.0.0
        Source: svchost.exe, 00000019.00000000.347411701.000000000482C000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: VMware Virtual disk SCSI Disk Device
        Source: mine327.exe, 00000000.00000002.377843630.00000000029FE000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: noValueButYesKey)C:\WINDOWS\system32\drivers\VBoxMouse.sys
        Source: svchost.exe, 00000016.00000002.605131595.0000000002100000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: if(($pr.Name -eq "DeviceId" -or $pr.Name -eq "Caption" -or $pr.Name -eq "Name" -or $pr.Name -eq "PNPDeviceID" -or $pr.Name -eq "Service" -or $pr.Name -eq "Description") -and ($pr.Value -match 'VEN_80EE' -or $pr.Value -match 'VEN_15AD' -or $pr.Value -match 'VBOX' -or $pr.Value -match 'VBox' -or $pr.Value -match 'VMWARE' -or $pr.Value -match 'VMWare' -or $pr.Value -match '82801FB' -or $pr.Value -match '82441FX' -or $pr.Value -match '82371SB' -or $pr.Value -match 'OpenHCD'))
        Source: mine327.exe, 00000000.00000002.377843630.00000000029FE000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: C:\WINDOWS\system32\drivers\VBoxMouse.sys
        Source: svchost.exe, 00000019.00000002.603306949.00000000002EF000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: VMware
        Source: svchost.exe, 00000014.00000000.343599035.000000000177E000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: \ven_15ad&dev_07a0&subsys_07a015ad&rev_01\3&2b8e0b4b&0&b0pci\ven_15ad&dev_07a0&subsys_07a015ad&rev_01\3&2b8e0b4b&0&b8acpi\pnp0a05\5aroot\ms_pppoeminiport\0000root\legacy_discache\0000pci\ven_15ad&dev_07a0&subsys_07a015ad&rev_01\3&2b8e0b4b&0&c0acpi\pnp0a05\23usb\vid_0e0f&pid_0003&mi_01\7&2a7d3009&0&0001pciide\idechannel\4&c5d1198&0&0acpi\pnp0a05\4&205ad762&0acpi\pnp0a05\5broot\legacy_ndproxy\0000acpi\pnp0a05\24pciide\idechannel\5&35c44269&0&5root\legacy_storflt\0000pciide\idechannel\5&35c44269&0&19root\ms_pptpminiport\0000ide\cdromnecvmwar_vmware_sata_cd01_______________1.00____\6&373888b8&0&1.0.0acpi\pnp0a05\5cacpi\pnp0a05\25acpi\pnp0a05\40pciide\idechannel\4&c5d1198&0&1acpi\pnp0a05\5droot\legacy_tcpip\0000acpi\pnp0a05\26pciide\idechannel\5&35c44269&0&6root\ms_sstpminiport\0000pci\ven_15ad&dev_07a0&subsys_07a015ad&rev_01\3&2b8e0b4b&0&a9acpi\pnp0a05\41pci\ven_15ad&dev_07a0&subsys_07a015ad&rev_01\3&2b8e0b4b&0&b1pciide\idechannel\5&35c44269&0&2pci\ven_15ad&dev_07a0&subsys_07a015ad&rev_01\3&2b8e0b4b&0&b9pci\ven_15ad&dev_07a0&subsys_07a015ad&rev_01
        Source: WmiPrvSE.exe, 00000022.00000003.441341124.00000000003FF000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: VMware SVGA IIES1371
        Source: explorer.exe, 0000001F.00000002.604991513.00000000025E0000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: IDE\CDROMNECVMWAR_VMWARE_SATA_CD01_______________1.00____\6&373888B8&0&1.0.0a
        Source: svchost.exe, 00000016.00000002.605131595.0000000002100000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: if(($pr.Name -eq "Caption" -or $pr.Name -eq "Name" -or $pr.Name -eq "PNPDeviceID" -or $pr.Name -eq "AdapterCompatibility" -or $pr.Name -eq "Description" -or $pr.Name -eq "InfSection" -or $pr.Name -eq "VideoProcessor") -and ($pr.Value -match 'VBOX' -or $pr.Value -match 'VBox' -or $pr.Value -match 'VMWARE' -or $pr.Value -match 'VirtualBox' -or $pr.Value -match 'VMware' -or $pr.Value -match 'Oracle Corporation' -or $pr.Value -match 'Microsoft Basic Display Adapter'))
        Source: svchost.exe, 00000014.00000002.602992913.0000000000210000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 1SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\5&22BE343F&0&000000
        Source: explorer.exe, 0000001F.00000000.349660283.00000000001D6000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \\?\IDE#CdRomNECVMWar_VMware_SATA_CD01_______________1.00____#6&373888b8&0&1.0.0#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}7
        Source: svchost.exe, 00000019.00000002.609571037.00000000035A1000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: WDMClassesOfDriverMSStorageDriver_SenseDataSCSI\Disk&Ven_VMware&Prod_Virtual_disk\5&22be343f&0&000000_0-{05901221-D566-11d1-B2F0-00A0C9062910}
        Source: services.exe, 00000006.00000000.341821779.0000000001783000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: 53f56308-b6bf-11d0-94f2-00a0c91efb8b\\?\IDE#CdRomNECVMWar_VMware_SATA_CD01_______________1.00____#6&373888b8&0&1.0.0#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}IDE\CdRomNECVMWar_VMware_SATA_CD01_______________1.00____IDE\NECVMWar_VMware_SATA_CD01_______________1.00____IDE\CdRomNECVMWar_VMware_SATA_CD01_______________NECVMWar_VMware_SATA_CD01_____
        Source: lsm.exe, 00000013.00000002.603598092.000000000038E000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 1IDE\CDROMNECVMWAR_VMWARE_SATA_CD01_______________1.00____\6&373888B8&0&1.0.0
        Source: svchost.exe, 00000019.00000002.609805884.0000000003731000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: WMIBinaryMofResourceSCSI\Disk&Ven_VMware&Prod_Virtual_disk\5&22be343f&0&000000_0-{05901221-D566-11d1-B2F0-00A0C9062910}ceName]me]$
        Source: WmiPrvSE.exe, 00000022.00000003.441341124.00000000003FF000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: VMware, Inc.
        Source: svchost.exe, 0000001D.00000002.605471171.00000000020A3000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: DE\CdRomNECVMWar_VMware_SATA_CD01_______________1.00____\6&373888b8&0&1.0.0
        Source: svchost.exe, 00000019.00000002.603306949.00000000002EF000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#5&22b
        Source: svchost.exe, 00000019.00000000.347207490.00000000036C0000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: naryMofResourceSCSI\Disk&Ven_VMware&Prod_Virtual_disk\5&22be343f&0&000000_0-{05901221-D566-11d1-B2F0-00A0C9062910}
        Source: services.exe, 00000006.00000002.607282545.0000000000FAB000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: 53f5630d-b6bf-11d0-94f2-00a0c91efb8b\\?\IDE#CdRomNECVMWar_VMware_SATA_CD01_______________1.00____#6&373888b8&0&1.0.0#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}IDE\CdRomNECVMWar_VMware_SATA_CD01_______________1.00____IDE\NECVMWar_VMware_SATA_CD01_______________1.00____IDE\CdRomNECVMWar_VMware_SATA_CD01_______________NECVMWar_VMware_SATA_CD01_______________1.00____GenCdRomGenCdRom
        Source: svchost.exe, 00000017.00000002.607596633.0000000001E2B000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: _vmware&prod_virtual_disk#5
        Source: svchost.exe, 00000014.00000000.343599035.000000000177E000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: _volsnap\0000root\legacy_ksecpkg\0000pciide\idechannel\5&35c44269&0&10acpi\pnp0a05\2froot\*teredo\0000display\default_monitor\4&10c2e2d6&0&12345678&00&0facpi\pnp0a05\4aroot\legacy_peauth\0000scsi\disk&ven_vmware&prod_virtual_disk\5&22be343f&0&000000acpi\genuineintel_-_intel64_family_6_model_85_-_intel(r)_core(tm)2_cpu_6600_@_2.40_ghz\_0acpi\pnp0a05\30acpi\pnp0a05\4broot\legacy_wanarpv6\0000root\legacy_lltdio\0000root\acpi_hal\0000pciide\idechannel\5&35c44269&0&24pci\ven_15ad&dev_0740&subsys_074015ad&rev_10\3&2b8e0b4b&0&3fpciide\idechannel\5&35c44269&0&11root\legacy_psched\0000pci\ven_15ad&dev_07a0&subsys_07a015ad&rev_01\3&2b8e0b4b&0&acpci\ven_15ad&dev_07a0&subsys_07a015ad&rev_01\3&2b8e0b4b&0&b4acpi\pnp0a05\31pci\ven_15ad&dev_07a0&subsys_07a015ad&rev_01\3&2b8e0b4b&0&bcpci\ven_15ad&dev_07a0&subsys_07a015ad&rev_01\3&2b8e0b4b&0&c4acpi\pnp0a05\4cacpi\pnp0800\4&205ad762&0root\blbdrive\0000pci\ven_8086&dev_7110&subsys_197615ad&rev_08\3&2b8e0b4b&0&38root\legacy_wdf01000\0000acpi\pnp0a05\32hdaudio\func_01&ven_15ad&dev_1975&subsys_15ad1975&rev_1001\5&8a7c
        Source: svchost.exe, 00000019.00000000.346906062.0000000001170000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \\?\IDE#CdRomNECVMWar_VMware_SATA_CD01_______________1.00____#6&373888b8&0&1.0.0#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
        Source: svchost.exe, 00000019.00000000.346906062.0000000001170000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \\?\SCSI#Disk&Ven_VMware&Prod_Virtual_disk#5&22be343f&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
        Source: WmiPrvSE.exe, 00000022.00000003.441341124.00000000003FF000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: VMware SVGA II
        Source: mine327.exe, 00000000.00000002.377843630.00000000029FE000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: VMWARE"SOFTWARE\VMware, Inc.\VMware ToolsLHARDWARE\DEVICEMAP\Scsi\Scsi Port 1\Scsi Bus 0\Target Id 0\Logical Unit Id 0LHARDWARE\DEVICEMAP\Scsi\Scsi Port 2\Scsi Bus 0\Target Id 0\Logical Unit Id 0'SYSTEM\ControlSet001\Services\Disk\Enum
        Source: svchost.exe, 00000019.00000000.346906062.0000000001170000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \\?\IDE#CdRomNECVMWar_VMware_SATA_CD01_______________1.00____#6&373888b8&0&1.0.0#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}w
        Source: explorer.exe, 0000001F.00000002.606706574.0000000003E59000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: \\?\ide#cdromnecvmwar_vmware_sata_cd01_______________1.00____#6&373888b8&0&1.0.0#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}100\4&20
        Source: svchost.exe, 00000017.00000002.603298774.000000000037B000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \\?\ide#cdromnecvmwar_vmware_sata_cd01_______________1.00____#6&373888b8&0&1.0.0#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
        Source: WmiPrvSE.exe, 00000022.00000003.441760961.00000000003AB000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\5&22BE343F&0&000000
        Source: services.exe, 00000006.00000002.608321393.00000000017C0000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: 53f56307-b6bf-11d0-94f2-00a0c91efb8b\\?\SCSI#Disk&Ven_VMware&Prod_Virtual_disk#5&22be343f&0&000000#{53f56307-b6bf-1
        Source: svchost.exe, 00000019.00000002.603306949.00000000002EF000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: VMware Virtual disk 1.0 MM*
        Source: svchost.exe, 00000014.00000002.606686716.0000000000F67000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: CdRomNECVMWar_VMware_SATA_CD01_______________1.00____#6&373888b8&0&1.0.0#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{8a079453-cd11-11ea-a1d0-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{8a079453-cd11-11ea-a1d0-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
        Source: svchost.exe, 00000014.00000002.606686716.0000000000F60000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\5&22BE343F&0&0000000
        Source: services.exe, 00000006.00000000.341821779.0000000001783000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: 53f56307-b6bf-11d0-94f2-00a0c91efb8b\\?\SCSI#Disk&Ven_VMware&Prod_Virtual_disk#5&22be343f&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}SCSI\DiskVMware__Virtual_disk____1.0_SCSI\DiskVMware__Virtual_disk____SCSI\DiskVMware__SCSI\VMware__Virtual_disk____1VMware__Virtual_disk____1GenDiskSCSI\DiskSCSI\RAWE_Channel*PNP0600
        Source: svchost.exe, 00000019.00000000.347411701.0000000004720000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: stringComputer System ProductComputer System Product9BUL1B92043542-3A67-1E19-BC53-0184572EE55CVMware, Inc.Noney*
        Source: WmiPrvSE.exe, 00000024.00000003.509098082.000000000027C000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: select * from WMIBinaryMofResource where Name = "SCSI\\Disk&Ven_VMware&Prod_Virtual_disk\\5&22be343f&0&000000_0-{05901221-D566-11d1-B2F0-00A0C9062910}"00A0C9062910}"
        Source: mine327.exe, 00000000.00000002.377843630.00000000029FE000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: SOFTWARE\VMware, Inc.\VMware Tools
        Source: svchost.exe, 00000014.00000002.606686716.0000000000F67000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: IDE\CdRomNECVMWar_VMware_SATA_CD01_______________1.00____\6&373888b8&0&1.0.0
        Source: svchost.exe, 00000016.00000002.605131595.0000000002100000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: $value = $pr.Value.replace("VBOX", $value).replace("VBox", $value).replace("VMWARE", $value).replace("VMware", $value).replace("VirtualBox", $value).replace("Oracle Corporation", $value).replace("Microsoft Basic Display Adapter", $value)
        Source: services.exe, 00000006.00000000.341821779.0000000001783000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: 53f56307-b6bf-11d0-94f2-00a0c91efb8b\\?\SCSI#Disk&Ven_VMware&Prod_Virtual_disk#5&22be343f&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}SCSI\DiskVMware__Virtual_disk____1.0_SCSI\DiskVMware__Virtual_disk____SCSI\DiskVMware__SCSI\VMware__Virtual_disk____1VMware__Virtual_disk____1GenDiskSCSI\DiskSCSI\RAW
        Source: svchost.exe, 00000014.00000002.602992913.00000000001E3000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: scsi\disk&ven_vmware&prod_virtual_disk\5&22be343f&0&000000
        Source: svchost.exe, 00000016.00000002.605131595.0000000002100000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: $value = $pr.Value.replace("VEN_80EE", $value).replace("VEN_15AD", $value).replace("VBOX", $value).replace("VBox", $value).replace("VMWARE", $value).replace("82801FB", $value).replace("82441FX", $value).replace("82371SB", $value).replace("OpenHCD", $value).replace("VMWare", $value)
        Source: explorer.exe, 0000001F.00000002.606706574.0000000003E59000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: \\?\ide#cdromnecvmwar_vmware_sata_cd01_______________1.00____#6&373888b8&0&1.0.0#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}eeab7790
        Source: svchost.exe, 00000014.00000002.602992913.00000000001E3000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: scsi\disk&ven_vmware_&prod_vmware_virtual_s\5&22be343f&0&000000
        Source: svchost.exe, 00000019.00000000.346906062.0000000001170000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \\?\IDE#CdRomNECVMWar_VMware_SATA_CD01_______________1.00____#6&373888b8&0&1.0.0#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}a
        Source: svchost.exe, 0000001D.00000002.605471171.00000000020A3000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: ZDE\CdRomNECVMWar_VMware_SATA_CD01_______________1.00____\6&373888b8&0&1.0.0272fb
        Source: svchost.exe, 0000001D.00000002.603668650.000000000038D000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: Policyagent049f198-1016-11e7-b87b-806e6f6e6963}\??\IDE#CdRomNECVMWar_VMware_SATA_CD01_______________1.00____#6&373888b8&0&1.0.0#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\Device\CdRom0\DosDevices\D:\??\Volume{8a07945e-cd11-11ea-a1d0-806e6f6e6963}c
        Source: svchost.exe, 00000019.00000000.347411701.000000000482C000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: Win32_PnPEntityVMware Virtual disk SCSI Disk Device{4d36e967-e325-11ce-bfc1-08002be10318}System.String[]Win32_PnPEntityDisk driveSCSI\DISK&VEN__HV5B96L&PROD_VIRTUAL_DISK\5&22BE343F&0&000000System.String[](Standard disk drives)VMware Virtual disk SCSI Disk DeviceSCSI\DISK&VEN_DN177VWB&PROD_VIRTUAL_DISK\5&22BE343F&0&000000diskOKWin32_ComputerSystemuser-PCBCAAEBA95E435CA5300A680BE9BF735F04A93ECECD18F46C56865C6158D43B74
        Source: services.exe, 00000006.00000000.341821779.0000000001783000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: 53f56308-b6bf-11d0-94f2-00a0c91efb8b\\?\IDE#CdRomNECVMWar_VMware_SATA_CD01_______________1.00____#6&373888b8&0&1.0.0#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}IDE\CdRomNECVMWar_VMware_SATA_CD01_______________1.00____IDE\NECVMWar_VMware_SATA_CD01_______________1.00____IDE\CdRomNECVMWar_VMware_SATA_CD01_______________NECVMWar_VMware_SATA_CD01_______________1.00____GenCdRomGenCdRome8
        Source: svchost.exe, 00000016.00000002.605131595.0000000002100000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: if(($pr.Name -eq "DeviceId" -or $pr.Name -eq "Caption" -or $pr.Name -eq "Model" -or $pr.Name -eq "PNPDeviceID") -and ($pr.Value -match 'VBOX' -or $pr.Value -match 'VBox' -or $pr.Value -match 'VMWARE' -or $pr.Value -match 'VMware'))
        Source: services.exe, 00000006.00000000.341821779.0000000001783000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: 53f56307-b6bf-11d0-94f2-00a0c91efb8b\\?\SCSI#Disk&Ven_VMware&Prod_Virtual_disk#5&22be343f&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}SCSI\DiskVMware__Virtual_disk____1.0_SCSI\DiskVMware__Virtual_disk____SCSI\DiskVMware__SCSI\VMware__Virtual_disk____1VMware__Virtual_disk____1GenDiskSCSI\DiskSCSI\RAWeX
        Source: C:\Windows\System32\dialer.exeAPI call chain: ExitProcess graph end nodegraph_3-415
        Source: C:\ProgramData\jjfvbumjfczj\oapavmkbdsqp.exeAPI call chain: ExitProcess graph end node
        Source: C:\Windows\System32\dialer.exeProcess information queried: ProcessInformationJump to behavior
        Source: C:\Users\user\Desktop\mine327.exeProcess queried: DebugPortJump to behavior
        Source: C:\Users\user\Desktop\mine327.exeProcess queried: DebugPortJump to behavior
        Source: C:\Users\user\Desktop\mine327.exeCode function: 0_2_00577D90 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,0_2_00577D90
        Source: C:\ProgramData\jjfvbumjfczj\oapavmkbdsqp.exeCode function: 16_2_FF64020C RegisterTraceGuidsW,RegDeleteKeyExW,GetCurrentProcess,SetPriorityClass,SystemParametersInfoW,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,RegCreateKeyW,CreateMutexW,WaitForSingleObject,#899,#188,SetProcessShutdownParameters,PeekMessageW,WaitForSingleObject,CloseHandle,OleInitialize,CoCreateInstance,#660,SHGetValueW,GetUserDefaultUILanguage,SHGetSpecialFolderPathW,SHGetSpecialFolderPathW,SHGetSpecialFolderPathW,GetSystemMetrics,CreateEventW,GetSystemMetrics,#885,CloseHandle,RegQueryValueExW,RegSetValueExW,#110,SHCreateThreadRef,SHSetThreadRef,#176,ReleaseMutex,CloseHandle,PostMessageW,#16,GetCurrentProcess,SetPriorityClass,RegisterApplicationRestart,CoCreateInstance,#201,ReleaseMutex,CloseHandle,GetCurrentProcess,SetPriorityClass,memset,SHGetKnownFolderIDList,ShellExecuteExW,#155,memset,GetCommandLineW,PathGetArgsW,CoCreateInstance,CoCreateInstance,CoCreateInstance,memset,GetStartupInfoW,#155,LoadLibraryW,GetProcAddress,FreeLibrary,SHSetThreadRef,GetMessageW,TranslateMessage,DispatchMessageW,RegSetValueExW,#111,OleUninitialize,#188,GetCommandLineW,PathGetArgsW,#158,#10,UnregisterTraceGuids,ExitProcess,16_2_FF64020C
        Source: C:\Users\user\Desktop\mine327.exeCode function: 0_2_00571628 GetProcessHeap,HeapAlloc,RegOpenKeyExW,RegOpenKeyExW,RegCloseKey,RegOpenKeyExW,RegCloseKey,RegOpenKeyExW,RegCloseKey,RegOpenKeyExW,RegCloseKey,RegOpenKeyExW,RegCloseKey,RegOpenKeyExW,RegCloseKey,RegOpenKeyExW,RegCloseKey,RegOpenKeyExW,RegCloseKey,RegCloseKey,0_2_00571628
        Source: C:\Windows\System32\dialer.exeProcess token adjusted: DebugJump to behavior
        Source: C:\Users\user\Desktop\mine327.exeCode function: 0_2_005780F8 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,0_2_005780F8
        Source: C:\Users\user\Desktop\mine327.exeCode function: 0_2_00577D90 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,0_2_00577D90
        Source: C:\Users\user\Desktop\mine327.exeCode function: 0_2_00586218 SetUnhandledExceptionFilter,0_2_00586218
        Source: C:\Users\user\Desktop\mine327.exeCode function: 0_2_0057D2A4 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,0_2_0057D2A4
        Source: C:\Windows\explorer.exeCode function: 2_2_0000000140001160 Sleep,Sleep,_amsg_exit,_initterm,SetUnhandledExceptionFilter,malloc,strlen,malloc,memcpy,_cexit,exit,2_2_0000000140001160
        Source: C:\Windows\System32\services.exeCode function: 6_2_001F80F8 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,TerminateProcess,6_2_001F80F8
        Source: C:\Windows\System32\services.exeCode function: 6_2_001F7D90 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,6_2_001F7D90
        Source: C:\Windows\System32\services.exeCode function: 6_2_001FD2A4 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,6_2_001FD2A4
        Source: C:\Windows\System32\WerFault.exeCode function: 10_2_0248D2A4 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,10_2_0248D2A4
        Source: C:\Windows\System32\WerFault.exeCode function: 10_2_024880F8 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,TerminateProcess,10_2_024880F8
        Source: C:\Windows\System32\WerFault.exeCode function: 10_2_02487D90 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,10_2_02487D90
        Source: C:\Windows\System32\winlogon.exeCode function: 12_2_009880F8 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,12_2_009880F8
        Source: C:\Windows\System32\winlogon.exeCode function: 12_2_00987D90 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,12_2_00987D90
        Source: C:\Windows\System32\winlogon.exeCode function: 12_2_0098D2A4 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,12_2_0098D2A4
        Source: C:\Windows\System32\winlogon.exeCode function: 12_2_00996218 SetUnhandledExceptionFilter,12_2_00996218
        Source: C:\Windows\System32\sc.exeCode function: 13_2_00167D90 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,13_2_00167D90
        Source: C:\Windows\System32\sc.exeCode function: 13_2_00176218 SetUnhandledExceptionFilter,13_2_00176218
        Source: C:\Windows\System32\sc.exeCode function: 13_2_0016D2A4 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,13_2_0016D2A4
        Source: C:\Windows\System32\conhost.exeCode function: 15_2_00207D90 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,15_2_00207D90
        Source: C:\Windows\System32\conhost.exeCode function: 15_2_0020D2A4 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,15_2_0020D2A4
        Source: C:\ProgramData\jjfvbumjfczj\oapavmkbdsqp.exeCode function: 16_2_002880F8 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,16_2_002880F8
        Source: C:\ProgramData\jjfvbumjfczj\oapavmkbdsqp.exeCode function: 16_2_00287D90 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,16_2_00287D90
        Source: C:\ProgramData\jjfvbumjfczj\oapavmkbdsqp.exeCode function: 16_2_00296218 SetUnhandledExceptionFilter,16_2_00296218
        Source: C:\ProgramData\jjfvbumjfczj\oapavmkbdsqp.exeCode function: 16_2_0028D2A4 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,16_2_0028D2A4
        Source: C:\ProgramData\jjfvbumjfczj\oapavmkbdsqp.exeCode function: 16_2_002F7D90 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,16_2_002F7D90
        Source: C:\ProgramData\jjfvbumjfczj\oapavmkbdsqp.exeCode function: 16_2_00306218 SetUnhandledExceptionFilter,16_2_00306218
        Source: C:\ProgramData\jjfvbumjfczj\oapavmkbdsqp.exeCode function: 16_2_002FD2A4 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,16_2_002FD2A4
        Source: C:\ProgramData\jjfvbumjfczj\oapavmkbdsqp.exeCode function: 16_2_FF64A6E8 SetUnhandledExceptionFilter,16_2_FF64A6E8
        Source: C:\ProgramData\jjfvbumjfczj\oapavmkbdsqp.exeCode function: 16_2_FF6212F0 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,16_2_FF6212F0
        Source: C:\Windows\System32\lsass.exeCode function: 17_2_009C7D90 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,17_2_009C7D90
        Source: C:\Windows\System32\lsass.exeCode function: 17_2_009CD2A4 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,17_2_009CD2A4
        Source: C:\Windows\System32\lsm.exeCode function: 19_2_00267D90 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,19_2_00267D90
        Source: C:\Windows\System32\lsm.exeCode function: 19_2_00276218 SetUnhandledExceptionFilter,19_2_00276218
        Source: C:\Windows\System32\lsm.exeCode function: 19_2_0026D2A4 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,19_2_0026D2A4
        Source: C:\Windows\System32\svchost.exeCode function: 20_2_006B7D90 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,20_2_006B7D90
        Source: C:\Windows\System32\svchost.exeCode function: 20_2_006BD2A4 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,20_2_006BD2A4
        Source: C:\Windows\System32\svchost.exeCode function: 22_2_014A7D90 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,22_2_014A7D90
        Source: C:\Windows\System32\svchost.exeCode function: 22_2_014AD2A4 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,22_2_014AD2A4
        Source: C:\Windows\System32\svchost.exeCode function: 23_2_00BC7D90 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,23_2_00BC7D90
        Source: C:\Windows\System32\svchost.exeCode function: 23_2_00BCD2A4 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,23_2_00BCD2A4
        Source: C:\Windows\System32\svchost.exeCode function: 24_2_00A77D90 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,24_2_00A77D90
        Source: C:\Windows\System32\svchost.exeCode function: 24_2_00A7D2A4 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,24_2_00A7D2A4
        Source: C:\Windows\System32\svchost.exeCode function: 25_2_00C67D90 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,25_2_00C67D90
        Source: C:\Windows\System32\svchost.exeCode function: 25_2_00C6D2A4 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,25_2_00C6D2A4
        Source: C:\Windows\System32\svchost.exeCode function: 26_2_002C7D90 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,26_2_002C7D90
        Source: C:\Windows\System32\svchost.exeCode function: 26_2_002CD2A4 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,26_2_002CD2A4
        Source: C:\Users\user\Desktop\mine327.exeMemory allocated: page read and write | page guardJump to behavior

        HIPS / PFW / Operating System Protection Evasion

        barindex
        Benign windows process drops PE files
        Source: C:\Windows\explorer.exeFile created: oapavmkbdsqp.exe.2.drJump to dropped file
        Early bird code injection technique detected
        Source: C:\Windows\System32\svchost.exeProcess created / APC Queued / Resumed: C:\Windows\System32\WerFault.exeJump to behavior
        Allocates memory in foreign processes
        Source: C:\Users\user\Desktop\mine327.exeMemory allocated: C:\Windows\explorer.exe base: 140000000 protect: page execute and read and writeJump to behavior
        Source: C:\Windows\System32\dialer.exeMemory allocated: C:\Windows\System32\services.exe base: 1C0000 protect: page execute and read and writeJump to behavior
        Source: C:\Windows\System32\dialer.exeMemory allocated: C:\Windows\System32\winlogon.exe base: 950000 protect: page execute and read and writeJump to behavior
        Source: C:\Windows\System32\dialer.exeMemory allocated: C:\Windows\System32\lsass.exe base: F0000 protect: page execute and read and writeJump to behavior
        Source: C:\Windows\System32\dialer.exeMemory allocated: C:\ProgramData\jjfvbumjfczj\oapavmkbdsqp.exe base: E0000 protect: page execute and read and writeJump to behavior
        Source: C:\Windows\System32\dialer.exeMemory allocated: C:\Windows\System32\lsm.exe base: 1B0000 protect: page execute and read and writeJump to behavior
        Source: C:\Windows\System32\dialer.exeMemory allocated: C:\Windows\System32\svchost.exe base: 680000 protect: page execute and read and writeJump to behavior
        Source: C:\Windows\System32\dialer.exeMemory allocated: C:\Windows\System32\svchost.exe base: 130000 protect: page execute and read and writeJump to behavior
        Source: C:\Windows\System32\dialer.exeMemory allocated: C:\Windows\System32\svchost.exe base: 13F0000 protect: page execute and read and writeJump to behavior
        Source: C:\Windows\System32\dialer.exeMemory allocated: C:\Windows\System32\svchost.exe base: 970000 protect: page execute and read and writeJump to behavior
        Source: C:\Windows\System32\dialer.exeMemory allocated: C:\Windows\System32\svchost.exe base: 180000 protect: page execute and read and writeJump to behavior
        Source: C:\Windows\System32\dialer.exeMemory allocated: C:\Windows\System32\svchost.exe base: B90000 protect: page execute and read and writeJump to behavior
        Source: C:\Windows\System32\dialer.exeMemory allocated: C:\Windows\System32\svchost.exe base: 110000 protect: page execute and read and writeJump to behavior
        Source: C:\Windows\System32\dialer.exeMemory allocated: C:\Windows\System32\svchost.exe base: FD0000 protect: page execute and read and writeJump to behavior
        Source: C:\Windows\System32\dialer.exeMemory allocated: C:\Windows\System32\spoolsv.exe base: 1E50000 protect: page execute and read and writeJump to behavior
        Source: C:\Windows\System32\dialer.exeMemory allocated: C:\Windows\System32\svchost.exe base: 120000 protect: page execute and read and writeJump to behavior
        Source: C:\Windows\System32\dialer.exeMemory allocated: C:\Windows\System32\dwm.exe base: 340000 protect: page execute and read and writeJump to behavior
        Source: C:\Windows\System32\dialer.exeMemory allocated: C:\Windows\explorer.exe base: 2800000 protect: page execute and read and writeJump to behavior
        Source: C:\Windows\System32\dialer.exeMemory allocated: C:\Windows\System32\taskeng.exe base: 970000 protect: page execute and read and writeJump to behavior
        Source: C:\Windows\System32\dialer.exeMemory allocated: C:\Windows\System32\UI0Detect.exe base: 1B80000 protect: page execute and read and writeJump to behavior
        Source: C:\Windows\System32\dialer.exeMemory allocated: C:\Windows\System32\wbem\WmiPrvSE.exe base: 1A0000 protect: page execute and read and writeJump to behavior
        Source: C:\Windows\System32\dialer.exeMemory allocated: C:\Windows\System32\svchost.exe base: 330000 protect: page execute and read and writeJump to behavior
        Source: C:\Windows\System32\dialer.exeMemory allocated: C:\Windows\System32\wbem\WmiPrvSE.exe base: 1B0000 protect: page execute and read and writeJump to behavior
        Source: C:\Windows\System32\dialer.exeMemory allocated: C:\Windows\System32\wbem\WmiPrvSE.exe base: 1C0000 protect: page execute and read and writeJump to behavior
        Source: C:\Windows\System32\dialer.exeMemory allocated: C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE base: 130000 protect: page execute and read and writeJump to behavior
        Source: C:\Windows\System32\dialer.exeMemory allocated: C:\Users\user\Desktop\mine327.exe base: 540000 protect: page execute and read and writeJump to behavior
        Source: C:\Windows\System32\dialer.exeMemory allocated: C:\ProgramData\jjfvbumjfczj\oapavmkbdsqp.exe base: 2C0000 protect: page execute and read and writeJump to behavior
        Source: C:\Windows\System32\dialer.exeMemory allocated: C:\Windows\System32\svchost.exe base: 120000 protect: page execute and read and writeJump to behavior
        Source: C:\Windows\System32\dialer.exeMemory allocated: C:\Windows\System32\WerFault.exe base: 1D80000 protect: page execute and read and writeJump to behavior
        Source: C:\Windows\System32\dialer.exeMemory allocated: C:\Windows\System32\sc.exe base: 130000 protect: page execute and read and writeJump to behavior
        Source: C:\Windows\System32\dialer.exeMemory allocated: C:\Windows\System32\conhost.exe base: 1D0000 protect: page execute and read and writeJump to behavior
        Source: C:\Windows\System32\dialer.exeMemory allocated: C:\Users\user\Desktop\mine327.exe base: C60000 protect: page execute and read and writeJump to behavior
        Source: C:\Windows\System32\dialer.exeMemory allocated: C:\Users\user\Desktop\mine327.exe base: 1140000 protect: page execute and read and writeJump to behavior
        Source: C:\Windows\System32\dialer.exeMemory allocated: C:\Users\user\Desktop\mine327.exe base: 1ACC0000 protect: page execute and read and writeJump to behavior
        Source: C:\Windows\System32\dialer.exeMemory allocated: C:\Users\user\Desktop\mine327.exe base: 1B4A0000 protect: page execute and read and writeJump to behavior
        Source: C:\Windows\System32\dialer.exeMemory allocated: C:\Users\user\Desktop\mine327.exe base: 1BE40000 protect: page execute and read and writeJump to behavior
        Source: C:\Windows\System32\dialer.exeMemory allocated: C:\Users\user\Desktop\mine327.exe base: 1BEA0000 protect: page execute and read and writeJump to behavior
        Source: C:\Windows\System32\dialer.exeMemory allocated: C:\Users\user\Desktop\mine327.exe base: 1BF00000 protect: page execute and read and writeJump to behavior
        Source: C:\Windows\System32\dialer.exeMemory allocated: C:\Users\user\Desktop\mine327.exe base: 1BF60000 protect: page execute and read and writeJump to behavior
        Source: C:\Windows\System32\dialer.exeMemory allocated: C:\Users\user\Desktop\mine327.exe base: 1BFC0000 protect: page execute and read and writeJump to behavior
        Source: C:\Windows\System32\dialer.exeMemory allocated: C:\Users\user\Desktop\mine327.exe base: 1C020000 protect: page execute and read and writeJump to behavior
        Source: C:\Windows\System32\dialer.exeMemory allocated: C:\Users\user\Desktop\mine327.exe base: 1C080000 protect: page execute and read and writeJump to behavior
        Changes memory attributes in foreign processes to executable or writable
        Source: C:\Windows\System32\dialer.exeMemory protected: C:\Windows\System32\services.exe base: 1C0000 protect: page execute and read and writeJump to behavior
        Source: C:\Windows\System32\dialer.exeMemory protected: C:\Windows\System32\services.exe base: 1C0000 protect: page execute and read and writeJump to behavior
        Source: C:\Windows\System32\dialer.exeMemory protected: C:\Windows\System32\winlogon.exe base: 950000 protect: page execute and read and writeJump to behavior
        Source: C:\Windows\System32\dialer.exeMemory protected: C:\Windows\System32\winlogon.exe base: 950000 protect: page execute and read and writeJump to behavior
        Source: C:\Windows\System32\dialer.exeMemory protected: C:\Windows\System32\lsass.exe base: F0000 protect: page execute and read and writeJump to behavior
        Source: C:\Windows\System32\dialer.exeMemory protected: C:\Windows\System32\lsass.exe base: F0000 protect: page execute and read and writeJump to behavior
        Source: C:\Windows\System32\dialer.exeMemory protected: C:\ProgramData\jjfvbumjfczj\oapavmkbdsqp.exe base: E0000 protect: page execute and read and writeJump to behavior
        Source: C:\Windows\System32\dialer.exeMemory protected: C:\ProgramData\jjfvbumjfczj\oapavmkbdsqp.exe base: E0000 protect: page execute and read and writeJump to behavior
        Source: C:\Windows\System32\dialer.exeMemory protected: C:\Windows\System32\lsm.exe base: 1B0000 protect: page execute and read and writeJump to behavior
        Source: C:\Windows\System32\dialer.exeMemory protected: C:\Windows\System32\lsm.exe base: 1B0000 protect: page execute and read and writeJump to behavior
        Source: C:\Windows\System32\dialer.exeMemory protected: C:\Windows\System32\svchost.exe base: 680000 protect: page execute and read and writeJump to behavior
        Source: C:\Windows\System32\dialer.exeMemory protected: C:\Windows\System32\svchost.exe base: 680000 protect: page execute and read and writeJump to behavior
        Source: C:\Windows\System32\dialer.exeMemory protected: C:\Windows\System32\svchost.exe base: 130000 protect: page execute and read and writeJump to behavior
        Source: C:\Windows\System32\dialer.exeMemory protected: C:\Windows\System32\svchost.exe base: 130000 protect: page execute and read and writeJump to behavior
        Source: C:\Windows\System32\dialer.exeMemory protected: C:\Windows\System32\svchost.exe base: 13F0000 protect: page execute and read and writeJump to behavior
        Source: C:\Windows\System32\dialer.exeMemory protected: C:\Windows\System32\svchost.exe base: 13F0000 protect: page execute and read and writeJump to behavior
        Source: C:\Windows\System32\dialer.exeMemory protected: C:\Windows\System32\svchost.exe base: 970000 protect: page execute and read and writeJump to behavior
        Source: C:\Windows\System32\dialer.exeMemory protected: C:\Windows\System32\svchost.exe base: 970000 protect: page execute and read and writeJump to behavior
        Source: C:\Windows\System32\dialer.exeMemory protected: C:\Windows\System32\svchost.exe base: 180000 protect: page execute and read and writeJump to behavior
        Source: C:\Windows\System32\dialer.exeMemory protected: C:\Windows\System32\svchost.exe base: 180000 protect: page execute and read and writeJump to behavior
        Source: C:\Windows\System32\dialer.exeMemory protected: C:\Windows\System32\svchost.exe base: B90000 protect: page execute and read and writeJump to behavior
        Source: C:\Windows\System32\dialer.exeMemory protected: C:\Windows\System32\svchost.exe base: B90000 protect: page execute and read and writeJump to behavior
        Source: C:\Windows\System32\dialer.exeMemory protected: C:\Windows\System32\svchost.exe base: 110000 protect: page execute and read and writeJump to behavior
        Source: C:\Windows\System32\dialer.exeMemory protected: C:\Windows\System32\svchost.exe base: 110000 protect: page execute and read and writeJump to behavior
        Source: C:\Windows\System32\dialer.exeMemory protected: C:\Windows\System32\svchost.exe base: FD0000 protect: page execute and read and writeJump to behavior
        Source: C:\Windows\System32\dialer.exeMemory protected: C:\Windows\System32\svchost.exe base: FD0000 protect: page execute and read and writeJump to behavior
        Source: C:\Windows\System32\dialer.exeMemory protected: C:\Windows\System32\spoolsv.exe base: 1E50000 protect: page execute and read and writeJump to behavior
        Source: C:\Windows\System32\dialer.exeMemory protected: C:\Windows\System32\spoolsv.exe base: 1E50000 protect: page execute and read and writeJump to behavior
        Source: C:\Windows\System32\dialer.exeMemory protected: C:\Windows\System32\svchost.exe base: 120000 protect: page execute and read and writeJump to behavior
        Source: C:\Windows\System32\dialer.exeMemory protected: C:\Windows\System32\svchost.exe base: 120000 protect: page execute and read and writeJump to behavior
        Source: C:\Windows\System32\dialer.exeMemory protected: C:\Windows\System32\dwm.exe base: 340000 protect: page execute and read and writeJump to behavior
        Source: C:\Windows\System32\dialer.exeMemory protected: C:\Windows\System32\dwm.exe base: 340000 protect: page execute and read and writeJump to behavior
        Source: C:\Windows\System32\dialer.exeMemory protected: C:\Windows\explorer.exe base: 2800000 protect: page execute and read and writeJump to behavior
        Source: C:\Windows\System32\dialer.exeMemory protected: C:\Windows\explorer.exe base: 2800000 protect: page execute and read and writeJump to behavior
        Source: C:\Windows\System32\dialer.exeMemory protected: C:\Windows\System32\taskeng.exe base: 970000 protect: page execute and read and writeJump to behavior
        Source: C:\Windows\System32\dialer.exeMemory protected: C:\Windows\System32\taskeng.exe base: 970000 protect: page execute and read and writeJump to behavior
        Source: C:\Windows\System32\dialer.exeMemory protected: C:\Windows\System32\UI0Detect.exe base: 1B80000 protect: page execute and read and writeJump to behavior
        Source: C:\Windows\System32\dialer.exeMemory protected: C:\Windows\System32\UI0Detect.exe base: 1B80000 protect: page execute and read and writeJump to behavior
        Source: C:\Windows\System32\dialer.exeMemory protected: C:\Windows\System32\wbem\WmiPrvSE.exe base: 1A0000 protect: page execute and read and writeJump to behavior
        Source: C:\Windows\System32\dialer.exeMemory protected: C:\Windows\System32\wbem\WmiPrvSE.exe base: 1A0000 protect: page execute and read and writeJump to behavior
        Source: C:\Windows\System32\dialer.exeMemory protected: C:\Windows\System32\svchost.exe base: 330000 protect: page execute and read and writeJump to behavior
        Source: C:\Windows\System32\dialer.exeMemory protected: C:\Windows\System32\svchost.exe base: 330000 protect: page execute and read and writeJump to behavior
        Source: C:\Windows\System32\dialer.exeMemory protected: C:\Windows\System32\wbem\WmiPrvSE.exe base: 1B0000 protect: page execute and read and writeJump to behavior
        Source: C:\Windows\System32\dialer.exeMemory protected: C:\Windows\System32\wbem\WmiPrvSE.exe base: 1B0000 protect: page execute and read and writeJump to behavior
        Source: C:\Windows\System32\dialer.exeMemory protected: C:\Windows\System32\wbem\WmiPrvSE.exe base: 1C0000 protect: page execute and read and writeJump to behavior
        Source: C:\Windows\System32\dialer.exeMemory protected: C:\Windows\System32\wbem\WmiPrvSE.exe base: 1C0000 protect: page execute and read and writeJump to behavior
        Source: C:\Windows\System32\dialer.exeMemory protected: C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE base: 130000 protect: page execute and read and writeJump to behavior
        Source: C:\Windows\System32\dialer.exeMemory protected: C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE base: 130000 protect: page execute and read and writeJump to behavior
        Source: C:\Windows\System32\dialer.exeMemory protected: C:\Users\user\Desktop\mine327.exe base: 540000 protect: page execute and read and writeJump to behavior
        Source: C:\Windows\System32\dialer.exeMemory protected: C:\Users\user\Desktop\mine327.exe base: 540000 protect: page execute and read and writeJump to behavior
        Source: C:\Windows\System32\dialer.exeMemory protected: C:\Windows\System32\svchost.exe base: 120000 protect: page execute and read and writeJump to behavior
        Source: C:\Windows\System32\dialer.exeMemory protected: C:\Windows\System32\svchost.exe base: 120000 protect: page execute and read and writeJump to behavior
        Source: C:\Windows\System32\dialer.exeMemory protected: C:\Windows\System32\WerFault.exe base: 1D80000 protect: page execute and read and writeJump to behavior
        Source: C:\Windows\System32\dialer.exeMemory protected: C:\Windows\System32\WerFault.exe base: 1D80000 protect: page execute and read and writeJump to behavior
        Source: C:\Windows\System32\dialer.exeMemory protected: C:\Windows\System32\sc.exe base: 130000 protect: page execute and read and writeJump to behavior
        Source: C:\Windows\System32\dialer.exeMemory protected: C:\Windows\System32\sc.exe base: 130000 protect: page execute and read and writeJump to behavior
        Source: C:\Windows\System32\dialer.exeMemory protected: C:\Windows\System32\conhost.exe base: 1D0000 protect: page execute and read and writeJump to behavior
        Source: C:\Windows\System32\dialer.exeMemory protected: C:\Windows\System32\conhost.exe base: 1D0000 protect: page execute and read and writeJump to behavior
        Contains functionality to inject code into remote processes
        Source: C:\Windows\System32\dialer.exeCode function: 3_2_0000000140001C88 CreateProcessW,VirtualAllocEx,WriteProcessMemory,WriteProcessMemory,VirtualAlloc,GetThreadContext,WriteProcessMemory,SetThreadContext,ResumeThread,OpenProcess,TerminateProcess,3_2_0000000140001C88
        Creates a thread in another existing process (thread injection)
        Source: C:\Windows\System32\dialer.exeThread created: C:\Windows\System32\services.exe EIP: 1C273CJump to behavior
        Source: C:\Windows\System32\dialer.exeThread created: C:\Windows\System32\winlogon.exe EIP: 95273CJump to behavior
        Source: C:\Windows\System32\dialer.exeThread created: C:\Windows\System32\conhost.exe EIP: E273CJump to behavior
        Source: C:\Windows\System32\dialer.exeThread created: C:\Windows\System32\lsass.exe EIP: F273CJump to behavior
        Source: C:\Windows\System32\dialer.exeThread created: C:\Windows\System32\lsm.exe EIP: 1B273CJump to behavior
        Source: C:\Windows\System32\dialer.exeThread created: C:\Windows\System32\svchost.exe EIP: 68273CJump to behavior
        Source: C:\Windows\System32\dialer.exeThread created: C:\Windows\System32\svchost.exe EIP: 13273CJump to behavior
        Source: C:\Windows\System32\dialer.exeThread created: C:\Windows\System32\svchost.exe EIP: 13F273CJump to behavior
        Source: C:\Windows\System32\dialer.exeThread created: C:\Windows\System32\svchost.exe EIP: 97273CJump to behavior
        Source: C:\Windows\System32\dialer.exeThread created: C:\Windows\System32\svchost.exe EIP: 18273CJump to behavior
        Source: C:\Windows\System32\dialer.exeThread created: C:\Windows\System32\svchost.exe EIP: B9273CJump to behavior
        Source: C:\Windows\System32\dialer.exeThread created: C:\Windows\System32\svchost.exe EIP: 11273CJump to behavior
        Source: C:\Windows\System32\dialer.exeThread created: C:\Windows\System32\svchost.exe EIP: FD273CJump to behavior
        Source: C:\Windows\System32\dialer.exeThread created: C:\Windows\System32\spoolsv.exe EIP: 1E5273CJump to behavior
        Source: C:\Windows\System32\dialer.exeThread created: C:\Windows\System32\svchost.exe EIP: 12273CJump to behavior
        Source: C:\Windows\System32\dialer.exeThread created: C:\Windows\System32\dwm.exe EIP: 34273CJump to behavior
        Source: C:\Windows\System32\dialer.exeThread created: C:\Windows\explorer.exe EIP: 280273CJump to behavior
        Source: C:\Windows\System32\dialer.exeThread created: C:\Windows\System32\taskeng.exe EIP: 97273CJump to behavior
        Source: C:\Windows\System32\dialer.exeThread created: C:\Windows\System32\UI0Detect.exe EIP: 1B8273CJump to behavior
        Source: C:\Windows\System32\dialer.exeThread created: C:\Windows\System32\wbem\WmiPrvSE.exe EIP: 1A273CJump to behavior
        Source: C:\Windows\System32\dialer.exeThread created: C:\Windows\System32\svchost.exe EIP: 33273CJump to behavior
        Source: C:\Windows\System32\dialer.exeThread created: C:\Windows\System32\wbem\WmiPrvSE.exe EIP: 1B273CJump to behavior
        Source: C:\Windows\System32\dialer.exeThread created: C:\Windows\System32\wbem\WmiPrvSE.exe EIP: 1C273CJump to behavior
        Source: C:\Windows\System32\dialer.exeThread created: unknown EIP: 13273CJump to behavior
        Source: C:\Windows\System32\dialer.exeThread created: unknown EIP: 54273CJump to behavior
        Source: C:\Windows\System32\dialer.exeThread created: C:\Windows\System32\conhost.exe EIP: 2C273CJump to behavior
        Source: C:\Windows\System32\dialer.exeThread created: C:\Windows\System32\svchost.exe EIP: 12273CJump to behavior
        Source: C:\Windows\System32\dialer.exeThread created: C:\Windows\System32\WerFault.exe EIP: 1D8273CJump to behavior
        Source: C:\Windows\System32\dialer.exeThread created: C:\Windows\System32\sc.exe EIP: 13273CJump to behavior
        Source: C:\Windows\System32\dialer.exeThread created: C:\Windows\System32\conhost.exe EIP: 1D273CJump to behavior
        Source: C:\Windows\System32\dialer.exeThread created: unknown EIP: C6273CJump to behavior
        Source: C:\Windows\System32\dialer.exeThread created: unknown EIP: 1ACC273CJump to behavior
        Source: C:\Windows\System32\dialer.exeThread created: unknown EIP: 1BF6273CJump to behavior
        Source: C:\Windows\System32\dialer.exeThread created: unknown EIP: 1BFC273CJump to behavior
        Source: C:\Windows\System32\dialer.exeThread created: unknown EIP: 1C02273CJump to behavior
        Found direct / indirect Syscall (likely to bypass EDR)
        Source: C:\Windows\System32\dialer.exeNtQueryInformationProcess: Direct from: 0x1400018E6Jump to behavior
        Source: C:\ProgramData\jjfvbumjfczj\oapavmkbdsqp.exeNtResumeThread: Indirect: 0x28231EJump to behavior
        Source: C:\Windows\System32\dialer.exeNtQueryInformationProcess: Direct from: 0x140001176Jump to behavior
        Source: C:\Windows\System32\winlogon.exeNtOpenKeyEx: Direct from: 0x98171FJump to behavior
        Source: C:\Windows\System32\winlogon.exeNtOpenKeyEx: Direct from: 0x981795Jump to behavior
        Source: C:\Windows\System32\winlogon.exeNtProtectVirtualMemory: Direct from: 0x984E3CJump to behavior
        Source: C:\Windows\System32\dialer.exeNtCreateThreadEx: Direct from: 0x14000145BJump to behavior
        Source: C:\Windows\System32\services.exeNtNotifyChangeKey: Direct from: 0x1F3862Jump to behavior
        Source: C:\Windows\System32\dialer.exeNtMapViewOfSection: Direct from: 0x14000202BJump to behavior
        Source: C:\Windows\System32\lsass.exeNtSetTimer: Direct from: 0x772FA561Jump to behavior
        Source: C:\Windows\System32\services.exeNtQueryInformationProcess: Direct from: 0x1F196EJump to behavior
        Source: C:\Windows\System32\dialer.exeNtQuerySystemInformation: Direct from: 0x14000155DJump to behavior
        Source: C:\Windows\System32\services.exeNtQueryVolumeInformationFile: Direct from: 0x1F241CJump to behavior
        Source: C:\Windows\System32\dialer.exeNtRequestWaitReplyPort: Direct from: 0x1400024AAJump to behavior
        Source: C:\Windows\System32\winlogon.exeNtMapViewOfSection: Direct from: 0x989E4FJump to behavior
        Source: C:\Windows\System32\services.exeNtSetInformationProcess: Direct from: 0x1F1A66Jump to behavior
        Source: C:\Windows\System32\services.exeNtReadFile: Direct from: 0x1F2309Jump to behavior
        Source: C:\Windows\System32\sc.exeNtEnumerateValueKey: Indirect: 0x16293DJump to behavior
        Source: C:\Windows\System32\lsass.exeNtClose: Direct from: 0x9C173A
        Source: C:\Windows\System32\lsass.exeNtMapViewOfSection: Direct from: 0xF2861Jump to behavior
        Source: C:\Windows\System32\dialer.exeNtProtectVirtualMemory: Direct from: 0x1400020B4Jump to behavior
        Source: C:\Windows\System32\winlogon.exeNtDelayExecution: Direct from: 0x981ADDJump to behavior
        Source: C:\ProgramData\jjfvbumjfczj\oapavmkbdsqp.exeNtEnumerateValueKey: Indirect: 0x28293DJump to behavior
        Source: C:\Windows\System32\winlogon.exeNtOpenSection: Direct from: 0x98F43AJump to behavior
        Source: C:\Windows\System32\WerFault.exeNtQuerySystemInformation: Indirect: 0x248205DJump to behavior
        Source: C:\Windows\System32\services.exeNtClose: Direct from: 0x1F173A
        Source: C:\Windows\System32\dialer.exeNtClose: Direct from: 0x140002321
        Source: C:\Windows\System32\dialer.exeNtCreateKey: Direct from: 0x140002444Jump to behavior
        Source: C:\Windows\System32\winlogon.exeNtEnumerateValueKey: Direct from: 0x98290EJump to behavior
        Source: C:\Windows\System32\dialer.exeNtFsControlFile: Direct from: 0x140002208Jump to behavior
        Source: C:\Windows\System32\winlogon.exeNtProtectVirtualMemory: Direct from: 0x983830Jump to behavior
        Source: C:\Windows\System32\services.exeNtQueryDirectoryFile: Direct from: 0x1F23AEJump to behavior
        Source: C:\Windows\System32\dialer.exeNtCreateKey: Direct from: 0x1400023C4Jump to behavior
        Source: C:\Windows\System32\dialer.exeNtReadVirtualMemory: Direct from: 0x1400015B0Jump to behavior
        Source: C:\Windows\System32\dialer.exeNtProtectVirtualMemory: Direct from: 0x1400020E4Jump to behavior
        Source: C:\Windows\System32\dialer.exeNtReadVirtualMemory: Direct from: 0x140001FAEJump to behavior
        Source: C:\Windows\System32\winlogon.exeNtOpenKeyEx: Direct from: 0x9816E5Jump to behavior
        Source: C:\Windows\System32\dialer.exeNtQueryInformationProcess: Direct from: 0x14000121CJump to behavior
        Source: C:\Windows\System32\services.exeNtResumeThread: Direct from: 0x1F231EJump to behavior
        Source: C:\Windows\System32\dialer.exeNtAdjustPrivilegesToken: Direct from: 0x14000230EJump to behavior
        Source: C:\Windows\System32\winlogon.exeNtOpenKeyEx: Direct from: 0x98180BJump to behavior
        Source: C:\Windows\System32\winlogon.exeNtClose: Direct from: 0x9818A6
        Source: C:\Windows\System32\winlogon.exeNtRequestWaitReplyPort: Direct from: 0x983311Jump to behavior
        Source: C:\Windows\System32\winlogon.exeNtProtectVirtualMemory: Direct from: 0x985E6CJump to behavior
        Source: C:\Windows\System32\dialer.exeNtClose: Direct from: 0x140001901
        Source: C:\Windows\System32\dialer.exeNtClose: Direct from: 0x140001623
        Source: C:\Windows\System32\sc.exeNtResumeThread: Indirect: 0x16231EJump to behavior
        Source: C:\Windows\System32\dialer.exeNtFsControlFile: Direct from: 0x140002C97Jump to behavior
        Source: C:\Windows\System32\dialer.exeNtAllocateVirtualMemory: Direct from: 0x14000192AJump to behavior
        Source: C:\Windows\System32\winlogon.exeNtOpenKeyEx: Direct from: 0x98175AJump to behavior
        Source: C:\Windows\System32\dialer.exeNtCreateFile: Direct from: 0x140001FDEJump to behavior
        Source: C:\Windows\System32\dialer.exeNtCreateNamedPipeFile: Direct from: 0x140001C6DJump to behavior
        Source: C:\Windows\System32\WerFault.exeNtResumeThread: Indirect: 0x248231EJump to behavior
        Source: C:\Windows\System32\dialer.exeNtQuerySystemInformation: Direct from: 0x140002B9FJump to behavior
        Source: C:\Windows\System32\sc.exeNtDeviceIoControlFile: Indirect: 0x162B9DJump to behavior
        Source: C:\Windows\System32\winlogon.exeNtOpenKeyEx: Direct from: 0x981881Jump to behavior
        Source: C:\Windows\System32\dialer.exeNtAllocateVirtualMemory: Direct from: 0x140001657Jump to behavior
        Source: C:\Windows\System32\dialer.exeNtAllocateVirtualMemory: Direct from: 0x140001414Jump to behavior
        Source: C:\Windows\System32\dialer.exeNtClose: Direct from: 0x1400014B1
        Source: C:\Windows\System32\lsass.exeNtQuerySystemInformation: Direct from: 0x9C205DJump to behavior
        Source: C:\ProgramData\jjfvbumjfczj\oapavmkbdsqp.exeNtEnumerateValueKey: Indirect: 0x28290EJump to behavior
        Source: C:\Windows\System32\lsass.exeNtResumeThread: Direct from: 0x9C3311Jump to behavior
        Source: C:\Windows\System32\dialer.exeNtRequestWaitReplyPort: Direct from: 0x1400024EEJump to behavior
        Source: C:\Windows\System32\dialer.exeNtAllocateVirtualMemory: Direct from: 0x140002335Jump to behavior
        Source: C:\Windows\System32\dialer.exeNtAllocateVirtualMemory: Direct from: 0x772FA36EJump to behavior
        Source: C:\Windows\System32\services.exeNtRequestWaitReplyPort: Direct from: 0x1F3311Jump to behavior
        Source: C:\Windows\System32\WerFault.exeNtQueryDirectoryFile: Indirect: 0x24823AEJump to behavior
        Source: C:\Windows\System32\dialer.exeNtFsControlFile: Direct from: 0x140002C30Jump to behavior
        Source: C:\ProgramData\jjfvbumjfczj\oapavmkbdsqp.exeNtDeviceIoControlFile: Indirect: 0x282B9DJump to behavior
        Source: C:\Windows\System32\winlogon.exeNtProtectVirtualMemory: Direct from: 0x9837F4Jump to behavior
        Source: C:\Windows\System32\winlogon.exeNtOpenKeyEx: Direct from: 0x9817D0Jump to behavior
        Source: C:\Windows\System32\dialer.exeNtRequestWaitReplyPort: Direct from: 0x140002081Jump to behavior
        Source: C:\Windows\System32\winlogon.exeNtClose: Direct from: 0x98173A
        Source: C:\Windows\System32\winlogon.exeNtProtectVirtualMemory: Direct from: 0x98565FJump to behavior
        Source: C:\Windows\System32\dialer.exeNtReadVirtualMemory: Direct from: 0x1400015E7Jump to behavior
        Source: C:\Windows\System32\services.exeNtOpenSection: Direct from: 0x1FF43AJump to behavior
        Source: C:\Windows\System32\winlogon.exeNtOpenKeyEx: Direct from: 0x9816B8Jump to behavior
        Source: C:\Windows\System32\services.exeNtCreateFile: Direct from: 0x1F22C2Jump to behavior
        Source: C:\ProgramData\jjfvbumjfczj\oapavmkbdsqp.exeNtQuerySystemInformation: Indirect: 0x28205DJump to behavior
        Source: C:\Windows\System32\winlogon.exeNtAllocateVirtualMemory: Direct from: 0x983AA5Jump to behavior
        Source: C:\Windows\System32\dialer.exeNtProtectVirtualMemory: Direct from: 0x140001437Jump to behavior
        Source: C:\Windows\System32\lsass.exeNtDelayExecution: Direct from: 0x9C1ADDJump to behavior
        Source: C:\Windows\System32\lsass.exeNtOpenSection: Direct from: 0x9CF43AJump to behavior
        Source: C:\Windows\System32\dialer.exeNtSetSecurityObject: Direct from: 0x140002404Jump to behavior
        Source: C:\Windows\System32\services.exeNtMapViewOfSection: Direct from: 0x1C2861Jump to behavior
        Source: C:\Windows\System32\winlogon.exeNtProtectVirtualMemory: Direct from: 0x952861Jump to behavior
        Source: C:\Windows\System32\dialer.exeNtRequestWaitReplyPort: Direct from: 0x14000250FJump to behavior
        Source: C:\Windows\System32\services.exeNtMapViewOfSection: Direct from: 0x1F9E4FJump to behavior
        Source: C:\Windows\System32\winlogon.exeNtEnumerateValueKey: Direct from: 0x98293DJump to behavior
        Source: C:\Windows\System32\winlogon.exeNtAllocateVirtualMemory: Direct from: 0x9527DDJump to behavior
        Source: C:\Windows\System32\lsass.exeNtMapViewOfSection: Direct from: 0x9C9E4FJump to behavior
        Source: C:\Windows\System32\services.exeNtDelayExecution: Direct from: 0x1F1ADDJump to behavior
        Source: C:\Windows\System32\dialer.exeNtSetValueKey: Direct from: 0x140002475Jump to behavior
        Source: C:\Windows\System32\dialer.exeNtProtectVirtualMemory: Direct from: 0x140001BF1Jump to behavior
        Source: C:\Windows\System32\dialer.exeNtDeviceIoControlFile: Direct from: 0x1400023EBJump to behavior
        Source: C:\Windows\System32\sc.exeNtEnumerateValueKey: Indirect: 0x16290EJump to behavior
        Source: C:\Windows\System32\dialer.exeNtDelayExecution: Direct from: 0x140002517Jump to behavior
        Source: C:\Windows\System32\dialer.exeNtClose: Direct from: 0x14000247F
        Source: C:\Windows\System32\winlogon.exeNtOpenKeyEx: Direct from: 0x981846Jump to behavior
        Source: C:\Windows\System32\dialer.exeNtReadFile: Direct from: 0x140002C53Jump to behavior
        Source: C:\Windows\System32\dialer.exeNtQuerySystemInformation: Direct from: 0x1400022D6Jump to behavior
        Injects a PE file into a foreign processes
        Source: C:\Users\user\Desktop\mine327.exeMemory written: C:\Windows\explorer.exe base: 140000000 value starts with: 4D5AJump to behavior
        Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\services.exe base: 1C0000 value starts with: 4D5AJump to behavior
        Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\winlogon.exe base: 950000 value starts with: 4D5AJump to behavior
        Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\lsass.exe base: F0000 value starts with: 4D5AJump to behavior
        Source: C:\Windows\System32\dialer.exeMemory written: C:\ProgramData\jjfvbumjfczj\oapavmkbdsqp.exe base: E0000 value starts with: 4D5AJump to behavior
        Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\lsm.exe base: 1B0000 value starts with: 4D5AJump to behavior
        Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\svchost.exe base: 680000 value starts with: 4D5AJump to behavior
        Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\svchost.exe base: 130000 value starts with: 4D5AJump to behavior
        Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\svchost.exe base: 13F0000 value starts with: 4D5AJump to behavior
        Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\svchost.exe base: 970000 value starts with: 4D5AJump to behavior
        Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\svchost.exe base: 180000 value starts with: 4D5AJump to behavior
        Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\svchost.exe base: B90000 value starts with: 4D5AJump to behavior
        Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\svchost.exe base: 110000 value starts with: 4D5AJump to behavior
        Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\svchost.exe base: FD0000 value starts with: 4D5AJump to behavior
        Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\spoolsv.exe base: 1E50000 value starts with: 4D5AJump to behavior
        Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\svchost.exe base: 120000 value starts with: 4D5AJump to behavior
        Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\dwm.exe base: 340000 value starts with: 4D5AJump to behavior
        Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\explorer.exe base: 2800000 value starts with: 4D5AJump to behavior
        Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\taskeng.exe base: 970000 value starts with: 4D5AJump to behavior
        Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\UI0Detect.exe base: 1B80000 value starts with: 4D5AJump to behavior
        Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\wbem\WmiPrvSE.exe base: 1A0000 value starts with: 4D5AJump to behavior
        Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\svchost.exe base: 330000 value starts with: 4D5AJump to behavior
        Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\wbem\WmiPrvSE.exe base: 1B0000 value starts with: 4D5AJump to behavior
        Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\wbem\WmiPrvSE.exe base: 1C0000 value starts with: 4D5AJump to behavior
        Source: C:\Windows\System32\dialer.exeMemory written: C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE base: 130000 value starts with: 4D5AJump to behavior
        Source: C:\Windows\System32\dialer.exeMemory written: C:\Users\user\Desktop\mine327.exe base: 540000 value starts with: 4D5AJump to behavior
        Source: C:\Windows\System32\dialer.exeMemory written: C:\ProgramData\jjfvbumjfczj\oapavmkbdsqp.exe base: 2C0000 value starts with: 4D5AJump to behavior
        Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\svchost.exe base: 120000 value starts with: 4D5AJump to behavior
        Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\WerFault.exe base: 1D80000 value starts with: 4D5AJump to behavior
        Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\sc.exe base: 130000 value starts with: 4D5AJump to behavior
        Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\conhost.exe base: 1D0000 value starts with: 4D5AJump to behavior
        Source: C:\Windows\System32\dialer.exeMemory written: C:\Users\user\Desktop\mine327.exe base: C60000 value starts with: 4D5AJump to behavior
        Source: C:\Windows\System32\dialer.exeMemory written: C:\Users\user\Desktop\mine327.exe base: 1140000 value starts with: 4D5AJump to behavior
        Source: C:\Windows\System32\dialer.exeMemory written: C:\Users\user\Desktop\mine327.exe base: 1ACC0000 value starts with: 4D5AJump to behavior
        Source: C:\Windows\System32\dialer.exeMemory written: C:\Users\user\Desktop\mine327.exe base: 1B4A0000 value starts with: 4D5AJump to behavior
        Source: C:\Windows\System32\dialer.exeMemory written: C:\Users\user\Desktop\mine327.exe base: 1BE40000 value starts with: 4D5AJump to behavior
        Source: C:\Windows\System32\dialer.exeMemory written: C:\Users\user\Desktop\mine327.exe base: 1BEA0000 value starts with: 4D5AJump to behavior
        Source: C:\Windows\System32\dialer.exeMemory written: C:\Users\user\Desktop\mine327.exe base: 1BF00000 value starts with: 4D5AJump to behavior
        Source: C:\Windows\System32\dialer.exeMemory written: C:\Users\user\Desktop\mine327.exe base: 1BF60000 value starts with: 4D5AJump to behavior
        Source: C:\Windows\System32\dialer.exeMemory written: C:\Users\user\Desktop\mine327.exe base: 1BFC0000 value starts with: 4D5AJump to behavior
        Source: C:\Windows\System32\dialer.exeMemory written: C:\Users\user\Desktop\mine327.exe base: 1C020000 value starts with: 4D5AJump to behavior
        Source: C:\Windows\System32\dialer.exeMemory written: C:\Users\user\Desktop\mine327.exe base: 1C080000 value starts with: 4D5AJump to behavior
        Injects code into the Windows Explorer (explorer.exe)
        Source: C:\Users\user\Desktop\mine327.exeMemory written: PID: 2996 base: 140000000 value: 4DJump to behavior
        Source: C:\Users\user\Desktop\mine327.exeMemory written: PID: 2996 base: 140001000 value: 56Jump to behavior
        Source: C:\Users\user\Desktop\mine327.exeMemory written: PID: 2996 base: 140008000 value: 28Jump to behavior
        Source: C:\Users\user\Desktop\mine327.exeMemory written: PID: 2996 base: 14000A000 value: 00Jump to behavior
        Source: C:\Users\user\Desktop\mine327.exeMemory written: PID: 2996 base: 1402BD000 value: 00Jump to behavior
        Source: C:\Users\user\Desktop\mine327.exeMemory written: PID: 2996 base: 1402BE000 value: 80Jump to behavior
        Source: C:\Users\user\Desktop\mine327.exeMemory written: PID: 2996 base: 1402BF000 value: 00Jump to behavior
        Source: C:\Users\user\Desktop\mine327.exeMemory written: PID: 2996 base: 1402C0000 value: 00Jump to behavior
        Source: C:\Users\user\Desktop\mine327.exeMemory written: PID: 2996 base: 7FFFFFDB010 value: 00Jump to behavior
        Source: C:\Windows\System32\dialer.exeMemory written: PID: 1244 base: 2800000 value: 4DJump to behavior
        Modifies the context of a thread in another process (thread injection)
        Source: C:\Users\user\Desktop\mine327.exeThread register set: target process: 2996Jump to behavior
        Source: C:\Windows\explorer.exeThread register set: target process: 2096Jump to behavior
        Queues an APC in another process (thread injection)
        Source: C:\Windows\System32\services.exeThread APC queued: target process: C:\Windows\System32\WerFault.exeJump to behavior
        Writes to foreign memory regions
        Source: C:\Users\user\Desktop\mine327.exeMemory written: C:\Windows\explorer.exe base: 140000000Jump to behavior
        Source: C:\Users\user\Desktop\mine327.exeMemory written: C:\Windows\explorer.exe base: 140001000Jump to behavior
        Source: C:\Users\user\Desktop\mine327.exeMemory written: C:\Windows\explorer.exe base: 140008000Jump to behavior
        Source: C:\Users\user\Desktop\mine327.exeMemory written: C:\Windows\explorer.exe base: 14000A000Jump to behavior
        Source: C:\Users\user\Desktop\mine327.exeMemory written: C:\Windows\explorer.exe base: 1402BD000Jump to behavior
        Source: C:\Users\user\Desktop\mine327.exeMemory written: C:\Windows\explorer.exe base: 1402BE000Jump to behavior
        Source: C:\Users\user\Desktop\mine327.exeMemory written: C:\Windows\explorer.exe base: 1402BF000Jump to behavior
        Source: C:\Users\user\Desktop\mine327.exeMemory written: C:\Windows\explorer.exe base: 1402C0000Jump to behavior
        Source: C:\Users\user\Desktop\mine327.exeMemory written: C:\Windows\explorer.exe base: 7FFFFFDB010Jump to behavior
        Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\services.exe base: 1C0000Jump to behavior
        Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\winlogon.exe base: 950000Jump to behavior
        Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\lsass.exe base: F0000Jump to behavior
        Source: C:\Windows\System32\dialer.exeMemory written: C:\ProgramData\jjfvbumjfczj\oapavmkbdsqp.exe base: E0000Jump to behavior
        Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\lsm.exe base: 1B0000Jump to behavior
        Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\svchost.exe base: 680000Jump to behavior
        Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\svchost.exe base: 130000Jump to behavior
        Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\svchost.exe base: 13F0000Jump to behavior
        Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\svchost.exe base: 970000Jump to behavior
        Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\svchost.exe base: 180000Jump to behavior
        Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\svchost.exe base: B90000Jump to behavior
        Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\svchost.exe base: 110000Jump to behavior
        Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\svchost.exe base: FD0000Jump to behavior
        Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\spoolsv.exe base: 1E50000Jump to behavior
        Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\svchost.exe base: 120000Jump to behavior
        Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\dwm.exe base: 340000Jump to behavior
        Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\explorer.exe base: 2800000Jump to behavior
        Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\taskeng.exe base: 970000Jump to behavior
        Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\UI0Detect.exe base: 1B80000Jump to behavior
        Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\wbem\WmiPrvSE.exe base: 1A0000Jump to behavior
        Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\svchost.exe base: 330000Jump to behavior
        Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\wbem\WmiPrvSE.exe base: 1B0000Jump to behavior
        Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\wbem\WmiPrvSE.exe base: 1C0000Jump to behavior
        Source: C:\Windows\System32\dialer.exeMemory written: C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE base: 130000Jump to behavior
        Source: C:\Windows\System32\dialer.exeMemory written: C:\Users\user\Desktop\mine327.exe base: 540000Jump to behavior
        Source: C:\Windows\System32\dialer.exeMemory written: C:\ProgramData\jjfvbumjfczj\oapavmkbdsqp.exe base: 2C0000Jump to behavior
        Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\svchost.exe base: 120000Jump to behavior
        Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\WerFault.exe base: 1D80000Jump to behavior
        Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\sc.exe base: 130000Jump to behavior
        Source: C:\Windows\System32\dialer.exeMemory written: C:\Windows\System32\conhost.exe base: 1D0000Jump to behavior
        Source: C:\Windows\System32\dialer.exeMemory written: C:\Users\user\Desktop\mine327.exe base: C60000Jump to behavior
        Source: C:\Windows\System32\dialer.exeMemory written: C:\Users\user\Desktop\mine327.exe base: 1140000Jump to behavior
        Source: C:\Windows\System32\dialer.exeMemory written: C:\Users\user\Desktop\mine327.exe base: 1ACC0000Jump to behavior
        Source: C:\Windows\System32\dialer.exeMemory written: C:\Users\user\Desktop\mine327.exe base: 1B4A0000Jump to behavior
        Source: C:\Windows\System32\dialer.exeMemory written: C:\Users\user\Desktop\mine327.exe base: 1BE40000Jump to behavior
        Source: C:\Windows\System32\dialer.exeMemory written: C:\Users\user\Desktop\mine327.exe base: 1BEA0000Jump to behavior
        Source: C:\Windows\System32\dialer.exeMemory written: C:\Users\user\Desktop\mine327.exe base: 1BF00000Jump to behavior
        Source: C:\Windows\System32\dialer.exeMemory written: C:\Users\user\Desktop\mine327.exe base: 1BF60000Jump to behavior
        Source: C:\Windows\System32\dialer.exeMemory written: C:\Users\user\Desktop\mine327.exe base: 1BFC0000Jump to behavior
        Source: C:\Windows\System32\dialer.exeMemory written: C:\Users\user\Desktop\mine327.exe base: 1C020000Jump to behavior
        Source: C:\Windows\System32\dialer.exeMemory written: C:\Users\user\Desktop\mine327.exe base: 1C080000Jump to behavior
        Source: C:\Windows\System32\lsass.exeMemory written: C:\Windows\System32\WerFault.exe base: 1BB0000Jump to behavior
        Source: C:\Windows\System32\lsass.exeMemory written: C:\Windows\System32\WerFault.exe base: 1BB0000Jump to behavior
        Source: C:\Windows\System32\lsass.exeMemory written: C:\Windows\System32\WerFault.exe base: 1BB0000Jump to behavior
        Source: C:\Windows\System32\lsass.exeMemory written: C:\Windows\System32\WerFault.exe base: 1BB0000Jump to behavior
        Source: C:\Windows\System32\lsass.exeMemory written: C:\Windows\System32\WerFault.exe base: 1BB0000Jump to behavior
        Source: C:\Windows\System32\lsass.exeMemory written: C:\Windows\System32\WerFault.exe base: 1BB0000Jump to behavior
        Source: C:\Windows\System32\lsass.exeMemory written: C:\Windows\System32\WerFault.exe base: 1BB0000Jump to behavior
        Source: C:\Windows\System32\lsass.exeMemory written: C:\Windows\System32\WerFault.exe base: 1BB0000Jump to behavior
        Source: C:\Windows\System32\lsass.exeMemory written: C:\Windows\System32\WerFault.exe base: 1BB0000Jump to behavior
        Source: C:\Users\user\Desktop\mine327.exeProcess created: C:\Windows\explorer.exe "C:\Windows\explorer.exe"Jump to behavior
        Source: C:\Windows\System32\services.exeProcess created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k WerSvcGroupJump to behavior
        Source: C:\Windows\System32\services.exeProcess created: C:\ProgramData\jjfvbumjfczj\oapavmkbdsqp.exe C:\ProgramData\jjfvbumjfczj\oapavmkbdsqp.exeJump to behavior
        Source: C:\Windows\System32\svchost.exeProcess created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 1436 -s 724Jump to behavior
        Source: C:\Windows\System32\svchost.exeProcess created: unknown unknownJump to behavior
        Source: C:\Windows\System32\dialer.exeCode function: 3_2_0000000140001B54 AllocateAndInitializeSid,SetEntriesInAclW,LocalAlloc,InitializeSecurityDescriptor,SetSecurityDescriptorDacl,CreateNamedPipeW,3_2_0000000140001B54
        Source: C:\Windows\System32\dialer.exeCode function: 3_2_0000000140001B54 AllocateAndInitializeSid,SetEntriesInAclW,LocalAlloc,InitializeSecurityDescriptor,SetSecurityDescriptorDacl,CreateNamedPipeW,3_2_0000000140001B54
        Source: explorer.exe, 0000001F.00000002.602714101.00000000001D6000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001F.00000000.349660283.00000000001D6000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Progman-
        Source: winlogon.exe, 0000000C.00000000.342557683.0000000001570000.00000002.00000001.00040000.00000000.sdmp, winlogon.exe, 0000000C.00000002.607268412.0000000001570000.00000002.00000001.00040000.00000000.sdmp, dwm.exe, 0000001E.00000002.603257969.0000000000600000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: Program Manager
        Source: winlogon.exe, 0000000C.00000000.342557683.0000000001570000.00000002.00000001.00040000.00000000.sdmp, winlogon.exe, 0000000C.00000002.607268412.0000000001570000.00000002.00000001.00040000.00000000.sdmp, oapavmkbdsqp.exe, dwm.exe, 0000001E.00000002.603257969.0000000000600000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: Shell_TrayWnd
        Source: explorer.exe, 00000002.00000003.341979658.0000000000430000.00000004.00000001.00020000.00000000.sdmp, oapavmkbdsqp.exe, 00000010.00000000.342456608.00000000FF6DA000.00000002.00000001.01000000.00000007.sdmp, oapavmkbdsqp.exe, 00000010.00000002.410015355.00000000FF6DA000.00000002.00000001.01000000.00000007.sdmpBinary or memory string: Shell_TrayWndSettingsStuckRects2Logoff UserRestartTimerEnable Balloon TipShowOnlyQuickLaunchDeskBandDropDescriptionTrayClockWClass
        Source: oapavmkbdsqp.exeBinary or memory string: Progman
        Source: winlogon.exe, 0000000C.00000000.342557683.0000000001570000.00000002.00000001.00040000.00000000.sdmp, winlogon.exe, 0000000C.00000002.607268412.0000000001570000.00000002.00000001.00040000.00000000.sdmp, dwm.exe, 0000001E.00000002.603257969.0000000000600000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: !Progman
        Source: explorer.exe, 00000002.00000003.341979658.0000000000430000.00000004.00000001.00020000.00000000.sdmp, oapavmkbdsqp.exe, 00000010.00000000.342456608.00000000FF6DA000.00000002.00000001.01000000.00000007.sdmp, oapavmkbdsqp.exe, 00000010.00000002.410015355.00000000FF6DA000.00000002.00000001.01000000.00000007.sdmpBinary or memory string: ProgmanProxy DesktopHIMAGELIST_QueryInterfaceRtlDllShutdownInProgressntdll.dll9V
        Source: C:\Users\user\Desktop\mine327.exeCode function: 0_2_005536F0 cpuid 0_2_005536F0
        Source: C:\ProgramData\jjfvbumjfczj\oapavmkbdsqp.exeCode function: GetWindowLongW,GetSystemMetrics,SetRect,GetWindowLongW,GetWindowLongW,AdjustWindowRectEx,GetThemeBackgroundExtent,GetLocaleInfoW,GetLocaleInfoW,16_2_FF630870
        Source: C:\ProgramData\jjfvbumjfczj\oapavmkbdsqp.exeCode function: GetLocaleInfoW,16_2_FF64A0B0
        Source: C:\Users\user\Desktop\mine327.exeQueries volume information: C:\Users\user\Desktop\mine327.exe VolumeInformationJump to behavior
        Source: C:\ProgramData\jjfvbumjfczj\oapavmkbdsqp.exeKey value queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\TimeZoneInformation BiasJump to behavior
        Source: C:\Windows\System32\dialer.exeCode function: 3_2_0000000140001B54 AllocateAndInitializeSid,SetEntriesInAclW,LocalAlloc,InitializeSecurityDescriptor,SetSecurityDescriptorDacl,CreateNamedPipeW,3_2_0000000140001B54
        Source: C:\Users\user\Desktop\mine327.exeCode function: 0_2_00577960 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,0_2_00577960
        Source: C:\ProgramData\jjfvbumjfczj\oapavmkbdsqp.exeCode function: 16_2_FF6387AC GetThemeBool,GetUserNameExW,GdipAlloc,GdipCreateBitmapFromHBITMAP,GdipGetImageWidth,GdipGetImageHeight,GdipGetImageHeight,GdipGetImageWidth,DeleteObject,#2,#241,SetWindowTextW,GdipGetImageWidth,GdipGetImageHeight,MulDiv,GdipGetImageHeight,GdipGetImageWidth,MulDiv,#484,16_2_FF6387AC
        Source: C:\ProgramData\jjfvbumjfczj\oapavmkbdsqp.exeCode function: 16_2_FF649DB0 memset,GetDynamicTimeZoneInformation,EnterCriticalSection,memcmp,memset,RegCloseKey,memcpy,LeaveCriticalSection,GetTimeZoneInformation,GetLastError,16_2_FF649DB0
        Source: C:\ProgramData\jjfvbumjfczj\oapavmkbdsqp.exeCode function: 16_2_FF6A9E9C CoCreateInstance,memset,GetVersionExW,GetProductInfo,#155,RegOpenKeyExW,#439,#460,#190,#16,SHCreateDataObject,#155,#155,RegCloseKey,16_2_FF6A9E9C
        Source: C:\Users\user\Desktop\mine327.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior
        Source: svchost.exe, 00000016.00000002.602523824.00000000000F4000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000016.00000000.344499993.00000000000F4000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000019.00000000.347411701.0000000004720000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: %ProgramFiles%\Windows Defender\MSASCui.exe
        Source: svchost.exe, 00000019.00000000.347411701.0000000004720000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: efender\MSASCui.exe
        Source: C:\ProgramData\jjfvbumjfczj\oapavmkbdsqp.exeCode function: 16_2_FF634EF4 SHBindToParent,16_2_FF634EF4
        Source: C:\ProgramData\jjfvbumjfczj\oapavmkbdsqp.exeCode function: 16_2_FF6B9EF0 memset,RpcStringBindingComposeW,RpcBindingFromStringBindingW,RpcStringFreeW,LocalAlloc,CreateWellKnownSid,GetLastError,RpcBindingSetAuthInfoExW,LocalFree,RpcBindingFree,16_2_FF6B9EF0
        Source: C:\ProgramData\jjfvbumjfczj\oapavmkbdsqp.exeCode function: 16_2_FF642ED0 SHBindToParent,16_2_FF642ED0
        Source: C:\ProgramData\jjfvbumjfczj\oapavmkbdsqp.exeCode function: 16_2_FF6A8D58 SHBindToParent,#460,SHStrDupW,16_2_FF6A8D58
        Source: C:\ProgramData\jjfvbumjfczj\oapavmkbdsqp.exeCode function: 16_2_FF63FDA0 SHBindToParent,16_2_FF63FDA0
        Source: C:\ProgramData\jjfvbumjfczj\oapavmkbdsqp.exeCode function: 16_2_FF69AD98 SetForegroundWindow,SHBindToObject,#279,SHGetPathFromIDListW,#388,16_2_FF69AD98
        Source: C:\ProgramData\jjfvbumjfczj\oapavmkbdsqp.exeCode function: 16_2_FF6B6CD8 #21,SHBindToObject,#155,SHBindToObject,SHGetIDListFromObject,#484,#155,#155,#155,16_2_FF6B6CD8
        Source: C:\ProgramData\jjfvbumjfczj\oapavmkbdsqp.exeCode function: 16_2_FF6B9B64 RpcBindingFree,CloseHandle,CloseHandle,NdrClientCall3,LocalFree,16_2_FF6B9B64
        Source: C:\ProgramData\jjfvbumjfczj\oapavmkbdsqp.exeCode function: 16_2_FF6B6B20 #21,SHBindToObject,#155,SHBindToObject,SHGetIDListFromObject,#155,#155,#155,16_2_FF6B6B20
        Source: C:\ProgramData\jjfvbumjfczj\oapavmkbdsqp.exeCode function: 16_2_FF6AFBDC SHBindToParent,16_2_FF6AFBDC
        Source: C:\ProgramData\jjfvbumjfczj\oapavmkbdsqp.exeCode function: 16_2_FF665A40 SHBindToParent,#571,DestroyWindow,16_2_FF665A40
        Source: C:\ProgramData\jjfvbumjfczj\oapavmkbdsqp.exeCode function: 16_2_FF62F9CC SHBindToFolderIDListParent,16_2_FF62F9CC
        Source: C:\ProgramData\jjfvbumjfczj\oapavmkbdsqp.exeCode function: 16_2_FF62A8E8 SHBindToFolderIDListParent,#787,SHStrDupW,PathParseIconLocationW,Shell_GetCachedImageIndexW,CoTaskMemFree,memset,PathIsNetworkPathW,AssocQueryKeyW,Shell_GetCachedImageIndexW,SHGetValueW,RegCloseKey,PathParseIconLocationW,Shell_GetCachedImageIndexW,16_2_FF62A8E8
        Source: C:\ProgramData\jjfvbumjfczj\oapavmkbdsqp.exeCode function: 16_2_FF65F750 SetForegroundWindow,#89,SHBindToParent,CreatePopupMenu,LoadStringW,AppendMenuW,LoadStringW,AppendMenuW,TrackPopupMenu,DestroyMenu,#155,#100,SHGetFolderPathW,AppendMenuW,LoadStringW,AppendMenuW,#158,memset,SHGetPathFromIDListA,SHGetPathFromIDListW,SHGetKnownFolderIDList,16_2_FF65F750
        Source: C:\ProgramData\jjfvbumjfczj\oapavmkbdsqp.exeCode function: 16_2_FF634720 SHBindToParent,DestroyIcon,SHParseDisplayName,SHBindToParent,DestroyIcon,#155,16_2_FF634720
        Source: C:\ProgramData\jjfvbumjfczj\oapavmkbdsqp.exeCode function: 16_2_FF63F798 #89,SHBindToObject,CoTaskMemFree,#155,16_2_FF63F798
        Source: C:\ProgramData\jjfvbumjfczj\oapavmkbdsqp.exeCode function: 16_2_FF6506F4 SHBindToParent,16_2_FF6506F4
        Source: C:\ProgramData\jjfvbumjfczj\oapavmkbdsqp.exeCode function: 16_2_FF66941C GetClientRect,SHGetKnownFolderIDList,SHBindToParent,SendMessageCallbackW,#155,CoTaskMemFree,DestroyIcon,16_2_FF66941C
        Source: C:\ProgramData\jjfvbumjfczj\oapavmkbdsqp.exeCode function: 16_2_FF67437C SHGetIDListFromObject,#16,#17,#155,SHBindToParent,#199,16_2_FF67437C
        Source: C:\ProgramData\jjfvbumjfczj\oapavmkbdsqp.exeCode function: 16_2_FF635320 SHGetKnownFolderIDList,SHBindToParent,CoCreateInstance,#487,StrCmpW,CoTaskMemFree,PathParseIconLocationW,#460,CoTaskMemFree,CoTaskMemFree,CoTaskMemFree,CoTaskMemFree,CoTaskMemFree,CoTaskMemFree,CoTaskMemFree,CoTaskMemFree,SendMessageCallbackW,#155,CoTaskMemFree,DestroyIcon,16_2_FF635320
        Source: C:\ProgramData\jjfvbumjfczj\oapavmkbdsqp.exeCode function: 16_2_FF6BC3E0 #278,CoCreateInstance,SendMessageW,SHBindToParent,SendMessageW,#571,SendMessageW,DestroyWindow,16_2_FF6BC3E0
        Source: C:\ProgramData\jjfvbumjfczj\oapavmkbdsqp.exeCode function: 16_2_FF6D73F4 SHBindToObject,#155,16_2_FF6D73F4
        Source: C:\ProgramData\jjfvbumjfczj\oapavmkbdsqp.exeCode function: 16_2_FF672398 memset,StringFromGUID2,#155,SHBindToObject,16_2_FF672398
        Source: C:\ProgramData\jjfvbumjfczj\oapavmkbdsqp.exeCode function: 16_2_FF6D7270 #25,#155,SHBindToObject,#18,16_2_FF6D7270
        Source: C:\ProgramData\jjfvbumjfczj\oapavmkbdsqp.exeCode function: 16_2_FF6A9110 SHGetKnownFolderIDList,SHBindToObject,#25,#155,#155,SHGetKnownFolderIDList,#155,16_2_FF6A9110
        Source: C:\ProgramData\jjfvbumjfczj\oapavmkbdsqp.exeCode function: 16_2_FF6741F0 #155,#155,SHBindToObject,16_2_FF6741F0
        Source: C:\ProgramData\jjfvbumjfczj\oapavmkbdsqp.exeCode function: 16_2_FF674000 SHGetIDListFromObject,SHBindToObject,CoTaskMemFree,CoTaskMemFree,SHCreateItemFromIDList,CoTaskMemFree,16_2_FF674000

        Mitre Att&ck Matrix

        ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
        Gather Victim Identity InformationAcquire InfrastructureValid Accounts2
        Native API        		1
        DLL Side-Loading        		1
        Abuse Elevation Control Mechanism        		1
        Disable or Modify Tools        		21
        Input Capture        		22
        System Time Discovery        		Remote Services1
        Archive Collected Data        		1
        Encrypted Channel        		Exfiltration Over Other Network Medium1
        System Shutdown/Reboot
        CredentialsDomainsDefault Accounts1
        Exploitation for Client Execution        		12
        Windows Service        		1
        DLL Side-Loading        		1
        Deobfuscate/Decode Files or Information        		LSASS Memory1
        Account Discovery        		Remote Desktop Protocol1
        Screen Capture        		Junk DataExfiltration Over BluetoothNetwork Denial of Service
        Email AddressesDNS ServerDomain Accounts1
        Command and Scripting Interpreter        		Logon Script (Windows)1
        Access Token Manipulation        		1
        Abuse Elevation Control Mechanism        		Security Account Manager2
        File and Directory Discovery        		SMB/Windows Admin Shares21
        Input Capture        		SteganographyAutomated ExfiltrationData Encrypted for Impact
        Employee NamesVirtual Private ServerLocal Accounts3
        Service Execution        		Login Hook12
        Windows Service        		3
        Obfuscated Files or Information        		NTDS34
        System Information Discovery        		Distributed Component Object ModelInput CaptureProtocol ImpersonationTraffic DuplicationData Destruction
        Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon Script1013
        Process Injection        		1
        Software Packing        		LSA Secrets241
        Security Software Discovery        		SSHKeyloggingFallback ChannelsScheduled TransferData Encrypted for Impact
        Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC ScriptsRC Scripts1
        Timestomp        		Cached Domain Credentials3
        Virtualization/Sandbox Evasion        		VNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
        DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup ItemsStartup Items1
        DLL Side-Loading        		DCSync2
        Process Discovery        		Windows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery
        Network Trust DependenciesServerlessDrive-by CompromiseContainer Orchestration JobScheduled Task/JobScheduled Task/Job111
        Masquerading        		Proc Filesystem11
        Application Window Discovery        		Cloud ServicesCredential API HookingApplication Layer ProtocolExfiltration Over Alternative ProtocolDefacement
        Network TopologyMalvertisingExploit Public-Facing ApplicationCommand and Scripting InterpreterAtAt3
        Virtualization/Sandbox Evasion        		/etc/passwd and /etc/shadow1
        System Owner/User Discovery        		Direct Cloud VM ConnectionsData StagedWeb ProtocolsExfiltration Over Symmetric Encrypted Non-C2 ProtocolInternal Defacement
        IP AddressesCompromise InfrastructureSupply Chain CompromisePowerShellCronCron1
        Access Token Manipulation        		Network Sniffing1
        Remote System Discovery        		Shared WebrootLocal Data StagingFile Transfer ProtocolsExfiltration Over Asymmetric Encrypted Non-C2 ProtocolExternal Defacement
        Network Security AppliancesDomainsCompromise Software Dependencies and Development ToolsAppleScriptLaunchdLaunchd1013
        Process Injection        		Input CaptureSystem Network Connections DiscoverySoftware Deployment ToolsRemote Data StagingMail ProtocolsExfiltration Over Unencrypted Non-C2 ProtocolFirmware Corruption

        Behavior Graph

        Hide Legend

        Legend:

        • Process
        • Signature
        • Created File
        • DNS/IP Info
        • Is Dropped
        • Is Windows Process
        • Number of created Registry Values
        • Number of created Files
        • Visual Basic
        • Delphi
        • Java
        • .Net C# or VB.NET
        • C, C++ or other language
        • Is malicious
        • Internet
        behaviorgraph top1 signatures2 2 Behavior Graph ID: 1417451 Sample: mine327.exe Startdate: 29/03/2024 Architecture: WINDOWS Score: 100 49 Antivirus / Scanner detection for submitted sample 2->49 51 Multi AV Scanner detection for submitted file 2->51 53 Yara detected UAC Bypass using CMSTP 2->53 55 3 other signatures 2->55 10 mine327.exe 1 7 2->10         started        13 explorer.exe 2->13         started        15 conhost.exe 2->15         started        process3 signatures4 79 Injects code into the Windows Explorer (explorer.exe) 10->79 81 Tries to detect sandboxes and other dynamic analysis tools (process name or module or function) 10->81 83 Writes to foreign memory regions 10->83 85 3 other signatures 10->85 17 explorer.exe 2 10->17         started        process5 file6 47 C:\ProgramData\...\oapavmkbdsqp.exe, PE32+ 17->47 dropped 57 Benign windows process drops PE files 17->57 59 Modifies the context of a thread in another process (thread injection) 17->59 21 dialer.exe 1 17->21         started        24 sc.exe 17->24         started        26 sc.exe 17->26         started        28 2 other processes 17->28 signatures7 process8 signatures9 61 Changes memory attributes in foreign processes to executable or writable 21->61 63 Injects code into the Windows Explorer (explorer.exe) 21->63 65 Contains functionality to inject code into remote processes 21->65 69 5 other signatures 21->69 30 services.exe 5 21->30 injected 33 lsass.exe 21->33 injected 35 winlogon.exe 21->35 injected 37 20 other processes 21->37 67 Found direct / indirect Syscall (likely to bypass EDR) 24->67 process10 signatures11 89 Queues an APC in another process (thread injection) 30->89 91 Found direct / indirect Syscall (likely to bypass EDR) 30->91 39 oapavmkbdsqp.exe 1 2 30->39         started        42 svchost.exe 30->42         started        93 Writes to foreign memory regions 33->93 process12 signatures13 71 Detected unpacking (creates a PE file in dynamic memory) 39->71 73 Creates files in the system32 config directory 39->73 75 Found direct / indirect Syscall (likely to bypass EDR) 39->75 77 Early bird code injection technique detected 42->77 44 WerFault.exe 7 4 42->44         started        process14 signatures15 87 Found direct / indirect Syscall (likely to bypass EDR) 44->87

        Screenshots

        Thumbnails

        This section contains all screenshots as thumbnails, including those not shown in the slideshow.


        windows-stand

        Antivirus, Machine Learning and Genetic Malware Detection

        Initial Sample

        SourceDetectionScannerLabelLink
        mine327.exe70%ReversingLabsWin64.Trojan.Smokeloader
        mine327.exe49%VirustotalBrowse
        mine327.exe100%AviraHEUR/AGEN.1313962
        mine327.exe100%Joe Sandbox ML

        Dropped Files

        SourceDetectionScannerLabelLink
        C:\ProgramData\jjfvbumjfczj\oapavmkbdsqp.exe0%ReversingLabs
        C:\ProgramData\jjfvbumjfczj\oapavmkbdsqp.exe0%VirustotalBrowse

        Unpacked PE Files

        ⊘No Antivirus matches

        Domains

        ⊘No Antivirus matches

        URLs

        SourceDetectionScannerLabelLink
        http://java.sun.com0%URL Reputationsafe
        http://java.sun.com0%URL Reputationsafe
        http://crl.pki.goog/gsr1/gsr1.crl0;0%URL Reputationsafe
        http://crl.pkioverheid.nl/DomOvLatestCRL.crl00%URL Reputationsafe
        http://ocsp.entrust.net030%URL Reputationsafe
        http://ocsp.entrust.net030%URL Reputationsafe
        http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl00%URL Reputationsafe
        http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl00%URL Reputationsafe
        http://crl.pki.goog/gtsr1/gtsr1.crl0W0%URL Reputationsafe
        http://www.diginotar.nl/cps/pkioverheid00%URL Reputationsafe
        http://pki.goog/gsr1/gsr1.crt020%URL Reputationsafe
        https://pki.goog/repository/00%URL Reputationsafe
        https://pki.goog/repository/00%URL Reputationsafe
        http://ocsp.entrust.net0D0%URL Reputationsafe
        http://schemas.micro0%URL Reputationsafe
        http://pki.goog/repo/certs/gts1c3.der00%URL Reputationsafe
        http://pki.goog/repo/certs/gtsr1.der040%URL Reputationsafe
        http://schemas.com/win/2004/08/events0%Avira URL Cloudsafe
        http://crls.pki.goog/gts1c3/moVDfISia2k.crl00%Avira URL Cloudsafe
        http://crls.pki.goog/gts1c3/moVDfISia2k.crl00%VirustotalBrowse

        Domains and IPs

        Contacted Domains

        ⊘No contacted domains info

        URLs from Memory and Binaries

        NameSourceMaliciousAntivirus DetectionReputation
        http://java.sun.comexplorer.exe, 0000001F.00000002.602714101.00000000001D6000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001F.00000000.349660283.00000000001D6000.00000004.00000020.00020000.00000000.sdmpfalse
        • URL Reputation: safe
        • URL Reputation: safe
        		unknown
        http://www.piriform.com/ccleanerxeexplorer.exe, 0000001F.00000000.350097876.000000000260E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001F.00000002.604991513.000000000260E000.00000004.00000001.00020000.00000000.sdmpfalse
          		high
          http://crl.pki.goog/gsr1/gsr1.crl0;lsass.exe, 00000011.00000000.343011330.0000000001220000.00000004.00000001.00020000.00000000.sdmpfalse
          • URL Reputation: safe
          		unknown
          http://crl.pkioverheid.nl/DomOvLatestCRL.crl0WerFault.exe, 0000000A.00000002.376314972.0000000003A63000.00000004.00000001.00020000.00000000.sdmp, WerFault.exe, 0000000A.00000003.363740029.0000000003A63000.00000004.00000001.00020000.00000000.sdmpfalse
          • URL Reputation: safe
          		unknown
          http://www.piriform.com/ccleanerhttp://www.piriform.com/ccleanervexplorer.exe, 0000001F.00000002.606706574.0000000003DB1000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001F.00000000.350381000.0000000003DB1000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001F.00000000.350097876.000000000260E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001F.00000002.608288265.0000000007AE8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001F.00000000.350702735.0000000007AE8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001F.00000002.606706574.0000000003E98000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001F.00000000.350381000.0000000003E98000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001F.00000002.604991513.000000000260E000.00000004.00000001.00020000.00000000.sdmpfalse
            		high
            http://crl.entrust.net/server1.crl0WerFault.exe, 0000000A.00000002.367143979.00000000003CF000.00000004.00000001.00020000.00000000.sdmp, WerFault.exe, 0000000A.00000003.363658371.00000000003C2000.00000004.00000001.00020000.00000000.sdmp, WerFault.exe, 0000000A.00000002.376314972.0000000003A63000.00000004.00000001.00020000.00000000.sdmp, WerFault.exe, 0000000A.00000003.363740029.0000000003A63000.00000004.00000001.00020000.00000000.sdmpfalse
              		high
              http://ocsp.entrust.net03WerFault.exe, 0000000A.00000002.367143979.00000000003CF000.00000004.00000001.00020000.00000000.sdmp, WerFault.exe, 0000000A.00000003.363658371.00000000003C2000.00000004.00000001.00020000.00000000.sdmp, WerFault.exe, 0000000A.00000002.376314972.0000000003A63000.00000004.00000001.00020000.00000000.sdmp, WerFault.exe, 0000000A.00000003.363740029.0000000003A63000.00000004.00000001.00020000.00000000.sdmpfalse
              • URL Reputation: safe
              • URL Reputation: safe
              		unknown
              http://schemas.com/win/2004/08/eventssvchost.exe, 00000016.00000000.345782413.0000000001FFC000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000016.00000002.605131595.0000000001FFC000.00000004.00000001.00020000.00000000.sdmpfalse
              • Avira URL Cloud: safe
              		unknown
              http://crls.pki.goog/gts1c3/moVDfISia2k.crl0lsass.exe, 00000011.00000002.606687725.0000000001220000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000011.00000000.343011330.000000000122E000.00000004.00000001.00020000.00000000.sdmpfalse
              • 0%, Virustotal, Browse
              • Avira URL Cloud: safe
              		unknown
              http://www.piriform.com/ccleanerexplorer.exe, 0000001F.00000002.606706574.0000000003DB1000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001F.00000000.350381000.0000000003DB1000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001F.00000000.350097876.000000000260E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001F.00000002.608288265.0000000007AE8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001F.00000000.350702735.0000000007AE8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001F.00000002.606706574.0000000003E98000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001F.00000000.350381000.0000000003E98000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001F.00000002.604991513.000000000260E000.00000004.00000001.00020000.00000000.sdmpfalse
                		high
                http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0WerFault.exe, 0000000A.00000002.375602362.00000000039FE000.00000004.00000001.00020000.00000000.sdmp, WerFault.exe, 0000000A.00000002.376314972.0000000003A63000.00000004.00000001.00020000.00000000.sdmp, WerFault.exe, 0000000A.00000003.363740029.0000000003A63000.00000004.00000001.00020000.00000000.sdmpfalse
                • URL Reputation: safe
                • URL Reputation: safe
                		unknown
                http://crl.pki.goog/gtsr1/gtsr1.crl0Wlsass.exe, 00000011.00000002.606687725.0000000001220000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000011.00000000.343011330.000000000122E000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000011.00000000.343011330.0000000001220000.00000004.00000001.00020000.00000000.sdmpfalse
                • URL Reputation: safe
                		unknown
                http://www.autoitscript.com/autoit3explorer.exe, 0000001F.00000002.602714101.00000000001D6000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001F.00000000.349660283.00000000001D6000.00000004.00000020.00020000.00000000.sdmpfalse
                  		high
                  http://www.diginotar.nl/cps/pkioverheid0WerFault.exe, 0000000A.00000002.375602362.00000000039FE000.00000004.00000001.00020000.00000000.sdmp, WerFault.exe, 0000000A.00000002.376314972.0000000003A63000.00000004.00000001.00020000.00000000.sdmp, WerFault.exe, 0000000A.00000003.363740029.0000000003A63000.00000004.00000001.00020000.00000000.sdmpfalse
                  • URL Reputation: safe
                  		unknown
                  http://pki.goog/gsr1/gsr1.crt02lsass.exe, 00000011.00000000.343011330.0000000001220000.00000004.00000001.00020000.00000000.sdmpfalse
                  • URL Reputation: safe
                  		unknown
                  https://support.mozilla.orgexplorer.exe, 0000001F.00000002.602714101.00000000001D6000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001F.00000000.349660283.00000000001D6000.00000004.00000020.00020000.00000000.sdmpfalse
                    		high
                    https://pki.goog/repository/0lsass.exe, 00000011.00000002.606687725.0000000001220000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000011.00000000.343011330.000000000122E000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000011.00000000.343011330.0000000001220000.00000004.00000001.00020000.00000000.sdmpfalse
                    • URL Reputation: safe
                    • URL Reputation: safe
                    		unknown
                    http://ocsp.entrust.net0DWerFault.exe, 0000000A.00000002.376314972.0000000003A41000.00000004.00000001.00020000.00000000.sdmp, WerFault.exe, 0000000A.00000003.363740029.0000000003A41000.00000004.00000001.00020000.00000000.sdmp, WerFault.exe, 0000000A.00000002.376314972.0000000003A63000.00000004.00000001.00020000.00000000.sdmp, WerFault.exe, 0000000A.00000003.363740029.0000000003A63000.00000004.00000001.00020000.00000000.sdmpfalse
                    • URL Reputation: safe
                    		unknown
                    http://schemas.microsvchost.exe, 00000019.00000000.346998279.0000000001FD6000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000019.00000002.608643399.0000000001FD6000.00000004.00000001.00020000.00000000.sdmpfalse
                    • URL Reputation: safe
                    		unknown
                    https://secure.comodo.com/CPS0WerFault.exe, 0000000A.00000002.376314972.0000000003A41000.00000004.00000001.00020000.00000000.sdmp, WerFault.exe, 0000000A.00000003.363740029.0000000003A41000.00000004.00000001.00020000.00000000.sdmp, WerFault.exe, 0000000A.00000003.363658371.000000000044C000.00000004.00000001.00020000.00000000.sdmp, WerFault.exe, 0000000A.00000002.367143979.000000000044C000.00000004.00000001.00020000.00000000.sdmp, WerFault.exe, 0000000A.00000002.376314972.0000000003A63000.00000004.00000001.00020000.00000000.sdmp, WerFault.exe, 0000000A.00000003.363740029.0000000003A63000.00000004.00000001.00020000.00000000.sdmpfalse
                      		high
                      http://crl.entrust.net/2048ca.crl0WerFault.exe, 0000000A.00000002.376314972.0000000003A41000.00000004.00000001.00020000.00000000.sdmp, WerFault.exe, 0000000A.00000003.363740029.0000000003A41000.00000004.00000001.00020000.00000000.sdmp, WerFault.exe, 0000000A.00000002.376314972.0000000003A63000.00000004.00000001.00020000.00000000.sdmp, WerFault.exe, 0000000A.00000003.363740029.0000000003A63000.00000004.00000001.00020000.00000000.sdmpfalse
                        		high
                        http://pki.goog/repo/certs/gts1c3.der0lsass.exe, 00000011.00000002.606687725.0000000001220000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000011.00000000.343011330.000000000122E000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000011.00000000.342781591.000000000022B000.00000004.00000020.00020000.00000000.sdmp, lsass.exe, 00000011.00000002.603202980.000000000022B000.00000004.00000020.00020000.00000000.sdmpfalse
                        • URL Reputation: safe
                        		unknown
                        http://pki.goog/repo/certs/gtsr1.der04lsass.exe, 00000011.00000002.606687725.0000000001220000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000011.00000000.343011330.000000000122E000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000011.00000000.343011330.0000000001220000.00000004.00000001.00020000.00000000.sdmpfalse
                        • URL Reputation: safe
                        		unknown

                        World Map of Contacted IPs

                        ⊘No contacted IP infos

                        General Information

                        Joe Sandbox version:40.0.0 Tourmaline
                        Analysis ID:1417451
                        Start date and time:2024-03-29 10:26:31 +01:00
                        Joe Sandbox product:CloudBasic
                        Overall analysis duration:0h 10m 15s
                        Hypervisor based Inspection enabled:false
                        Report type:full
                        Cookbook file name:default.jbs
                        Analysis system description:Windows 7 x64 SP1 with Office 2010 SP1 (IE 11, FF52, Chrome 57, Adobe Reader DC 15, Flash 25.0.0.127, Java 8 Update 121, .NET 4.6.2)
                        Number of analysed new started processes analysed:16
                        Number of new started drivers analysed:0
                        Number of existing processes analysed:0
                        Number of existing drivers analysed:0
                        Number of injected processes analysed:22
                        Technologies:
                        • HCA enabled
                        • EGA enabled
                        • AMSI enabled
                        Analysis Mode:default
                        Sample name:mine327.exe
                        Detection:MAL
                        Classification:mal100.expl.evad.winEXE@23/1@0/0
                        EGA Information:
                        • Successful, ratio: 100%
                        HCA Information:
                        • Successful, ratio: 100%
                        • Number of executed functions: 118
                        • Number of non-executed functions: 266
                        Cookbook Comments:
                        • Found application associated with file extension: .exe

                        Warnings

                        • Exclude process from analysis (whitelisted): dllhost.exe, conhost.exe
                        • Excluded IPs from analysis (whitelisted): 104.208.16.93
                        • Excluded domains from analysis (whitelisted): onedsblobprdcus07.centralus.cloudapp.azure.com, watson.microsoft.com, legacywatson.trafficmanager.net
                        • Not all processes where analyzed, report is missing behavior information
                        • Report creation exceeded maximum time and may have missing disassembly code information.
                        • Report size exceeded maximum capacity and may have missing behavior information.
                        • Report size exceeded maximum capacity and may have missing disassembly code.
                        • Report size getting too big, too many NtCreateFile calls found.
                        • Report size getting too big, too many NtEnumerateValueKey calls found.
                        • Report size getting too big, too many NtOpenFile calls found.
                        • Report size getting too big, too many NtOpenKeyEx calls found.
                        • Report size getting too big, too many NtQueryValueKey calls found.
                        • Report size getting too big, too many NtReadVirtualMemory calls found.

                        Simulations

                        Behavior and APIs

                        TimeTypeDescription
                        10:27:14API Interceptor49x Sleep call for process: mine327.exe modified
                        10:27:17API Interceptor24442x Sleep call for process: explorer.exe modified
                        10:27:17API Interceptor2089x Sleep call for process: dialer.exe modified
                        10:27:17API Interceptor4x Sleep call for process: sc.exe modified
                        10:27:18API Interceptor141x Sleep call for process: WerFault.exe modified
                        10:27:18API Interceptor131405x Sleep call for process: services.exe modified
                        10:27:18API Interceptor53414x Sleep call for process: svchost.exe modified
                        10:27:18API Interceptor212x Sleep call for process: oapavmkbdsqp.exe modified
                        10:27:19API Interceptor127669x Sleep call for process: lsass.exe modified
                        10:27:30API Interceptor2417x Sleep call for process: WmiPrvSE.exe modified
                        10:27:44API Interceptor6669x Sleep call for process: lsm.exe modified
                        10:27:46API Interceptor6139x Sleep call for process: spoolsv.exe modified
                        10:27:53API Interceptor83423x Sleep call for process: winlogon.exe modified
                        10:27:55API Interceptor3022x Sleep call for process: UI0Detect.exe modified
                        10:27:57API Interceptor5694x Sleep call for process: dwm.exe modified
                        10:28:00API Interceptor53x Sleep call for process: taskeng.exe modified

                        Joe Sandbox View / Context

                        IPs

                        ⊘No context

                        Domains

                        ⊘No context

                        ASNs

                        ⊘No context

                        JA3 Fingerprints

                        ⊘No context

                        Dropped Files

                        ⊘No context

                        Created / dropped Files

                        C:\ProgramData\jjfvbumjfczj\oapavmkbdsqp.exe

                        Download File
                        Process:C:\Windows\explorer.exe
                        File Type:PE32+ executable (GUI) x86-64, for MS Windows
                        Category:dropped
                        Size (bytes):3229696
                        Entropy (8bit):5.55686352176075
                        Encrypted:false
                        SSDEEP:98304:6AQexfDvYYYYYYYYYYYRYYYYYYYYYYE3ia0eojk221:6AQexfDl3r7ojk22
                        MD5:38AE1B3C38FAEF56FE4907922F0385BA
                        SHA1:84123A3DECDAA217E3588A1DE59FE6CEE1998004
                        SHA-256:D5BC504277172BE5C54B60AD5C13209DC1F729131DEF084DE3EC8C72E54C58EF
                        SHA-512:EB678243A7125C7D3A2F41250E375319E3C6A8D8B6F101E312DF15D5B04139E130F5559330BDA1A8ECF89CF23D991BCEDB404BEF574B557658199572D8A5D018
                        Malicious:true
                        Antivirus:
                        • Antivirus: ReversingLabs, Detection: 0%
                        • Antivirus: Virustotal, Detection: 0%, Browse
                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......S.(7..Fd..Fd..Fd...d].Fd...d..Fd...d>.Fd..Gd .Fd...d7.Fd...dY.Fd...d..Fd...d..FdRich..Fd........................PE..d....N.W.........."...........%...............................................1......I1...@...............................................................!.....p............`1.d&..L...8...............................................0... ...@....................text............................... ..`.rdata..............................@..@.data....@.......<...|..............@....pdata..p...........................@..@.rsrc.....!.......!.................@..@.reloc..d&...`1..(... 1.............@..B................................................................................................................................................................................................................................................................

                        Static File Info

                        General

                        File type:PE32+ executable (GUI) x86-64 Mono/.Net assembly, for MS Windows
                        Entropy (8bit):7.999012220540237
                        TrID:
                        • Win64 Executable GUI (202006/5) 92.65%
                        • Win64 Executable (generic) (12005/4) 5.51%
                        • Generic Win/DOS Executable (2004/3) 0.92%
                        • DOS Executable Generic (2002/1) 0.92%
                        • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
                        File name:mine327.exe
                        File size:3'249'284 bytes
                        MD5:f3e70f68d7e2f644bcd312f1333094e1
                        SHA1:259dd00ddb8a08fb149c37254bfb865a74bb11b9
                        SHA256:6607d552accc951f2cd068bb394200987d7d1e90e34f8cdab3afe6e3ccedee4e
                        SHA512:425d60775735804dce4a43aba0426966cc21ef5c0c997d073bc3d0740d3a07b13227fd1e5be93189079e8e01ca0c515d27ddc0451ee4e514e02bdc3bd8f4d33d
                        SSDEEP:98304:JmZqA+iL8qKL6O30JpMQEXUNa+6wBil8Ze:Jva8tLlIEEUzyZe
                        TLSH:47E53330B7FD8FADD96B4132A411E6B94630E543498152FC6EB744A41FAD38BAA1C3C7
                        File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d....LM..........."...0..m............... ....@...... ....................................`................................

                        File Icon

                        Icon Hash:aaf3e3e3918382a0

                        Static PE Info

                        General

                        Entrypoint:0x400000
                        Entrypoint Section:
                        Digitally signed:false
                        Imagebase:0x400000
                        Subsystem:windows gui
                        Image File Characteristics:EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
                        DLL Characteristics:HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
                        Time Stamp:0xFC4D4CA1 [Wed Feb 20 04:18:41 2104 UTC]
                        TLS Callbacks:
                        CLR (.Net) Version:
                        OS Version Major:4
                        OS Version Minor:0
                        File Version Major:4
                        File Version Minor:0
                        Subsystem Version Major:4
                        Subsystem Version Minor:0
                        Import Hash:

                        Entrypoint Preview

                        Instruction
                        dec ebp
                        pop edx
                        nop
                        add byte ptr [ebx], al
                        add byte ptr [eax], al
                        add byte ptr [eax+eax], al
                        add byte ptr [eax], al

                        Data Directories

                        NameVirtual AddressVirtual Size Is in Section
                        IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                        IMAGE_DIRECTORY_ENTRY_IMPORT0x00x0
                        IMAGE_DIRECTORY_ENTRY_RESOURCE0xa0000xbfc.rsrc
                        IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                        IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                        IMAGE_DIRECTORY_ENTRY_BASERELOC0x00x0
                        IMAGE_DIRECTORY_ENTRY_DEBUG0x8c580x38.text
                        IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                        IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                        IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                        IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
                        IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                        IMAGE_DIRECTORY_ENTRY_IAT0x00x0
                        IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                        IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x20000x48.text
                        IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                        Sections

                        NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
                        .text0x20000x6d100x6e00d77d03b88fdd51395ca931f26c6100c3False0.4962002840909091data5.85732877610208IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                        .rsrc0xa0000xbfc0xc0032f8ce49ea17d3cef7cf5e8250f60757False0.2975260416666667data4.023823319556393IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

                        Resources

                        NameRVASizeTypeLanguageCountryZLIB Complexity
                        RT_VERSION0xa0b80x4acdata0.47575250836120403
                        RT_VERSION0xa5640x4acdataEnglishUnited States0.47575250836120403
                        RT_MANIFEST0xaa100x1eaXML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators0.5489795918367347

                        Possible Origin

                        Language of compilation systemCountry where language is spokenMap
                        EnglishUnited States

                        Network Behavior

                        ⊘No network behavior found

                        Statistics

                        CPU Usage

                        Click to jump to process

                        Memory Usage

                        Click to jump to process

                        High Level Behavior Distribution

                        Click to dive into process behavior distribution

                        Behavior

                        Click to jump to process

                        System Behavior

                        General

                        Target ID:0
                        Start time:10:27:14
                        Start date:29/03/2024
                        Path:C:\Users\user\Desktop\mine327.exe
                        Wow64 process (32bit):false
                        Commandline:"C:\Users\user\Desktop\mine327.exe"
                        Imagebase:0x1290000
                        File size:3'249'284 bytes
                        MD5 hash:F3E70F68D7E2F644BCD312F1333094E1
                        Has elevated privileges:true
                        Has administrator privileges:true
                        Programmed in:C, C++ or other language
                        Yara matches:
                        • Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000000.00000002.377843630.00000000029FE000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                        Reputation:low
                        Has exited:false

                        General

                        Target ID:2
                        Start time:10:27:17
                        Start date:29/03/2024
                        Path:C:\Windows\explorer.exe
                        Wow64 process (32bit):false
                        Commandline:"C:\Windows\explorer.exe"
                        Imagebase:0xff2f0000
                        File size:3'229'696 bytes
                        MD5 hash:38AE1B3C38FAEF56FE4907922F0385BA
                        Has elevated privileges:true
                        Has administrator privileges:true
                        Programmed in:C, C++ or other language
                        Reputation:high
                        Has exited:true

                        General

                        Target ID:3
                        Start time:10:27:17
                        Start date:29/03/2024
                        Path:C:\Windows\System32\dialer.exe
                        Wow64 process (32bit):false
                        Commandline:C:\Windows\system32\dialer.exe
                        Imagebase:0xff1c0000
                        File size:35'328 bytes
                        MD5 hash:46523E17EE0F6837746924EDA7E9BAC9
                        Has elevated privileges:true
                        Has administrator privileges:true
                        Programmed in:C, C++ or other language
                        Reputation:low
                        Has exited:false

                        General

                        Target ID:4
                        Start time:10:27:17
                        Start date:29/03/2024
                        Path:C:\Windows\System32\sc.exe
                        Wow64 process (32bit):false
                        Commandline:C:\Windows\system32\sc.exe delete "GVKQGWZS"
                        Imagebase:0xffa70000
                        File size:45'056 bytes
                        MD5 hash:4EBBC2B0AD7F9075AE9D6835D2A62B6E
                        Has elevated privileges:true
                        Has administrator privileges:true
                        Programmed in:C, C++ or other language
                        Reputation:low
                        Has exited:true

                        General

                        Target ID:5
                        Start time:10:27:17
                        Start date:29/03/2024
                        Path:C:\Windows\System32\conhost.exe
                        Wow64 process (32bit):false
                        Commandline:C:\Windows\system32\conhost.exe "139732321118494632871898021326457884-543674567-14929065572102852035-708161083"
                        Imagebase:0xff850000
                        File size:338'432 bytes
                        MD5 hash:CE476F23405AADC46039AC13127DF473
                        Has elevated privileges:true
                        Has administrator privileges:true
                        Programmed in:C, C++ or other language
                        Reputation:moderate
                        Has exited:true

                        General

                        Target ID:6
                        Start time:10:27:17
                        Start date:29/03/2024
                        Path:C:\Windows\System32\services.exe
                        Wow64 process (32bit):false
                        Commandline:C:\Windows\system32\services.exe
                        Imagebase:0xff940000
                        File size:328'704 bytes
                        MD5 hash:71C85477DF9347FE8E7BC55768473FCA
                        Has elevated privileges:true
                        Has administrator privileges:true
                        Programmed in:C, C++ or other language
                        Reputation:low
                        Has exited:false

                        General

                        Target ID:7
                        Start time:10:27:17
                        Start date:29/03/2024
                        Path:C:\Windows\System32\sc.exe
                        Wow64 process (32bit):false
                        Commandline:C:\Windows\system32\sc.exe create "GVKQGWZS" binpath= "C:\ProgramData\jjfvbumjfczj\oapavmkbdsqp.exe" start= "auto"
                        Imagebase:0xff190000
                        File size:45'056 bytes
                        MD5 hash:4EBBC2B0AD7F9075AE9D6835D2A62B6E
                        Has elevated privileges:true
                        Has administrator privileges:true
                        Programmed in:C, C++ or other language
                        Reputation:low
                        Has exited:true

                        General

                        Target ID:9
                        Start time:10:27:18
                        Start date:29/03/2024
                        Path:C:\Windows\System32\svchost.exe
                        Wow64 process (32bit):false
                        Commandline:C:\Windows\System32\svchost.exe -k WerSvcGroup
                        Imagebase:0xff150000
                        File size:27'136 bytes
                        MD5 hash:C78655BC80301D76ED4FEF1C1EA40A7D
                        Has elevated privileges:true
                        Has administrator privileges:true
                        Programmed in:C, C++ or other language
                        Reputation:moderate
                        Has exited:false

                        General

                        Target ID:10
                        Start time:10:27:18
                        Start date:29/03/2024
                        Path:C:\Windows\System32\WerFault.exe
                        Wow64 process (32bit):false
                        Commandline:C:\Windows\system32\WerFault.exe -u -p 1436 -s 724
                        Imagebase:0xffbc0000
                        File size:415'232 bytes
                        MD5 hash:8784236EED5079493DA9FC95B28B89F8
                        Has elevated privileges:true
                        Has administrator privileges:true
                        Programmed in:C, C++ or other language
                        Reputation:moderate
                        Has exited:false

                        General

                        Target ID:11
                        Start time:10:27:18
                        Start date:29/03/2024
                        Path:C:\Windows\System32\sc.exe
                        Wow64 process (32bit):false
                        Commandline:C:\Windows\system32\sc.exe stop eventlog
                        Imagebase:0xffcc0000
                        File size:45'056 bytes
                        MD5 hash:4EBBC2B0AD7F9075AE9D6835D2A62B6E
                        Has elevated privileges:true
                        Has administrator privileges:true
                        Programmed in:C, C++ or other language
                        Reputation:low
                        Has exited:true

                        General

                        Target ID:12
                        Start time:10:27:18
                        Start date:29/03/2024
                        Path:C:\Windows\System32\winlogon.exe
                        Wow64 process (32bit):false
                        Commandline:winlogon.exe
                        Imagebase:0xff6c0000
                        File size:455'168 bytes
                        MD5 hash:8CEBD9D0A0A879CDE9F36F4383B7CAEA
                        Has elevated privileges:true
                        Has administrator privileges:true
                        Programmed in:C, C++ or other language
                        Reputation:low
                        Has exited:false

                        General

                        Target ID:13
                        Start time:10:27:18
                        Start date:29/03/2024
                        Path:C:\Windows\System32\sc.exe
                        Wow64 process (32bit):false
                        Commandline:C:\Windows\system32\sc.exe start "GVKQGWZS"
                        Imagebase:0xffcc0000
                        File size:45'056 bytes
                        MD5 hash:4EBBC2B0AD7F9075AE9D6835D2A62B6E
                        Has elevated privileges:true
                        Has administrator privileges:true
                        Programmed in:C, C++ or other language
                        Reputation:low
                        Has exited:false

                        General

                        Target ID:15
                        Start time:10:27:18
                        Start date:29/03/2024
                        Path:C:\Windows\System32\conhost.exe
                        Wow64 process (32bit):false
                        Commandline:C:\Windows\system32\conhost.exe "-1634546190-146323334895602099619948307862079476161-1963036748880124969-1741426452"
                        Imagebase:0xff0d0000
                        File size:338'432 bytes
                        MD5 hash:CE476F23405AADC46039AC13127DF473
                        Has elevated privileges:true
                        Has administrator privileges:true
                        Programmed in:C, C++ or other language
                        Reputation:moderate
                        Has exited:false

                        General

                        Target ID:16
                        Start time:10:27:18
                        Start date:29/03/2024
                        Path:C:\ProgramData\jjfvbumjfczj\oapavmkbdsqp.exe
                        Wow64 process (32bit):false
                        Commandline:C:\ProgramData\jjfvbumjfczj\oapavmkbdsqp.exe
                        Imagebase:0xff620000
                        File size:3'229'696 bytes
                        MD5 hash:38AE1B3C38FAEF56FE4907922F0385BA
                        Has elevated privileges:true
                        Has administrator privileges:true
                        Programmed in:C, C++ or other language
                        Antivirus matches:
                        • Detection: 0%, ReversingLabs
                        • Detection: 0%, Virustotal, Browse
                        Has exited:false

                        General

                        Target ID:17
                        Start time:10:27:18
                        Start date:29/03/2024
                        Path:C:\Windows\System32\lsass.exe
                        Wow64 process (32bit):false
                        Commandline:C:\Windows\system32\lsass.exe
                        Imagebase:0xff340000
                        File size:30'720 bytes
                        MD5 hash:CA69E856332E2D85294665F6B7E97254
                        Has elevated privileges:true
                        Has administrator privileges:true
                        Programmed in:C, C++ or other language
                        Has exited:false

                        General

                        Target ID:18
                        Start time:10:27:18
                        Start date:29/03/2024
                        Path:C:\Windows\explorer.exe
                        Wow64 process (32bit):
                        Commandline:C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                        Imagebase:
                        File size:3'229'696 bytes
                        MD5 hash:38AE1B3C38FAEF56FE4907922F0385BA
                        Has elevated privileges:true
                        Has administrator privileges:true
                        Programmed in:C, C++ or other language
                        Has exited:false

                        General

                        Target ID:19
                        Start time:10:27:18
                        Start date:29/03/2024
                        Path:C:\Windows\System32\lsm.exe
                        Wow64 process (32bit):false
                        Commandline:C:\Windows\system32\lsm.exe
                        Imagebase:0xff7a0000
                        File size:343'040 bytes
                        MD5 hash:9662EE182644511439F1C53745DC1C88
                        Has elevated privileges:true
                        Has administrator privileges:true
                        Programmed in:C, C++ or other language
                        Has exited:false

                        General

                        Target ID:20
                        Start time:10:27:19
                        Start date:29/03/2024
                        Path:C:\Windows\System32\svchost.exe
                        Wow64 process (32bit):false
                        Commandline:C:\Windows\system32\svchost.exe -k DcomLaunch
                        Imagebase:0xff150000
                        File size:27'136 bytes
                        MD5 hash:C78655BC80301D76ED4FEF1C1EA40A7D
                        Has elevated privileges:true
                        Has administrator privileges:true
                        Programmed in:C, C++ or other language
                        Has exited:false

                        General

                        Target ID:21
                        Start time:10:27:19
                        Start date:29/03/2024
                        Path:C:\Windows\System32\svchost.exe
                        Wow64 process (32bit):false
                        Commandline:C:\Windows\system32\svchost.exe -k RPCSS
                        Imagebase:0xff150000
                        File size:27'136 bytes
                        MD5 hash:C78655BC80301D76ED4FEF1C1EA40A7D
                        Has elevated privileges:true
                        Has administrator privileges:false
                        Programmed in:C, C++ or other language
                        Has exited:false

                        General

                        Target ID:22
                        Start time:10:27:19
                        Start date:29/03/2024
                        Path:C:\Windows\System32\svchost.exe
                        Wow64 process (32bit):false
                        Commandline:C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
                        Imagebase:0xff150000
                        File size:27'136 bytes
                        MD5 hash:C78655BC80301D76ED4FEF1C1EA40A7D
                        Has elevated privileges:true
                        Has administrator privileges:false
                        Programmed in:C, C++ or other language
                        Has exited:false

                        General

                        Target ID:23
                        Start time:10:27:20
                        Start date:29/03/2024
                        Path:C:\Windows\System32\svchost.exe
                        Wow64 process (32bit):false
                        Commandline:C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
                        Imagebase:0xff150000
                        File size:27'136 bytes
                        MD5 hash:C78655BC80301D76ED4FEF1C1EA40A7D
                        Has elevated privileges:true
                        Has administrator privileges:true
                        Programmed in:C, C++ or other language
                        Has exited:false

                        General

                        Target ID:24
                        Start time:10:27:20
                        Start date:29/03/2024
                        Path:C:\Windows\System32\svchost.exe
                        Wow64 process (32bit):false
                        Commandline:C:\Windows\system32\svchost.exe -k LocalService
                        Imagebase:0xff150000
                        File size:27'136 bytes
                        MD5 hash:C78655BC80301D76ED4FEF1C1EA40A7D
                        Has elevated privileges:true
                        Has administrator privileges:false
                        Programmed in:C, C++ or other language
                        Has exited:false

                        General

                        Target ID:25
                        Start time:10:27:20
                        Start date:29/03/2024
                        Path:C:\Windows\System32\svchost.exe
                        Wow64 process (32bit):false
                        Commandline:C:\Windows\system32\svchost.exe -k netsvcs
                        Imagebase:0xff150000
                        File size:27'136 bytes
                        MD5 hash:C78655BC80301D76ED4FEF1C1EA40A7D
                        Has elevated privileges:true
                        Has administrator privileges:true
                        Programmed in:C, C++ or other language
                        Has exited:false

                        General

                        Target ID:26
                        Start time:10:27:20
                        Start date:29/03/2024
                        Path:C:\Windows\System32\svchost.exe
                        Wow64 process (32bit):false
                        Commandline:C:\Windows\system32\svchost.exe -k GPSvcGroup
                        Imagebase:0xff150000
                        File size:27'136 bytes
                        MD5 hash:C78655BC80301D76ED4FEF1C1EA40A7D
                        Has elevated privileges:true
                        Has administrator privileges:true
                        Programmed in:C, C++ or other language
                        Has exited:false

                        General

                        Target ID:27
                        Start time:10:27:21
                        Start date:29/03/2024
                        Path:C:\Windows\System32\svchost.exe
                        Wow64 process (32bit):false
                        Commandline:C:\Windows\system32\svchost.exe -k NetworkService
                        Imagebase:0xff150000
                        File size:27'136 bytes
                        MD5 hash:C78655BC80301D76ED4FEF1C1EA40A7D
                        Has elevated privileges:true
                        Has administrator privileges:false
                        Programmed in:C, C++ or other language
                        Has exited:false

                        General

                        Target ID:28
                        Start time:10:27:21
                        Start date:29/03/2024
                        Path:C:\Windows\System32\spoolsv.exe
                        Wow64 process (32bit):false
                        Commandline:C:\Windows\System32\spoolsv.exe
                        Imagebase:0xffb20000
                        File size:559'104 bytes
                        MD5 hash:B96C17B5DC1424D56EEA3A99E97428CD
                        Has elevated privileges:true
                        Has administrator privileges:true
                        Programmed in:C, C++ or other language
                        Has exited:false

                        General

                        Target ID:29
                        Start time:10:27:21
                        Start date:29/03/2024
                        Path:C:\Windows\System32\svchost.exe
                        Wow64 process (32bit):false
                        Commandline:C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
                        Imagebase:0xff150000
                        File size:27'136 bytes
                        MD5 hash:C78655BC80301D76ED4FEF1C1EA40A7D
                        Has elevated privileges:true
                        Has administrator privileges:false
                        Programmed in:C, C++ or other language
                        Has exited:false

                        General

                        Target ID:30
                        Start time:10:27:21
                        Start date:29/03/2024
                        Path:C:\Windows\System32\dwm.exe
                        Wow64 process (32bit):false
                        Commandline:"C:\Windows\system32\Dwm.exe"
                        Imagebase:0xff590000
                        File size:120'320 bytes
                        MD5 hash:F162D5F5E845B9DC352DD1BAD8CEF1BC
                        Has elevated privileges:
                        Has administrator privileges:
                        Programmed in:C, C++ or other language
                        Has exited:false

                        General

                        Target ID:31
                        Start time:10:27:21
                        Start date:29/03/2024
                        Path:C:\Windows\explorer.exe
                        Wow64 process (32bit):false
                        Commandline:C:\Windows\Explorer.EXE
                        Imagebase:0xff2f0000
                        File size:3'229'696 bytes
                        MD5 hash:38AE1B3C38FAEF56FE4907922F0385BA
                        Has elevated privileges:
                        Has administrator privileges:
                        Programmed in:C, C++ or other language
                        Has exited:false

                        General

                        Target ID:32
                        Start time:10:27:22
                        Start date:29/03/2024
                        Path:C:\Windows\System32\taskeng.exe
                        Wow64 process (32bit):false
                        Commandline:taskeng.exe {0261976F-A640-459E-8DC4-21A56BEEBB73} S-1-5-18:NT AUTHORITY\System:Service:
                        Imagebase:0xff6a0000
                        File size:464'384 bytes
                        MD5 hash:65EA57712340C09B1B0C427B4848AE05
                        Has elevated privileges:
                        Has administrator privileges:
                        Programmed in:C, C++ or other language
                        Has exited:false

                        General

                        Target ID:33
                        Start time:10:27:22
                        Start date:29/03/2024
                        Path:C:\Windows\System32\UI0Detect.exe
                        Wow64 process (32bit):false
                        Commandline:C:\Windows\system32\UI0Detect.exe
                        Imagebase:0xff390000
                        File size:40'960 bytes
                        MD5 hash:3CBDEC8D06B9968ABA702EBA076364A1
                        Has elevated privileges:
                        Has administrator privileges:
                        Programmed in:C, C++ or other language
                        Has exited:false

                        General

                        Target ID:34
                        Start time:10:27:23
                        Start date:29/03/2024
                        Path:C:\Windows\System32\wbem\WmiPrvSE.exe
                        Wow64 process (32bit):false
                        Commandline:C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
                        Imagebase:0x13fa80000
                        File size:425'984 bytes
                        MD5 hash:D683C112190F4B4C6D477D693EE88E35
                        Has elevated privileges:
                        Has administrator privileges:
                        Programmed in:C, C++ or other language
                        Has exited:false

                        General

                        Target ID:35
                        Start time:10:27:24
                        Start date:29/03/2024
                        Path:C:\Windows\System32\svchost.exe
                        Wow64 process (32bit):false
                        Commandline:C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
                        Imagebase:0xff150000
                        File size:27'136 bytes
                        MD5 hash:C78655BC80301D76ED4FEF1C1EA40A7D
                        Has elevated privileges:
                        Has administrator privileges:
                        Programmed in:C, C++ or other language
                        Has exited:false

                        General

                        Target ID:36
                        Start time:10:27:24
                        Start date:29/03/2024
                        Path:C:\Windows\System32\wbem\WmiPrvSE.exe
                        Wow64 process (32bit):false
                        Commandline:C:\Windows\system32\wbem\wmiprvse.exe -Embedding
                        Imagebase:0x13fa80000
                        File size:425'984 bytes
                        MD5 hash:D683C112190F4B4C6D477D693EE88E35
                        Has elevated privileges:
                        Has administrator privileges:
                        Programmed in:C, C++ or other language
                        Has exited:false

                        General

                        Target ID:37
                        Start time:10:27:24
                        Start date:29/03/2024
                        Path:C:\Windows\System32\wbem\WmiPrvSE.exe
                        Wow64 process (32bit):false
                        Commandline:
                        Imagebase:0x13fa80000
                        File size:425'984 bytes
                        MD5 hash:D683C112190F4B4C6D477D693EE88E35
                        Has elevated privileges:
                        Has administrator privileges:
                        Programmed in:C, C++ or other language
                        Has exited:false

                        Disassembly

                        Reset < >

                          Execution Graph

                          Execution Coverage:7.6%
                          Dynamic/Decrypted Code Coverage:100%
                          Signature Coverage:19.2%
                          Total number of Nodes:239
                          Total number of Limit Nodes:33
                          execution_graph 37710 57f394 37712 57f3f1 __vcrt_FlsSetValue 37710->37712 37716 57f3ec __vcrt_FlsSetValue 37710->37716 37711 57f421 LoadLibraryExW 37713 57f4f6 37711->37713 37714 57f446 GetLastError 37711->37714 37713->37712 37715 57f50d FreeLibrary 37713->37715 37714->37716 37715->37712 37716->37711 37716->37712 37717 57f480 LoadLibraryExW 37716->37717 37717->37713 37717->37716 37553 7fe93d70a9c 37554 7fe93d70aa5 37553->37554 37555 7fe93d70a4f SetThreadContext 37554->37555 37557 7fe93d70abc 37554->37557 37556 7fe93d70a6a 37555->37556 37559 7fe93d70b37 37557->37559 37560 7fe93d550f0 37557->37560 37561 7fe93d55100 37560->37561 37564 7fe93d54630 37561->37564 37565 7fe93d5cfd0 37564->37565 37568 7fe93d58560 37565->37568 37567 7fe93d55123 37567->37559 37571 7fe93d58577 37568->37571 37569 7fe93d589a0 37573 7fe93d546d8 CreateProcessW 37569->37573 37571->37569 37572 7fe93d589b2 37571->37572 37572->37567 37573->37572 37686 575cf0 37687 575cfd 37686->37687 37688 575d09 37687->37688 37694 575e1a 37687->37694 37689 575d3e 37688->37689 37690 575d8d 37688->37690 37691 575d66 SetThreadContext 37689->37691 37691->37690 37692 575e41 VirtualProtect FlushInstructionCache 37692->37694 37693 575efe 37695 575f1e 37693->37695 37708 5743e0 VirtualFree 37693->37708 37694->37692 37694->37693 37704 574df0 GetCurrentProcess 37695->37704 37698 575f23 37699 575f77 37698->37699 37700 575f37 ResumeThread 37698->37700 37709 577940 TerminateProcess RtlCaptureContext capture_previous_context __raise_securityfailure _invalid_parameter_noinfo 37699->37709 37701 575f6b 37700->37701 37701->37698 37703 575fbf 37707 574e0c 37704->37707 37705 574e53 37705->37698 37706 574e22 VirtualProtect FlushInstructionCache 37706->37707 37707->37705 37707->37706 37708->37695 37709->37703 37732 7fe93d6ccee 37733 7fe93d6ccfb 37732->37733 37733->37732 37734 7fe93d6cdf8 37733->37734 37736 7fe93d6ce0b 37733->37736 37737 7fe93d546d8 CreateProcessW 37734->37737 37737->37736 37574 7fe93d7001d 37575 7fe93d7004b 37574->37575 37576 7fe93d70139 37575->37576 37577 7fe93d701d6 VirtualAllocEx 37575->37577 37578 7fe93d70226 37577->37578 37738 54273c 37740 54276a 37738->37740 37739 5427ec 37740->37739 37741 5427c5 VirtualAlloc 37740->37741 37741->37739 37579 7fe93d69d99 37580 7fe93d69d3f 37579->37580 37581 7fe93d69dac VirtualProtect 37579->37581 37583 7fe93d69e51 37581->37583 37742 7fe93d6fbf9 37743 7fe93d6fc05 37742->37743 37744 7fe93d6fb9f 37743->37744 37745 7fe93d6fcd1 CreateProcessW 37743->37745 37746 7fe93d6fd32 37745->37746 37584 7fe93d6ec98 37585 7fe93d6ecd2 37584->37585 37587 7fe93d6edc0 37585->37587 37588 7fe93d6ed99 37585->37588 37590 7fe93d6bd38 37585->37590 37588->37587 37589 7fe93d6bd38 4 API calls 37588->37589 37589->37587 37592 7fe93d6f010 37590->37592 37591 7fe93d6f14f 37591->37588 37592->37591 37614 7fe93d5a238 37592->37614 37595 7fe93d6f203 37597 7fe93d6f240 37595->37597 37598 7fe93d6f22b 37595->37598 37596 7fe93d5a238 CreateProcessW 37596->37595 37600 7fe93d5a238 CreateProcessW 37597->37600 37599 7fe93d5a238 CreateProcessW 37598->37599 37601 7fe93d6f234 37599->37601 37600->37601 37602 7fe93d5a258 CreateProcessW 37601->37602 37609 7fe93d6f277 37601->37609 37602->37609 37606 7fe93d6f58a 37606->37588 37607 7fe93d5a238 CreateProcessW 37611 7fe93d6f3d4 37607->37611 37609->37606 37609->37611 37618 7fe93d5a2d8 37609->37618 37622 7fe93d5a258 37609->37622 37626 7fe93d6e460 37609->37626 37611->37606 37611->37607 37611->37609 37612 7fe93d5a258 CreateProcessW 37611->37612 37613 7fe93d6f585 37611->37613 37630 7fe93d6e470 WriteProcessMemory 37611->37630 37631 7fe93d6e480 WriteProcessMemory 37611->37631 37612->37611 37613->37606 37615 7fe93d6f830 37614->37615 37616 7fe93d550f0 CreateProcessW 37615->37616 37617 7fe93d6f1ed 37616->37617 37617->37595 37617->37596 37619 7fe93d6fae0 37618->37619 37620 7fe93d550f0 CreateProcessW 37619->37620 37621 7fe93d6fb7f 37620->37621 37621->37609 37623 7fe93d6f8d0 37622->37623 37624 7fe93d550f0 CreateProcessW 37623->37624 37625 7fe93d6f920 37624->37625 37625->37609 37627 7fe93d6fe40 NtUnmapViewOfSection 37626->37627 37629 7fe93d6feca 37627->37629 37629->37609 37630->37611 37631->37611 37632 7fe93d6aa98 37635 7fe93d6aa9d 37632->37635 37633 7fe93d6ace6 37639 7fe93d6ad67 37633->37639 37646 7fe93d5a3b0 37633->37646 37635->37633 37637 7fe93d6ad65 37635->37637 37635->37639 37636 7fe93d6ae5f 37638 7fe93d5a3b0 CreateProcessW 37637->37638 37638->37639 37639->37636 37640 7fe93d6b25f 37639->37640 37641 7fe93d6b23d 37639->37641 37655 7fe93d54608 37640->37655 37642 7fe93d54608 CreateProcessW 37641->37642 37642->37636 37644 7fe93d6b267 37660 7fe93d5a3c0 37644->37660 37647 7fe93d6b0c0 37646->37647 37648 7fe93d6b25f 37647->37648 37649 7fe93d6b23d 37647->37649 37654 7fe93d6b12c 37647->37654 37651 7fe93d54608 CreateProcessW 37648->37651 37650 7fe93d54608 CreateProcessW 37649->37650 37650->37654 37652 7fe93d6b267 37651->37652 37653 7fe93d5a3c0 CreateProcessW 37652->37653 37653->37654 37654->37639 37656 7fe93d6b410 37655->37656 37656->37644 37657 7fe93d6baa4 37656->37657 37658 7fe93d550f0 CreateProcessW 37656->37658 37657->37644 37659 7fe93d6bb38 37658->37659 37659->37644 37662 7fe93d6b440 37660->37662 37661 7fe93d6baa4 37661->37636 37662->37661 37663 7fe93d550f0 CreateProcessW 37662->37663 37664 7fe93d6bb38 37663->37664 37664->37636 37747 573ab9 37750 573a06 _invalid_parameter_noinfo 37747->37750 37748 573a70 37749 573a56 VirtualQuery 37749->37748 37749->37750 37750->37748 37750->37749 37751 573a8a VirtualAlloc 37750->37751 37751->37748 37752 573abb GetLastError 37751->37752 37752->37748 37752->37750 37665 579dc4 37670 579e08 __vcrt_FlsSetValue 37665->37670 37671 579ecd __vcrt_FlsSetValue 37665->37671 37666 579e36 LoadLibraryExW 37667 579e57 GetLastError 37666->37667 37668 579ead 37666->37668 37667->37670 37669 579ec4 FreeLibrary 37668->37669 37668->37671 37669->37671 37670->37666 37670->37671 37672 579e79 LoadLibraryExW 37670->37672 37672->37668 37672->37670 37753 7fe93d70b6a 37754 7fe93d70b77 37753->37754 37755 7fe93d70b8c ResumeThread 37754->37755 37756 7fe93d70b1f 37754->37756 37760 7fe93d70c14 37755->37760 37757 7fe93d550f0 CreateProcessW 37756->37757 37758 7fe93d70b37 37757->37758 37718 7fe93d708cd 37719 7fe93d708db 37718->37719 37720 7fe93d7087f WriteProcessMemory 37719->37720 37722 7fe93d708ec 37719->37722 37721 7fe93d7089b 37720->37721 37723 7fe93d550f0 CreateProcessW 37722->37723 37724 7fe93d7098f 37723->37724 37761 7fe93d7036d 37762 7fe93d7031f 37761->37762 37763 7fe93d7038c WriteProcessMemory 37761->37763 37764 7fe93d550f0 CreateProcessW 37762->37764 37767 7fe93d70441 37763->37767 37765 7fe93d70337 37764->37765 37768 7fe93d5eded 37769 7fe93d5ed8f 37768->37769 37771 7fe93d5edfc 37768->37771 37770 7fe93d5ef58 37771->37770 37772 7fe93d5ef2a 37771->37772 37773 7fe93d5ef08 37771->37773 37785 7fe93d5a9b0 37772->37785 37777 7fe93d5a9b8 37773->37777 37776 7fe93d5ef28 37782 7fe93d628c0 37777->37782 37779 7fe93d62c95 37780 7fe93d630d0 37779->37780 37781 7fe93d62f19 37779->37781 37804 7fe93d546d8 CreateProcessW 37780->37804 37781->37776 37782->37779 37798 7fe93d5a998 37782->37798 37784 7fe93d630e3 37784->37776 37784->37781 37786 7fe93d5f160 37785->37786 37789 7fe93d5f306 37786->37789 37793 7fe93d5f20f 37786->37793 37788 7fe93d5f384 37791 7fe93d5a990 CreateProcessW 37788->37791 37797 7fe93d5f2e5 37788->37797 37789->37788 37789->37797 37806 7fe93d5a990 37789->37806 37790 7fe93d5a990 CreateProcessW 37790->37793 37795 7fe93d5f3d2 37791->37795 37792 7fe93d5f2b0 37794 7fe93d5a990 CreateProcessW 37792->37794 37792->37797 37793->37790 37793->37792 37793->37797 37794->37797 37796 7fe93d5a9b8 CreateProcessW 37795->37796 37795->37797 37796->37797 37797->37776 37799 7fe93d62fa0 37798->37799 37800 7fe93d630d0 37799->37800 37801 7fe93d62ff3 37799->37801 37805 7fe93d546d8 CreateProcessW 37800->37805 37801->37782 37803 7fe93d630e3 37803->37782 37803->37801 37804->37784 37805->37803 37807 7fe93d5f8d0 37806->37807 37808 7fe93d5f92a 37807->37808 37810 7fe93d5f93f 37807->37810 37812 7fe93d546d8 CreateProcessW 37808->37812 37810->37789 37811 7fe93d5f93d 37811->37810 37812->37811 37673 57554d 37675 575554 37673->37675 37674 5755bb 37675->37674 37676 575637 VirtualProtect 37675->37676 37677 575663 GetLastError 37676->37677 37678 575671 37676->37678 37677->37678 37725 7fe93d6084b 37727 7fe93d60852 37725->37727 37726 7fe93d60947 37727->37726 37728 7fe93d6154f 37727->37728 37731 7fe93d546d8 CreateProcessW 37728->37731 37730 7fe93d61562 37730->37726 37731->37730 37813 7fe93d6bfe8 37814 7fe93d6c000 37813->37814 37819 7fe93d54600 37814->37819 37816 7fe93d6c016 37824 7fe93d54638 37816->37824 37823 7fe93d6cb80 37819->37823 37820 7fe93d58560 CreateProcessW 37822 7fe93d6cce0 37820->37822 37821 7fe93d6cbfd 37821->37816 37822->37816 37823->37820 37823->37821 37825 7fe93d6cc90 37824->37825 37826 7fe93d58560 CreateProcessW 37825->37826 37827 7fe93d6c033 37826->37827 37679 5728c8 37680 57290e 37679->37680 37681 572970 37680->37681 37683 573844 37680->37683 37684 573851 StrCmpNIW 37683->37684 37685 573866 37683->37685 37684->37685 37685->37680

                          Executed Functions

                          Function 00571628 Relevance: 50.9, APIs: 20, Strings: 9, Instructions: 157registrymemoryCOMMON
                          Download Yara Rule

                          Control-flow Graph

                          APIs
                          • GetProcessHeap.KERNEL32 ref: 00571633
                          • HeapAlloc.KERNEL32 ref: 00571642
                            • Part of subcall function 00571268: GetProcessHeap.KERNEL32 ref: 0057126E
                            • Part of subcall function 00571268: HeapAlloc.KERNEL32 ref: 0057127D
                            • Part of subcall function 00571268: GetProcessHeap.KERNEL32 ref: 00571297
                            • Part of subcall function 00571268: HeapAlloc.KERNEL32 ref: 005712A8
                            • Part of subcall function 00571000: GetProcessHeap.KERNEL32 ref: 00571006
                            • Part of subcall function 00571000: HeapAlloc.KERNEL32 ref: 00571015
                            • Part of subcall function 00571000: GetProcessHeap.KERNEL32 ref: 00571028
                            • Part of subcall function 00571000: HeapAlloc.KERNEL32 ref: 00571037
                          • RegOpenKeyExW.ADVAPI32 ref: 005716B2
                          • RegOpenKeyExW.ADVAPI32 ref: 005716DF
                          • RegCloseKey.ADVAPI32 ref: 005716F9
                          • RegOpenKeyExW.ADVAPI32 ref: 00571719
                          • RegCloseKey.ADVAPI32 ref: 00571734
                          • RegOpenKeyExW.ADVAPI32 ref: 00571754
                          • RegCloseKey.ADVAPI32 ref: 0057176F
                          • RegOpenKeyExW.ADVAPI32 ref: 0057178F
                          • RegCloseKey.ADVAPI32 ref: 005717AA
                          • RegOpenKeyExW.ADVAPI32 ref: 005717CA
                          • RegCloseKey.ADVAPI32 ref: 005717E5
                          • RegOpenKeyExW.ADVAPI32 ref: 00571805
                          • RegCloseKey.ADVAPI32 ref: 00571820
                          • RegOpenKeyExW.ADVAPI32 ref: 00571840
                          • RegCloseKey.ADVAPI32 ref: 0057185B
                          • RegOpenKeyExW.ADVAPI32 ref: 0057187B
                          • RegCloseKey.ADVAPI32 ref: 00571896
                          • RegCloseKey.ADVAPI32 ref: 005718A0
                            • Part of subcall function 005712BC: RegQueryInfoKeyW.ADVAPI32 ref: 00571319
                            • Part of subcall function 005712BC: GetProcessHeap.KERNEL32 ref: 00571327
                            • Part of subcall function 005712BC: HeapAlloc.KERNEL32 ref: 00571338
                            • Part of subcall function 005712BC: RegEnumValueW.ADVAPI32 ref: 00571397
                            • Part of subcall function 005712BC: GetProcessHeap.KERNEL32 ref: 005713DF
                            • Part of subcall function 005712BC: HeapAlloc.KERNEL32 ref: 005713ED
                            • Part of subcall function 005712BC: GetProcessHeap.KERNEL32 ref: 0057140A
                            • Part of subcall function 005712BC: HeapFree.KERNEL32 ref: 00571418
                            • Part of subcall function 005712BC: lstrlenW.KERNEL32 ref: 00571421
                            • Part of subcall function 005712BC: GetProcessHeap.KERNEL32 ref: 0057142F
                            • Part of subcall function 005712BC: HeapAlloc.KERNEL32 ref: 0057143D
                          Strings
                          Memory Dump Source
                          • Source File: 00000000.00000002.377736747.0000000000570000.00000040.00001000.00020000.00000000.sdmp, Offset: 00570000, based on PE: true
                          • Associated: 00000000.00000002.377736747.0000000000599000.00000040.00001000.00020000.00000000.sdmpDownload File
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_0_2_570000_mine327.jbxd
                          Similarity
                          • API ID: Heap$CloseOpenProcess$Alloc$EnumFreeInfoQueryValuelstrlen
                          • String ID: SOFTWARE\dialerconfig$paths$pid$process_names$service_names$startup$tcp_local$tcp_remote$udp
                          • API String ID: 2135414181-2879589442
                          • Opcode ID: 84d977f69669bb910c18c90d9c150143eff6fe6f95bc9245a9bd4b5f56132143
                          • Instruction ID: c4ecbee555536d7fe0ececdc798455638bce6deeff431b0a19c930d038b84400
                          • Opcode Fuzzy Hash: 84d977f69669bb910c18c90d9c150143eff6fe6f95bc9245a9bd4b5f56132143
                          • Instruction Fuzzy Hash: 1D71D936710E51C6EB209F66EC9875E27B4FB88B89F409121DE4E57B29EF38C444DB48
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 000007FE93D54670 Relevance: 1.9, Strings: 1, Instructions: 674COMMON
                          Download Yara Rule

                          Control-flow Graph

                          • Executed
                          • Not Executed
                          control_flow_graph 482 7fe93d54670-7fe93d563a1 call 7fe93d56260 489 7fe93d563c4-7fe93d563d3 482->489 490 7fe93d563d5-7fe93d563ef call 7fe93d56260 call 7fe93d562b0 489->490 491 7fe93d563a3-7fe93d563aa call 7fe93d56260 489->491 495 7fe93d563af-7fe93d563b9 call 7fe93d562b0 491->495 500 7fe93d563f0-7fe93d56418 495->500 501 7fe93d563bb-7fe93d563c2 495->501 504 7fe93d5641e-7fe93d56440 500->504 505 7fe93d5641a 500->505 501->489 508 7fe93d56442-7fe93d56447 call 7fe93d55ae8 504->508 509 7fe93d5644c-7fe93d56483 504->509 505->495 507 7fe93d5641c 505->507 507->504 508->509 512 7fe93d5667f-7fe93d566e9 509->512 513 7fe93d56489-7fe93d56494 509->513 543 7fe93d566eb-7fe93d566f1 512->543 544 7fe93d56706-7fe93d56730 512->544 514 7fe93d56508-7fe93d5650d 513->514 515 7fe93d56496-7fe93d564a4 513->515 518 7fe93d56580-7fe93d5658a 514->518 519 7fe93d5650f-7fe93d5651b 514->519 515->512 517 7fe93d564aa-7fe93d564b9 515->517 520 7fe93d564ed-7fe93d564f8 517->520 521 7fe93d564bb-7fe93d564eb 517->521 522 7fe93d565ac-7fe93d565b4 518->522 523 7fe93d5658c-7fe93d56599 call 7fe93d55b08 518->523 519->512 524 7fe93d56521-7fe93d56534 519->524 520->512 527 7fe93d564fe-7fe93d56506 520->527 521->520 533 7fe93d56539-7fe93d5653c 521->533 525 7fe93d565b7-7fe93d565c2 522->525 538 7fe93d5659e-7fe93d565aa 523->538 524->525 525->512 528 7fe93d565c8-7fe93d565d8 525->528 527->514 527->515 528->512 531 7fe93d565de-7fe93d565eb 528->531 531->512 537 7fe93d565f1-7fe93d56611 531->537 535 7fe93d56552-7fe93d5655a 533->535 536 7fe93d5653e-7fe93d5654e 533->536 535->512 539 7fe93d56560-7fe93d5657f 535->539 536->535 537->512 545 7fe93d56613-7fe93d56622 537->545 538->522 547 7fe93d566f3-7fe93d56704 543->547 548 7fe93d56731-7fe93d56785 543->548 550 7fe93d56624-7fe93d5662f 545->550 551 7fe93d5666d-7fe93d5667e 545->551 547->543 547->544 560 7fe93d56799-7fe93d567d1 548->560 561 7fe93d56787-7fe93d56797 548->561 550->551 557 7fe93d56631-7fe93d56668 call 7fe93d55b08 550->557 557->551 567 7fe93d567d3-7fe93d567d9 560->567 568 7fe93d56828-7fe93d5682f 560->568 561->560 561->561 567->568 571 7fe93d567db-7fe93d567dc 567->571 569 7fe93d56872-7fe93d5689b 568->569 570 7fe93d56831-7fe93d56832 568->570 572 7fe93d56835-7fe93d56838 570->572 573 7fe93d567df-7fe93d567e2 571->573 574 7fe93d5689c-7fe93d568b1 572->574 575 7fe93d5683a-7fe93d5684b 572->575 573->574 577 7fe93d567e8-7fe93d567f5 573->577 586 7fe93d568b3-7fe93d568ba 574->586 587 7fe93d568bb-7fe93d568ea 574->587 580 7fe93d5684d-7fe93d56853 575->580 581 7fe93d56869-7fe93d56870 575->581 578 7fe93d56821-7fe93d56826 577->578 579 7fe93d567f7-7fe93d5681e 577->579 578->568 578->573 579->578 580->574 583 7fe93d56855-7fe93d56865 580->583 581->569 581->572 583->581 586->587
                          Strings
                          Memory Dump Source
                          • Source File: 00000000.00000002.398904745.000007FE93D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 000007FE93D50000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_0_2_7fe93d50000_mine327.jbxd
                          Similarity
                          • API ID:
                          • String ID: d
                          • API String ID: 0-2564639436
                          • Opcode ID: 3555a7df1526104fa03d009644220cfb7f7609ee7be1ccc1f0875ac6478005a8
                          • Instruction ID: 62dccd91375b9771500c819afe02b1d1d8554f88df08f907b6111b397f1a9178
                          • Opcode Fuzzy Hash: 3555a7df1526104fa03d009644220cfb7f7609ee7be1ccc1f0875ac6478005a8
                          • Instruction Fuzzy Hash: 6912773090DB494FE749EF28D4916757BE1FF82314F1452A9D48AC71ABEA28F843C792
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 000007FE93D606E0 Relevance: 1.9, Instructions: 1910COMMON
                          Download Yara Rule
                          Memory Dump Source
                          • Source File: 00000000.00000002.398904745.000007FE93D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 000007FE93D50000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_0_2_7fe93d50000_mine327.jbxd
                          Similarity
                          • API ID:
                          • String ID:
                          • API String ID:
                          • Opcode ID: a30ee711671f74f02ce7593753560ceab706e80109544d75cda0e0cbe013cbcd
                          • Instruction ID: 7b40c727f64dd931e2f8d977f97351a187f7bbf68a5c511eb262b5c277a7b524
                          • Opcode Fuzzy Hash: a30ee711671f74f02ce7593753560ceab706e80109544d75cda0e0cbe013cbcd
                          • Instruction Fuzzy Hash: 93D28B3051CB494FE749DB28C4915B9B7E2FB85305F2446BEE48AC72B6DA34F846C782
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 000007FE93D6A3C5 Relevance: 1.8, Instructions: 1772COMMON
                          Download Yara Rule
                          Memory Dump Source
                          • Source File: 00000000.00000002.398904745.000007FE93D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 000007FE93D50000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_0_2_7fe93d50000_mine327.jbxd
                          Similarity
                          • API ID:
                          • String ID:
                          • API String ID:
                          • Opcode ID: 29fc53f4ce46144d2926df153c2eea38e9491b3c2b791e75db271e4d38705545
                          • Instruction ID: ba4d9963f44fb59796a6b834eca70097c197920ac3a4fbdafd17e3c9b61e23e8
                          • Opcode Fuzzy Hash: 29fc53f4ce46144d2926df153c2eea38e9491b3c2b791e75db271e4d38705545
                          • Instruction Fuzzy Hash: C1C23A30A0CA494FE759EB68C4656B977E1FF95305F1005BEE08AC72B2DA34F846C792
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 000007FE93D55EDC Relevance: 1.7, Strings: 1, Instructions: 415COMMON
                          Download Yara Rule
                          Strings
                          Memory Dump Source
                          • Source File: 00000000.00000002.398904745.000007FE93D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 000007FE93D50000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_0_2_7fe93d50000_mine327.jbxd
                          Similarity
                          • API ID:
                          • String ID: fish
                          • API String ID: 0-1064584243
                          • Opcode ID: 024812b7bf569d9c8ff6f314a2c5f154c381cf6b17565d61d90201726fe7bc72
                          • Instruction ID: 2916b2270e41a9f9eaebf3a3fb614f1c98fcf1af33c9217acb976b31b0b77146
                          • Opcode Fuzzy Hash: 024812b7bf569d9c8ff6f314a2c5f154c381cf6b17565d61d90201726fe7bc72
                          • Instruction Fuzzy Hash: 3FC12C30A1CB490FE759EB78846567977E1FF96310F0416BED48BC31A7EE18B8069392
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 000007FE93D6FEF4 Relevance: 1.7, APIs: 1, Instructions: 164COMMON
                          Download Yara Rule
                          Memory Dump Source
                          • Source File: 00000000.00000002.398904745.000007FE93D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 000007FE93D50000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_0_2_7fe93d50000_mine327.jbxd
                          Similarity
                          • API ID:
                          • String ID:
                          • API String ID:
                          • Opcode ID: 344567a8141fecdde2788dd216c8db263490a55db18f5ea4cffe612aca24ac57
                          • Instruction ID: a70e514d79bfe804b26381e86c8e226a51753b5feec0a2e922bc34c88dba16ee
                          • Opcode Fuzzy Hash: 344567a8141fecdde2788dd216c8db263490a55db18f5ea4cffe612aca24ac57
                          • Instruction Fuzzy Hash: 8341283160D6850FE34AD37C5816365BFD2EF96324F1841EBE14DC32F7E96868129351
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 000007FE93D6FE1A Relevance: 1.6, APIs: 1, Instructions: 105nativeCOMMON
                          Download Yara Rule
                          APIs
                          Memory Dump Source
                          • Source File: 00000000.00000002.398904745.000007FE93D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 000007FE93D50000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_0_2_7fe93d50000_mine327.jbxd
                          Similarity
                          • API ID: SectionUnmapView
                          • String ID:
                          • API String ID: 498011366-0
                          • Opcode ID: 81ce4fc838abac559b632104c51d7158ed56b16bd70f8862f9238395784e32f1
                          • Instruction ID: f1abea7b0b693310d2a859d23e2a1137bd2e43afc6c43b321d586bf1b94c3e5d
                          • Opcode Fuzzy Hash: 81ce4fc838abac559b632104c51d7158ed56b16bd70f8862f9238395784e32f1
                          • Instruction Fuzzy Hash: C721D23190CA4C8FEB58DF9CD84A7A97BF5EB96320F04419FD04DC7253D660A806CB92
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 000007FE93D6E460 Relevance: 1.6, APIs: 1, Instructions: 96nativeCOMMON
                          Download Yara Rule
                          APIs
                          Memory Dump Source
                          • Source File: 00000000.00000002.398904745.000007FE93D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 000007FE93D50000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_0_2_7fe93d50000_mine327.jbxd
                          Similarity
                          • API ID: SectionUnmapView
                          • String ID:
                          • API String ID: 498011366-0
                          • Opcode ID: 91aefe6b531e1d5584b587064c7dc9871dd03f1ab070cbd7b282de2df3dc4ddc
                          • Instruction ID: 6aeb88295fa8354993f2b067605490e366c8e526adc1bd19a2f40100f3c4db40
                          • Opcode Fuzzy Hash: 91aefe6b531e1d5584b587064c7dc9871dd03f1ab070cbd7b282de2df3dc4ddc
                          • Instruction Fuzzy Hash: 2C21C431A0CA0C8FEB58DF9CD84A7B97BE5FBA9320F10416ED04DD3252D670A816CB91
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 000007FE93D5A9B8 Relevance: 1.6, Instructions: 1560COMMON
                          Download Yara Rule
                          Memory Dump Source
                          • Source File: 00000000.00000002.398904745.000007FE93D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 000007FE93D50000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_0_2_7fe93d50000_mine327.jbxd
                          Similarity
                          • API ID:
                          • String ID:
                          • API String ID:
                          • Opcode ID: f12b563804436c8e21a38dcdd20565727bc6ec75a3f0655c8505d4eb442e6165
                          • Instruction ID: d4f87258613780aea05b45d826aa3ffd760244db7c4d9f310697986aca8c1692
                          • Opcode Fuzzy Hash: f12b563804436c8e21a38dcdd20565727bc6ec75a3f0655c8505d4eb442e6165
                          • Instruction Fuzzy Hash: D4B2053090DA498FEB99DB68C4A57B87BE1FF59304F2400AAD05EC72B2DA34BC45DB51
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 000007FE93D5DD58 Relevance: 1.4, Instructions: 1426COMMON
                          Download Yara Rule
                          Memory Dump Source
                          • Source File: 00000000.00000002.398904745.000007FE93D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 000007FE93D50000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_0_2_7fe93d50000_mine327.jbxd
                          Similarity
                          • API ID:
                          • String ID:
                          • API String ID:
                          • Opcode ID: 7fe9ef00f5dc98d173bc4a7eb0c200cfff649f37685c1b350168ffc539d9bf55
                          • Instruction ID: 840241e747fbe97d1287e974ca22f260222d00ac37f9112850619a6de57d5192
                          • Opcode Fuzzy Hash: 7fe9ef00f5dc98d173bc4a7eb0c200cfff649f37685c1b350168ffc539d9bf55
                          • Instruction Fuzzy Hash: 87A2583051C74A8FE749DB28C4905B9BBE2FB95301F1446BEE08AC72B6DA38F846D751
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 000007FE93D6220A Relevance: 1.1, Instructions: 1089COMMON
                          Download Yara Rule
                          Memory Dump Source
                          • Source File: 00000000.00000002.398904745.000007FE93D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 000007FE93D50000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_0_2_7fe93d50000_mine327.jbxd
                          Similarity
                          • API ID:
                          • String ID:
                          • API String ID:
                          • Opcode ID: 01ffdfc74f979d19b23c51b62ab7e92ca24dff1fb166ecd35abb9520b85897f8
                          • Instruction ID: f73be5808bd896ed2dd908689f48b7d5ca31033aed0092840a3d33e76f7a5b24
                          • Opcode Fuzzy Hash: 01ffdfc74f979d19b23c51b62ab7e92ca24dff1fb166ecd35abb9520b85897f8
                          • Instruction Fuzzy Hash: FA72BD3051CB494FE359DB28C4616B577E2FB96304F2046BED49AC72B2DA38F846C792
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 000007FE93D5A9B0 Relevance: .9, Instructions: 862COMMON
                          Download Yara Rule
                          Memory Dump Source
                          • Source File: 00000000.00000002.398904745.000007FE93D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 000007FE93D50000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_0_2_7fe93d50000_mine327.jbxd
                          Similarity
                          • API ID:
                          • String ID:
                          • API String ID:
                          • Opcode ID: 69cd54d479df9cefc95dee69bec9ad92152aeae54afd5aef276a8e74555b711a
                          • Instruction ID: fca4e68fc8baba7870752c81c364cbf75bb9ea0ed62c8674337f64e68f93c2d2
                          • Opcode Fuzzy Hash: 69cd54d479df9cefc95dee69bec9ad92152aeae54afd5aef276a8e74555b711a
                          • Instruction Fuzzy Hash: 09420830A0DA498FEB59EB28C4617797BE5FF59301F1401AEE08EC72A6DA24FC42D751
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 000007FE93E50E25 Relevance: .8, Instructions: 846COMMON
                          Download Yara Rule
                          Memory Dump Source
                          • Source File: 00000000.00000002.399788533.000007FE93E50000.00000040.00000800.00020000.00000000.sdmp, Offset: 000007FE93E50000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_0_2_7fe93e50000_mine327.jbxd
                          Similarity
                          • API ID:
                          • String ID:
                          • API String ID:
                          • Opcode ID: 7096ab98f08939a0aaabc5f0408f1bbea631b3db1d7094b749fb5cb9568447d1
                          • Instruction ID: 7fe919f61be1cac2044e76617a558a599d4f552076ebc202155cdae94162f758
                          • Opcode Fuzzy Hash: 7096ab98f08939a0aaabc5f0408f1bbea631b3db1d7094b749fb5cb9568447d1
                          • Instruction Fuzzy Hash: 6B42F53140E7C54FDB53DB388C552A9BFE1EF57204F1902EBD48ACB1A3D6686859C3A2
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 000007FE93D6BD38 Relevance: .7, Instructions: 730COMMON
                          Download Yara Rule
                          Memory Dump Source
                          • Source File: 00000000.00000002.398904745.000007FE93D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 000007FE93D50000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_0_2_7fe93d50000_mine327.jbxd
                          Similarity
                          • API ID: MemoryProcessWrite
                          • String ID:
                          • API String ID: 3559483778-0
                          • Opcode ID: f1857f93a0711f123f3432f55b6c56cc0be8f7c9802c2035df47c2bf795e5e4f
                          • Instruction ID: e5f735cdf9a7e5073d047f8ef34fbb034010ed01b5a8df90a536747568b1eb48
                          • Opcode Fuzzy Hash: f1857f93a0711f123f3432f55b6c56cc0be8f7c9802c2035df47c2bf795e5e4f
                          • Instruction Fuzzy Hash: 56320830A18A4A4FEB48DF58C4617BD73E6FB88304F20516DD46EC32E6DA78B851DB52
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 000007FE93D5FC20 Relevance: .7, Instructions: 687COMMON
                          Download Yara Rule
                          Memory Dump Source
                          • Source File: 00000000.00000002.398904745.000007FE93D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 000007FE93D50000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_0_2_7fe93d50000_mine327.jbxd
                          Similarity
                          • API ID:
                          • String ID:
                          • API String ID:
                          • Opcode ID: 279ca5eff8ec89a5e368ba8e396a4e6f13f67ec6011a8dff6a25a7d0a4c7e884
                          • Instruction ID: 272e5084cc36db5d55a465be59c5d53d7be640cff916e18709a109e1d8bc10a3
                          • Opcode Fuzzy Hash: 279ca5eff8ec89a5e368ba8e396a4e6f13f67ec6011a8dff6a25a7d0a4c7e884
                          • Instruction Fuzzy Hash: 79224630A0DA8A4FE799D77844653757BD2FF89304F2401BE949EC72E7EA18BC059392
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 000007FE93D5D8C9 Relevance: .5, Instructions: 511COMMON
                          Download Yara Rule
                          Memory Dump Source
                          • Source File: 00000000.00000002.398904745.000007FE93D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 000007FE93D50000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_0_2_7fe93d50000_mine327.jbxd
                          Similarity
                          • API ID:
                          • String ID:
                          • API String ID:
                          • Opcode ID: 70dbedba6136dd1b0f2c3043e89947f96ba365f436091d744bfada27acc67088
                          • Instruction ID: ca3f65d985fdec98b2d85457656bdcd8e1613963d605618cefcc2e4389ba45ae
                          • Opcode Fuzzy Hash: 70dbedba6136dd1b0f2c3043e89947f96ba365f436091d744bfada27acc67088
                          • Instruction Fuzzy Hash: 4FF18B3051CB864FE319C72884A12757BE2FB95301F1446BED4CAC72B6DB68B842C7A2
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 000007FE93D6CCEE Relevance: .3, Instructions: 341COMMON
                          Download Yara Rule
                          Memory Dump Source
                          • Source File: 00000000.00000002.398904745.000007FE93D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 000007FE93D50000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_0_2_7fe93d50000_mine327.jbxd
                          Similarity
                          • API ID:
                          • String ID:
                          • API String ID:
                          • Opcode ID: 90bb3505e133d3d97ee71f4fc7a7b17620e2058c49b1e3f4235eade86644fbc5
                          • Instruction ID: 260741a2b451c38a7b62a0fdb55243baebcaa14fcbd97a231d63b26857175a58
                          • Opcode Fuzzy Hash: 90bb3505e133d3d97ee71f4fc7a7b17620e2058c49b1e3f4235eade86644fbc5
                          • Instruction Fuzzy Hash: 47B1493050DA0A8FE759DB28C0646B977E5FB55305F2001BEE05BC32E2DA6AF846D792
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 000007FE93D667DA Relevance: .2, Instructions: 193COMMON
                          Download Yara Rule
                          Memory Dump Source
                          • Source File: 00000000.00000002.398904745.000007FE93D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 000007FE93D50000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_0_2_7fe93d50000_mine327.jbxd
                          Similarity
                          • API ID:
                          • String ID:
                          • API String ID:
                          • Opcode ID: 14edbede121d8b1d7b0febf3dd0fe471398476e091e69f0147d4531fefaa3115
                          • Instruction ID: 73187c7f71078e39cb327a170f2b926957ff488f53eef7d72253242f98a7775e
                          • Opcode Fuzzy Hash: 14edbede121d8b1d7b0febf3dd0fe471398476e091e69f0147d4531fefaa3115
                          • Instruction Fuzzy Hash: B151683160D74D0FD71EDA3888616B53BA6EB82220F1582BFD09BC72E7D924AC078391
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 005728C8 Relevance: .1, Instructions: 64COMMON
                          Download Yara Rule
                          Memory Dump Source
                          • Source File: 00000000.00000002.377736747.0000000000570000.00000040.00001000.00020000.00000000.sdmp, Offset: 00570000, based on PE: true
                          • Associated: 00000000.00000002.377736747.0000000000599000.00000040.00001000.00020000.00000000.sdmpDownload File
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_0_2_570000_mine327.jbxd
                          Similarity
                          • API ID:
                          • String ID:
                          • API String ID:
                          • Opcode ID: ea01328f76c44aa633d3a0b11419896060d1427299ac3f1269e71d0bcd887c61
                          • Instruction ID: 75a7ff90c0153e03e9ee790035400043319597d472311fac39b525df6dc376ed
                          • Opcode Fuzzy Hash: ea01328f76c44aa633d3a0b11419896060d1427299ac3f1269e71d0bcd887c61
                          • Instruction Fuzzy Hash: 62119D36714B559AD324CF17B84062EBBA4F384F94F59812ADF9A43B28DF34D886DB00
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 0057F394 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117libraryloaderCOMMON
                          Download Yara Rule

                          Control-flow Graph

                          • Executed
                          • Not Executed
                          control_flow_graph 51 57f394-57f3e6 52 57f4d7 51->52 53 57f3ec-57f3ef 51->53 56 57f4d9-57f4f5 52->56 54 57f3f1-57f3f4 53->54 55 57f3f9-57f3fc 53->55 54->56 57 57f402-57f411 55->57 58 57f4bc-57f4cf 55->58 59 57f413-57f416 57->59 60 57f421-57f440 LoadLibraryExW 57->60 58->52 61 57f516-57f525 call 586090 59->61 62 57f41c 59->62 63 57f4f6-57f50b 60->63 64 57f446-57f44f GetLastError 60->64 72 57f4b5 61->72 73 57f527-57f54e 61->73 68 57f4a8-57f4af 62->68 63->61 69 57f50d-57f510 FreeLibrary 63->69 66 57f496-57f4a0 64->66 67 57f451-57f468 call 57c928 64->67 66->68 67->66 75 57f46a-57f47e call 57c928 67->75 68->57 68->72 69->61 72->58 73->56 75->66 78 57f480-57f494 LoadLibraryExW 75->78 78->63 78->66
                          APIs
                          Strings
                          Memory Dump Source
                          • Source File: 00000000.00000002.377736747.0000000000570000.00000040.00001000.00020000.00000000.sdmp, Offset: 00570000, based on PE: true
                          • Associated: 00000000.00000002.377736747.0000000000599000.00000040.00001000.00020000.00000000.sdmpDownload File
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_0_2_570000_mine327.jbxd
                          Similarity
                          • API ID: AddressFreeLibraryProc
                          • String ID: api-ms-$ext-ms-
                          • API String ID: 3013587201-537541572
                          • Opcode ID: a0f3cb97d83f084b5c078ea606d329a918e0789490c159543aff3f4a2fa5ff9f
                          • Instruction ID: d8cd877fdf0b9cdee266304a9f707151d39299d74e142816026f6c5a6a38b9cf
                          • Opcode Fuzzy Hash: a0f3cb97d83f084b5c078ea606d329a918e0789490c159543aff3f4a2fa5ff9f
                          • Instruction Fuzzy Hash: BF41F022311E1092EF16CB26BC087572B92FB49BE0F5982399E0E9B744EF3CC445A704
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 00579DC4 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE
                          Download Yara Rule

                          Control-flow Graph

                          • Executed
                          • Not Executed
                          control_flow_graph 79 579dc4-579e02 80 579ef3 79->80 81 579e08-579e0b 79->81 82 579ef5-579f11 80->82 81->82 83 579e11 81->83 84 579e14 83->84 85 579eeb 84->85 86 579e1a-579e29 84->86 85->80 87 579e36-579e55 LoadLibraryExW 86->87 88 579e2b-579e2e 86->88 91 579e57-579e60 GetLastError 87->91 92 579ead-579ec2 87->92 89 579e34 88->89 90 579ecd-579edc call 586090 88->90 95 579ea1-579ea8 89->95 90->85 100 579ede-579ee9 90->100 96 579e62-579e77 call 57c928 91->96 97 579e8f-579e99 91->97 92->90 93 579ec4-579ec7 FreeLibrary 92->93 93->90 95->84 96->97 102 579e79-579e8d LoadLibraryExW 96->102 97->95 100->82 102->92 102->97
                          APIs
                          Strings
                          Memory Dump Source
                          • Source File: 00000000.00000002.377736747.0000000000570000.00000040.00001000.00020000.00000000.sdmp, Offset: 00570000, based on PE: true
                          • Associated: 00000000.00000002.377736747.0000000000599000.00000040.00001000.00020000.00000000.sdmpDownload File
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_0_2_570000_mine327.jbxd
                          Similarity
                          • API ID: Library$Load$AddressErrorFreeLastProc
                          • String ID: api-ms-
                          • API String ID: 2559590344-2084034818
                          • Opcode ID: 1bec38bed2a9dad19cb8167f1bbce1e92081cdd400658c61ccc26499447e47b7
                          • Instruction ID: 9b01cc21bab95aa2086f0c5ff8b8396eb6f23eeda50d6f981bf2cca843899aba
                          • Opcode Fuzzy Hash: 1bec38bed2a9dad19cb8167f1bbce1e92081cdd400658c61ccc26499447e47b7
                          • Instruction Fuzzy Hash: CA310532312F40E1DF12DB42B8047666B98FB48BB0F598A25DD2E4B751EF39C585D720
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 00573790 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 44COMMON
                          Download Yara Rule

                          Control-flow Graph

                          • Executed
                          • Not Executed
                          control_flow_graph 103 573790-5737aa GetModuleHandleW 104 573835-573841 103->104 105 5737b0-5737c0 103->105 106 5737c2-5737ca 105->106 107 5737cc-5737f6 call 586038 VirtualProtectEx 105->107 106->104 106->107 107->104 110 5737f8-573830 call 586038 VirtualProtectEx 107->110 110->104
                          APIs
                          Strings
                          Memory Dump Source
                          • Source File: 00000000.00000002.377736747.0000000000570000.00000040.00001000.00020000.00000000.sdmp, Offset: 00570000, based on PE: true
                          • Associated: 00000000.00000002.377736747.0000000000599000.00000040.00001000.00020000.00000000.sdmpDownload File
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_0_2_570000_mine327.jbxd
                          Similarity
                          • API ID: CurrentProcessProtectVirtual$HandleModule
                          • String ID: wr
                          • API String ID: 1092925422-2678910430
                          • Opcode ID: d5ed198cecc284837a9554765ab7ffb778fa62629811cf0fe5ebc999f83bf42b
                          • Instruction ID: ef7fd244bf42b6ef11783212e63e6bdc826249ac33bcf72a45f2dc7ae47649b3
                          • Opcode Fuzzy Hash: d5ed198cecc284837a9554765ab7ffb778fa62629811cf0fe5ebc999f83bf42b
                          • Instruction Fuzzy Hash: A401696A705B81C2EF149B21F80836A7A74FB88B96F448129EE8D07B55EF3DC605DB04
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 00575B30 Relevance: 9.2, APIs: 6, Instructions: 240threadCOMMON
                          Download Yara Rule

                          Control-flow Graph

                          • Executed
                          • Not Executed
                          control_flow_graph 113 575b30-575b57 114 575b6b-575b76 GetCurrentThreadId 113->114 115 575b59-575b68 113->115 116 575b82-575b89 114->116 117 575b78-575b7d 114->117 115->114 119 575b9b-575baf 116->119 120 575b8b-575b96 call 575960 116->120 118 575faf-575fc6 call 577940 117->118 123 575bbe-575bc4 119->123 120->118 126 575c95-575cb6 123->126 127 575bca-575bd3 123->127 132 575e1f-575e30 call 5774bf 126->132 133 575cbc-575cdc GetThreadContext 126->133 129 575bd5-575c18 call 5785c0 127->129 130 575c1a-575c8d call 574510 call 5744b0 call 574470 127->130 143 575c90 129->143 130->143 147 575e35-575e3b 132->147 136 575ce2-575d03 133->136 137 575e1a 133->137 136->137 146 575d09-575d12 136->146 137->132 143->123 151 575d14-575d25 146->151 152 575d92-575da3 146->152 148 575e41-575e98 VirtualProtect FlushInstructionCache 147->148 149 575efe-575f0e 147->149 153 575e9a-575ea4 148->153 154 575ec9-575ef9 call 5778ac 148->154 158 575f10-575f17 149->158 159 575f1e-575f2a call 574df0 149->159 160 575d27-575d3c 151->160 161 575d8d 151->161 155 575e15 152->155 156 575da5-575dc3 152->156 153->154 162 575ea6-575ec1 call 574390 153->162 154->147 156->155 163 575dc5-575e10 call 573900 call 5774dd 156->163 158->159 165 575f19 call 5743e0 158->165 177 575f2f-575f35 159->177 160->161 167 575d3e-575d88 call 573970 SetThreadContext 160->167 161->155 162->154 163->155 165->159 167->161 178 575f77-575f95 177->178 179 575f37-575f75 ResumeThread call 5778ac 177->179 182 575f97-575fa6 178->182 183 575fa9 178->183 179->177 182->183 183->118
                          APIs
                          • GetCurrentThreadId.KERNEL32 ref: 00575B6B
                          • GetThreadContext.KERNEL32 ref: 00575CD5
                            • Part of subcall function 00575960: GetCurrentThreadId.KERNEL32 ref: 00575964
                          Memory Dump Source
                          • Source File: 00000000.00000002.377736747.0000000000570000.00000040.00001000.00020000.00000000.sdmp, Offset: 00570000, based on PE: true
                          • Associated: 00000000.00000002.377736747.0000000000599000.00000040.00001000.00020000.00000000.sdmpDownload File
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_0_2_570000_mine327.jbxd
                          Similarity
                          • API ID: Thread$Current$Context
                          • String ID:
                          • API String ID: 1666949209-0
                          • Opcode ID: aba7c51250b0bd2785b454d2868164715ffdc60c22b63475f1bba81942d6465a
                          • Instruction ID: dee296f22fc295b98ff09bea1c0ece4cae964aed17c0e7b744583fb56ed38df9
                          • Opcode Fuzzy Hash: aba7c51250b0bd2785b454d2868164715ffdc60c22b63475f1bba81942d6465a
                          • Instruction Fuzzy Hash: CBC18176219F99C2DA309B0AF49435ABBA0F3C8B88F104616EACD47B68DF7CC551DB44
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 005750D0 Relevance: 7.8, APIs: 5, Instructions: 318threadCOMMON
                          Download Yara Rule

                          Control-flow Graph

                          • Executed
                          • Not Executed
                          control_flow_graph 185 5750d0-5750fc 186 5750fe-575106 185->186 187 57510d-575116 185->187 186->187 188 575127-575130 187->188 189 575118-575120 187->189 190 575132-57513a 188->190 191 575141-57514a 188->191 189->188 190->191 192 575156-575161 GetCurrentThreadId 191->192 193 57514c-575151 191->193 195 575163-575168 192->195 196 57516d-575174 192->196 194 5756d3-5756da 193->194 195->194 197 575176-57517c 196->197 198 575181-57518a 196->198 197->194 199 575196-5751a2 198->199 200 57518c-575191 198->200 201 5751a4-5751c9 199->201 202 5751ce-575225 call 5756e0 * 2 199->202 200->194 201->194 207 575227-57522e 202->207 208 57523a-575243 202->208 209 575236 207->209 210 575230 207->210 211 575255-57525e 208->211 212 575245-575252 208->212 214 5752a6-5752aa 209->214 213 5752b0-5752b6 210->213 215 575273-575298 call 577870 211->215 216 575260-575270 211->216 212->211 217 5752e5-5752eb 213->217 218 5752b8-5752d4 call 574390 213->218 214->213 226 57529e 215->226 227 57532d-575342 call 573cc0 215->227 216->215 221 575315-575328 217->221 222 5752ed-57530c call 5778ac 217->222 218->217 228 5752d6-5752de 218->228 221->194 222->221 226->214 232 575344-57534c 227->232 233 575351-57535a 227->233 228->217 232->214 234 57536c-5753ba call 578c60 233->234 235 57535c-575369 233->235 238 5753c2-5753ca 234->238 235->234 239 5754d7-5754df 238->239 240 5753d0-5754bb call 577440 238->240 242 575523-57552b 239->242 243 5754e1-5754f4 call 574590 239->243 252 5754bf-5754ce call 574060 240->252 253 5754bd 240->253 244 575537-575546 242->244 245 57552d-575535 242->245 254 5754f6 243->254 255 5754f8-575521 243->255 250 57554f 244->250 251 575548 244->251 245->244 249 575554-575561 245->249 257 575564-5755b9 call 5785c0 249->257 258 575563 249->258 250->249 251->250 261 5754d2 252->261 262 5754d0 252->262 253->239 254->242 255->239 264 5755bb-5755c3 257->264 265 5755c8-575661 call 574510 call 574470 VirtualProtect 257->265 258->257 261->238 262->239 270 575663-575668 GetLastError 265->270 271 575671-5756d1 265->271 270->271 271->194
                          APIs
                          • GetCurrentThreadId.KERNEL32 ref: 00575156
                          Memory Dump Source
                          • Source File: 00000000.00000002.377736747.0000000000570000.00000040.00001000.00020000.00000000.sdmp, Offset: 00570000, based on PE: true
                          • Associated: 00000000.00000002.377736747.0000000000599000.00000040.00001000.00020000.00000000.sdmpDownload File
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_0_2_570000_mine327.jbxd
                          Similarity
                          • API ID: CurrentThread
                          • String ID:
                          • API String ID: 2882836952-0
                          • Opcode ID: a9eeae0eee8a65d3360f20c0190c6c2044be682fe56af66e10426f66e33a6bd7
                          • Instruction ID: 2ec5c0203ae36fdb74b573b1315847e9d2af4e7f6934b1b211fbf8bd30b7702f
                          • Opcode Fuzzy Hash: a9eeae0eee8a65d3360f20c0190c6c2044be682fe56af66e10426f66e33a6bd7
                          • Instruction Fuzzy Hash: 0CF1B436219B8486DB60CB59F49475ABBA1F3C4B94F104416EB8E87B68EFBCC484DF40
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 005739E0 Relevance: 4.6, APIs: 3, Instructions: 64memoryCOMMON
                          Download Yara Rule

                          Control-flow Graph

                          • Executed
                          • Not Executed
                          control_flow_graph 272 5739e0-573a01 call 573c30 275 573a06-573a10 272->275 276 573a16-573a22 275->276 277 573afa 275->277 278 573a44-573a6e call 578c60 VirtualQuery 276->278 279 573a24-573a30 276->279 280 573afc-573b00 277->280 284 573a75-573a7d 278->284 285 573a70 278->285 279->278 281 573a32-573a42 279->281 281->275 286 573a7f-573a88 284->286 287 573add-573af0 call 573c30 284->287 285->277 286->287 288 573a8a-573ab0 VirtualAlloc 286->288 293 573af5 287->293 290 573ab2-573ab7 288->290 291 573abb-573ac5 GetLastError 288->291 290->280 294 573ac7-573ac9 291->294 295 573acb-573adb 291->295 293->275 294->280 295->293
                          APIs
                          Memory Dump Source
                          • Source File: 00000000.00000002.377736747.0000000000570000.00000040.00001000.00020000.00000000.sdmp, Offset: 00570000, based on PE: true
                          • Associated: 00000000.00000002.377736747.0000000000599000.00000040.00001000.00020000.00000000.sdmpDownload File
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_0_2_570000_mine327.jbxd
                          Similarity
                          • API ID: Virtual$AllocQuery
                          • String ID:
                          • API String ID: 31662377-0
                          • Opcode ID: ad31f8c641c3994e4c662b42b06090e17ab0b09933d29211a4965d6dca603ca4
                          • Instruction ID: 55e396aeec8631656f8bbfd154d91b4b77dbc0ccb4fd401e2e21e41e396bb25f
                          • Opcode Fuzzy Hash: ad31f8c641c3994e4c662b42b06090e17ab0b09933d29211a4965d6dca603ca4
                          • Instruction Fuzzy Hash: 43212622219B8581DB31DB15F45631B6BA4F3887D4F108925F6CD46B68DF7DC780BB04
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 0057328C Relevance: 4.5, APIs: 3, Instructions: 43threadCOMMON
                          Download Yara Rule

                          Control-flow Graph

                          • Executed
                          • Not Executed
                          control_flow_graph 296 57328c-57329b 297 573323-573325 296->297 298 5732a1-5732b6 GetModuleFileNameW 296->298 299 573327 call 5736c8 297->299 300 57332c 297->300 301 57331f-573321 298->301 302 5732b8-5732cd PathFindFileNameW call 573844 298->302 299->300 303 573331-573339 300->303 301->303 302->301 307 5732cf-5732d6 call 573790 302->307 307->301 310 5732d8-5732df 307->310 310->300 311 5732e1-573318 CreateThread call 571d14 310->311 313 57331d 311->313 313->300
                          APIs
                          • GetModuleFileNameW.KERNEL32 ref: 005732AE
                          • PathFindFileNameW.SHLWAPI ref: 005732BD
                            • Part of subcall function 00573844: StrCmpNIW.SHLWAPI ref: 0057385C
                            • Part of subcall function 00573790: GetModuleHandleW.KERNEL32 ref: 0057379E
                            • Part of subcall function 00573790: GetCurrentProcess.KERNEL32 ref: 005737CC
                            • Part of subcall function 00573790: VirtualProtectEx.KERNEL32 ref: 005737EE
                            • Part of subcall function 00573790: GetCurrentProcess.KERNEL32 ref: 00573809
                            • Part of subcall function 00573790: VirtualProtectEx.KERNEL32 ref: 0057382A
                          • CreateThread.KERNEL32 ref: 0057330B
                            • Part of subcall function 00571D14: GetCurrentThread.KERNEL32 ref: 00571D1F
                          Memory Dump Source
                          • Source File: 00000000.00000002.377736747.0000000000570000.00000040.00001000.00020000.00000000.sdmp, Offset: 00570000, based on PE: true
                          • Associated: 00000000.00000002.377736747.0000000000599000.00000040.00001000.00020000.00000000.sdmpDownload File
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_0_2_570000_mine327.jbxd
                          Similarity
                          • API ID: Current$FileModuleNameProcessProtectThreadVirtual$CreateFindHandlePath
                          • String ID:
                          • API String ID: 1683269324-0
                          • Opcode ID: c94412c55dcd243bcd3fbe265bea19663896af10ab27123b85acb7154d5eea14
                          • Instruction ID: d092b5597ae69af24a502869bde255681fdc5e0cfd21854db1a2a96c6f1900c7
                          • Opcode Fuzzy Hash: c94412c55dcd243bcd3fbe265bea19663896af10ab27123b85acb7154d5eea14
                          • Instruction Fuzzy Hash: 9A01D470A25F41D2EB34AB21FD0D76A2B54BB94366F50C928DA4E82560EF7CC348FB40
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 00574DF0 Relevance: 4.5, APIs: 3, Instructions: 23memoryCOMMON
                          Download Yara Rule

                          Control-flow Graph

                          • Executed
                          • Not Executed
                          control_flow_graph 314 574df0-574e0a GetCurrentProcess 315 574e1a-574e20 314->315 316 574e53-574e57 315->316 317 574e22-574e51 VirtualProtect FlushInstructionCache 315->317 318 574e0c-574e15 317->318 318->315
                          APIs
                          • GetCurrentProcess.KERNEL32 ref: 00574DF4
                          • VirtualProtect.KERNEL32 ref: 00574E37
                          • FlushInstructionCache.KERNEL32 ref: 00574E4C
                          Memory Dump Source
                          • Source File: 00000000.00000002.377736747.0000000000570000.00000040.00001000.00020000.00000000.sdmp, Offset: 00570000, based on PE: true
                          • Associated: 00000000.00000002.377736747.0000000000599000.00000040.00001000.00020000.00000000.sdmpDownload File
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_0_2_570000_mine327.jbxd
                          Similarity
                          • API ID: CacheCurrentFlushInstructionProcessProtectVirtual
                          • String ID:
                          • API String ID: 3733156554-0
                          • Opcode ID: efc513032ac2f8104d68ff6d1779eae6f51007478eb3e1ac0120cc0a77f626c8
                          • Instruction ID: 30af28f305ba50babe79490bbf9a594a3844e574a75c6857e97037c3ddeb02d4
                          • Opcode Fuzzy Hash: efc513032ac2f8104d68ff6d1779eae6f51007478eb3e1ac0120cc0a77f626c8
                          • Instruction Fuzzy Hash: AEF0DA66218B48C1C620DB05F45571AAFA5F3CCBE4F188115FA8D47B28CB3DC6909F40
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 00571ABC Relevance: 3.1, APIs: 2, Instructions: 68sleepCOMMON
                          Download Yara Rule

                          Control-flow Graph

                          • Executed
                          • Not Executed
                          control_flow_graph 319 571abc-571acb call 571628 322 571ad2-571aef Sleep SleepEx 319->322 323 571af5-571af8 322->323 324 571baa 322->324 326 571ba1-571ba8 323->326 327 571afe-571b01 323->327 325 571bad-571bb5 call 5718b4 324->325 325->322 326->325 327->326 329 571b07-571b14 call 571598 327->329 333 571b16-571b25 call 571220 329->333 334 571b94 329->334 333->334 339 571b27-571b36 call 571598 333->339 335 571b96-571b98 334->335 335->324 337 571b9a 335->337 337->326 339->334 342 571b38-571b47 call 571598 339->342 342->334 345 571b49-571b58 call 571598 342->345 345->334 348 571b5a-571b69 call 571220 345->348 348->334 351 571b6b-571b7a call 571220 348->351 351->334 354 571b7c-571b8b call 571220 351->354 354->334 357 571b8d-571b92 354->357 357->335
                          APIs
                            • Part of subcall function 00571628: GetProcessHeap.KERNEL32 ref: 00571633
                            • Part of subcall function 00571628: HeapAlloc.KERNEL32 ref: 00571642
                            • Part of subcall function 00571628: RegOpenKeyExW.ADVAPI32 ref: 005716B2
                            • Part of subcall function 00571628: RegOpenKeyExW.ADVAPI32 ref: 005716DF
                            • Part of subcall function 00571628: RegCloseKey.ADVAPI32 ref: 005716F9
                            • Part of subcall function 00571628: RegOpenKeyExW.ADVAPI32 ref: 00571719
                            • Part of subcall function 00571628: RegCloseKey.ADVAPI32 ref: 00571734
                            • Part of subcall function 00571628: RegOpenKeyExW.ADVAPI32 ref: 00571754
                            • Part of subcall function 00571628: RegCloseKey.ADVAPI32 ref: 0057176F
                            • Part of subcall function 00571628: RegOpenKeyExW.ADVAPI32 ref: 0057178F
                            • Part of subcall function 00571628: RegCloseKey.ADVAPI32 ref: 005717AA
                            • Part of subcall function 00571628: RegOpenKeyExW.ADVAPI32 ref: 005717CA
                          • Sleep.KERNEL32 ref: 00571AD7
                          • SleepEx.KERNEL32 ref: 00571ADD
                            • Part of subcall function 00571628: RegCloseKey.ADVAPI32 ref: 005717E5
                            • Part of subcall function 00571628: RegOpenKeyExW.ADVAPI32 ref: 00571805
                            • Part of subcall function 00571628: RegCloseKey.ADVAPI32 ref: 00571820
                            • Part of subcall function 00571628: RegOpenKeyExW.ADVAPI32 ref: 00571840
                            • Part of subcall function 00571628: RegCloseKey.ADVAPI32 ref: 0057185B
                            • Part of subcall function 00571628: RegOpenKeyExW.ADVAPI32 ref: 0057187B
                            • Part of subcall function 00571628: RegCloseKey.ADVAPI32 ref: 00571896
                            • Part of subcall function 00571628: RegCloseKey.ADVAPI32 ref: 005718A0
                          Memory Dump Source
                          • Source File: 00000000.00000002.377736747.0000000000570000.00000040.00001000.00020000.00000000.sdmp, Offset: 00570000, based on PE: true
                          • Associated: 00000000.00000002.377736747.0000000000599000.00000040.00001000.00020000.00000000.sdmpDownload File
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_0_2_570000_mine327.jbxd
                          Similarity
                          • API ID: CloseOpen$HeapSleep$AllocProcess
                          • String ID:
                          • API String ID: 1534210851-0
                          • Opcode ID: ad614115fa5d2181ccf7742c52f053f5bbac07b16a2f1961ccdf1ed8f9939afa
                          • Instruction ID: ee191dcd9d2b5b296c029d72443a9ffecab87fa41338a09fe3bb7363838c5855
                          • Opcode Fuzzy Hash: ad614115fa5d2181ccf7742c52f053f5bbac07b16a2f1961ccdf1ed8f9939afa
                          • Instruction Fuzzy Hash: 6121FA75210E42D2DF14AB2EFA4936A2BA4BBC8BC0F08D4219E0E87755FF24C851E718
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 000007FE93E5026B Relevance: 2.3, Strings: 1, Instructions: 1016COMMON
                          Download Yara Rule

                          Control-flow Graph

                          • Executed
                          • Not Executed
                          control_flow_graph 358 7fe93e5026b-7fe93e5026d 359 7fe93e5026e-7fe93e5027c 358->359 360 7fe93e503b1-7fe93e503b7 358->360 361 7fe93e50284-7fe93e50286 359->361 365 7fe93e503b9-7fe93e503c8 360->365 363 7fe93e502f7-7fe93e50306 361->363 364 7fe93e50288-7fe93e50289 361->364 366 7fe93e50307-7fe93e50309 363->366 367 7fe93e5024f-7fe93e5026a 364->367 368 7fe93e5028b 364->368 369 7fe93e503c9-7fe93e50427 365->369 366->360 373 7fe93e5030a-7fe93e50348 366->373 367->358 368->366 370 7fe93e5028d 368->370 371 7fe93e5045c-7fe93e50474 369->371 372 7fe93e50429-7fe93e50440 369->372 374 7fe93e502d4 370->374 375 7fe93e5028f-7fe93e502b8 370->375 376 7fe93e50442-7fe93e50457 372->376 377 7fe93e504b1-7fe93e504e7 372->377 373->365 398 7fe93e5034a-7fe93e5034d 373->398 374->360 380 7fe93e502da-7fe93e502f4 374->380 375->360 387 7fe93e502be-7fe93e502d1 375->387 376->371 381 7fe93e5051c-7fe93e50534 377->381 382 7fe93e504e9-7fe93e50500 377->382 380->363 385 7fe93e50502-7fe93e50517 382->385 386 7fe93e50571-7fe93e50590 382->386 385->381 389 7fe93e50592-7fe93e50596 386->389 390 7fe93e50597-7fe93e505a7 386->390 387->374 389->390 392 7fe93e505dc-7fe93e505f4 390->392 393 7fe93e505a9-7fe93e505c0 390->393 395 7fe93e505c2-7fe93e505d7 393->395 396 7fe93e50631-7fe93e50668 393->396 395->392 399 7fe93e5066a-7fe93e5067a 396->399 400 7fe93e5069d-7fe93e506a8 396->400 398->369 401 7fe93e5034f 398->401 402 7fe93e506eb-7fe93e506f8 399->402 403 7fe93e5067c-7fe93e5067e 399->403 404 7fe93e506aa-7fe93e506b5 400->404 405 7fe93e506bc-7fe93e506c5 400->405 407 7fe93e50351-7fe93e50395 401->407 408 7fe93e50396-7fe93e503b0 401->408 406 7fe93e506fa-7fe93e5073c 402->406 403->406 409 7fe93e50680 403->409 404->405 410 7fe93e506c6-7fe93e506c7 405->410 411 7fe93e5073e-7fe93e50772 406->411 412 7fe93e50786-7fe93e5078b 406->412 407->408 409->410 413 7fe93e50682-7fe93e5069c 409->413 414 7fe93e50a42-7fe93e50a56 411->414 415 7fe93e50778-7fe93e50785 411->415 412->414 416 7fe93e5078c-7fe93e5079e 412->416 413->400 424 7fe93e50a57-7fe93e50ab7 414->424 415->412 419 7fe93e5079f-7fe93e507bd 416->419 419->414 425 7fe93e507c3-7fe93e507d6 419->425 426 7fe93e50aec-7fe93e50b04 424->426 427 7fe93e50ab9-7fe93e50ad0 424->427 436 7fe93e50847-7fe93e50856 425->436 437 7fe93e507d8-7fe93e507d9 425->437 428 7fe93e50b41-7fe93e50b77 426->428 427->428 429 7fe93e50ad2-7fe93e50ae7 427->429 430 7fe93e50bac-7fe93e50bc4 428->430 431 7fe93e50b79-7fe93e50b90 428->431 429->426 434 7fe93e50b92-7fe93e50bc4 431->434 435 7fe93e50c01-7fe93e50c37 431->435 439 7fe93e50c6c-7fe93e50c84 435->439 440 7fe93e50c39-7fe93e50c50 435->440 438 7fe93e50857-7fe93e50859 436->438 437->419 442 7fe93e507db 437->442 438->414 443 7fe93e5085a-7fe93e50872 438->443 444 7fe93e50c52-7fe93e50c84 440->444 445 7fe93e50cc1-7fe93e50cfe 440->445 442->438 446 7fe93e507dd 442->446 456 7fe93e50874-7fe93e50877 443->456 457 7fe93e508e3-7fe93e508f0 443->457 450 7fe93e50824 446->450 451 7fe93e507df-7fe93e50808 446->451 450->414 452 7fe93e5082a-7fe93e50844 450->452 451->414 459 7fe93e5080e-7fe93e50821 451->459 452->436 460 7fe93e508f3 456->460 461 7fe93e50879 456->461 457->460 459->450 460->414 462 7fe93e508f9-7fe93e5090c 460->462 463 7fe93e508c0 461->463 464 7fe93e5087b-7fe93e508a2 461->464 469 7fe93e5090e-7fe93e50912 462->469 470 7fe93e5097d-7fe93e50990 462->470 465 7fe93e508c2 463->465 466 7fe93e508c3-7fe93e508de 463->466 464->414 471 7fe93e508a8-7fe93e508be 464->471 465->466 466->457 472 7fe93e50914 469->472 473 7fe93e50993 469->473 470->473 471->414 471->463 475 7fe93e50974-7fe93e5097c 472->475 473->414 474 7fe93e50999-7fe93e509e6 473->474 474->424 479 7fe93e509e8-7fe93e509ed 474->479 475->470 479->475 481 7fe93e509ef 479->481 481->414
                          Strings
                          Memory Dump Source
                          • Source File: 00000000.00000002.399788533.000007FE93E50000.00000040.00000800.00020000.00000000.sdmp, Offset: 000007FE93E50000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_0_2_7fe93e50000_mine327.jbxd
                          Similarity
                          • API ID:
                          • String ID: A
                          • API String ID: 0-3554254475
                          • Opcode ID: a23a1b71da440ad9989a09b18765fa44db9d6ccf6d3658b7513d27470442c01f
                          • Instruction ID: cc48985043bdaff12cd6692538c78ec12febf24484e16fa2e589fa1b522c1495
                          • Opcode Fuzzy Hash: a23a1b71da440ad9989a09b18765fa44db9d6ccf6d3658b7513d27470442c01f
                          • Instruction Fuzzy Hash: 0E62163040D7CA4FDB53DB2888556A9BFE0FF57304F1906EAD08ACB1A3D6646C5AC752
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 000007FE93D7001D Relevance: 1.8, APIs: 1, Instructions: 270memoryCOMMON
                          Download Yara Rule

                          Control-flow Graph

                          • Executed
                          • Not Executed
                          control_flow_graph 1198 7fe93d7001d-7fe93d70049 1199 7fe93d70093-7fe93d700bc call 7fe93d5ce30 1198->1199 1200 7fe93d7004b-7fe93d70076 1198->1200 1208 7fe93d700be-7fe93d700f5 1199->1208 1209 7fe93d700f7-7fe93d70103 1199->1209 1201 7fe93d70154-7fe93d7015a 1200->1201 1202 7fe93d7007c-7fe93d7008f 1200->1202 1207 7fe93d7015c-7fe93d7017a 1201->1207 1202->1199 1210 7fe93d7010f-7fe93d7011c 1207->1210 1211 7fe93d7017c-7fe93d70188 1207->1211 1222 7fe93d70128-7fe93d70130 1208->1222 1209->1207 1213 7fe93d70105-7fe93d70108 1209->1213 1214 7fe93d7011e-7fe93d70123 1210->1214 1215 7fe93d7018d-7fe93d701a0 1210->1215 1216 7fe93d70189-7fe93d7018c 1211->1216 1213->1216 1217 7fe93d7010a-7fe93d7010d 1213->1217 1219 7fe93d70125-7fe93d70126 1214->1219 1220 7fe93d701a4-7fe93d701b7 1214->1220 1218 7fe93d701a1-7fe93d701a3 1215->1218 1216->1215 1217->1210 1218->1220 1219->1222 1226 7fe93d701b8-7fe93d70224 VirtualAllocEx 1220->1226 1222->1218 1224 7fe93d70132-7fe93d70137 1222->1224 1224->1226 1227 7fe93d70139-7fe93d70153 call 7fe93d590e0 1224->1227 1231 7fe93d7022c-7fe93d70249 1226->1231 1232 7fe93d70226 1226->1232 1232->1231
                          APIs
                          Memory Dump Source
                          • Source File: 00000000.00000002.398904745.000007FE93D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 000007FE93D50000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_0_2_7fe93d50000_mine327.jbxd
                          Similarity
                          • API ID: AllocVirtual
                          • String ID:
                          • API String ID: 4275171209-0
                          • Opcode ID: 2064ac2d883735744c349bce5470637308bfee638960f9b3319cfab47925dcb4
                          • Instruction ID: 269d5484fe4053547368117d9eb973c140665ddab6e579c0155a1659aa4d1bc9
                          • Opcode Fuzzy Hash: 2064ac2d883735744c349bce5470637308bfee638960f9b3319cfab47925dcb4
                          • Instruction Fuzzy Hash: 63816C7090C7894FE759DB68C8566E5BBE1FB96310F10017ED08AC32A2DA74B846C7D2
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 000007FE93D6E380 Relevance: 1.8, APIs: 1, Instructions: 256processCOMMON
                          Download Yara Rule

                          Control-flow Graph

                          • Executed
                          • Not Executed
                          control_flow_graph 1233 7fe93d6e380-7fe93d6e441 1248 7fe93d6e4a3 1233->1248 1249 7fe93d6e439-7fe93d6e441 1248->1249 1250 7fe93d6e4a6-7fe93d6fc8c 1248->1250 1249->1248 1254 7fe93d6fc8e-7fe93d6fc93 1250->1254 1255 7fe93d6fc96-7fe93d6fc9b 1250->1255 1254->1255 1256 7fe93d6fca5-7fe93d6fcc7 1255->1256 1257 7fe93d6fc9d-7fe93d6fca2 1255->1257 1258 7fe93d6fcd1-7fe93d6fd30 CreateProcessW 1256->1258 1259 7fe93d6fcc9-7fe93d6fcce 1256->1259 1257->1256 1260 7fe93d6fd32 1258->1260 1261 7fe93d6fd38-7fe93d6fd65 1258->1261 1259->1258 1260->1261
                          APIs
                          Memory Dump Source
                          • Source File: 00000000.00000002.398904745.000007FE93D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 000007FE93D50000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_0_2_7fe93d50000_mine327.jbxd
                          Similarity
                          • API ID: CreateProcess
                          • String ID:
                          • API String ID: 963392458-0
                          • Opcode ID: b34746958bfb76cb59ff3b2c894f92830ff938fecdd7942092c6494549aa35af
                          • Instruction ID: fd2c9d1facdd9ffac79b72ea36c2cc97635924d36ecb1aad348efb1a185ce0f0
                          • Opcode Fuzzy Hash: b34746958bfb76cb59ff3b2c894f92830ff938fecdd7942092c6494549aa35af
                          • Instruction Fuzzy Hash: B771293280C7698FE754EB5CE8957FE7BE1EF95328F0401AFE089C3162EA24A445D791
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 000007FE93D6E341 Relevance: 1.7, APIs: 1, Instructions: 245processCOMMON
                          Download Yara Rule

                          Control-flow Graph

                          • Executed
                          • Not Executed
                          control_flow_graph 1262 7fe93d6e341-7fe93d6e441 1275 7fe93d6e4a3 1262->1275 1276 7fe93d6e439-7fe93d6e441 1275->1276 1277 7fe93d6e4a6-7fe93d6fc8c 1275->1277 1276->1275 1281 7fe93d6fc8e-7fe93d6fc93 1277->1281 1282 7fe93d6fc96-7fe93d6fc9b 1277->1282 1281->1282 1283 7fe93d6fca5-7fe93d6fcc7 1282->1283 1284 7fe93d6fc9d-7fe93d6fca2 1282->1284 1285 7fe93d6fcd1-7fe93d6fd30 CreateProcessW 1283->1285 1286 7fe93d6fcc9-7fe93d6fcce 1283->1286 1284->1283 1287 7fe93d6fd32 1285->1287 1288 7fe93d6fd38-7fe93d6fd65 1285->1288 1286->1285 1287->1288
                          APIs
                          Memory Dump Source
                          • Source File: 00000000.00000002.398904745.000007FE93D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 000007FE93D50000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_0_2_7fe93d50000_mine327.jbxd
                          Similarity
                          • API ID: CreateProcess
                          • String ID:
                          • API String ID: 963392458-0
                          • Opcode ID: 0faacaf8784db3d465f2e8e8e5559d1450236db08f892d58649e25171a13e606
                          • Instruction ID: 01f93ead0e82fb1d4dd830374841285180649ba302f651dd241dce7e9d7edb33
                          • Opcode Fuzzy Hash: 0faacaf8784db3d465f2e8e8e5559d1450236db08f892d58649e25171a13e606
                          • Instruction Fuzzy Hash: 1661273280CB688FE754EB5CE8457FA7BE1EF95324F04016FE049D3162EA24A845D791
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 000007FE93D6E347 Relevance: 1.7, APIs: 1, Instructions: 245COMMON
                          Download Yara Rule
                          Memory Dump Source
                          • Source File: 00000000.00000002.398904745.000007FE93D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 000007FE93D50000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_0_2_7fe93d50000_mine327.jbxd
                          Similarity
                          • API ID:
                          • String ID:
                          • API String ID:
                          • Opcode ID: 131f4f5549b196358b45ee28dd11b2203d44fbb992b7dfaa24baeb8575f4ee05
                          • Instruction ID: 242a53c79569b15747f1f57480726f0b9f4e4bd0537c4ead8b7ed1829b134bf8
                          • Opcode Fuzzy Hash: 131f4f5549b196358b45ee28dd11b2203d44fbb992b7dfaa24baeb8575f4ee05
                          • Instruction Fuzzy Hash: 3861173280CB588FE754EB5CE8457FA7BE1EB95324F04426FE049D3262EA34A845D791
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 000007FE93D6FBB5 Relevance: 1.7, APIs: 1, Instructions: 232COMMON
                          Download Yara Rule
                          Memory Dump Source
                          • Source File: 00000000.00000002.398904745.000007FE93D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 000007FE93D50000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_0_2_7fe93d50000_mine327.jbxd
                          Similarity
                          • API ID:
                          • String ID:
                          • API String ID:
                          • Opcode ID: 80a60593f1356bbf6895619a078d3dbde9d56d62779a30c7c83340f967084713
                          • Instruction ID: 4733a453b0626eec789bb15d5655194d942648f992d0e33fdaa6e184bff8e92b
                          • Opcode Fuzzy Hash: 80a60593f1356bbf6895619a078d3dbde9d56d62779a30c7c83340f967084713
                          • Instruction Fuzzy Hash: 0561463190CA8D4FEB59DB6C94103B9BBE1FB99310F1442AFE48DD32A2DA74B841C781
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 000007FE93D6E4E0 Relevance: 1.7, APIs: 1, Instructions: 209threadCOMMON
                          Download Yara Rule
                          APIs
                          Memory Dump Source
                          • Source File: 00000000.00000002.398904745.000007FE93D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 000007FE93D50000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_0_2_7fe93d50000_mine327.jbxd
                          Similarity
                          • API ID: ResumeThread
                          • String ID:
                          • API String ID: 947044025-0
                          • Opcode ID: 393eebccb16575583c55d2cdb1d1b19378b9fb05f027fa64718ec58c5e5778b8
                          • Instruction ID: ae64c3e52e7d5d5a78b258499a880b6599f63dfea04637d1bc67a68c158a1da3
                          • Opcode Fuzzy Hash: 393eebccb16575583c55d2cdb1d1b19378b9fb05f027fa64718ec58c5e5778b8
                          • Instruction Fuzzy Hash: DC51E53090CA4C8FEB58EF5CC845BF9BBE1EB95325F14416FD04AD31A2D660A856CB91
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 000007FE93D6FBF9 Relevance: 1.7, APIs: 1, Instructions: 174processCOMMON
                          Download Yara Rule
                          APIs
                          Memory Dump Source
                          • Source File: 00000000.00000002.398904745.000007FE93D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 000007FE93D50000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_0_2_7fe93d50000_mine327.jbxd
                          Similarity
                          • API ID: CreateProcess
                          • String ID:
                          • API String ID: 963392458-0
                          • Opcode ID: 712568a6a3e61b5f967e2ff9fcba1cabd0c7cd0e831b358534b75ee70b0a0c96
                          • Instruction ID: 9660ffbdf4944b5431540915c90d186278a94acc32ba2c2a368a0cd108ed12d9
                          • Opcode Fuzzy Hash: 712568a6a3e61b5f967e2ff9fcba1cabd0c7cd0e831b358534b75ee70b0a0c96
                          • Instruction Fuzzy Hash: DB51D23180CB4C8FDB59DB5C84447A9BBF1FBA9321F05426FE489D3262DB74A8458B81
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 000007FE93D7036D Relevance: 1.7, APIs: 1, Instructions: 171injectionCOMMON
                          Download Yara Rule
                          APIs
                          Memory Dump Source
                          • Source File: 00000000.00000002.398904745.000007FE93D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 000007FE93D50000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_0_2_7fe93d50000_mine327.jbxd
                          Similarity
                          • API ID: MemoryProcessWrite
                          • String ID:
                          • API String ID: 3559483778-0
                          • Opcode ID: eb554e22c3eec0565e4ef08510ae6df7c51159d8ff8f4ef3bd1802142b53f7a3
                          • Instruction ID: 66ce12bcbda062ce6737ca132e4004aad3a136b67ad7e746857a1100e92e4a8d
                          • Opcode Fuzzy Hash: eb554e22c3eec0565e4ef08510ae6df7c51159d8ff8f4ef3bd1802142b53f7a3
                          • Instruction Fuzzy Hash: E0415B3190C7884FDB19DB6C98067B97FE1EF9A321F1442AFE089C3193DA746846C792
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 000007FE93D707B6 Relevance: 1.7, APIs: 1, Instructions: 169injectionCOMMON
                          Download Yara Rule
                          APIs
                          Memory Dump Source
                          • Source File: 00000000.00000002.398904745.000007FE93D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 000007FE93D50000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_0_2_7fe93d50000_mine327.jbxd
                          Similarity
                          • API ID: MemoryProcessWrite
                          • String ID:
                          • API String ID: 3559483778-0
                          • Opcode ID: 7410467a8ea2e77ad5bea53c8d46df1f21bf53e0579209cecf185df8d3049e33
                          • Instruction ID: f0fac43fcd380b2ff35d39b861e92b23607302da1af84e403228fe4f82538ddc
                          • Opcode Fuzzy Hash: 7410467a8ea2e77ad5bea53c8d46df1f21bf53e0579209cecf185df8d3049e33
                          • Instruction Fuzzy Hash: 4341163090DB484FEB44DB5C98467B9BBE1FB99711F0041AFE08DD32A3CA74A805C792
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 000007FE93D69D99 Relevance: 1.7, APIs: 1, Instructions: 166memoryCOMMON
                          Download Yara Rule
                          APIs
                          Memory Dump Source
                          • Source File: 00000000.00000002.398904745.000007FE93D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 000007FE93D50000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_0_2_7fe93d50000_mine327.jbxd
                          Similarity
                          • API ID: ProtectVirtual
                          • String ID:
                          • API String ID: 544645111-0
                          • Opcode ID: 3cdf5795ffe8500b0e7be129d7cc6f1948886de93d5e6cd6c684450119429b9d
                          • Instruction ID: c1a39004ad3119013335696c555d5c8f61eb558dbe7c3b29ce7dfe80aff1d77d
                          • Opcode Fuzzy Hash: 3cdf5795ffe8500b0e7be129d7cc6f1948886de93d5e6cd6c684450119429b9d
                          • Instruction Fuzzy Hash: F241F83090DB5C4FDB09DBAC98456F9BFE1EB9A321F0442AFD049C31A3DB646856C791
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 000007FE93D708CD Relevance: 1.6, APIs: 1, Instructions: 143COMMON
                          Download Yara Rule
                          Memory Dump Source
                          • Source File: 00000000.00000002.398904745.000007FE93D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 000007FE93D50000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_0_2_7fe93d50000_mine327.jbxd
                          Similarity
                          • API ID:
                          • String ID:
                          • API String ID:
                          • Opcode ID: baa880d50d759ca74265aac4e630003bbb4531cc8bcab72dd7259783e477eadd
                          • Instruction ID: ac5af0fc71337508ea9680f0896ecbede1e661974b6e858753464732d8a6a64f
                          • Opcode Fuzzy Hash: baa880d50d759ca74265aac4e630003bbb4531cc8bcab72dd7259783e477eadd
                          • Instruction Fuzzy Hash: D441243160D6850FE70AA77C58252B57FD2EF86225F1841EFE09DC32E3D968A8529392
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 000007FE93D70B6A Relevance: 1.6, APIs: 1, Instructions: 139threadCOMMON
                          Download Yara Rule
                          APIs
                          Memory Dump Source
                          • Source File: 00000000.00000002.398904745.000007FE93D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 000007FE93D50000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_0_2_7fe93d50000_mine327.jbxd
                          Similarity
                          • API ID: ResumeThread
                          • String ID:
                          • API String ID: 947044025-0
                          • Opcode ID: 516de3a994b731dd93c5faab820a90a4b593c52e1605ebdd0b03dd2ba67b94d5
                          • Instruction ID: 1c72cb088d4f09ee021634976114229786cbca7391796e8f02b2dd15a47d9df7
                          • Opcode Fuzzy Hash: 516de3a994b731dd93c5faab820a90a4b593c52e1605ebdd0b03dd2ba67b94d5
                          • Instruction Fuzzy Hash: 17414730A0CA4C8FDB59DB6CD849BB9BBE1EF96320F04416FD04EC31A2D764A856C791
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 000007FE93D6E480 Relevance: 1.6, APIs: 1, Instructions: 129injectionCOMMON
                          Download Yara Rule
                          APIs
                          Memory Dump Source
                          • Source File: 00000000.00000002.398904745.000007FE93D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 000007FE93D50000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_0_2_7fe93d50000_mine327.jbxd
                          Similarity
                          • API ID: MemoryProcessWrite
                          • String ID:
                          • API String ID: 3559483778-0
                          • Opcode ID: 5fa0d2c77957350101cfba318fd0f24c6b7f8a3588546e9e48b4e8687495a80c
                          • Instruction ID: 3cae8c9096b2984ebede7b73254ed7dff067f307657ef4192af87b78d178f25c
                          • Opcode Fuzzy Hash: 5fa0d2c77957350101cfba318fd0f24c6b7f8a3588546e9e48b4e8687495a80c
                          • Instruction Fuzzy Hash: D231B27091CB088FDB58DF9CD8457B9BBE5FB99711F00426EE08AD3252CB70A8058B92
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 000007FE93D70A9C Relevance: 1.6, APIs: 1, Instructions: 125COMMON
                          Download Yara Rule
                          Memory Dump Source
                          • Source File: 00000000.00000002.398904745.000007FE93D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 000007FE93D50000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_0_2_7fe93d50000_mine327.jbxd
                          Similarity
                          • API ID:
                          • String ID:
                          • API String ID:
                          • Opcode ID: 9d0394e2d085f2d66ac43a38f8d02691c29b28a16e6779d288bd8690551abb29
                          • Instruction ID: bb7de90a1e7bab2c279f1a25008f66149d0ba8d0c135281b4166cabb5c678857
                          • Opcode Fuzzy Hash: 9d0394e2d085f2d66ac43a38f8d02691c29b28a16e6779d288bd8690551abb29
                          • Instruction Fuzzy Hash: 9431573060D7894FE746D77D48553A57FD2EF86224F1840EBD08DC72E7DA28A85983A2
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 000007FE93D6E4B0 Relevance: 1.6, APIs: 1, Instructions: 125memoryCOMMON
                          Download Yara Rule
                          APIs
                          Memory Dump Source
                          • Source File: 00000000.00000002.398904745.000007FE93D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 000007FE93D50000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_0_2_7fe93d50000_mine327.jbxd
                          Similarity
                          • API ID: AllocVirtual
                          • String ID:
                          • API String ID: 4275171209-0
                          • Opcode ID: 1ca01c9c33252e61c3a437bd652cc83ed5e54469ea8a724df752577ba56b1ab7
                          • Instruction ID: 59e8b2a4c921093e347116b265f8e141312bc7032e73b2bf9eaf7d3cdb5c9458
                          • Opcode Fuzzy Hash: 1ca01c9c33252e61c3a437bd652cc83ed5e54469ea8a724df752577ba56b1ab7
                          • Instruction Fuzzy Hash: 4A31F83190CA4C8FEB09EB5CD8466F97BE1FB9A325F10426FD08AD3263D6606846C791
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 000007FE93D5B4C5 Relevance: 1.6, APIs: 1, Instructions: 124memoryCOMMON
                          Download Yara Rule
                          APIs
                          Memory Dump Source
                          • Source File: 00000000.00000002.398904745.000007FE93D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 000007FE93D50000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_0_2_7fe93d50000_mine327.jbxd
                          Similarity
                          • API ID: ProtectVirtual
                          • String ID:
                          • API String ID: 544645111-0
                          • Opcode ID: 8559b52fa18ef52d91c4f45c757f28a304ea44a0c028e8052bfd5566705b0fd2
                          • Instruction ID: d2849d0ddb186bf77839ea65fafd5ac757cc206f133027e24f695d296e8afee2
                          • Opcode Fuzzy Hash: 8559b52fa18ef52d91c4f45c757f28a304ea44a0c028e8052bfd5566705b0fd2
                          • Instruction Fuzzy Hash: 7731F630A0CA5C4FDB08DB5CD8496FD7BE1EB95321F10426FE04AD3292DB716856CB91
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 000007FE93D6E470 Relevance: 1.6, APIs: 1, Instructions: 120injectionCOMMON
                          Download Yara Rule
                          APIs
                          Memory Dump Source
                          • Source File: 00000000.00000002.398904745.000007FE93D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 000007FE93D50000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_0_2_7fe93d50000_mine327.jbxd
                          Similarity
                          • API ID: MemoryProcessWrite
                          • String ID:
                          • API String ID: 3559483778-0
                          • Opcode ID: 5ed355490d9a36ec0193f1cbc952e478f4447388094c1ad195ad8cb465067c6f
                          • Instruction ID: f1a325d1231d56c5fb64bd7b86a22eb4ea6e05645dc61ea2ae4c654a4e605e24
                          • Opcode Fuzzy Hash: 5ed355490d9a36ec0193f1cbc952e478f4447388094c1ad195ad8cb465067c6f
                          • Instruction Fuzzy Hash: 3F31B27191CB488FDB08DF5CD8466B97BE5FB99715F10422FE04AD3292DB70A806CB92
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 000007FE93D6E510 Relevance: 1.6, APIs: 1, Instructions: 114threadinjectionCOMMON
                          Download Yara Rule
                          APIs
                          Memory Dump Source
                          • Source File: 00000000.00000002.398904745.000007FE93D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 000007FE93D50000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_0_2_7fe93d50000_mine327.jbxd
                          Similarity
                          • API ID: ContextThread
                          • String ID:
                          • API String ID: 1591575202-0
                          • Opcode ID: 14f4537eb1c84401b061f08724a922d9f8b63ba9a2217e196344f9cdf44905d2
                          • Instruction ID: 60b5e8ad41fb930e117d3793e2f96e01480cd8276b95c2e17d2a39a326882aac
                          • Opcode Fuzzy Hash: 14f4537eb1c84401b061f08724a922d9f8b63ba9a2217e196344f9cdf44905d2
                          • Instruction Fuzzy Hash: 8B31263090C64C8FEB48DF5CD846BF97BE1EB96320F1441AFD049C72A3D660A846CBA1
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 000007FE93D709C5 Relevance: 1.6, APIs: 1, Instructions: 104threadinjectionCOMMON
                          Download Yara Rule
                          APIs
                          Memory Dump Source
                          • Source File: 00000000.00000002.398904745.000007FE93D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 000007FE93D50000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_0_2_7fe93d50000_mine327.jbxd
                          Similarity
                          • API ID: ContextThread
                          • String ID:
                          • API String ID: 1591575202-0
                          • Opcode ID: e7c57b3080829f4aff9d1a8b29e19a9c86c32132298540e8ab0a44a5de299852
                          • Instruction ID: 763866c5f2ec1b6d03829608da163c0423c4f4016a29885784bb505621b61fbb
                          • Opcode Fuzzy Hash: e7c57b3080829f4aff9d1a8b29e19a9c86c32132298540e8ab0a44a5de299852
                          • Instruction Fuzzy Hash: C631D47190C64C8FDB58DFACD8497F97BF0EB56321F04416FD089C3192D660A845CB91
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 000007FE93D6E540 Relevance: 1.6, APIs: 1, Instructions: 99threadCOMMON
                          Download Yara Rule
                          APIs
                          Memory Dump Source
                          • Source File: 00000000.00000002.398904745.000007FE93D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 000007FE93D50000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_0_2_7fe93d50000_mine327.jbxd
                          Similarity
                          • API ID: ResumeThread
                          • String ID:
                          • API String ID: 947044025-0
                          • Opcode ID: d910afe0904d57e259f2c2660305006119310249e70b4034cab9657dbdfa92e2
                          • Instruction ID: e8a343e5efd82cf8c5ad570f4d0d14589a0667fc4d68735f87d92095deab0450
                          • Opcode Fuzzy Hash: d910afe0904d57e259f2c2660305006119310249e70b4034cab9657dbdfa92e2
                          • Instruction Fuzzy Hash: B421D27090CA4C8FEB49DB58C845BF9BBE1EB96324F00416FD04AD31A2D760A816CB91
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 0054273C Relevance: 1.4, APIs: 1, Instructions: 187memoryCOMMON
                          Download Yara Rule
                          APIs
                          Memory Dump Source
                          • Source File: 00000000.00000002.377729179.0000000000540000.00000040.00000400.00020000.00000000.sdmp, Offset: 00540000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_0_2_540000_mine327.jbxd
                          Similarity
                          • API ID: AllocVirtual
                          • String ID:
                          • API String ID: 4275171209-0
                          • Opcode ID: 8c1c9448f3dd1088c887dafc1273d9eb4da1e6d2ce59199f574756fa2a1f07a1
                          • Instruction ID: b05344c6fc6ec3db6f7c52c7a5bb2c874267a3c660527894cb8bac75d4f8ae53
                          • Opcode Fuzzy Hash: 8c1c9448f3dd1088c887dafc1273d9eb4da1e6d2ce59199f574756fa2a1f07a1
                          • Instruction Fuzzy Hash: C7614972B116A4CBCF18CF25D0406BDBB62FB54BA8F988125EF5947748DB38D892C700
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 000007FE93E51269 Relevance: .2, Instructions: 151COMMON
                          Download Yara Rule
                          Memory Dump Source
                          • Source File: 00000000.00000002.399788533.000007FE93E50000.00000040.00000800.00020000.00000000.sdmp, Offset: 000007FE93E50000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_0_2_7fe93e50000_mine327.jbxd
                          Similarity
                          • API ID:
                          • String ID:
                          • API String ID:
                          • Opcode ID: 6cd78567d5218706cdb97702faf14cf782ce3a4c64db58e54e8d5b3f26e9161b
                          • Instruction ID: 6782042184deb7da5ea5051922aea24666acc10002aa5f9f17fcc310d440a0ae
                          • Opcode Fuzzy Hash: 6cd78567d5218706cdb97702faf14cf782ce3a4c64db58e54e8d5b3f26e9161b
                          • Instruction Fuzzy Hash: 5541E03050D7C94FCF47DB2888656A97FF0EF56300B1A02EBD04ACB5A3D624B855C792
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Non-executed Functions

                          Function 00572B2C Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 264stringlibraryloaderCOMMON
                          Download Yara Rule
                          APIs
                          • GetModuleHandleA.KERNEL32 ref: 00572BD0
                          • lstrlenW.KERNEL32 ref: 00572E0A
                            • Part of subcall function 0057199C: OpenProcess.KERNEL32 ref: 005719C2
                            • Part of subcall function 0057199C: K32GetModuleFileNameExW.KERNEL32 ref: 005719E0
                            • Part of subcall function 0057199C: PathFindFileNameW.SHLWAPI ref: 005719EF
                            • Part of subcall function 0057199C: lstrlenW.KERNEL32 ref: 005719FB
                            • Part of subcall function 0057199C: StrCpyW.SHLWAPI ref: 00571A0E
                            • Part of subcall function 0057199C: CloseHandle.KERNEL32 ref: 00571A1C
                          • GetProcAddress.KERNEL32 ref: 00572BE5
                            • Part of subcall function 0057152C: StrCmpIW.SHLWAPI ref: 0057155D
                            • Part of subcall function 00573844: StrCmpNIW.SHLWAPI ref: 0057385C
                          • StrCmpNIW.SHLWAPI ref: 00572C28
                          • lstrlenW.KERNEL32 ref: 00572D50
                          Strings
                          Memory Dump Source
                          • Source File: 00000000.00000002.377736747.0000000000570000.00000040.00001000.00020000.00000000.sdmp, Offset: 00570000, based on PE: true
                          • Associated: 00000000.00000002.377736747.0000000000599000.00000040.00001000.00020000.00000000.sdmpDownload File
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_0_2_570000_mine327.jbxd
                          Similarity
                          • API ID: lstrlen$FileHandleModuleName$AddressCloseFindOpenPathProcProcess
                          • String ID: NtQueryObject$\Device\Nsi$ntdll.dll
                          • API String ID: 2119608203-3850299575
                          • Opcode ID: 4f621fb1587c0d31dffa94ac8be990c76594e3be50ef12941f5ce2f96c448f72
                          • Instruction ID: cb87936b7fd651148a1c4673fd72d28fbab4b5d56d8e9e8995a3db13471a0d03
                          • Opcode Fuzzy Hash: 4f621fb1587c0d31dffa94ac8be990c76594e3be50ef12941f5ce2f96c448f72
                          • Instruction Fuzzy Hash: 8AA1B172220A9186DB29CF25E84476A7BA9FB84F94F54D016EE4D57B18DF34CC81E740
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 00577D90 Relevance: 10.6, APIs: 7, Instructions: 72COMMON
                          Download Yara Rule
                          APIs
                          • IsProcessorFeaturePresent.KERNEL32 ref: 00577DAC
                          • RtlCaptureContext.NTDLL ref: 00577DD9
                          • RtlLookupFunctionEntry.NTDLL ref: 00577DF3
                          • RtlVirtualUnwind.NTDLL ref: 00577E34
                          • IsDebuggerPresent.KERNEL32 ref: 00577E88
                          • SetUnhandledExceptionFilter.KERNEL32 ref: 00577EA9
                          • UnhandledExceptionFilter.KERNEL32 ref: 00577EB4
                          Memory Dump Source
                          • Source File: 00000000.00000002.377736747.0000000000570000.00000040.00001000.00020000.00000000.sdmp, Offset: 00570000, based on PE: true
                          • Associated: 00000000.00000002.377736747.0000000000599000.00000040.00001000.00020000.00000000.sdmpDownload File
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_0_2_570000_mine327.jbxd
                          Similarity
                          • API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
                          • String ID:
                          • API String ID: 3140674995-0
                          • Opcode ID: 781d1b9bde8934adc12bfa83d35ad1be64d2520f1bd2f9e02f1b4bb1ea1a0257
                          • Instruction ID: 9371fec9c73cae2cf1d94d911779f5458950f4bc8e8af8aafbcf1137d50364df
                          • Opcode Fuzzy Hash: 781d1b9bde8934adc12bfa83d35ad1be64d2520f1bd2f9e02f1b4bb1ea1a0257
                          • Instruction Fuzzy Hash: 99313C76205B848AEB609F60F8947EE7764F788749F44842ADB4E57B58EF38C648CB10
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 0057D2A4 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE
                          Download Yara Rule
                          APIs
                          • RtlCaptureContext.NTDLL ref: 0057D31D
                          • RtlLookupFunctionEntry.NTDLL ref: 0057D335
                          • RtlVirtualUnwind.NTDLL ref: 0057D370
                          • IsDebuggerPresent.KERNEL32 ref: 0057D3A9
                          • SetUnhandledExceptionFilter.KERNEL32 ref: 0057D3B3
                          • UnhandledExceptionFilter.KERNEL32 ref: 0057D3BE
                          Memory Dump Source
                          • Source File: 00000000.00000002.377736747.0000000000570000.00000040.00001000.00020000.00000000.sdmp, Offset: 00570000, based on PE: true
                          • Associated: 00000000.00000002.377736747.0000000000599000.00000040.00001000.00020000.00000000.sdmpDownload File
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_0_2_570000_mine327.jbxd
                          Similarity
                          • API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
                          • String ID:
                          • API String ID: 1239891234-0
                          • Opcode ID: 056b8809331e045eb0ff6df28b8a67c6be047fb713c0be5e5acd4a9b147221bc
                          • Instruction ID: f5b8b20c5500e7aacc34686d3c26110c4d76f8708bb566ed82ff957f9cbc66c4
                          • Opcode Fuzzy Hash: 056b8809331e045eb0ff6df28b8a67c6be047fb713c0be5e5acd4a9b147221bc
                          • Instruction Fuzzy Hash: 0D316B36214F808ADB20CF25E8843AE77B4FB89755F504526EE9D57B68EF38C546CB00
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 00577960 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMONLIBRARYCODE
                          Download Yara Rule
                          APIs
                          • GetSystemTimeAsFileTime.KERNEL32 ref: 0057798C
                          • GetCurrentThreadId.KERNEL32 ref: 0057799A
                          • GetCurrentProcessId.KERNEL32 ref: 005779A6
                          • QueryPerformanceCounter.KERNEL32 ref: 005779B6
                          Memory Dump Source
                          • Source File: 00000000.00000002.377736747.0000000000570000.00000040.00001000.00020000.00000000.sdmp, Offset: 00570000, based on PE: true
                          • Associated: 00000000.00000002.377736747.0000000000599000.00000040.00001000.00020000.00000000.sdmpDownload File
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_0_2_570000_mine327.jbxd
                          Similarity
                          • API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
                          • String ID:
                          • API String ID: 2933794660-0
                          • Opcode ID: 561ac6f4885ef0f33bff27beb4ddb95e6a253367b5c72fac45fcb4617ca9122b
                          • Instruction ID: 5bad979b51797cde7894a2fc8ab88851ceb2ca36c63e84299734f80e5829de00
                          • Opcode Fuzzy Hash: 561ac6f4885ef0f33bff27beb4ddb95e6a253367b5c72fac45fcb4617ca9122b
                          • Instruction Fuzzy Hash: 7A115B22710F058AEF00CF60EC593A933A4F719B69F440E21EE6D867A5DF78C1A8C780
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 005844A8 Relevance: 3.2, APIs: 2, Instructions: 227COMMONLIBRARYCODE
                          Download Yara Rule
                          APIs
                          Memory Dump Source
                          • Source File: 00000000.00000002.377736747.0000000000570000.00000040.00001000.00020000.00000000.sdmp, Offset: 00570000, based on PE: true
                          • Associated: 00000000.00000002.377736747.0000000000599000.00000040.00001000.00020000.00000000.sdmpDownload File
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_0_2_570000_mine327.jbxd
                          Similarity
                          • API ID: ExceptionRaise_clrfp
                          • String ID:
                          • API String ID: 15204871-0
                          • Opcode ID: 91c45a23742243141810e6f77c67a66073dfa56da4d49e6a277af36b1acf7cf1
                          • Instruction ID: eca4c4cdb5f174a0f34ef354727cd459e097e9846074a352d5af750b41767242
                          • Opcode Fuzzy Hash: 91c45a23742243141810e6f77c67a66073dfa56da4d49e6a277af36b1acf7cf1
                          • Instruction Fuzzy Hash: D3A14D77600B898BDB19DF29C88635C7BA0F385B98F158916DF6D97B64CB39C452CB00
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 005538A8 Relevance: 1.7, APIs: 1, Instructions: 227COMMONLIBRARYCODE
                          Download Yara Rule
                          APIs
                          Memory Dump Source
                          • Source File: 00000000.00000002.377729179.0000000000540000.00000040.00000400.00020000.00000000.sdmp, Offset: 00540000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_0_2_540000_mine327.jbxd
                          Similarity
                          • API ID: _clrfp
                          • String ID:
                          • API String ID: 3618594692-0
                          • Opcode ID: 91c45a23742243141810e6f77c67a66073dfa56da4d49e6a277af36b1acf7cf1
                          • Instruction ID: 4dcd1b5a99db42d4e2029ffc9f8f64bfa0661c304653e54009b0613ef68ca2bd
                          • Opcode Fuzzy Hash: 91c45a23742243141810e6f77c67a66073dfa56da4d49e6a277af36b1acf7cf1
                          • Instruction Fuzzy Hash: 37A13C77600B888BDB19CF29C8963587BA0F384B99F198916DFAD87768CB39C955C700
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 0057DCE0 Relevance: 1.6, APIs: 1, Instructions: 149COMMON
                          Download Yara Rule
                          Memory Dump Source
                          • Source File: 00000000.00000002.377736747.0000000000570000.00000040.00001000.00020000.00000000.sdmp, Offset: 00570000, based on PE: true
                          • Associated: 00000000.00000002.377736747.0000000000599000.00000040.00001000.00020000.00000000.sdmpDownload File
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_0_2_570000_mine327.jbxd
                          Similarity
                          • API ID:
                          • String ID:
                          • API String ID:
                          • Opcode ID: 8a50f75ef125d869803f794afb43eee9f14e6b347dae9078a5d16d69e4517c5a
                          • Instruction ID: d8e8bdbdfd5e6865063dd6a96970431ae9feb63f16fc137b734c0ad6f3d93010
                          • Opcode Fuzzy Hash: 8a50f75ef125d869803f794afb43eee9f14e6b347dae9078a5d16d69e4517c5a
                          • Instruction Fuzzy Hash: B251BF22700B9189EB20DB72B84869E7F75FB84BA8F148225EE9D27B58DB38C541D700
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 000007FE93D51098 Relevance: 1.4, Strings: 1, Instructions: 107COMMON
                          Download Yara Rule
                          Strings
                          Memory Dump Source
                          • Source File: 00000000.00000002.398904745.000007FE93D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 000007FE93D50000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_0_2_7fe93d50000_mine327.jbxd
                          Similarity
                          • API ID:
                          • String ID: 7+4
                          • API String ID: 0-3714776299
                          • Opcode ID: 42dd4c085d1a7c92cc7b9d9be86d8c0c60deaa7221c3f320620b6173a9286715
                          • Instruction ID: 19cd9897843bb48ee0ae3feafc2d74e6f577e61c4c6fee302789f6d1f3ed9e46
                          • Opcode Fuzzy Hash: 42dd4c085d1a7c92cc7b9d9be86d8c0c60deaa7221c3f320620b6173a9286715
                          • Instruction Fuzzy Hash: 4321F7277095219BDA10F9BEF8051FF3385D7D1376F004937D184E6025E614A04BE6E2
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 000007FE93D510D0 Relevance: 1.3, Strings: 1, Instructions: 76COMMON
                          Download Yara Rule
                          Strings
                          Memory Dump Source
                          • Source File: 00000000.00000002.398904745.000007FE93D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 000007FE93D50000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_0_2_7fe93d50000_mine327.jbxd
                          Similarity
                          • API ID:
                          • String ID: 7+4
                          • API String ID: 0-3714776299
                          • Opcode ID: 82c01e13a43fbf92d76ab593a3a2080ac5defe990af7c7e91fad9b188d14e29b
                          • Instruction ID: d10d642aa773616fd078cb86abb8db5367835f601d77f764c76d15c9573bcaec
                          • Opcode Fuzzy Hash: 82c01e13a43fbf92d76ab593a3a2080ac5defe990af7c7e91fad9b188d14e29b
                          • Instruction Fuzzy Hash: 2C112527709A359BEA10F9BEF8001EF3386D7C1375B004877D184EA035EA10A04BE6E2
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 000007FE93D69E84 Relevance: .6, Instructions: 612COMMON
                          Download Yara Rule
                          Memory Dump Source
                          • Source File: 00000000.00000002.398904745.000007FE93D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 000007FE93D50000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_0_2_7fe93d50000_mine327.jbxd
                          Similarity
                          • API ID:
                          • String ID:
                          • API String ID:
                          • Opcode ID: 90fb2b7dde5e394b5e656fc745823e11a33ef76bd16d610fc3f5a0da7cdbe7c8
                          • Instruction ID: bc2e9ddb23ef40e061477c1b32d846dd45999286b687f9233a65110233abcf41
                          • Opcode Fuzzy Hash: 90fb2b7dde5e394b5e656fc745823e11a33ef76bd16d610fc3f5a0da7cdbe7c8
                          • Instruction Fuzzy Hash: 28126A3051CB864FE719DB24C4A15B5BBE1FF96304F1006BED4D6C72A2DA68F846C792
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 00541F2C Relevance: .3, Instructions: 264COMMON
                          Download Yara Rule
                          Memory Dump Source
                          • Source File: 00000000.00000002.377729179.0000000000540000.00000040.00000400.00020000.00000000.sdmp, Offset: 00540000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_0_2_540000_mine327.jbxd
                          Similarity
                          • API ID:
                          • String ID:
                          • API String ID:
                          • Opcode ID: ede98a6d8d02e88a1d8b84a5c6c80a15dedc9657b0a7b1a34b363c45f1d0dee8
                          • Instruction ID: 9fdd67fd2333c469abfc074554bf03f227ca7f677b7d6307873782cebe6c75a4
                          • Opcode Fuzzy Hash: ede98a6d8d02e88a1d8b84a5c6c80a15dedc9657b0a7b1a34b363c45f1d0dee8
                          • Instruction Fuzzy Hash: 1FA1E176224BA186DB288F25C8547EABBA4FB84B8CF946016FE0D53B14EF75CD81C740
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 0054D0E0 Relevance: .1, Instructions: 149COMMON
                          Download Yara Rule
                          Memory Dump Source
                          • Source File: 00000000.00000002.377729179.0000000000540000.00000040.00000400.00020000.00000000.sdmp, Offset: 00540000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_0_2_540000_mine327.jbxd
                          Similarity
                          • API ID:
                          • String ID:
                          • API String ID:
                          • Opcode ID: 29975c57d01bdb1e687cc302dc7d7dc5a8663a128fa1f3b93342ad94a271d3ec
                          • Instruction ID: b07b40910c7a2eaef048bc429247a1d1de95f68daca91460b6fc1833d03aeb91
                          • Opcode Fuzzy Hash: 29975c57d01bdb1e687cc302dc7d7dc5a8663a128fa1f3b93342ad94a271d3ec
                          • Instruction Fuzzy Hash: 8451AE32704B9199EB20DF72A8446AE7FB5F784BECF145229EE9967B58DB38C401C700
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 005536F0 Relevance: .0, Instructions: 32COMMON
                          Download Yara Rule
                          Memory Dump Source
                          • Source File: 00000000.00000002.377729179.0000000000540000.00000040.00000400.00020000.00000000.sdmp, Offset: 00540000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_0_2_540000_mine327.jbxd
                          Similarity
                          • API ID:
                          • String ID:
                          • API String ID:
                          • Opcode ID: 06df2142d5dd0183fd0e01b7d5608ecb5bc0210788fa76ce78b9fbce82fbb0aa
                          • Instruction ID: 659b7d81cf0255faed4c00572becf08bf472cb0817c20fa5ede8ee5efca12a62
                          • Opcode Fuzzy Hash: 06df2142d5dd0183fd0e01b7d5608ecb5bc0210788fa76ce78b9fbce82fbb0aa
                          • Instruction Fuzzy Hash: C2F012B1725A948FDBA88F28A85671A77A1F3483D5FD08119D68983B14D63D8461CF04
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 00586218 Relevance: .0, Instructions: 2COMMONLIBRARYCODE
                          Download Yara Rule
                          Memory Dump Source
                          • Source File: 00000000.00000002.377736747.0000000000570000.00000040.00001000.00020000.00000000.sdmp, Offset: 00570000, based on PE: true
                          • Associated: 00000000.00000002.377736747.0000000000599000.00000040.00001000.00020000.00000000.sdmpDownload File
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_0_2_570000_mine327.jbxd
                          Similarity
                          • API ID:
                          • String ID:
                          • API String ID:
                          • Opcode ID: 32a3371fccff7e48a12706b8d34f5f5cb9986713573a21c371ac617320c9bcc6
                          • Instruction ID: 56cae8cb1c77b8828ebdd61b25950643798fc64f5389fc6020cc65b86a9d389c
                          • Opcode Fuzzy Hash: 32a3371fccff7e48a12706b8d34f5f5cb9986713573a21c371ac617320c9bcc6
                          • Instruction Fuzzy Hash: 6990020640E3D045C603472108600982F60828284078FC1E6C38842683C08C14088B62
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 005712BC Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 120memoryregistrystringCOMMON
                          Download Yara Rule
                          APIs
                          Strings
                          Memory Dump Source
                          • Source File: 00000000.00000002.377736747.0000000000570000.00000040.00001000.00020000.00000000.sdmp, Offset: 00570000, based on PE: true
                          • Associated: 00000000.00000002.377736747.0000000000599000.00000040.00001000.00020000.00000000.sdmpDownload File
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_0_2_570000_mine327.jbxd
                          Similarity
                          • API ID: Heap$Process$Alloc$Free$EnumInfoQueryValuelstrlen
                          • String ID: d
                          • API String ID: 2005889112-2564639436
                          • Opcode ID: 8b653d2a3574a9b9f54f76d34c9bbade1314fe17b6e977058bb62b7e32ce9810
                          • Instruction ID: 6853ed82a0f29f912a76034f049969894bf3f256fb07018de3b7ba570ede2681
                          • Opcode Fuzzy Hash: 8b653d2a3574a9b9f54f76d34c9bbade1314fe17b6e977058bb62b7e32ce9810
                          • Instruction Fuzzy Hash: 7A514A76614F8486EB14CF66E94835BB7A2F789F9AF448124DE4A17729DF3CC049CB00
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 00571D14 Relevance: 22.8, APIs: 1, Strings: 12, Instructions: 65threadCOMMON
                          Download Yara Rule
                          APIs
                          • GetCurrentThread.KERNEL32 ref: 00571D1F
                            • Part of subcall function 00571FD4: GetModuleHandleA.KERNEL32 ref: 00571FEC
                            • Part of subcall function 00571FD4: GetProcAddress.KERNEL32 ref: 00571FFD
                            • Part of subcall function 00575B30: GetCurrentThreadId.KERNEL32 ref: 00575B6B
                          Strings
                          Memory Dump Source
                          • Source File: 00000000.00000002.377736747.0000000000570000.00000040.00001000.00020000.00000000.sdmp, Offset: 00570000, based on PE: true
                          • Associated: 00000000.00000002.377736747.0000000000599000.00000040.00001000.00020000.00000000.sdmpDownload File
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_0_2_570000_mine327.jbxd
                          Similarity
                          • API ID: CurrentThread$AddressHandleModuleProc
                          • String ID: EnumServiceGroupW$EnumServicesStatusExW$NtDeviceIoControlFile$NtEnumerateKey$NtEnumerateValueKey$NtQueryDirectoryFile$NtQueryDirectoryFileEx$NtQuerySystemInformation$NtResumeThread$advapi32.dll$ntdll.dll$sechost.dll
                          • API String ID: 4175298099-1975688563
                          • Opcode ID: 848021bf4701eae64bbfc749c93af06548ec6c37c79a2989ab503d46e0816dd6
                          • Instruction ID: 0473c5db155c0c3e8167b5bf3f58662f6645356bc79f50a84b35ad78bf85d407
                          • Opcode Fuzzy Hash: 848021bf4701eae64bbfc749c93af06548ec6c37c79a2989ab503d46e0816dd6
                          • Instruction Fuzzy Hash: D231B264104E4AB0EA04EB69FC65BE66370B744386FC18423D84D22171AF78CA4AEFA0
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 00546910 Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 230COMMON
                          Download Yara Rule
                          APIs
                          • __scrt_dllmain_crt_thread_attach.LIBCMT ref: 00546938
                          • __scrt_acquire_startup_lock.LIBCMT ref: 0054698A
                          • _RTC_Initialize.LIBCMT ref: 005469B8
                          • __scrt_dllmain_after_initialize_c.LIBCMT ref: 005469DE
                          • __scrt_release_startup_lock.LIBCMT ref: 00546A09
                          Strings
                          Memory Dump Source
                          • Source File: 00000000.00000002.377729179.0000000000540000.00000040.00000400.00020000.00000000.sdmp, Offset: 00540000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_0_2_540000_mine327.jbxd
                          Similarity
                          • API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
                          • String ID: `dynamic initializer for '$`eh vector copy constructor iterator'$`eh vector vbase copy constructor iterator'$scriptor'
                          • API String ID: 190073905-1786718095
                          • Opcode ID: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
                          • Instruction ID: 3b8b3d6d021bd18201cc8917a2d86bd556520d4e221bc1272e916114da6cc2eb
                          • Opcode Fuzzy Hash: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
                          • Instruction Fuzzy Hash: 71714871700F0286EB10AB66D8553DA6FA0FBCB78CF548425EA4483716EF79CC45CB02
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 0057CE28 Relevance: 18.1, APIs: 12, Instructions: 112COMMONLIBRARYCODE
                          Download Yara Rule
                          APIs
                          • GetLastError.KERNEL32 ref: 0057CE37
                          • FlsGetValue.KERNEL32(?,?,?,00580A6B,?,?,?,0058045C,?,?,?,0057C84F), ref: 0057CE4C
                          • FlsSetValue.KERNEL32(?,?,?,00580A6B,?,?,?,0058045C,?,?,?,0057C84F), ref: 0057CE6D
                          • FlsSetValue.KERNEL32(?,?,?,00580A6B,?,?,?,0058045C,?,?,?,0057C84F), ref: 0057CE9A
                          • FlsSetValue.KERNEL32(?,?,?,00580A6B,?,?,?,0058045C,?,?,?,0057C84F), ref: 0057CEAB
                          • FlsSetValue.KERNEL32(?,?,?,00580A6B,?,?,?,0058045C,?,?,?,0057C84F), ref: 0057CEBC
                          • SetLastError.KERNEL32 ref: 0057CED7
                          • FlsGetValue.KERNEL32(?,?,?,?,?,?,?,00580A6B,?,?,?,0058045C,?,?,?,0057C84F), ref: 0057CF0D
                          • FlsSetValue.KERNEL32(?,?,00000001,0057ECCC,?,?,?,?,0057BF9F,?,?,?,?,?,00577AB0), ref: 0057CF2C
                            • Part of subcall function 0057D6CC: HeapAlloc.KERNEL32 ref: 0057D721
                          • FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00580A6B,?,?,?,0058045C,?,?,?,0057C84F), ref: 0057CF54
                            • Part of subcall function 0057D744: HeapFree.KERNEL32 ref: 0057D75A
                            • Part of subcall function 0057D744: GetLastError.KERNEL32 ref: 0057D764
                          • FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00580A6B,?,?,?,0058045C,?,?,?,0057C84F), ref: 0057CF65
                          • FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00580A6B,?,?,?,0058045C,?,?,?,0057C84F), ref: 0057CF76
                          Memory Dump Source
                          • Source File: 00000000.00000002.377736747.0000000000570000.00000040.00001000.00020000.00000000.sdmp, Offset: 00570000, based on PE: true
                          • Associated: 00000000.00000002.377736747.0000000000599000.00000040.00001000.00020000.00000000.sdmpDownload File
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_0_2_570000_mine327.jbxd
                          Similarity
                          • API ID: Value$ErrorLast$Heap$AllocFree
                          • String ID:
                          • API String ID: 570795689-0
                          • Opcode ID: 81ae7dfa4ed2d3c1f1356864241e8c9d76a8deab2a50f3105871727dc9b84e00
                          • Instruction ID: 4817247e7ca04ca5348873a23887e8f4b42cd5600e3a3cebf834b5d60b444fc7
                          • Opcode Fuzzy Hash: 81ae7dfa4ed2d3c1f1356864241e8c9d76a8deab2a50f3105871727dc9b84e00
                          • Instruction Fuzzy Hash: 56317560301A4682EE29A735795E7392E56BFC47F0F14CB28ED3E4A7E5DE289441A700
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 00572244 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 52filethreadCOMMON
                          Download Yara Rule
                          APIs
                          • GetProcessIdOfThread.KERNEL32 ref: 00572259
                          • GetCurrentProcessId.KERNEL32 ref: 00572263
                            • Part of subcall function 00571934: OpenProcess.KERNEL32 ref: 00571952
                            • Part of subcall function 00571934: IsWow64Process.KERNEL32 ref: 00571968
                            • Part of subcall function 00571934: CloseHandle.KERNEL32 ref: 00571983
                          • CreateFileW.KERNEL32 ref: 005722BC
                          • WriteFile.KERNEL32 ref: 005722E4
                          • ReadFile.KERNEL32 ref: 00572303
                          • CloseHandle.KERNEL32 ref: 0057230C
                          Strings
                          • \\.\pipe\dialerchildproc64, xrefs: 0057228C
                          • \\.\pipe\dialerchildproc32, xrefs: 00572293
                          Memory Dump Source
                          • Source File: 00000000.00000002.377736747.0000000000570000.00000040.00001000.00020000.00000000.sdmp, Offset: 00570000, based on PE: true
                          • Associated: 00000000.00000002.377736747.0000000000599000.00000040.00001000.00020000.00000000.sdmpDownload File
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_0_2_570000_mine327.jbxd
                          Similarity
                          • API ID: Process$File$CloseHandle$CreateCurrentOpenReadThreadWow64Write
                          • String ID: \\.\pipe\dialerchildproc32$\\.\pipe\dialerchildproc64
                          • API String ID: 2171963597-1373409510
                          • Opcode ID: d76f145db3bc14c8b60d6abb5b011cd5988a1ad04fc2d4b7169b2a78ec3c4c79
                          • Instruction ID: b0e9cc1815f2dc8b3e2c7af49b9d404798a7237c78f1f7c46bbe6459e21ace06
                          • Opcode Fuzzy Hash: d76f145db3bc14c8b60d6abb5b011cd5988a1ad04fc2d4b7169b2a78ec3c4c79
                          • Instruction Fuzzy Hash: 24213B36614B40C3EB10CB25F84876A77A1F789BA5F508215EE5917BA8DF7CC549CF04
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 00549944 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 317COMMON
                          Download Yara Rule
                          APIs
                          • __FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 005499A1
                            • Part of subcall function 0054A814: __GetUnwindTryBlock.LIBCMT ref: 0054A857
                            • Part of subcall function 0054A814: __SetUnwindTryBlock.LIBVCRUNTIME ref: 0054A87C
                          • Is_bad_exception_allowed.LIBVCRUNTIME ref: 00549A79
                          • __FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 00549CCE
                          • std::bad_alloc::bad_alloc.LIBCMT ref: 00549DDA
                          Strings
                          Memory Dump Source
                          • Source File: 00000000.00000002.377729179.0000000000540000.00000040.00000400.00020000.00000000.sdmp, Offset: 00540000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_0_2_540000_mine327.jbxd
                          Similarity
                          • API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
                          • String ID: csm$csm$csm
                          • API String ID: 849930591-393685449
                          • Opcode ID: 65b39982983e806640910362ba4e105e6dc551b6220b15538d356c191c28ac3a
                          • Instruction ID: 9372f3f8bc76eafc8ea724d814f4005a2e3c9cdf50d1260bd65bbf4dfc5636c5
                          • Opcode Fuzzy Hash: 65b39982983e806640910362ba4e105e6dc551b6220b15538d356c191c28ac3a
                          • Instruction Fuzzy Hash: CCD1BC72A04B818ADB20DF6AE4863EE7FA4F799B9CF100516EE8957B19CF34C591C701
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 0057A544 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 317COMMON
                          Download Yara Rule
                          APIs
                          • __FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 0057A5A1
                            • Part of subcall function 0057B414: __GetUnwindTryBlock.LIBCMT ref: 0057B457
                            • Part of subcall function 0057B414: __SetUnwindTryBlock.LIBVCRUNTIME ref: 0057B47C
                          • Is_bad_exception_allowed.LIBVCRUNTIME ref: 0057A679
                          • __FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 0057A8CE
                          • std::bad_alloc::bad_alloc.LIBCMT ref: 0057A9DA
                          Strings
                          Memory Dump Source
                          • Source File: 00000000.00000002.377736747.0000000000570000.00000040.00001000.00020000.00000000.sdmp, Offset: 00570000, based on PE: true
                          • Associated: 00000000.00000002.377736747.0000000000599000.00000040.00001000.00020000.00000000.sdmpDownload File
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_0_2_570000_mine327.jbxd
                          Similarity
                          • API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
                          • String ID: csm$csm$csm
                          • API String ID: 849930591-393685449
                          • Opcode ID: 147a5c394ba4e007c258850d6061d542d969719de9d23a8e277659d08661d77f
                          • Instruction ID: a9fd0df79b64ebaa0bf6dd2974e8702994aa4dbed5f5004845694c6a909ef460
                          • Opcode Fuzzy Hash: 147a5c394ba4e007c258850d6061d542d969719de9d23a8e277659d08661d77f
                          • Instruction Fuzzy Hash: 59D1AC72A04B818ADB20DF65E48439D7FA4F7C9B98F14821AEF8D57B19CB34C591DB02
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 0057104C Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 99memoryregistryCOMMON
                          Download Yara Rule
                          APIs
                          Strings
                          Memory Dump Source
                          • Source File: 00000000.00000002.377736747.0000000000570000.00000040.00001000.00020000.00000000.sdmp, Offset: 00570000, based on PE: true
                          • Associated: 00000000.00000002.377736747.0000000000599000.00000040.00001000.00020000.00000000.sdmpDownload File
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_0_2_570000_mine327.jbxd
                          Similarity
                          • API ID: Heap$Process$AllocEnumFreeInfoQueryValue
                          • String ID: d
                          • API String ID: 3743429067-2564639436
                          • Opcode ID: 0cc5ceb7d92555702a84a43de404567f212e32e90d8a90c8922560dee2c01182
                          • Instruction ID: 1f3c137087c66545dbab53941f8057cd05b5cb7dcd090a3dfba7812facdceb87
                          • Opcode Fuzzy Hash: 0cc5ceb7d92555702a84a43de404567f212e32e90d8a90c8922560dee2c01182
                          • Instruction Fuzzy Hash: A9414C33214F84CAE760CF25E45479A7BA1F388B99F448129DB891BB18DF38C589CB40
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 0057D068 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 54COMMONLIBRARYCODE
                          Download Yara Rule
                          APIs
                          • FlsGetValue.KERNEL32(?,?,?,0057C7DE,?,?,?,?,?,?,?,?,0057CF9D,?,?,00000001), ref: 0057D087
                          • FlsSetValue.KERNEL32(?,?,?,0057C7DE,?,?,?,?,?,?,?,?,0057CF9D,?,?,00000001), ref: 0057D0A6
                          • FlsSetValue.KERNEL32(?,?,?,0057C7DE,?,?,?,?,?,?,?,?,0057CF9D,?,?,00000001), ref: 0057D0CE
                          • FlsSetValue.KERNEL32(?,?,?,0057C7DE,?,?,?,?,?,?,?,?,0057CF9D,?,?,00000001), ref: 0057D0DF
                          • FlsSetValue.KERNEL32(?,?,?,0057C7DE,?,?,?,?,?,?,?,?,0057CF9D,?,?,00000001), ref: 0057D0F0
                          Strings
                          Memory Dump Source
                          • Source File: 00000000.00000002.377736747.0000000000570000.00000040.00001000.00020000.00000000.sdmp, Offset: 00570000, based on PE: true
                          • Associated: 00000000.00000002.377736747.0000000000599000.00000040.00001000.00020000.00000000.sdmpDownload File
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_0_2_570000_mine327.jbxd
                          Similarity
                          • API ID: Value
                          • String ID: 1%$Y%
                          • API String ID: 3702945584-1395475152
                          • Opcode ID: eaed261e9eff258ccad1ac5f7a99306e4284ed666e6615725d2dc279c7a103a4
                          • Instruction ID: 84cc21d2d422c7422c5408683571f68ddd30bfabb1d3295a104d73905d97bb79
                          • Opcode Fuzzy Hash: eaed261e9eff258ccad1ac5f7a99306e4284ed666e6615725d2dc279c7a103a4
                          • Instruction Fuzzy Hash: E211EC2070464582EE28A736B95E33A69717FC47F0F54D734A83D077EDEE29C442A710
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 00577510 Relevance: 12.2, APIs: 8, Instructions: 230COMMON
                          Download Yara Rule
                          APIs
                          • __scrt_dllmain_crt_thread_attach.LIBCMT ref: 00577538
                          • __scrt_acquire_startup_lock.LIBCMT ref: 0057758A
                          • _RTC_Initialize.LIBCMT ref: 005775B8
                          • __scrt_dllmain_after_initialize_c.LIBCMT ref: 005775DE
                          • __scrt_release_startup_lock.LIBCMT ref: 00577609
                          Memory Dump Source
                          • Source File: 00000000.00000002.377736747.0000000000570000.00000040.00001000.00020000.00000000.sdmp, Offset: 00570000, based on PE: true
                          • Associated: 00000000.00000002.377736747.0000000000599000.00000040.00001000.00020000.00000000.sdmpDownload File
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_0_2_570000_mine327.jbxd
                          Similarity
                          • API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
                          • String ID:
                          • API String ID: 190073905-0
                          • Opcode ID: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
                          • Instruction ID: f19a4c37aea66695094d04a1b340b47dd1a6d702520d5f389d02ac403ceea2e1
                          • Opcode Fuzzy Hash: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
                          • Instruction Fuzzy Hash: 50710B31718B4A86EB14AB69F84535A2F91FBCD780F54C825DE0D5771AEF38C945EB00
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 00583DB4 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON
                          Download Yara Rule
                          APIs
                          Strings
                          Memory Dump Source
                          • Source File: 00000000.00000002.377736747.0000000000570000.00000040.00001000.00020000.00000000.sdmp, Offset: 00570000, based on PE: true
                          • Associated: 00000000.00000002.377736747.0000000000599000.00000040.00001000.00020000.00000000.sdmpDownload File
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_0_2_570000_mine327.jbxd
                          Similarity
                          • API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
                          • String ID: CONOUT$
                          • API String ID: 3230265001-3130406586
                          • Opcode ID: ea8503a65e9befc0d33d9332805196394b6329e0df61646a9863ad39bb9ae76f
                          • Instruction ID: 5802ebd336da8258339eb0d59c552f309497f6856f72d57dbe3d4a7e3f43a153
                          • Opcode Fuzzy Hash: ea8503a65e9befc0d33d9332805196394b6329e0df61646a9863ad39bb9ae76f
                          • Instruction Fuzzy Hash: 49118C31310F8086E7509B52EC5832AB6A4F788FE6F148224EE5A977A5CF38C914CB44
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 00572F04 Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 93memoryCOMMON
                          Download Yara Rule
                          APIs
                          Strings
                          Memory Dump Source
                          • Source File: 00000000.00000002.377736747.0000000000570000.00000040.00001000.00020000.00000000.sdmp, Offset: 00570000, based on PE: true
                          • Associated: 00000000.00000002.377736747.0000000000599000.00000040.00001000.00020000.00000000.sdmpDownload File
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_0_2_570000_mine327.jbxd
                          Similarity
                          • API ID: Heap$Process$AllocFree
                          • String ID: dialer
                          • API String ID: 756756679-3528709123
                          • Opcode ID: 2e24de9146afbba5105044d4fd5602f1f9f0ed558a5ed62472976580c3eaf0ad
                          • Instruction ID: 0238b30573d1b67fd15ae28de227df1be1f1b9c2b37da20f9fa4412ff99e0db7
                          • Opcode Fuzzy Hash: 2e24de9146afbba5105044d4fd5602f1f9f0ed558a5ed62472976580c3eaf0ad
                          • Instruction Fuzzy Hash: 6F319C22701B5582EB15DF26F94572AAB60FB44B95F08C124EF4C47B16EF38C5A1E700
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 0057CFA0 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE
                          Download Yara Rule
                          APIs
                          • GetLastError.KERNEL32 ref: 0057CFAF
                          • FlsSetValue.KERNEL32(?,?,?,0057D6B5,?,?,?,?,0057D778), ref: 0057CFE5
                          • FlsSetValue.KERNEL32(?,?,?,0057D6B5,?,?,?,?,0057D778), ref: 0057D012
                          • FlsSetValue.KERNEL32(?,?,?,0057D6B5,?,?,?,?,0057D778), ref: 0057D023
                          • FlsSetValue.KERNEL32(?,?,?,0057D6B5,?,?,?,?,0057D778), ref: 0057D034
                          • SetLastError.KERNEL32 ref: 0057D04F
                          Memory Dump Source
                          • Source File: 00000000.00000002.377736747.0000000000570000.00000040.00001000.00020000.00000000.sdmp, Offset: 00570000, based on PE: true
                          • Associated: 00000000.00000002.377736747.0000000000599000.00000040.00001000.00020000.00000000.sdmpDownload File
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_0_2_570000_mine327.jbxd
                          Similarity
                          • API ID: Value$ErrorLast
                          • String ID:
                          • API String ID: 2506987500-0
                          • Opcode ID: 4f148fb448054b99fdb5313590ff83f86fc6d8762bc770a772f95ba4b575ef67
                          • Instruction ID: 37e621378eb5f449893b3f5a6c01e60eb8ccfd3cdbe500b1b46797a95d7d96de
                          • Opcode Fuzzy Hash: 4f148fb448054b99fdb5313590ff83f86fc6d8762bc770a772f95ba4b575ef67
                          • Instruction Fuzzy Hash: 9811AB20305A8182EA18E732B95D7396A62BFC57F0F14D728EC3E477D9EE69C441A710
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 0057199C Relevance: 9.0, APIs: 6, Instructions: 42stringCOMMON
                          Download Yara Rule
                          APIs
                          Memory Dump Source
                          • Source File: 00000000.00000002.377736747.0000000000570000.00000040.00001000.00020000.00000000.sdmp, Offset: 00570000, based on PE: true
                          • Associated: 00000000.00000002.377736747.0000000000599000.00000040.00001000.00020000.00000000.sdmpDownload File
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_0_2_570000_mine327.jbxd
                          Similarity
                          • API ID: FileName$CloseFindHandleModuleOpenPathProcesslstrlen
                          • String ID:
                          • API String ID: 517849248-0
                          • Opcode ID: 01214db588610ff501214a343c1506f8e4016efad0e64bbd234dc336c45f59d3
                          • Instruction ID: ae118cb436e3781d774590740b1e492fd67bdc08659f237694be5d02d34e1fc3
                          • Opcode Fuzzy Hash: 01214db588610ff501214a343c1506f8e4016efad0e64bbd234dc336c45f59d3
                          • Instruction Fuzzy Hash: 39018831300E8082EB20DB52B88875A63A1F788FC2F888035DE8D67715DF3CC989CB40
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 005736C8 Relevance: 9.0, APIs: 6, Instructions: 38threadCOMMON
                          Download Yara Rule
                          APIs
                          Memory Dump Source
                          • Source File: 00000000.00000002.377736747.0000000000570000.00000040.00001000.00020000.00000000.sdmp, Offset: 00570000, based on PE: true
                          • Associated: 00000000.00000002.377736747.0000000000599000.00000040.00001000.00020000.00000000.sdmpDownload File
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_0_2_570000_mine327.jbxd
                          Similarity
                          • API ID: CurrentProcessProtectVirtual$HandleModuleTerminateThread
                          • String ID:
                          • API String ID: 449555515-0
                          • Opcode ID: 33edae7e4393505c590e6bdf894c2b6337bb17a10dfae21a600636dc78c73843
                          • Instruction ID: f0f55adbe4f8fbcc9426fb572465235d8d9958009c09becf405d7085e6d155b0
                          • Opcode Fuzzy Hash: 33edae7e4393505c590e6bdf894c2b6337bb17a10dfae21a600636dc78c73843
                          • Instruction Fuzzy Hash: 54012565312B40C2EB289B22FC1831A67A0FB49B87F048428CE4D1B765EF3DC608DB04
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 0054F040 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 182COMMON
                          Download Yara Rule
                          APIs
                          • _invalid_parameter_noinfo.LIBCMT ref: 0054F124
                          Strings
                          Memory Dump Source
                          • Source File: 00000000.00000002.377729179.0000000000540000.00000040.00000400.00020000.00000000.sdmp, Offset: 00540000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_0_2_540000_mine327.jbxd
                          Similarity
                          • API ID: _invalid_parameter_noinfo
                          • String ID: Tuesday$Wednesday$or copy constructor iterator'$iT
                          • API String ID: 3215553584-1378320079
                          • Opcode ID: 9e57f18f61c22f0406784eb273be7b0d6046b42052b72e443b30de0c50228f55
                          • Instruction ID: 06b8340f8a8c069a7a802b5e44ec1f38ba8b1a231a783cd37387710451173850
                          • Opcode Fuzzy Hash: 9e57f18f61c22f0406784eb273be7b0d6046b42052b72e443b30de0c50228f55
                          • Instruction Fuzzy Hash: 6751023A604A40C2EA29DB7DED487AE6F61F7C578CF556939CA0B17B28DB74C842C700
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 00578FE8 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 144COMMON
                          Download Yara Rule
                          APIs
                          • __except_validate_context_record.LIBVCRUNTIME ref: 00579013
                          • _IsNonwritableInCurrentImage.LIBCMT ref: 005790A8
                          • RtlUnwindEx.NTDLL ref: 005790F7
                          Strings
                          Memory Dump Source
                          • Source File: 00000000.00000002.377736747.0000000000570000.00000040.00001000.00020000.00000000.sdmp, Offset: 00570000, based on PE: true
                          • Associated: 00000000.00000002.377736747.0000000000599000.00000040.00001000.00020000.00000000.sdmpDownload File
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_0_2_570000_mine327.jbxd
                          Similarity
                          • API ID: CurrentImageNonwritableUnwind__except_validate_context_record
                          • String ID: csm$f
                          • API String ID: 2395640692-629598281
                          • Opcode ID: cf88226c4e0499e864df13b9fa0a288c301b8b6e63eb257c90d52d35e879efeb
                          • Instruction ID: 9a167e15d877fb9052cdbb8caaf2480fda1fb6be0f72498d3b5f5716e3a84cd7
                          • Opcode Fuzzy Hash: cf88226c4e0499e864df13b9fa0a288c301b8b6e63eb257c90d52d35e879efeb
                          • Instruction Fuzzy Hash: 1451EE327116028ACB14DF25F848B693B66F384BD8F91C524EE5E47708EB75CD91EB20
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 00571A40 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 30stringCOMMON
                          Download Yara Rule
                          APIs
                          Strings
                          Memory Dump Source
                          • Source File: 00000000.00000002.377736747.0000000000570000.00000040.00001000.00020000.00000000.sdmp, Offset: 00570000, based on PE: true
                          • Associated: 00000000.00000002.377736747.0000000000599000.00000040.00001000.00020000.00000000.sdmpDownload File
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_0_2_570000_mine327.jbxd
                          Similarity
                          • API ID: FinalHandleNamePathlstrlen
                          • String ID: \\?\
                          • API String ID: 2719912262-4282027825
                          • Opcode ID: c1daab9146f2a1614ef605d22fd4f721266e20aa8a0235322e79b2424596649d
                          • Instruction ID: 73343f6f5efa60eb8f8ba58cf85026f93e5941b238949a65249d3a54ddd32409
                          • Opcode Fuzzy Hash: c1daab9146f2a1614ef605d22fd4f721266e20aa8a0235322e79b2424596649d
                          • Instruction Fuzzy Hash: B4F04922304A4192EB208B25FC88B5A6760F748B8AF94C020DE4D4BA58DF3CC68DCF00
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 00573044 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 27COMMON
                          Download Yara Rule
                          APIs
                          Strings
                          Memory Dump Source
                          • Source File: 00000000.00000002.377736747.0000000000570000.00000040.00001000.00020000.00000000.sdmp, Offset: 00570000, based on PE: true
                          • Associated: 00000000.00000002.377736747.0000000000599000.00000040.00001000.00020000.00000000.sdmpDownload File
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_0_2_570000_mine327.jbxd
                          Similarity
                          • API ID: CombinePath
                          • String ID: \\.\pipe\
                          • API String ID: 3422762182-91387939
                          • Opcode ID: 8c685e1f0b85bfe06f91eeefbd03c12bff8419d51c8b157116edbf6ca1c9c829
                          • Instruction ID: f5bae6cab5429e41efb65ba09a98ec10f5ce943be0906231878e4b09d7e3e95f
                          • Opcode Fuzzy Hash: 8c685e1f0b85bfe06f91eeefbd03c12bff8419d51c8b157116edbf6ca1c9c829
                          • Instruction Fuzzy Hash: BDF03065714F8482EB049F57BD1835A6761BB48FD2F08D530EE4A67B18DF3CC5459B00
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 0057BC98 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON
                          Download Yara Rule
                          APIs
                          Strings
                          Memory Dump Source
                          • Source File: 00000000.00000002.377736747.0000000000570000.00000040.00001000.00020000.00000000.sdmp, Offset: 00570000, based on PE: true
                          • Associated: 00000000.00000002.377736747.0000000000599000.00000040.00001000.00020000.00000000.sdmpDownload File
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_0_2_570000_mine327.jbxd
                          Similarity
                          • API ID: AddressFreeHandleLibraryModuleProc
                          • String ID: CorExitProcess$mscoree.dll
                          • API String ID: 4061214504-1276376045
                          • Opcode ID: 95c54818ea39ae4ab476006ce308989d1f654d2f667890579c20066112978b6c
                          • Instruction ID: 956f264366d756fe319cffd51827f3ddd1c968ea8d7d791ec0e4ffd273e72937
                          • Opcode Fuzzy Hash: 95c54818ea39ae4ab476006ce308989d1f654d2f667890579c20066112978b6c
                          • Instruction Fuzzy Hash: A0F09061311F0581FB108B25FC4836A6720FB88BA2F548219CE6E4A2E4DF3CC548CB00
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 00575710 Relevance: 7.6, APIs: 5, Instructions: 124threadCOMMON
                          Download Yara Rule
                          APIs
                          • GetCurrentThreadId.KERNEL32 ref: 00575726
                          Memory Dump Source
                          • Source File: 00000000.00000002.377736747.0000000000570000.00000040.00001000.00020000.00000000.sdmp, Offset: 00570000, based on PE: true
                          • Associated: 00000000.00000002.377736747.0000000000599000.00000040.00001000.00020000.00000000.sdmpDownload File
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_0_2_570000_mine327.jbxd
                          Similarity
                          • API ID: CurrentThread
                          • String ID:
                          • API String ID: 2882836952-0
                          • Opcode ID: 0c7f3a11ae4e5ff47235e902b7b6ce7055ed727b420134bb2449cab27e882fd8
                          • Instruction ID: fa48dfb0ba6f72932a51820f202810693d7f5ac3e3b10ab142247935e731b0b4
                          • Opcode Fuzzy Hash: 0c7f3a11ae4e5ff47235e902b7b6ce7055ed727b420134bb2449cab27e882fd8
                          • Instruction Fuzzy Hash: 0F51B536619F85C6DB60CB16F44431ABBA0F3C8794F50951AEA8E47B68EBBCC940DF44
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 00553504 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE
                          Download Yara Rule
                          APIs
                          Memory Dump Source
                          • Source File: 00000000.00000002.377729179.0000000000540000.00000040.00000400.00020000.00000000.sdmp, Offset: 00540000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_0_2_540000_mine327.jbxd
                          Similarity
                          • API ID: _set_statfp
                          • String ID:
                          • API String ID: 1156100317-0
                          • Opcode ID: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
                          • Instruction ID: 49e757b541bb36747fdfd7d4e7a8f163a62c097cf35a97a2a46dcdafb7932090
                          • Opcode Fuzzy Hash: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
                          • Instruction Fuzzy Hash: 1B010832A10E1251DB541528E4763251F817F983F6F58AA3FAD7E167E6FA28CF4D4200
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 00584104 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE
                          Download Yara Rule
                          APIs
                          Memory Dump Source
                          • Source File: 00000000.00000002.377736747.0000000000570000.00000040.00001000.00020000.00000000.sdmp, Offset: 00570000, based on PE: true
                          • Associated: 00000000.00000002.377736747.0000000000599000.00000040.00001000.00020000.00000000.sdmpDownload File
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_0_2_570000_mine327.jbxd
                          Similarity
                          • API ID: _set_statfp
                          • String ID:
                          • API String ID: 1156100317-0
                          • Opcode ID: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
                          • Instruction ID: e626834a04c16669c3d5330297c9bf3ed71f0d157ba58bbc12df8ed0799963b8
                          • Opcode Fuzzy Hash: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
                          • Instruction Fuzzy Hash: C1016532A54F5321E7247568E85E3661D117BB93B8F594A34AD7637BE6CB28C8C1CF00
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 00579650 Relevance: 7.6, APIs: 5, Instructions: 53COMMONLIBRARYCODE
                          Download Yara Rule
                          APIs
                          Memory Dump Source
                          • Source File: 00000000.00000002.377736747.0000000000570000.00000040.00001000.00020000.00000000.sdmp, Offset: 00570000, based on PE: true
                          • Associated: 00000000.00000002.377736747.0000000000599000.00000040.00001000.00020000.00000000.sdmpDownload File
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_0_2_570000_mine327.jbxd
                          Similarity
                          • API ID: ErrorLast
                          • String ID:
                          • API String ID: 1452528299-0
                          • Opcode ID: 46c896f13dff0714c7ccebb8ca9383bb675cc38bcf091c92c481f4a556b8b138
                          • Instruction ID: ab4fbea496eeb865d7624ffe0882f55f27e8c824546a85a84e556fb09a4586c4
                          • Opcode Fuzzy Hash: 46c896f13dff0714c7ccebb8ca9383bb675cc38bcf091c92c481f4a556b8b138
                          • Instruction Fuzzy Hash: B211AB70701A9183DF149B25BC887252A51BB847E0F14D728D92E577D9DF3CC851D724
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 0057AA1C Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 147COMMON
                          Download Yara Rule
                          APIs
                          • EncodePointer.KERNEL32 ref: 0057AA68
                          • _CallSETranslator.LIBVCRUNTIME ref: 0057AAB7
                          Strings
                          Memory Dump Source
                          • Source File: 00000000.00000002.377736747.0000000000570000.00000040.00001000.00020000.00000000.sdmp, Offset: 00570000, based on PE: true
                          • Associated: 00000000.00000002.377736747.0000000000599000.00000040.00001000.00020000.00000000.sdmpDownload File
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_0_2_570000_mine327.jbxd
                          Similarity
                          • API ID: CallEncodePointerTranslator
                          • String ID: MOC$RCC
                          • API String ID: 3544855599-2084237596
                          • Opcode ID: afa423ce38c0d5e6a55dfbc7a81328fa63e7332d8ee03f3f3ca57a2373e92492
                          • Instruction ID: 89e72812ce4a6bbcdf5f99e469e09a3c4783a2fb08ee4f80d3159aa9bf3ace8c
                          • Opcode Fuzzy Hash: afa423ce38c0d5e6a55dfbc7a81328fa63e7332d8ee03f3f3ca57a2373e92492
                          • Instruction Fuzzy Hash: FD518873A00B848AEB20DF65E48039D7BA1F388B88F148216EF8E17B58DB38C595D701
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 0054A178 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMON
                          Download Yara Rule
                          APIs
                          • __except_validate_context_record.LIBVCRUNTIME ref: 0054A1A0
                          • __FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 0054A288
                          Strings
                          Memory Dump Source
                          • Source File: 00000000.00000002.377729179.0000000000540000.00000040.00000400.00020000.00000000.sdmp, Offset: 00540000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_0_2_540000_mine327.jbxd
                          Similarity
                          • API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
                          • String ID: csm$csm
                          • API String ID: 3896166516-3733052814
                          • Opcode ID: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
                          • Instruction ID: 64f5b87d252574119bcdde57c18d85a089b24de4c15266b02bf1e1677a6f80bd
                          • Opcode Fuzzy Hash: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
                          • Instruction Fuzzy Hash: E951F532144781CACFB48F65D4443AD7FA0F395B9CF18961AEB9987B99DB38D490CB02
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 0057AD78 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMON
                          Download Yara Rule
                          APIs
                          • __except_validate_context_record.LIBVCRUNTIME ref: 0057ADA0
                          • __FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 0057AE88
                          Strings
                          Memory Dump Source
                          • Source File: 00000000.00000002.377736747.0000000000570000.00000040.00001000.00020000.00000000.sdmp, Offset: 00570000, based on PE: true
                          • Associated: 00000000.00000002.377736747.0000000000599000.00000040.00001000.00020000.00000000.sdmpDownload File
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_0_2_570000_mine327.jbxd
                          Similarity
                          • API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
                          • String ID: csm$csm
                          • API String ID: 3896166516-3733052814
                          • Opcode ID: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
                          • Instruction ID: 604c25aac036e35f16e2205e4322cf8dd082c19578e198143c562863f2c3be0b
                          • Opcode Fuzzy Hash: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
                          • Instruction Fuzzy Hash: 73517D76100381CACB348F26B58835D7FA4F3D5B95F18D216EA9D47B55CB38D491EB02
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 00548405 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 135COMMON
                          Download Yara Rule
                          APIs
                          • __except_validate_context_record.LIBVCRUNTIME ref: 00548413
                          • _IsNonwritableInCurrentImage.LIBCMT ref: 005484A8
                          Strings
                          Memory Dump Source
                          • Source File: 00000000.00000002.377729179.0000000000540000.00000040.00000400.00020000.00000000.sdmp, Offset: 00540000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_0_2_540000_mine327.jbxd
                          Similarity
                          • API ID: CurrentImageNonwritable__except_validate_context_record
                          • String ID: csm$f
                          • API String ID: 3242871069-629598281
                          • Opcode ID: 114af5d7cf0438a1297bb8b9b6869ba79c6078414514cf9bb502ab9f42d0baed
                          • Instruction ID: 34ddbb06490cf01866425ce584c10de1582e565be29de7dae366aeb9241525b1
                          • Opcode Fuzzy Hash: 114af5d7cf0438a1297bb8b9b6869ba79c6078414514cf9bb502ab9f42d0baed
                          • Instruction Fuzzy Hash: 5C51A832712A00AACB15DB25E844BFD3B65F355B9CF598124DE1A47708EF38D981CB04
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 005483E8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 75COMMON
                          Download Yara Rule
                          APIs
                          • __except_validate_context_record.LIBVCRUNTIME ref: 00548413
                          • _IsNonwritableInCurrentImage.LIBCMT ref: 005484A8
                          Strings
                          Memory Dump Source
                          • Source File: 00000000.00000002.377729179.0000000000540000.00000040.00000400.00020000.00000000.sdmp, Offset: 00540000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_0_2_540000_mine327.jbxd
                          Similarity
                          • API ID: CurrentImageNonwritable__except_validate_context_record
                          • String ID: csm$f
                          • API String ID: 3242871069-629598281
                          • Opcode ID: 0036035fc280b7a5a111a049c7edfc77b7be6b9ab52e14187ebc45e366edaa55
                          • Instruction ID: 6e2255f4fea25a2453d114d97a1162454e929b721eb59defffc36bea3562b2bb
                          • Opcode Fuzzy Hash: 0036035fc280b7a5a111a049c7edfc77b7be6b9ab52e14187ebc45e366edaa55
                          • Instruction Fuzzy Hash: 78318932611B40E6CB15DF12E858BAE7B64F784BDDF598114EE5A07B08EF38DA41CB04
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 00582058 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON
                          Download Yara Rule
                          APIs
                          Memory Dump Source
                          • Source File: 00000000.00000002.377736747.0000000000570000.00000040.00001000.00020000.00000000.sdmp, Offset: 00570000, based on PE: true
                          • Associated: 00000000.00000002.377736747.0000000000599000.00000040.00001000.00020000.00000000.sdmpDownload File
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_0_2_570000_mine327.jbxd
                          Similarity
                          • API ID: FileWrite$ConsoleErrorLastOutput
                          • String ID:
                          • API String ID: 2718003287-0
                          • Opcode ID: d9b1ad1a373a674d1985cb33d71231f2b71aece2c14fe5b700ae80922c385091
                          • Instruction ID: a28994bce47b46dabe2cfad87ba489480dac89c9b19eeeb8ed7aea0ce5bce35d
                          • Opcode Fuzzy Hash: d9b1ad1a373a674d1985cb33d71231f2b71aece2c14fe5b700ae80922c385091
                          • Instruction Fuzzy Hash: BDC10232B14A8089DB11DFB9D4443AC3FB1F394BA8F548216DE5EA7BA9DA34C406C750
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 00582980 Relevance: 6.2, APIs: 4, Instructions: 218COMMON
                          Download Yara Rule
                          APIs
                          Memory Dump Source
                          • Source File: 00000000.00000002.377736747.0000000000570000.00000040.00001000.00020000.00000000.sdmp, Offset: 00570000, based on PE: true
                          • Associated: 00000000.00000002.377736747.0000000000599000.00000040.00001000.00020000.00000000.sdmpDownload File
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_0_2_570000_mine327.jbxd
                          Similarity
                          • API ID: ConsoleErrorLastMode
                          • String ID:
                          • API String ID: 953036326-0
                          • Opcode ID: c5ecde4312ccfa2e1ed1a2c608d038f857b097ec6549ceb78086129b2e572a94
                          • Instruction ID: ae9cf5aa684135d8e48d85046df4c1d785db0dc4f7ccdf35f8e5da231d13295d
                          • Opcode Fuzzy Hash: c5ecde4312ccfa2e1ed1a2c608d038f857b097ec6549ceb78086129b2e572a94
                          • Instruction Fuzzy Hash: 9F81D072B15A50D9EB24EF69D8843BD3FA0F744BC9F64850ADE4A77A54DB34C886CB00
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 0057ED0C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 194COMMON
                          Download Yara Rule
                          APIs
                            • Part of subcall function 0057E668: GetOEMCP.KERNEL32 ref: 0057E692
                          • IsValidCodePage.KERNEL32 ref: 0057ED79
                          • GetCPInfo.KERNEL32 ref: 0057EDBD
                          Strings
                          Memory Dump Source
                          • Source File: 00000000.00000002.377736747.0000000000570000.00000040.00001000.00020000.00000000.sdmp, Offset: 00570000, based on PE: true
                          • Associated: 00000000.00000002.377736747.0000000000599000.00000040.00001000.00020000.00000000.sdmpDownload File
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_0_2_570000_mine327.jbxd
                          Similarity
                          • API ID: CodeInfoPageValid
                          • String ID: yX
                          • API String ID: 546120528-2138869733
                          • Opcode ID: 6822e0a37001ac49409c30972473f96305db3612451a533fd16fefc89a3cd06d
                          • Instruction ID: 01e87f77211445e3e9c58fba145d112b04cd9d780f2f754929d64c8e96008947
                          • Opcode Fuzzy Hash: 6822e0a37001ac49409c30972473f96305db3612451a533fd16fefc89a3cd06d
                          • Instruction Fuzzy Hash: 75713362205B8486EB25DF29F84637ABF65F34CB80F58C4A6DF8E47A10DB39C945E700
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 0057253C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 185COMMON
                          Download Yara Rule
                          APIs
                          Strings
                          Memory Dump Source
                          • Source File: 00000000.00000002.377736747.0000000000570000.00000040.00001000.00020000.00000000.sdmp, Offset: 00570000, based on PE: true
                          • Associated: 00000000.00000002.377736747.0000000000599000.00000040.00001000.00020000.00000000.sdmpDownload File
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_0_2_570000_mine327.jbxd
                          Similarity
                          • API ID: FileType
                          • String ID: \\.\pipe\
                          • API String ID: 3081899298-91387939
                          • Opcode ID: 41f2590248caa42fa42cbc4740ff50b79ee080d5b4a351d521f36d41c2820f1b
                          • Instruction ID: 99762cdc5d362a626bfcf2040580097495647f4da7e2f69b6d68692af7323716
                          • Opcode Fuzzy Hash: 41f2590248caa42fa42cbc4740ff50b79ee080d5b4a351d521f36d41c2820f1b
                          • Instruction Fuzzy Hash: 3961B736200B9186C739DF2AFD583BA6FA4F389B94F548026DE4E57B18DE35CA45E700
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 00549E1C Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 147COMMON
                          Download Yara Rule
                          APIs
                          • _CallSETranslator.LIBVCRUNTIME ref: 00549EB7
                          Strings
                          Memory Dump Source
                          • Source File: 00000000.00000002.377729179.0000000000540000.00000040.00000400.00020000.00000000.sdmp, Offset: 00540000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_0_2_540000_mine327.jbxd
                          Similarity
                          • API ID: CallTranslator
                          • String ID: MOC$RCC
                          • API String ID: 3163161869-2084237596
                          • Opcode ID: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
                          • Instruction ID: e79f4c77bc7fa59dd0cf81c6b65d592a0a7f9298d71badf440f216c613a9ba8a
                          • Opcode Fuzzy Hash: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
                          • Instruction Fuzzy Hash: 0F515533A00B848AEB20DF65D4813EE7BA5F788B8CF144216EF8917B58DB78D595C740
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 00572330 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 141COMMON
                          Download Yara Rule
                          APIs
                          Strings
                          Memory Dump Source
                          • Source File: 00000000.00000002.377736747.0000000000570000.00000040.00001000.00020000.00000000.sdmp, Offset: 00570000, based on PE: true
                          • Associated: 00000000.00000002.377736747.0000000000599000.00000040.00001000.00020000.00000000.sdmpDownload File
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_0_2_570000_mine327.jbxd
                          Similarity
                          • API ID: FileType
                          • String ID: \\.\pipe\
                          • API String ID: 3081899298-91387939
                          • Opcode ID: 002250ee4f7fb53d82cbff54f4c55d9c13c210cbd3ade0a461cf797918ee8e55
                          • Instruction ID: 27e5a48490cb6cad40573c0183c693a9788b122d83b23936ecc31ccbd95d70ab
                          • Opcode Fuzzy Hash: 002250ee4f7fb53d82cbff54f4c55d9c13c210cbd3ade0a461cf797918ee8e55
                          • Instruction Fuzzy Hash: 1C41063221878282DA34DF2AB45C37AAF66F3C5780F85C129DE5D17B19EE39C945E780
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 005826F0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON
                          Download Yara Rule
                          APIs
                          Strings
                          Memory Dump Source
                          • Source File: 00000000.00000002.377736747.0000000000570000.00000040.00001000.00020000.00000000.sdmp, Offset: 00570000, based on PE: true
                          • Associated: 00000000.00000002.377736747.0000000000599000.00000040.00001000.00020000.00000000.sdmpDownload File
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_0_2_570000_mine327.jbxd
                          Similarity
                          • API ID: ErrorFileLastWrite
                          • String ID: U
                          • API String ID: 442123175-4171548499
                          • Opcode ID: 94e3e9b2e49fb54f8b51ea0afa049cb5a9b4caf00c445db25a5723c425a58a56
                          • Instruction ID: 4bbb0bd8d00f3a8a441cade0535b9cf81b19474c51de29dbe68051470b6463b0
                          • Opcode Fuzzy Hash: 94e3e9b2e49fb54f8b51ea0afa049cb5a9b4caf00c445db25a5723c425a58a56
                          • Instruction Fuzzy Hash: 5D31D432715B8086DB20DF26F8443AABBA0F798B94F908021EE4E97758EF3CC441CB40
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 005794A0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMONLIBRARYCODE
                          Download Yara Rule
                          APIs
                          Strings
                          Memory Dump Source
                          • Source File: 00000000.00000002.377736747.0000000000570000.00000040.00001000.00020000.00000000.sdmp, Offset: 00570000, based on PE: true
                          • Associated: 00000000.00000002.377736747.0000000000599000.00000040.00001000.00020000.00000000.sdmpDownload File
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_0_2_570000_mine327.jbxd
                          Similarity
                          • API ID: ExceptionFileHeaderRaise
                          • String ID: csm
                          • API String ID: 2573137834-1018135373
                          • Opcode ID: 596d8aa0106168f831d5a6617a756b303fb26e5894bac8705379b132699e985d
                          • Instruction ID: 4ea718c43624dc53bd461aac343ab1f65b8e13d18028705e0706dd9708a44701
                          • Opcode Fuzzy Hash: 596d8aa0106168f831d5a6617a756b303fb26e5894bac8705379b132699e985d
                          • Instruction Fuzzy Hash: 1D112E36214B9082DB218F29F84435ABBA5FB88B95F588225EFCD07B29DF3CC551CB00
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 00547356 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 18COMMON
                          Download Yara Rule
                          APIs
                          • __std_exception_copy.LIBVCRUNTIME ref: 0054737C
                          Strings
                          Memory Dump Source
                          • Source File: 00000000.00000002.377729179.0000000000540000.00000040.00000400.00020000.00000000.sdmp, Offset: 00540000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_0_2_540000_mine327.jbxd
                          Similarity
                          • API ID: __std_exception_copy
                          • String ID: ierarchy Descriptor'$riptor at (
                          • API String ID: 592178966-758928094
                          • Opcode ID: 13d46e236c22f038e3183f277bc937bc0c01c293d14bd07e4c5c2ea041926035
                          • Instruction ID: 4ffe84382d1598d81005838d0e18a08f3b1da83b6cee4bf4785fabe442455368
                          • Opcode Fuzzy Hash: 13d46e236c22f038e3183f277bc937bc0c01c293d14bd07e4c5c2ea041926035
                          • Instruction Fuzzy Hash: 0DE08661640F45D0DF018F61EC603E833A0EB98B65F989122995C06310FA3CD1E9C700
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 005473B4 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 17COMMON
                          Download Yara Rule
                          APIs
                          • __std_exception_copy.LIBVCRUNTIME ref: 005473D8
                          Strings
                          Memory Dump Source
                          • Source File: 00000000.00000002.377729179.0000000000540000.00000040.00000400.00020000.00000000.sdmp, Offset: 00540000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_0_2_540000_mine327.jbxd
                          Similarity
                          • API ID: __std_exception_copy
                          • String ID: Locator'$riptor at (
                          • API String ID: 592178966-4215709766
                          • Opcode ID: af0f0512ca75cd806a30771dd11e2a0f17b9e6725b3a9df23089972a8cb9d3f7
                          • Instruction ID: cb5310262a87cb101f455c4c39d2461f7c730daf877b32a3b073a750ed712a49
                          • Opcode Fuzzy Hash: af0f0512ca75cd806a30771dd11e2a0f17b9e6725b3a9df23089972a8cb9d3f7
                          • Instruction Fuzzy Hash: 7FE08C61A00F48C0DF028F61ECA03A873A0EBA8B69F889122CA4C06310FA3CD1E9C300
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 00571BF4 Relevance: 5.1, APIs: 4, Instructions: 52memoryCOMMON
                          Download Yara Rule
                          APIs
                          • GetProcessHeap.KERNEL32 ref: 00571C2D
                          • HeapAlloc.KERNEL32 ref: 00571C3B
                          • GetProcessHeap.KERNEL32 ref: 00571C77
                          • HeapFree.KERNEL32 ref: 00571C85
                            • Part of subcall function 0057152C: StrCmpIW.SHLWAPI ref: 0057155D
                          Memory Dump Source
                          • Source File: 00000000.00000002.377736747.0000000000570000.00000040.00001000.00020000.00000000.sdmp, Offset: 00570000, based on PE: true
                          • Associated: 00000000.00000002.377736747.0000000000599000.00000040.00001000.00020000.00000000.sdmpDownload File
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_0_2_570000_mine327.jbxd
                          Similarity
                          • API ID: Heap$Process$AllocFree
                          • String ID:
                          • API String ID: 756756679-0
                          • Opcode ID: e6b128499454e36a5cfdb4ce6de946333e896a2fc86765bea62df52d9c8f7d1a
                          • Instruction ID: 03f658cbe2af5d55591d110e53efaff83e5d6eb243694c9d84f8dad59b886125
                          • Opcode Fuzzy Hash: e6b128499454e36a5cfdb4ce6de946333e896a2fc86765bea62df52d9c8f7d1a
                          • Instruction Fuzzy Hash: 7C117C25611F8485EB05DFAAE80932A7BA5FB89FC1F588028DE4E57726DF38C842D744
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 00571268 Relevance: 5.0, APIs: 4, Instructions: 21memoryCOMMON
                          Download Yara Rule
                          APIs
                          Memory Dump Source
                          • Source File: 00000000.00000002.377736747.0000000000570000.00000040.00001000.00020000.00000000.sdmp, Offset: 00570000, based on PE: true
                          • Associated: 00000000.00000002.377736747.0000000000599000.00000040.00001000.00020000.00000000.sdmpDownload File
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_0_2_570000_mine327.jbxd
                          Similarity
                          • API ID: Heap$AllocProcess
                          • String ID:
                          • API String ID: 1617791916-0
                          • Opcode ID: c7b0d7b4e65e150846e46a28cdf479c2d04166a2b9ed3272f310b0e97a34ba1d
                          • Instruction ID: 4ef620a468cd5f5ecacd67805613c30fabb641f1320b82282eaee587eae97c63
                          • Opcode Fuzzy Hash: c7b0d7b4e65e150846e46a28cdf479c2d04166a2b9ed3272f310b0e97a34ba1d
                          • Instruction Fuzzy Hash: 16E0E575A11A0486EB089F62DC1C35B76E1FB89F56F49C024CD490B362EF7D8499CB90
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 00571000 Relevance: 5.0, APIs: 4, Instructions: 20memoryCOMMON
                          Download Yara Rule
                          APIs
                          Memory Dump Source
                          • Source File: 00000000.00000002.377736747.0000000000570000.00000040.00001000.00020000.00000000.sdmp, Offset: 00570000, based on PE: true
                          • Associated: 00000000.00000002.377736747.0000000000599000.00000040.00001000.00020000.00000000.sdmpDownload File
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_0_2_570000_mine327.jbxd
                          Similarity
                          • API ID: Heap$AllocProcess
                          • String ID:
                          • API String ID: 1617791916-0
                          • Opcode ID: 952b2c0fe5133ab7956e2ef84fe5bf2b2b692290a663e8cebccb5d827e1e35ea
                          • Instruction ID: 3200e899d11a2357643386302b5f4a3b7c0329d3aca960ad1f8b65b6969529f5
                          • Opcode Fuzzy Hash: 952b2c0fe5133ab7956e2ef84fe5bf2b2b692290a663e8cebccb5d827e1e35ea
                          • Instruction Fuzzy Hash: BDE01A75611A0487EB089F62DC0835B76E1FB8CF17F48C024CD090B322EE3C8499CB20
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Execution Graph

                          Execution Coverage:4.6%
                          Dynamic/Decrypted Code Coverage:100%
                          Signature Coverage:0%
                          Total number of Nodes:1357
                          Total number of Limit Nodes:2
                          execution_graph 2420 140001e03 2421 140001e2f 2420->2421 2422 140001e55 2421->2422 2423 140001ecc 2421->2423 2426 140001eb5 2421->2426 2422->2426 2428 140001f12 signal 2422->2428 2424 140001ed3 signal 2423->2424 2423->2426 2425 140001ee4 2424->2425 2424->2426 2425->2426 2427 140001eea signal 2425->2427 2427->2426 2428->2426 3768 140001ac3 3769 140001a70 3768->3769 3770 140001b36 3769->3770 3771 14000199e 3769->3771 3774 140001b53 3769->3774 3773 140001ba0 4 API calls 3770->3773 3772 140001a0f 3771->3772 3775 1400019e9 VirtualProtect 3771->3775 3773->3774 3775->3771 2383 140001ae4 2385 140001a70 2383->2385 2384 140001b36 2391 140001ba0 2384->2391 2385->2384 2386 14000199e 2385->2386 2389 140001b53 2385->2389 2387 140001a0f 2386->2387 2390 1400019e9 VirtualProtect 2386->2390 2390->2386 2394 140001bc2 2391->2394 2392 140001c04 memcpy 2392->2389 2394->2392 2395 140001c45 VirtualQuery 2394->2395 2396 140001cf4 2394->2396 2395->2396 2400 140001c72 2395->2400 2397 140001d23 GetLastError 2396->2397 2398 140001d37 2397->2398 2399 140001ca4 VirtualProtect 2399->2392 2399->2397 2400->2392 2400->2399 2429 140002104 2430 140002111 EnterCriticalSection 2429->2430 2433 140002218 2429->2433 2431 14000220b LeaveCriticalSection 2430->2431 2437 14000212e 2430->2437 2431->2433 2432 140002272 2433->2432 2435 140002241 DeleteCriticalSection 2433->2435 2436 140002230 free 2433->2436 2434 14000214d TlsGetValue GetLastError 2434->2437 2435->2432 2436->2435 2436->2436 2437->2431 2437->2434 2438 140001404 2511 140001394 2438->2511 2440 140001413 2441 140001394 malloc 2440->2441 2442 140001422 2441->2442 2443 140001394 malloc 2442->2443 2444 140001431 2443->2444 2445 140001394 malloc 2444->2445 2446 140001440 2445->2446 2447 140001394 malloc 2446->2447 2448 14000144f 2447->2448 2449 140001394 malloc 2448->2449 2450 14000145e 2449->2450 2451 140001394 malloc 2450->2451 2452 14000146d 2451->2452 2453 140001394 malloc 2452->2453 2454 14000147c 2453->2454 2455 140001394 malloc 2454->2455 2456 14000148b 2455->2456 2457 140001394 malloc 2456->2457 2458 14000149a 2457->2458 2459 140001394 malloc 2458->2459 2460 1400014a9 2459->2460 2461 140001394 malloc 2460->2461 2462 1400014b8 2461->2462 2463 140001394 malloc 2462->2463 2464 1400014c7 2463->2464 2465 140001394 malloc 2464->2465 2466 1400014d6 2465->2466 2467 1400014e5 2466->2467 2468 140001394 malloc 2466->2468 2469 140001394 malloc 2467->2469 2468->2467 2470 1400014ef 2469->2470 2471 1400014f4 2470->2471 2472 140001394 malloc 2470->2472 2473 140001394 malloc 2471->2473 2472->2471 2474 1400014fe 2473->2474 2475 140001503 2474->2475 2476 140001394 malloc 2474->2476 2477 140001394 malloc 2475->2477 2476->2475 2478 14000150d 2477->2478 2479 140001394 malloc 2478->2479 2480 140001512 2479->2480 2481 140001394 malloc 2480->2481 2482 140001521 2481->2482 2483 140001394 malloc 2482->2483 2484 140001530 2483->2484 2485 140001394 malloc 2484->2485 2486 14000153f 2485->2486 2487 140001394 malloc 2486->2487 2488 14000154e 2487->2488 2489 140001394 malloc 2488->2489 2490 14000155d 2489->2490 2491 140001394 malloc 2490->2491 2492 14000156c 2491->2492 2493 140001394 malloc 2492->2493 2494 14000157b 2493->2494 2495 140001394 malloc 2494->2495 2496 14000158a 2495->2496 2497 140001394 malloc 2496->2497 2498 140001599 2497->2498 2499 140001394 malloc 2498->2499 2500 1400015a8 2499->2500 2501 140001394 malloc 2500->2501 2502 1400015b7 2501->2502 2503 140001394 malloc 2502->2503 2504 1400015c6 2503->2504 2505 140001394 malloc 2504->2505 2506 1400015d5 2505->2506 2507 140001394 malloc 2506->2507 2508 1400015e4 2507->2508 2509 140001394 malloc 2508->2509 2510 1400015f3 2509->2510 2512 140006c20 malloc 2511->2512 2513 1400013b8 2512->2513 2513->2440 2401 140001e65 2402 140001e67 signal 2401->2402 2403 140001e7c 2402->2403 2405 140001e99 2402->2405 2404 140001e82 signal 2403->2404 2403->2405 2404->2405 3776 140001f47 3777 140001e67 signal 3776->3777 3778 140001e99 3776->3778 3777->3778 3779 140001e7c 3777->3779 3779->3778 3780 140001e82 signal 3779->3780 3780->3778 2406 14000216f 2407 140002178 InitializeCriticalSection 2406->2407 2408 140002185 2406->2408 2407->2408 2409 140001a70 2410 14000199e 2409->2410 2414 140001a7d 2409->2414 2411 140001a0f 2410->2411 2412 1400019e9 VirtualProtect 2410->2412 2412->2410 2413 140001b53 2414->2409 2414->2413 2415 140001b36 2414->2415 2416 140001ba0 4 API calls 2415->2416 2416->2413 3781 140002050 3782 14000205e EnterCriticalSection 3781->3782 3783 1400020cf 3781->3783 3784 1400020c2 LeaveCriticalSection 3782->3784 3785 140002079 3782->3785 3784->3783 3785->3784 3786 1400020bd free 3785->3786 3786->3784 3787 140001fd0 3788 140001fe4 3787->3788 3789 140002033 3787->3789 3788->3789 3790 140001ffd EnterCriticalSection LeaveCriticalSection 3788->3790 3790->3789 2522 140001ab3 2523 140001a70 2522->2523 2523->2522 2524 140001b36 2523->2524 2525 14000199e 2523->2525 2528 140001b53 2523->2528 2527 140001ba0 4 API calls 2524->2527 2526 140001a0f 2525->2526 2529 1400019e9 VirtualProtect 2525->2529 2527->2528 2529->2525 2376 140001394 2379 140006c20 2376->2379 2378 1400013b8 2380 140006c6b 2379->2380 2382 140006c3e 2379->2382 2381 140006d2f malloc 2380->2381 2380->2382 2381->2382 2382->2378 2514 14000219e 2515 140002272 2514->2515 2516 1400021ab EnterCriticalSection 2514->2516 2517 140002265 LeaveCriticalSection 2516->2517 2518 1400021c8 2516->2518 2517->2515 2518->2517 2519 1400021e9 TlsGetValue GetLastError 2518->2519 2519->2518 2417 140001800 2418 140001812 2417->2418 2419 140001835 fprintf 2418->2419 2520 140002320 strlen 2521 140002337 2520->2521 2530 140001140 2533 140001160 2530->2533 2532 140001156 2534 1400011b9 2533->2534 2535 14000118b 2533->2535 2536 1400011d3 2534->2536 2537 1400011c7 _amsg_exit 2534->2537 2535->2534 2538 140001190 2535->2538 2540 140001201 _initterm 2536->2540 2541 14000121a 2536->2541 2537->2536 2538->2534 2539 1400011a0 Sleep 2538->2539 2539->2534 2539->2538 2540->2541 2558 140001880 2541->2558 2544 14000126a 2545 14000126f malloc 2544->2545 2546 14000128b 2545->2546 2548 1400012d2 2545->2548 2547 1400012a0 strlen malloc memcpy 2546->2547 2547->2547 2549 1400012d0 2547->2549 2571 140003b30 2548->2571 2549->2548 2551 140001315 2552 140001344 2551->2552 2553 140001324 2551->2553 2556 140001160 80 API calls 2552->2556 2554 140001338 2553->2554 2555 14000132d _cexit 2553->2555 2554->2532 2555->2554 2557 140001366 2556->2557 2557->2532 2559 140001247 SetUnhandledExceptionFilter 2558->2559 2560 1400018a2 2558->2560 2559->2544 2560->2559 2561 14000194d 2560->2561 2566 140001a20 2560->2566 2562 140001956 2561->2562 2563 14000199e 2561->2563 2562->2563 2564 140001ba0 4 API calls 2562->2564 2563->2559 2565 1400019e9 VirtualProtect 2563->2565 2564->2562 2565->2563 2566->2563 2567 140001b5c 2566->2567 2568 140001b36 2566->2568 2569 140001ba0 4 API calls 2568->2569 2570 140001b53 2569->2570 2570->2567 2574 140003b46 2571->2574 2572 140003c40 wcslen 2720 14000153f 2572->2720 2574->2572 2576 1400041e7 2576->2551 2579 140003d40 2582 140003d5a memset wcscat memset 2579->2582 2585 140003db3 2582->2585 2584 140003e03 wcslen 2586 140003e15 2584->2586 2590 140003e5c 2584->2590 2585->2584 2587 140003e30 _wcsnicmp 2586->2587 2588 140003e46 wcslen 2587->2588 2587->2590 2588->2587 2588->2590 2589 140003ebd wcscpy wcscat memset 2592 140003efc 2589->2592 2590->2589 2591 140004004 wcscpy wcscat 2593 14000402f memset 2591->2593 2597 140004111 2591->2597 2592->2591 2595 140004050 2593->2595 2594 1400040b5 wcslen 2596 1400040cb 2594->2596 2604 14000410c 2594->2604 2595->2594 2599 1400040e0 _wcsnicmp 2596->2599 2860 140002df0 2597->2860 2600 1400040f6 wcslen 2599->2600 2599->2604 2600->2599 2600->2604 2601 140004356 wcscpy wcscat _wcsicmp 2602 1400043a3 memset 2601->2602 2603 14000438a 2601->2603 2607 1400043c4 2602->2607 2872 1400014d6 2603->2872 2604->2601 2606 140004409 wcscpy wcscat memset 2608 14000444f 2606->2608 2607->2606 2609 14000449f wcscpy wcscat memset 2608->2609 2611 1400044e8 2609->2611 2610 140004518 wcscpy wcscat 2917 140002f70 2610->2917 2611->2610 2613 140004554 2921 1400038c0 2613->2921 2618 14000145e malloc 2620 1400045b7 2618->2620 2619 1400046f8 wcslen 2991 14000157b 2619->2991 2620->2619 2623 14000478a memset 2625 1400047ab 2623->2625 2624 1400047fb wcslen 3008 1400015a8 2624->3008 2625->2624 2627 140002df0 10 API calls 2634 140004947 2627->2634 2628 14000489c 2628->2627 2635 140004a39 _wcsicmp 2628->2635 2630 14000486b _wcsnicmp 2631 140004890 2630->2631 2637 140005071 2630->2637 2632 14000145e malloc 2631->2632 2632->2628 2633 140002df0 10 API calls 2633->2635 2634->2633 2638 140004a54 memset 2635->2638 2651 140004dd7 2635->2651 2636 1400050ce wcslen 2639 1400015a8 malloc 2636->2639 2637->2636 2641 140004a78 2638->2641 2640 14000512a 2639->2640 2643 14000145e malloc 2640->2643 2642 140004abd wcscpy wcscat wcslen 2641->2642 3019 14000146d 2642->3019 2643->2628 2644 140004e8b wcslen 2646 14000153f malloc 2644->2646 2648 140004f16 2646->2648 2650 14000145e malloc 2648->2650 2653 140004f28 2650->2653 2651->2644 2658 140002f70 malloc 2653->2658 2664 140004fb5 2653->2664 2654 140004bc8 3105 1400014a9 2654->3105 2655 140005f5d 2656 14000145e malloc 2655->2656 2659 140005f69 2656->2659 2663 140004f52 2658->2663 2659->2551 2660 140005012 wcslen 2665 140005028 2660->2665 2680 14000506c 2660->2680 2662 140004c64 2668 14000145e malloc 2662->2668 2667 1400038c0 10 API calls 2663->2667 2664->2660 2669 140005040 _wcsnicmp 2665->2669 2672 140004f6f 2667->2672 2673 140004c58 2668->2673 2670 140005056 wcslen 2669->2670 2669->2680 2670->2669 2670->2680 2676 1400014c7 malloc 2672->2676 3221 140003350 memset 2673->3221 2674 1400051d9 memset wcscpy wcscat 2677 140002f70 malloc 2674->2677 2675 140004c4c 2678 14000145e malloc 2675->2678 2679 140004fa7 2676->2679 2682 140005230 2677->2682 2678->2673 2679->2664 2685 14000145e malloc 2679->2685 2680->2674 2684 140003350 10 API calls 2682->2684 2687 140005248 2684->2687 2685->2664 2686 1400014c7 malloc 2690 140004cb3 2686->2690 2688 1400014c7 malloc 2687->2688 2689 140005276 memset 2688->2689 2693 140005297 2689->2693 2691 140002df0 10 API calls 2690->2691 2699 140004d3c 2691->2699 2692 1400052e7 wcslen 2694 140005337 wcscat memset 2692->2694 2695 1400052f9 2692->2695 2693->2692 2701 140005371 2694->2701 2697 140005310 _wcsnicmp 2695->2697 2697->2694 2700 140005322 wcslen 2697->2700 2698 140002df0 10 API calls 2698->2576 2699->2698 2700->2694 2700->2697 2702 1400053c1 wcscpy wcscat 2701->2702 2703 1400053f6 2702->2703 2704 140005ed1 memcpy 2703->2704 2706 140005533 2703->2706 2704->2706 2705 14000569d wcslen 2707 14000153f malloc 2705->2707 2706->2705 2708 140005728 2707->2708 2709 14000145e malloc 2708->2709 2710 140005739 2709->2710 2711 1400057d1 2710->2711 2713 140002f70 malloc 2710->2713 2712 14000145e malloc 2711->2712 2712->2576 2714 140005766 2713->2714 2715 1400038c0 10 API calls 2714->2715 2716 14000578b 2715->2716 2717 1400014c7 malloc 2716->2717 2718 1400057c3 2717->2718 2718->2711 2719 14000145e malloc 2718->2719 2719->2711 2721 140001394 malloc 2720->2721 2722 14000154e 2721->2722 2723 140001394 malloc 2722->2723 2724 14000155d 2723->2724 2725 140001394 malloc 2724->2725 2726 14000156c 2725->2726 2727 140001394 malloc 2726->2727 2728 14000157b 2727->2728 2729 140001394 malloc 2728->2729 2730 14000158a 2729->2730 2731 140001394 malloc 2730->2731 2732 140001599 2731->2732 2733 140001394 malloc 2732->2733 2734 1400015a8 2733->2734 2735 140001394 malloc 2734->2735 2736 1400015b7 2735->2736 2737 140001394 malloc 2736->2737 2738 1400015c6 2737->2738 2739 140001394 malloc 2738->2739 2740 1400015d5 2739->2740 2741 140001394 malloc 2740->2741 2742 1400015e4 2741->2742 2743 140001394 malloc 2742->2743 2744 1400015f3 2743->2744 2744->2576 2745 140001503 2744->2745 2746 140001394 malloc 2745->2746 2747 14000150d 2746->2747 2748 140001394 malloc 2747->2748 2749 140001512 2748->2749 2750 140001394 malloc 2749->2750 2751 140001521 2750->2751 2752 140001394 malloc 2751->2752 2753 140001530 2752->2753 2754 140001394 malloc 2753->2754 2755 14000153f 2754->2755 2756 140001394 malloc 2755->2756 2757 14000154e 2756->2757 2758 140001394 malloc 2757->2758 2759 14000155d 2758->2759 2760 140001394 malloc 2759->2760 2761 14000156c 2760->2761 2762 140001394 malloc 2761->2762 2763 14000157b 2762->2763 2764 140001394 malloc 2763->2764 2765 14000158a 2764->2765 2766 140001394 malloc 2765->2766 2767 140001599 2766->2767 2768 140001394 malloc 2767->2768 2769 1400015a8 2768->2769 2770 140001394 malloc 2769->2770 2771 1400015b7 2770->2771 2772 140001394 malloc 2771->2772 2773 1400015c6 2772->2773 2774 140001394 malloc 2773->2774 2775 1400015d5 2774->2775 2776 140001394 malloc 2775->2776 2777 1400015e4 2776->2777 2778 140001394 malloc 2777->2778 2779 1400015f3 2778->2779 2779->2579 2780 14000156c 2779->2780 2781 140001394 malloc 2780->2781 2782 14000157b 2781->2782 2783 140001394 malloc 2782->2783 2784 14000158a 2783->2784 2785 140001394 malloc 2784->2785 2786 140001599 2785->2786 2787 140001394 malloc 2786->2787 2788 1400015a8 2787->2788 2789 140001394 malloc 2788->2789 2790 1400015b7 2789->2790 2791 140001394 malloc 2790->2791 2792 1400015c6 2791->2792 2793 140001394 malloc 2792->2793 2794 1400015d5 2793->2794 2795 140001394 malloc 2794->2795 2796 1400015e4 2795->2796 2797 140001394 malloc 2796->2797 2798 1400015f3 2797->2798 2798->2579 2799 14000145e 2798->2799 2800 140001394 malloc 2799->2800 2801 14000146d 2800->2801 2802 140001394 malloc 2801->2802 2803 14000147c 2802->2803 2804 140001394 malloc 2803->2804 2805 14000148b 2804->2805 2806 140001394 malloc 2805->2806 2807 14000149a 2806->2807 2808 140001394 malloc 2807->2808 2809 1400014a9 2808->2809 2810 140001394 malloc 2809->2810 2811 1400014b8 2810->2811 2812 140001394 malloc 2811->2812 2813 1400014c7 2812->2813 2814 140001394 malloc 2813->2814 2815 1400014d6 2814->2815 2816 1400014e5 2815->2816 2817 140001394 malloc 2815->2817 2818 140001394 malloc 2816->2818 2817->2816 2819 1400014ef 2818->2819 2820 1400014f4 2819->2820 2821 140001394 malloc 2819->2821 2822 140001394 malloc 2820->2822 2821->2820 2823 1400014fe 2822->2823 2824 140001503 2823->2824 2825 140001394 malloc 2823->2825 2826 140001394 malloc 2824->2826 2825->2824 2827 14000150d 2826->2827 2828 140001394 malloc 2827->2828 2829 140001512 2828->2829 2830 140001394 malloc 2829->2830 2831 140001521 2830->2831 2832 140001394 malloc 2831->2832 2833 140001530 2832->2833 2834 140001394 malloc 2833->2834 2835 14000153f 2834->2835 2836 140001394 malloc 2835->2836 2837 14000154e 2836->2837 2838 140001394 malloc 2837->2838 2839 14000155d 2838->2839 2840 140001394 malloc 2839->2840 2841 14000156c 2840->2841 2842 140001394 malloc 2841->2842 2843 14000157b 2842->2843 2844 140001394 malloc 2843->2844 2845 14000158a 2844->2845 2846 140001394 malloc 2845->2846 2847 140001599 2846->2847 2848 140001394 malloc 2847->2848 2849 1400015a8 2848->2849 2850 140001394 malloc 2849->2850 2851 1400015b7 2850->2851 2852 140001394 malloc 2851->2852 2853 1400015c6 2852->2853 2854 140001394 malloc 2853->2854 2855 1400015d5 2854->2855 2856 140001394 malloc 2855->2856 2857 1400015e4 2856->2857 2858 140001394 malloc 2857->2858 2859 1400015f3 2858->2859 2859->2579 3237 140002660 2860->3237 2862 140002e00 memset 2863 140002e3c 2862->2863 3239 140002690 2863->3239 2866 14000145e malloc 2868 140002f35 2866->2868 2867 140002f53 2870 14000145e malloc 2867->2870 2868->2867 3272 140001512 2868->3272 2871 140002f5d 2870->2871 2871->2576 2873 1400014e5 2872->2873 2874 140001394 malloc 2872->2874 2875 140001394 malloc 2873->2875 2874->2873 2876 1400014ef 2875->2876 2877 1400014f4 2876->2877 2878 140001394 malloc 2876->2878 2879 140001394 malloc 2877->2879 2878->2877 2880 1400014fe 2879->2880 2881 140001503 2880->2881 2882 140001394 malloc 2880->2882 2883 140001394 malloc 2881->2883 2882->2881 2884 14000150d 2883->2884 2885 140001394 malloc 2884->2885 2886 140001512 2885->2886 2887 140001394 malloc 2886->2887 2888 140001521 2887->2888 2889 140001394 malloc 2888->2889 2890 140001530 2889->2890 2891 140001394 malloc 2890->2891 2892 14000153f 2891->2892 2893 140001394 malloc 2892->2893 2894 14000154e 2893->2894 2895 140001394 malloc 2894->2895 2896 14000155d 2895->2896 2897 140001394 malloc 2896->2897 2898 14000156c 2897->2898 2899 140001394 malloc 2898->2899 2900 14000157b 2899->2900 2901 140001394 malloc 2900->2901 2902 14000158a 2901->2902 2903 140001394 malloc 2902->2903 2904 140001599 2903->2904 2905 140001394 malloc 2904->2905 2906 1400015a8 2905->2906 2907 140001394 malloc 2906->2907 2908 1400015b7 2907->2908 2909 140001394 malloc 2908->2909 2910 1400015c6 2909->2910 2911 140001394 malloc 2910->2911 2912 1400015d5 2911->2912 2913 140001394 malloc 2912->2913 2914 1400015e4 2913->2914 2915 140001394 malloc 2914->2915 2916 1400015f3 2915->2916 2916->2602 2918 140002f88 2917->2918 2919 1400014a9 malloc 2918->2919 2920 140002fd0 2919->2920 2920->2613 2922 140002690 9 API calls 2921->2922 2923 1400038fe 2922->2923 2924 140003b01 2923->2924 2925 1400014a9 malloc 2923->2925 2944 1400014c7 2924->2944 2926 140003947 2925->2926 2933 140003b08 2926->2933 3406 1400014b8 2926->3406 2929 140003a67 memset 3460 14000148b 2929->3460 2932 1400014b8 malloc 2934 14000396f 2932->2934 3625 1400015c6 2933->3625 2934->2929 2934->2932 3455 1400015d5 2934->3455 2938 1400014b8 malloc 2939 140003ae7 2938->2939 2939->2933 2940 140003aeb 2939->2940 3568 14000147c 2940->3568 2943 14000145e malloc 2943->2924 2945 140001394 malloc 2944->2945 2946 1400014d6 2945->2946 2947 1400014e5 2946->2947 2948 140001394 malloc 2946->2948 2949 140001394 malloc 2947->2949 2948->2947 2950 1400014ef 2949->2950 2951 1400014f4 2950->2951 2952 140001394 malloc 2950->2952 2953 140001394 malloc 2951->2953 2952->2951 2954 1400014fe 2953->2954 2955 140001503 2954->2955 2956 140001394 malloc 2954->2956 2957 140001394 malloc 2955->2957 2956->2955 2958 14000150d 2957->2958 2959 140001394 malloc 2958->2959 2960 140001512 2959->2960 2961 140001394 malloc 2960->2961 2962 140001521 2961->2962 2963 140001394 malloc 2962->2963 2964 140001530 2963->2964 2965 140001394 malloc 2964->2965 2966 14000153f 2965->2966 2967 140001394 malloc 2966->2967 2968 14000154e 2967->2968 2969 140001394 malloc 2968->2969 2970 14000155d 2969->2970 2971 140001394 malloc 2970->2971 2972 14000156c 2971->2972 2973 140001394 malloc 2972->2973 2974 14000157b 2973->2974 2975 140001394 malloc 2974->2975 2976 14000158a 2975->2976 2977 140001394 malloc 2976->2977 2978 140001599 2977->2978 2979 140001394 malloc 2978->2979 2980 1400015a8 2979->2980 2981 140001394 malloc 2980->2981 2982 1400015b7 2981->2982 2983 140001394 malloc 2982->2983 2984 1400015c6 2983->2984 2985 140001394 malloc 2984->2985 2986 1400015d5 2985->2986 2987 140001394 malloc 2986->2987 2988 1400015e4 2987->2988 2989 140001394 malloc 2988->2989 2990 1400015f3 2989->2990 2990->2618 2990->2620 2992 140001394 malloc 2991->2992 2993 14000158a 2992->2993 2994 140001394 malloc 2993->2994 2995 140001599 2994->2995 2996 140001394 malloc 2995->2996 2997 1400015a8 2996->2997 2998 140001394 malloc 2997->2998 2999 1400015b7 2998->2999 3000 140001394 malloc 2999->3000 3001 1400015c6 3000->3001 3002 140001394 malloc 3001->3002 3003 1400015d5 3002->3003 3004 140001394 malloc 3003->3004 3005 1400015e4 3004->3005 3006 140001394 malloc 3005->3006 3007 1400015f3 3006->3007 3007->2623 3007->2628 3009 140001394 malloc 3008->3009 3010 1400015b7 3009->3010 3011 140001394 malloc 3010->3011 3012 1400015c6 3011->3012 3013 140001394 malloc 3012->3013 3014 1400015d5 3013->3014 3015 140001394 malloc 3014->3015 3016 1400015e4 3015->3016 3017 140001394 malloc 3016->3017 3018 1400015f3 3017->3018 3018->2630 3018->2631 3020 140001394 malloc 3019->3020 3021 14000147c 3020->3021 3022 140001394 malloc 3021->3022 3023 14000148b 3022->3023 3024 140001394 malloc 3023->3024 3025 14000149a 3024->3025 3026 140001394 malloc 3025->3026 3027 1400014a9 3026->3027 3028 140001394 malloc 3027->3028 3029 1400014b8 3028->3029 3030 140001394 malloc 3029->3030 3031 1400014c7 3030->3031 3032 140001394 malloc 3031->3032 3033 1400014d6 3032->3033 3034 1400014e5 3033->3034 3035 140001394 malloc 3033->3035 3036 140001394 malloc 3034->3036 3035->3034 3037 1400014ef 3036->3037 3038 1400014f4 3037->3038 3039 140001394 malloc 3037->3039 3040 140001394 malloc 3038->3040 3039->3038 3041 1400014fe 3040->3041 3042 140001503 3041->3042 3043 140001394 malloc 3041->3043 3044 140001394 malloc 3042->3044 3043->3042 3045 14000150d 3044->3045 3046 140001394 malloc 3045->3046 3047 140001512 3046->3047 3048 140001394 malloc 3047->3048 3049 140001521 3048->3049 3050 140001394 malloc 3049->3050 3051 140001530 3050->3051 3052 140001394 malloc 3051->3052 3053 14000153f 3052->3053 3054 140001394 malloc 3053->3054 3055 14000154e 3054->3055 3056 140001394 malloc 3055->3056 3057 14000155d 3056->3057 3058 140001394 malloc 3057->3058 3059 14000156c 3058->3059 3060 140001394 malloc 3059->3060 3061 14000157b 3060->3061 3062 140001394 malloc 3061->3062 3063 14000158a 3062->3063 3064 140001394 malloc 3063->3064 3065 140001599 3064->3065 3066 140001394 malloc 3065->3066 3067 1400015a8 3066->3067 3068 140001394 malloc 3067->3068 3069 1400015b7 3068->3069 3070 140001394 malloc 3069->3070 3071 1400015c6 3070->3071 3072 140001394 malloc 3071->3072 3073 1400015d5 3072->3073 3074 140001394 malloc 3073->3074 3075 1400015e4 3074->3075 3076 140001394 malloc 3075->3076 3077 1400015f3 3076->3077 3078 140001530 3077->3078 3079 140001394 malloc 3078->3079 3080 14000153f 3079->3080 3081 140001394 malloc 3080->3081 3082 14000154e 3081->3082 3083 140001394 malloc 3082->3083 3084 14000155d 3083->3084 3085 140001394 malloc 3084->3085 3086 14000156c 3085->3086 3087 140001394 malloc 3086->3087 3088 14000157b 3087->3088 3089 140001394 malloc 3088->3089 3090 14000158a 3089->3090 3091 140001394 malloc 3090->3091 3092 140001599 3091->3092 3093 140001394 malloc 3092->3093 3094 1400015a8 3093->3094 3095 140001394 malloc 3094->3095 3096 1400015b7 3095->3096 3097 140001394 malloc 3096->3097 3098 1400015c6 3097->3098 3099 140001394 malloc 3098->3099 3100 1400015d5 3099->3100 3101 140001394 malloc 3100->3101 3102 1400015e4 3101->3102 3103 140001394 malloc 3102->3103 3104 1400015f3 3103->3104 3104->2654 3104->2655 3106 140001394 malloc 3105->3106 3107 1400014b8 3106->3107 3108 140001394 malloc 3107->3108 3109 1400014c7 3108->3109 3110 140001394 malloc 3109->3110 3111 1400014d6 3110->3111 3112 1400014e5 3111->3112 3113 140001394 malloc 3111->3113 3114 140001394 malloc 3112->3114 3113->3112 3115 1400014ef 3114->3115 3116 1400014f4 3115->3116 3117 140001394 malloc 3115->3117 3118 140001394 malloc 3116->3118 3117->3116 3119 1400014fe 3118->3119 3120 140001503 3119->3120 3121 140001394 malloc 3119->3121 3122 140001394 malloc 3120->3122 3121->3120 3123 14000150d 3122->3123 3124 140001394 malloc 3123->3124 3125 140001512 3124->3125 3126 140001394 malloc 3125->3126 3127 140001521 3126->3127 3128 140001394 malloc 3127->3128 3129 140001530 3128->3129 3130 140001394 malloc 3129->3130 3131 14000153f 3130->3131 3132 140001394 malloc 3131->3132 3133 14000154e 3132->3133 3134 140001394 malloc 3133->3134 3135 14000155d 3134->3135 3136 140001394 malloc 3135->3136 3137 14000156c 3136->3137 3138 140001394 malloc 3137->3138 3139 14000157b 3138->3139 3140 140001394 malloc 3139->3140 3141 14000158a 3140->3141 3142 140001394 malloc 3141->3142 3143 140001599 3142->3143 3144 140001394 malloc 3143->3144 3145 1400015a8 3144->3145 3146 140001394 malloc 3145->3146 3147 1400015b7 3146->3147 3148 140001394 malloc 3147->3148 3149 1400015c6 3148->3149 3150 140001394 malloc 3149->3150 3151 1400015d5 3150->3151 3152 140001394 malloc 3151->3152 3153 1400015e4 3152->3153 3154 140001394 malloc 3153->3154 3155 1400015f3 3154->3155 3155->2662 3156 140001440 3155->3156 3157 140001394 malloc 3156->3157 3158 14000144f 3157->3158 3159 140001394 malloc 3158->3159 3160 14000145e 3159->3160 3161 140001394 malloc 3160->3161 3162 14000146d 3161->3162 3163 140001394 malloc 3162->3163 3164 14000147c 3163->3164 3165 140001394 malloc 3164->3165 3166 14000148b 3165->3166 3167 140001394 malloc 3166->3167 3168 14000149a 3167->3168 3169 140001394 malloc 3168->3169 3170 1400014a9 3169->3170 3171 140001394 malloc 3170->3171 3172 1400014b8 3171->3172 3173 140001394 malloc 3172->3173 3174 1400014c7 3173->3174 3175 140001394 malloc 3174->3175 3176 1400014d6 3175->3176 3177 1400014e5 3176->3177 3178 140001394 malloc 3176->3178 3179 140001394 malloc 3177->3179 3178->3177 3180 1400014ef 3179->3180 3181 1400014f4 3180->3181 3182 140001394 malloc 3180->3182 3183 140001394 malloc 3181->3183 3182->3181 3184 1400014fe 3183->3184 3185 140001503 3184->3185 3186 140001394 malloc 3184->3186 3187 140001394 malloc 3185->3187 3186->3185 3188 14000150d 3187->3188 3189 140001394 malloc 3188->3189 3190 140001512 3189->3190 3191 140001394 malloc 3190->3191 3192 140001521 3191->3192 3193 140001394 malloc 3192->3193 3194 140001530 3193->3194 3195 140001394 malloc 3194->3195 3196 14000153f 3195->3196 3197 140001394 malloc 3196->3197 3198 14000154e 3197->3198 3199 140001394 malloc 3198->3199 3200 14000155d 3199->3200 3201 140001394 malloc 3200->3201 3202 14000156c 3201->3202 3203 140001394 malloc 3202->3203 3204 14000157b 3203->3204 3205 140001394 malloc 3204->3205 3206 14000158a 3205->3206 3207 140001394 malloc 3206->3207 3208 140001599 3207->3208 3209 140001394 malloc 3208->3209 3210 1400015a8 3209->3210 3211 140001394 malloc 3210->3211 3212 1400015b7 3211->3212 3213 140001394 malloc 3212->3213 3214 1400015c6 3213->3214 3215 140001394 malloc 3214->3215 3216 1400015d5 3215->3216 3217 140001394 malloc 3216->3217 3218 1400015e4 3217->3218 3219 140001394 malloc 3218->3219 3220 1400015f3 3219->3220 3220->2662 3220->2675 3222 1400035c1 memset 3221->3222 3226 1400033c3 3221->3226 3225 1400035e6 3222->3225 3223 14000343a memset 3223->3226 3224 14000362b wcscpy wcscat wcslen 3227 140001422 malloc 3224->3227 3225->3224 3226->3222 3226->3223 3228 140003493 wcscpy wcscat wcslen 3226->3228 3234 14000145e malloc 3226->3234 3236 140003579 3226->3236 3231 140003728 3227->3231 3632 140001422 3228->3632 3230 140003767 3230->2686 3231->3230 3701 140001431 3231->3701 3234->3226 3235 14000145e malloc 3235->3230 3236->3222 3238 14000266f 3237->3238 3238->2862 3238->3238 3303 14000155d 3239->3303 3241 1400027f4 3242 1400014c7 malloc 3241->3242 3243 140002816 3242->3243 3247 140001503 malloc 3243->3247 3244 140002785 wcsncmp 3324 1400014e5 3244->3324 3248 14000283d 3247->3248 3250 140002847 memset 3248->3250 3249 140002d27 3252 140002877 3250->3252 3251 1400028bc wcscpy wcscat wcslen 3253 14000291a 3251->3253 3254 1400028ee wcslen 3251->3254 3252->3251 3255 140002967 wcslen 3253->3255 3257 140002985 3253->3257 3254->3253 3255->3257 3256 1400029d9 wcslen 3258 1400014a9 malloc 3256->3258 3257->3249 3257->3256 3259 140002a73 3258->3259 3260 1400014a9 malloc 3259->3260 3261 140002bd2 3260->3261 3367 1400014f4 3261->3367 3264 1400014c7 malloc 3265 140002c99 3264->3265 3266 1400014c7 malloc 3265->3266 3267 140002cb1 3266->3267 3268 14000145e malloc 3267->3268 3269 140002cbb 3268->3269 3270 14000145e malloc 3269->3270 3271 140002cc5 3270->3271 3271->2866 3273 140001394 malloc 3272->3273 3274 140001521 3273->3274 3275 140001394 malloc 3274->3275 3276 140001530 3275->3276 3277 140001394 malloc 3276->3277 3278 14000153f 3277->3278 3279 140001394 malloc 3278->3279 3280 14000154e 3279->3280 3281 140001394 malloc 3280->3281 3282 14000155d 3281->3282 3283 140001394 malloc 3282->3283 3284 14000156c 3283->3284 3285 140001394 malloc 3284->3285 3286 14000157b 3285->3286 3287 140001394 malloc 3286->3287 3288 14000158a 3287->3288 3289 140001394 malloc 3288->3289 3290 140001599 3289->3290 3291 140001394 malloc 3290->3291 3292 1400015a8 3291->3292 3293 140001394 malloc 3292->3293 3294 1400015b7 3293->3294 3295 140001394 malloc 3294->3295 3296 1400015c6 3295->3296 3297 140001394 malloc 3296->3297 3298 1400015d5 3297->3298 3299 140001394 malloc 3298->3299 3300 1400015e4 3299->3300 3301 140001394 malloc 3300->3301 3302 1400015f3 3301->3302 3302->2867 3304 140001394 malloc 3303->3304 3305 14000156c 3304->3305 3306 140001394 malloc 3305->3306 3307 14000157b 3306->3307 3308 140001394 malloc 3307->3308 3309 14000158a 3308->3309 3310 140001394 malloc 3309->3310 3311 140001599 3310->3311 3312 140001394 malloc 3311->3312 3313 1400015a8 3312->3313 3314 140001394 malloc 3313->3314 3315 1400015b7 3314->3315 3316 140001394 malloc 3315->3316 3317 1400015c6 3316->3317 3318 140001394 malloc 3317->3318 3319 1400015d5 3318->3319 3320 140001394 malloc 3319->3320 3321 1400015e4 3320->3321 3322 140001394 malloc 3321->3322 3323 1400015f3 3322->3323 3323->3241 3323->3244 3323->3249 3325 140001394 malloc 3324->3325 3326 1400014ef 3325->3326 3327 1400014f4 3326->3327 3328 140001394 malloc 3326->3328 3329 140001394 malloc 3327->3329 3328->3327 3330 1400014fe 3329->3330 3331 140001503 3330->3331 3332 140001394 malloc 3330->3332 3333 140001394 malloc 3331->3333 3332->3331 3334 14000150d 3333->3334 3335 140001394 malloc 3334->3335 3336 140001512 3335->3336 3337 140001394 malloc 3336->3337 3338 140001521 3337->3338 3339 140001394 malloc 3338->3339 3340 140001530 3339->3340 3341 140001394 malloc 3340->3341 3342 14000153f 3341->3342 3343 140001394 malloc 3342->3343 3344 14000154e 3343->3344 3345 140001394 malloc 3344->3345 3346 14000155d 3345->3346 3347 140001394 malloc 3346->3347 3348 14000156c 3347->3348 3349 140001394 malloc 3348->3349 3350 14000157b 3349->3350 3351 140001394 malloc 3350->3351 3352 14000158a 3351->3352 3353 140001394 malloc 3352->3353 3354 140001599 3353->3354 3355 140001394 malloc 3354->3355 3356 1400015a8 3355->3356 3357 140001394 malloc 3356->3357 3358 1400015b7 3357->3358 3359 140001394 malloc 3358->3359 3360 1400015c6 3359->3360 3361 140001394 malloc 3360->3361 3362 1400015d5 3361->3362 3363 140001394 malloc 3362->3363 3364 1400015e4 3363->3364 3365 140001394 malloc 3364->3365 3366 1400015f3 3365->3366 3366->3241 3368 140001394 malloc 3367->3368 3369 1400014fe 3368->3369 3370 140001503 3369->3370 3371 140001394 malloc 3369->3371 3372 140001394 malloc 3370->3372 3371->3370 3373 14000150d 3372->3373 3374 140001394 malloc 3373->3374 3375 140001512 3374->3375 3376 140001394 malloc 3375->3376 3377 140001521 3376->3377 3378 140001394 malloc 3377->3378 3379 140001530 3378->3379 3380 140001394 malloc 3379->3380 3381 14000153f 3380->3381 3382 140001394 malloc 3381->3382 3383 14000154e 3382->3383 3384 140001394 malloc 3383->3384 3385 14000155d 3384->3385 3386 140001394 malloc 3385->3386 3387 14000156c 3386->3387 3388 140001394 malloc 3387->3388 3389 14000157b 3388->3389 3390 140001394 malloc 3389->3390 3391 14000158a 3390->3391 3392 140001394 malloc 3391->3392 3393 140001599 3392->3393 3394 140001394 malloc 3393->3394 3395 1400015a8 3394->3395 3396 140001394 malloc 3395->3396 3397 1400015b7 3396->3397 3398 140001394 malloc 3397->3398 3399 1400015c6 3398->3399 3400 140001394 malloc 3399->3400 3401 1400015d5 3400->3401 3402 140001394 malloc 3401->3402 3403 1400015e4 3402->3403 3404 140001394 malloc 3403->3404 3405 1400015f3 3404->3405 3405->3264 3407 140001394 malloc 3406->3407 3408 1400014c7 3407->3408 3409 140001394 malloc 3408->3409 3410 1400014d6 3409->3410 3411 1400014e5 3410->3411 3412 140001394 malloc 3410->3412 3413 140001394 malloc 3411->3413 3412->3411 3414 1400014ef 3413->3414 3415 1400014f4 3414->3415 3416 140001394 malloc 3414->3416 3417 140001394 malloc 3415->3417 3416->3415 3418 1400014fe 3417->3418 3419 140001503 3418->3419 3420 140001394 malloc 3418->3420 3421 140001394 malloc 3419->3421 3420->3419 3422 14000150d 3421->3422 3423 140001394 malloc 3422->3423 3424 140001512 3423->3424 3425 140001394 malloc 3424->3425 3426 140001521 3425->3426 3427 140001394 malloc 3426->3427 3428 140001530 3427->3428 3429 140001394 malloc 3428->3429 3430 14000153f 3429->3430 3431 140001394 malloc 3430->3431 3432 14000154e 3431->3432 3433 140001394 malloc 3432->3433 3434 14000155d 3433->3434 3435 140001394 malloc 3434->3435 3436 14000156c 3435->3436 3437 140001394 malloc 3436->3437 3438 14000157b 3437->3438 3439 140001394 malloc 3438->3439 3440 14000158a 3439->3440 3441 140001394 malloc 3440->3441 3442 140001599 3441->3442 3443 140001394 malloc 3442->3443 3444 1400015a8 3443->3444 3445 140001394 malloc 3444->3445 3446 1400015b7 3445->3446 3447 140001394 malloc 3446->3447 3448 1400015c6 3447->3448 3449 140001394 malloc 3448->3449 3450 1400015d5 3449->3450 3451 140001394 malloc 3450->3451 3452 1400015e4 3451->3452 3453 140001394 malloc 3452->3453 3454 1400015f3 3453->3454 3454->2934 3456 140001394 malloc 3455->3456 3457 1400015e4 3456->3457 3458 140001394 malloc 3457->3458 3459 1400015f3 3458->3459 3459->2934 3461 140001394 malloc 3460->3461 3462 14000149a 3461->3462 3463 140001394 malloc 3462->3463 3464 1400014a9 3463->3464 3465 140001394 malloc 3464->3465 3466 1400014b8 3465->3466 3467 140001394 malloc 3466->3467 3468 1400014c7 3467->3468 3469 140001394 malloc 3468->3469 3470 1400014d6 3469->3470 3471 1400014e5 3470->3471 3472 140001394 malloc 3470->3472 3473 140001394 malloc 3471->3473 3472->3471 3474 1400014ef 3473->3474 3475 1400014f4 3474->3475 3476 140001394 malloc 3474->3476 3477 140001394 malloc 3475->3477 3476->3475 3478 1400014fe 3477->3478 3479 140001503 3478->3479 3480 140001394 malloc 3478->3480 3481 140001394 malloc 3479->3481 3480->3479 3482 14000150d 3481->3482 3483 140001394 malloc 3482->3483 3484 140001512 3483->3484 3485 140001394 malloc 3484->3485 3486 140001521 3485->3486 3487 140001394 malloc 3486->3487 3488 140001530 3487->3488 3489 140001394 malloc 3488->3489 3490 14000153f 3489->3490 3491 140001394 malloc 3490->3491 3492 14000154e 3491->3492 3493 140001394 malloc 3492->3493 3494 14000155d 3493->3494 3495 140001394 malloc 3494->3495 3496 14000156c 3495->3496 3497 140001394 malloc 3496->3497 3498 14000157b 3497->3498 3499 140001394 malloc 3498->3499 3500 14000158a 3499->3500 3501 140001394 malloc 3500->3501 3502 140001599 3501->3502 3503 140001394 malloc 3502->3503 3504 1400015a8 3503->3504 3505 140001394 malloc 3504->3505 3506 1400015b7 3505->3506 3507 140001394 malloc 3506->3507 3508 1400015c6 3507->3508 3509 140001394 malloc 3508->3509 3510 1400015d5 3509->3510 3511 140001394 malloc 3510->3511 3512 1400015e4 3511->3512 3513 140001394 malloc 3512->3513 3514 1400015f3 3513->3514 3514->2933 3515 14000149a 3514->3515 3516 140001394 malloc 3515->3516 3517 1400014a9 3516->3517 3518 140001394 malloc 3517->3518 3519 1400014b8 3518->3519 3520 140001394 malloc 3519->3520 3521 1400014c7 3520->3521 3522 140001394 malloc 3521->3522 3523 1400014d6 3522->3523 3524 1400014e5 3523->3524 3525 140001394 malloc 3523->3525 3526 140001394 malloc 3524->3526 3525->3524 3527 1400014ef 3526->3527 3528 1400014f4 3527->3528 3529 140001394 malloc 3527->3529 3530 140001394 malloc 3528->3530 3529->3528 3531 1400014fe 3530->3531 3532 140001503 3531->3532 3533 140001394 malloc 3531->3533 3534 140001394 malloc 3532->3534 3533->3532 3535 14000150d 3534->3535 3536 140001394 malloc 3535->3536 3537 140001512 3536->3537 3538 140001394 malloc 3537->3538 3539 140001521 3538->3539 3540 140001394 malloc 3539->3540 3541 140001530 3540->3541 3542 140001394 malloc 3541->3542 3543 14000153f 3542->3543 3544 140001394 malloc 3543->3544 3545 14000154e 3544->3545 3546 140001394 malloc 3545->3546 3547 14000155d 3546->3547 3548 140001394 malloc 3547->3548 3549 14000156c 3548->3549 3550 140001394 malloc 3549->3550 3551 14000157b 3550->3551 3552 140001394 malloc 3551->3552 3553 14000158a 3552->3553 3554 140001394 malloc 3553->3554 3555 140001599 3554->3555 3556 140001394 malloc 3555->3556 3557 1400015a8 3556->3557 3558 140001394 malloc 3557->3558 3559 1400015b7 3558->3559 3560 140001394 malloc 3559->3560 3561 1400015c6 3560->3561 3562 140001394 malloc 3561->3562 3563 1400015d5 3562->3563 3564 140001394 malloc 3563->3564 3565 1400015e4 3564->3565 3566 140001394 malloc 3565->3566 3567 1400015f3 3566->3567 3567->2933 3567->2938 3569 140001394 malloc 3568->3569 3570 14000148b 3569->3570 3571 140001394 malloc 3570->3571 3572 14000149a 3571->3572 3573 140001394 malloc 3572->3573 3574 1400014a9 3573->3574 3575 140001394 malloc 3574->3575 3576 1400014b8 3575->3576 3577 140001394 malloc 3576->3577 3578 1400014c7 3577->3578 3579 140001394 malloc 3578->3579 3580 1400014d6 3579->3580 3581 1400014e5 3580->3581 3582 140001394 malloc 3580->3582 3583 140001394 malloc 3581->3583 3582->3581 3584 1400014ef 3583->3584 3585 1400014f4 3584->3585 3586 140001394 malloc 3584->3586 3587 140001394 malloc 3585->3587 3586->3585 3588 1400014fe 3587->3588 3589 140001503 3588->3589 3590 140001394 malloc 3588->3590 3591 140001394 malloc 3589->3591 3590->3589 3592 14000150d 3591->3592 3593 140001394 malloc 3592->3593 3594 140001512 3593->3594 3595 140001394 malloc 3594->3595 3596 140001521 3595->3596 3597 140001394 malloc 3596->3597 3598 140001530 3597->3598 3599 140001394 malloc 3598->3599 3600 14000153f 3599->3600 3601 140001394 malloc 3600->3601 3602 14000154e 3601->3602 3603 140001394 malloc 3602->3603 3604 14000155d 3603->3604 3605 140001394 malloc 3604->3605 3606 14000156c 3605->3606 3607 140001394 malloc 3606->3607 3608 14000157b 3607->3608 3609 140001394 malloc 3608->3609 3610 14000158a 3609->3610 3611 140001394 malloc 3610->3611 3612 140001599 3611->3612 3613 140001394 malloc 3612->3613 3614 1400015a8 3613->3614 3615 140001394 malloc 3614->3615 3616 1400015b7 3615->3616 3617 140001394 malloc 3616->3617 3618 1400015c6 3617->3618 3619 140001394 malloc 3618->3619 3620 1400015d5 3619->3620 3621 140001394 malloc 3620->3621 3622 1400015e4 3621->3622 3623 140001394 malloc 3622->3623 3624 1400015f3 3623->3624 3624->2943 3626 140001394 malloc 3625->3626 3627 1400015d5 3626->3627 3628 140001394 malloc 3627->3628 3629 1400015e4 3628->3629 3630 140001394 malloc 3629->3630 3631 1400015f3 3630->3631 3631->2924 3633 140001394 malloc 3632->3633 3634 140001431 3633->3634 3635 140001394 malloc 3634->3635 3636 140001440 3635->3636 3637 140001394 malloc 3636->3637 3638 14000144f 3637->3638 3639 140001394 malloc 3638->3639 3640 14000145e 3639->3640 3641 140001394 malloc 3640->3641 3642 14000146d 3641->3642 3643 140001394 malloc 3642->3643 3644 14000147c 3643->3644 3645 140001394 malloc 3644->3645 3646 14000148b 3645->3646 3647 140001394 malloc 3646->3647 3648 14000149a 3647->3648 3649 140001394 malloc 3648->3649 3650 1400014a9 3649->3650 3651 140001394 malloc 3650->3651 3652 1400014b8 3651->3652 3653 140001394 malloc 3652->3653 3654 1400014c7 3653->3654 3655 140001394 malloc 3654->3655 3656 1400014d6 3655->3656 3657 1400014e5 3656->3657 3658 140001394 malloc 3656->3658 3659 140001394 malloc 3657->3659 3658->3657 3660 1400014ef 3659->3660 3661 1400014f4 3660->3661 3662 140001394 malloc 3660->3662 3663 140001394 malloc 3661->3663 3662->3661 3664 1400014fe 3663->3664 3665 140001503 3664->3665 3666 140001394 malloc 3664->3666 3667 140001394 malloc 3665->3667 3666->3665 3668 14000150d 3667->3668 3669 140001394 malloc 3668->3669 3670 140001512 3669->3670 3671 140001394 malloc 3670->3671 3672 140001521 3671->3672 3673 140001394 malloc 3672->3673 3674 140001530 3673->3674 3675 140001394 malloc 3674->3675 3676 14000153f 3675->3676 3677 140001394 malloc 3676->3677 3678 14000154e 3677->3678 3679 140001394 malloc 3678->3679 3680 14000155d 3679->3680 3681 140001394 malloc 3680->3681 3682 14000156c 3681->3682 3683 140001394 malloc 3682->3683 3684 14000157b 3683->3684 3685 140001394 malloc 3684->3685 3686 14000158a 3685->3686 3687 140001394 malloc 3686->3687 3688 140001599 3687->3688 3689 140001394 malloc 3688->3689 3690 1400015a8 3689->3690 3691 140001394 malloc 3690->3691 3692 1400015b7 3691->3692 3693 140001394 malloc 3692->3693 3694 1400015c6 3693->3694 3695 140001394 malloc 3694->3695 3696 1400015d5 3695->3696 3697 140001394 malloc 3696->3697 3698 1400015e4 3697->3698 3699 140001394 malloc 3698->3699 3700 1400015f3 3699->3700 3700->3226 3702 140001394 malloc 3701->3702 3703 140001440 3702->3703 3704 140001394 malloc 3703->3704 3705 14000144f 3704->3705 3706 140001394 malloc 3705->3706 3707 14000145e 3706->3707 3708 140001394 malloc 3707->3708 3709 14000146d 3708->3709 3710 140001394 malloc 3709->3710 3711 14000147c 3710->3711 3712 140001394 malloc 3711->3712 3713 14000148b 3712->3713 3714 140001394 malloc 3713->3714 3715 14000149a 3714->3715 3716 140001394 malloc 3715->3716 3717 1400014a9 3716->3717 3718 140001394 malloc 3717->3718 3719 1400014b8 3718->3719 3720 140001394 malloc 3719->3720 3721 1400014c7 3720->3721 3722 140001394 malloc 3721->3722 3723 1400014d6 3722->3723 3724 1400014e5 3723->3724 3725 140001394 malloc 3723->3725 3726 140001394 malloc 3724->3726 3725->3724 3727 1400014ef 3726->3727 3728 1400014f4 3727->3728 3729 140001394 malloc 3727->3729 3730 140001394 malloc 3728->3730 3729->3728 3731 1400014fe 3730->3731 3732 140001503 3731->3732 3733 140001394 malloc 3731->3733 3734 140001394 malloc 3732->3734 3733->3732 3735 14000150d 3734->3735 3736 140001394 malloc 3735->3736 3737 140001512 3736->3737 3738 140001394 malloc 3737->3738 3739 140001521 3738->3739 3740 140001394 malloc 3739->3740 3741 140001530 3740->3741 3742 140001394 malloc 3741->3742 3743 14000153f 3742->3743 3744 140001394 malloc 3743->3744 3745 14000154e 3744->3745 3746 140001394 malloc 3745->3746 3747 14000155d 3746->3747 3748 140001394 malloc 3747->3748 3749 14000156c 3748->3749 3750 140001394 malloc 3749->3750 3751 14000157b 3750->3751 3752 140001394 malloc 3751->3752 3753 14000158a 3752->3753 3754 140001394 malloc 3753->3754 3755 140001599 3754->3755 3756 140001394 malloc 3755->3756 3757 1400015a8 3756->3757 3758 140001394 malloc 3757->3758 3759 1400015b7 3758->3759 3760 140001394 malloc 3759->3760 3761 1400015c6 3760->3761 3762 140001394 malloc 3761->3762 3763 1400015d5 3762->3763 3764 140001394 malloc 3763->3764 3765 1400015e4 3764->3765 3766 140001394 malloc 3765->3766 3767 1400015f3 3766->3767 3767->3235

                          Executed Functions

                          Function 0000000140001160 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 130sleepstringCOMMON
                          Download Yara Rule

                          Control-flow Graph

                          APIs
                          Strings
                          Memory Dump Source
                          • Source File: 00000002.00000002.342290062.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_2_2_140000000_explorer.jbxd
                          Similarity
                          • API ID: malloc$ExceptionFilterSleepUnhandled_amsg_exit_cexit_inittermmemcpystrlen
                          • String ID: 0f2$@_B
                          • API String ID: 2643109117-3396905219
                          • Opcode ID: ca0329993c1c53f529ae14717197dd365a7aa32f7a998183a96a8ed19b5bf4cc
                          • Instruction ID: 6d246a72b52f0afe911d4bb3f324d5782f9b37480792cdcca3da44e9eb07faf7
                          • Opcode Fuzzy Hash: ca0329993c1c53f529ae14717197dd365a7aa32f7a998183a96a8ed19b5bf4cc
                          • Instruction Fuzzy Hash: 635136B1601A4489FA67DF2BF9957E927A0BB8C7C0F449122EF4D877B2DFB885558300
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 0000000140006C20 Relevance: 4.7, APIs: 1, Strings: 2, Instructions: 185COMMON
                          Download Yara Rule

                          Control-flow Graph

                          APIs
                          • malloc.MSVCRT(00000001402BBC60,00000000,?,?,?,?,00000001400013B8,?,?,?,?,0000000140001315,?,?,?,0000000140001156), ref: 0000000140006D37
                          Strings
                          Memory Dump Source
                          • Source File: 00000002.00000002.342290062.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_2_2_140000000_explorer.jbxd
                          Similarity
                          • API ID: malloc
                          • String ID: -XU$-XU
                          • API String ID: 2803490479-1772126033
                          • Opcode ID: 8784497b709e8499feb206d1ef326ec729f21a25b570008e4a89e951244506d9
                          • Instruction ID: 3f35912461573c8d76fbfa8b3cfad85eb5a3445cfe2ae8a16965846e7a496669
                          • Opcode Fuzzy Hash: 8784497b709e8499feb206d1ef326ec729f21a25b570008e4a89e951244506d9
                          • Instruction Fuzzy Hash: CF71A1B67106508BE75ADF26E400BBB37E2F34DB88F045114FF56A73A5EB7498808791
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Non-executed Functions

                          Function 0000000140003350 Relevance: 21.2, APIs: 9, Strings: 5, Instructions: 206COMMON
                          Download Yara Rule

                          Control-flow Graph

                          • Executed
                          • Not Executed
                          control_flow_graph 458 140003350-1400033bd memset 459 1400035c1-1400035e0 memset 458->459 460 1400033c3-140003401 458->460 462 140003794-1400037cf call 140001370 459->462 463 1400035e6-1400035ed 459->463 461 140003423-140003430 460->461 465 140003432-140003438 461->465 466 14000343a-140003451 memset 461->466 468 1400035ef-140003624 462->468 475 1400037d5 462->475 467 14000362b-14000372a wcscpy wcscat wcslen call 140001422 463->467 463->468 465->466 470 140003410 465->470 471 140003457-14000345e 466->471 472 14000357b-1400035b6 call 140001370 466->472 482 140003767-140003793 467->482 483 14000372c-140003762 call 140001431 call 14000145e 467->483 468->467 476 140003416-14000341d 470->476 477 140003493-14000355e wcscpy wcscat wcslen call 140001422 471->477 478 140003460-14000348c 471->478 472->478 484 1400035bc 472->484 475->467 476->459 476->461 487 14000356a-140003573 477->487 488 140003560-140003565 call 14000145e 477->488 478->477 483->482 484->477 487->476 492 140003579 487->492 488->487 492->459
                          APIs
                          Strings
                          Memory Dump Source
                          • Source File: 00000002.00000002.342290062.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_2_2_140000000_explorer.jbxd
                          Similarity
                          • API ID: memset$wcscatwcscpywcslen
                          • String ID: $0$0$@$@
                          • API String ID: 4263182637-1413854666
                          • Opcode ID: bc3787c66d61e824b57d9e2677d935394362011e4346159d9ee72c5953b0e94a
                          • Instruction ID: 216aaecb85078f5973e305e587aacd75aca57f61c5cb74ce2d18dd6a7a54bfa4
                          • Opcode Fuzzy Hash: bc3787c66d61e824b57d9e2677d935394362011e4346159d9ee72c5953b0e94a
                          • Instruction Fuzzy Hash: 21B15CB1518AC185F323CF16F8497DAB7B0FB88388F405205EB8857AB5DBBDC2858B40
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 0000000140002690 Relevance: 19.6, APIs: 8, Strings: 3, Instructions: 322COMMON
                          Download Yara Rule

                          Control-flow Graph

                          APIs
                          Strings
                          Memory Dump Source
                          • Source File: 00000002.00000002.342290062.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_2_2_140000000_explorer.jbxd
                          Similarity
                          • API ID: wcslen$memsetwcscatwcscpywcsncmp
                          • String ID: 0$X$`
                          • API String ID: 329590056-2527496196
                          • Opcode ID: 64bb15d8a86bc07aba2e0d0987ceb590d8fbb0e47eb58c56c6219636339922d1
                          • Instruction ID: 00c9459810b2f107c3d29651561a2dc450c87c8357d5d623b929bfb8f4de4924
                          • Opcode Fuzzy Hash: 64bb15d8a86bc07aba2e0d0987ceb590d8fbb0e47eb58c56c6219636339922d1
                          • Instruction Fuzzy Hash: 5D026872618B8085E722CF1AF8447EA77A4F7897A4F504215EBA8477F5DFB8C289C740
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 0000000140001BA0 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 106memoryCOMMON
                          Download Yara Rule

                          Control-flow Graph

                          • Executed
                          • Not Executed
                          control_flow_graph 547 140001ba0-140001bc0 548 140001bc2-140001bd7 547->548 549 140001c09 547->549 551 140001be9-140001bf1 548->551 550 140001c0c-140001c17 call 1400023b0 549->550 558 140001cf4-140001cfe call 140001d40 550->558 559 140001c1d-140001c6c call 1400024d0 VirtualQuery 550->559 553 140001bf3-140001c02 551->553 554 140001be0-140001be7 551->554 553->554 555 140001c04 553->555 554->550 554->551 557 140001cd7-140001cf3 memcpy 555->557 562 140001d03-140001d1e call 140001d40 558->562 559->562 565 140001c72-140001c79 559->565 566 140001d23-140001d38 GetLastError call 140001d40 562->566 567 140001c7b-140001c7e 565->567 568 140001c8e-140001c97 565->568 570 140001cd1 567->570 571 140001c80-140001c83 567->571 572 140001ca4-140001ccf VirtualProtect 568->572 573 140001c99-140001c9c 568->573 570->557 571->570 575 140001c85-140001c8a 571->575 572->566 572->570 573->570 576 140001c9e 573->576 575->570 577 140001c8c 575->577 576->572 577->576
                          APIs
                          Strings
                          Memory Dump Source
                          • Source File: 00000002.00000002.342290062.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_2_2_140000000_explorer.jbxd
                          Similarity
                          • API ID: Virtual$ErrorLastProtectQuerymemcpy
                          • String ID: VirtualProtect failed with code 0x%x$ VirtualQuery failed for %d bytes at address %p$Address %p has no image-section
                          • API String ID: 2595394609-2123141913
                          • Opcode ID: b036aef210540155d25bac9066f1f65b42d1ba8cfe8ce65ca0a3f37c1866b593
                          • Instruction ID: 6f7dbc3cc7671727b68b30bffc1505b4655e22953445c2847731096a84e7e193
                          • Opcode Fuzzy Hash: b036aef210540155d25bac9066f1f65b42d1ba8cfe8ce65ca0a3f37c1866b593
                          • Instruction Fuzzy Hash: BA4137B1200A4486FA67DF47F844BD92BA0A78DBC4F554526EF0A877B1DE78C586C700
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 0000000140002104 Relevance: 9.1, APIs: 6, Instructions: 51COMMON
                          Download Yara Rule

                          Control-flow Graph

                          • Executed
                          • Not Executed
                          control_flow_graph 578 140002104-14000210b 579 140002111-140002128 EnterCriticalSection 578->579 580 140002218-140002221 578->580 581 14000220b-140002212 LeaveCriticalSection 579->581 582 14000212e-14000213c 579->582 583 140002272-140002280 580->583 584 140002223-14000222d 580->584 581->580 585 14000214d-140002159 TlsGetValue GetLastError 582->585 586 140002241-140002263 DeleteCriticalSection 584->586 587 14000222f 584->587 588 14000215b-14000215e 585->588 589 140002140-140002147 585->589 586->583 590 140002230-14000223f free 587->590 588->589 591 140002160-14000216d 588->591 589->581 589->585 590->586 590->590 591->589
                          APIs
                          Memory Dump Source
                          • Source File: 00000002.00000002.342290062.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_2_2_140000000_explorer.jbxd
                          Similarity
                          • API ID: CriticalSection$DeleteEnterErrorLastLeaveValuefree
                          • String ID:
                          • API String ID: 3326252324-0
                          • Opcode ID: 7081f78a86a1e8d366be765f63f4809ad475cce195255e7dcdade35cf48306f8
                          • Instruction ID: 56fcf2f6a94039fade65c40dd6e02c422ffa2c330224fcf84729020158c867a4
                          • Opcode Fuzzy Hash: 7081f78a86a1e8d366be765f63f4809ad475cce195255e7dcdade35cf48306f8
                          • Instruction Fuzzy Hash: F021F3B4201A0496FA5BDB57F998BE82760B76CBD0F540022EB19477F4DFB88A868300
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 0000000140001E03 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 82COMMON
                          Download Yara Rule

                          Control-flow Graph

                          • Executed
                          • Not Executed
                          control_flow_graph 593 140001e03-140001e2d 594 140001e3e-140001e48 593->594 595 140001e2f-140001e38 593->595 597 140001ea3-140001ea8 594->597 598 140001e4a-140001e53 594->598 595->594 596 140001f60-140001f69 595->596 597->596 601 140001eae-140001eb3 597->601 599 140001e55-140001e60 598->599 600 140001ecc-140001ed1 598->600 599->597 604 140001f23-140001f2d 600->604 605 140001ed3-140001ee2 signal 600->605 602 140001eb5-140001eba 601->602 603 140001efb-140001f0a call 1400071c0 601->603 602->596 610 140001ec0 602->610 603->604 614 140001f0c-140001f10 603->614 608 140001f43-140001f45 604->608 609 140001f2f-140001f3f 604->609 605->604 606 140001ee4-140001ee8 605->606 611 140001eea-140001ef9 signal 606->611 612 140001f4e-140001f53 606->612 608->596 609->608 610->604 611->596 615 140001f5a 612->615 616 140001f12-140001f21 signal 614->616 617 140001f55 614->617 615->596 616->596 617->615
                          Strings
                          Memory Dump Source
                          • Source File: 00000002.00000002.342290062.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_2_2_140000000_explorer.jbxd
                          Similarity
                          • API ID:
                          • String ID: CCG
                          • API String ID: 0-1584390748
                          • Opcode ID: b9c2567cc391eaa591388076f2eb292da1f7b5382379697509892d68b41ae285
                          • Instruction ID: 021059322143f787686ed12a90271b411eda44b39018bd00e1461e34b9ad4bb1
                          • Opcode Fuzzy Hash: b9c2567cc391eaa591388076f2eb292da1f7b5382379697509892d68b41ae285
                          • Instruction Fuzzy Hash: BC217AB1A0050982FA7BDA6AB9947F91292A7CC7E4F248535FF1D472F5DE7C88818241
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 0000000140001880 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 138memoryCOMMON
                          Download Yara Rule

                          Control-flow Graph

                          • Executed
                          • Not Executed
                          control_flow_graph 618 140001880-14000189c 619 1400018a2-1400018f9 call 140002420 call 140002660 618->619 620 140001a0f-140001a1f 618->620 619->620 625 1400018ff-140001910 619->625 626 140001912-14000191c 625->626 627 14000193e-140001941 625->627 628 14000194d-140001954 626->628 629 14000191e-140001929 626->629 627->628 630 140001943-140001947 627->630 633 140001956-140001961 628->633 634 14000199e-1400019a6 628->634 629->628 631 14000192b-14000193a 629->631 630->628 632 140001a20-140001a26 630->632 631->627 636 140001b87-140001b98 call 140001d40 632->636 637 140001a2c-140001a37 632->637 638 140001970-14000199c call 140001ba0 633->638 634->620 635 1400019a8-1400019c1 634->635 639 1400019df-1400019e7 635->639 637->634 640 140001a3d-140001a5f 637->640 638->634 643 1400019e9-140001a0d VirtualProtect 639->643 644 1400019d0-1400019dd 639->644 645 140001a7d-140001a97 640->645 643->644 644->620 644->639 648 140001b74-140001b82 call 140001d40 645->648 649 140001a9d-140001afa 645->649 648->636 655 140001b22-140001b26 649->655 656 140001afc-140001b0e 649->656 659 140001b2c-140001b30 655->659 660 140001a70-140001a77 655->660 657 140001b5c-140001b6c 656->657 658 140001b10-140001b20 656->658 657->648 661 140001b6f call 140001d40 657->661 658->655 658->657 659->660 662 140001b36-140001b57 call 140001ba0 659->662 660->634 660->645 661->648 662->657
                          APIs
                          • VirtualProtect.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,0000000140001247), ref: 00000001400019F9
                          Strings
                          Memory Dump Source
                          • Source File: 00000002.00000002.342290062.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_2_2_140000000_explorer.jbxd
                          Similarity
                          • API ID: ProtectVirtual
                          • String ID: Unknown pseudo relocation bit size %d.$ Unknown pseudo relocation protocol version %d.
                          • API String ID: 544645111-395989641
                          • Opcode ID: 0b0233dea2f752d1ee9db691179c492c09cd57189dd71899399c4d26caba6ddb
                          • Instruction ID: 23eeb0cebf1dbf95dbbb1354c6fb0bb5c89450fc78db1e818d89af55189420c9
                          • Opcode Fuzzy Hash: 0b0233dea2f752d1ee9db691179c492c09cd57189dd71899399c4d26caba6ddb
                          • Instruction Fuzzy Hash: 695138B2710944DAEB26CF27F8457D82761B79DBE8F448222EB59077B4DB78C686C700
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 0000000140001800 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 30COMMON
                          Download Yara Rule

                          Control-flow Graph

                          • Executed
                          • Not Executed
                          control_flow_graph 666 140001800-140001810 667 140001812-140001822 666->667 668 140001824 666->668 669 14000182b-140001867 call 140002290 fprintf 667->669 668->669
                          APIs
                          Strings
                          Memory Dump Source
                          • Source File: 00000002.00000002.342290062.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_2_2_140000000_explorer.jbxd
                          Similarity
                          • API ID: fprintf
                          • String ID: Unknown error$_matherr(): %s in %s(%g, %g) (retval=%g)
                          • API String ID: 383729395-3474627141
                          • Opcode ID: bfe106f18848904dd5f6982af14eb594fadc9c7108e9bac09e5251fef5da6f0d
                          • Instruction ID: 3bac48ec43f727a2d00e44ba4004bf05e664f3cc55b118b6d53b4471011a1bb8
                          • Opcode Fuzzy Hash: bfe106f18848904dd5f6982af14eb594fadc9c7108e9bac09e5251fef5da6f0d
                          • Instruction Fuzzy Hash: D8F09671A14A4482E622DB66B9413ED6360FB5D7C1F50D211FF8D57661DF38D182C300
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 000000014000219E Relevance: 5.0, APIs: 4, Instructions: 34COMMON
                          Download Yara Rule

                          Control-flow Graph

                          • Executed
                          • Not Executed
                          control_flow_graph 672 14000219e-1400021a5 673 140002272-140002280 672->673 674 1400021ab-1400021c2 EnterCriticalSection 672->674 675 140002265-14000226c LeaveCriticalSection 674->675 676 1400021c8-1400021d6 674->676 675->673 677 1400021e9-1400021f5 TlsGetValue GetLastError 676->677 678 1400021f7-1400021fa 677->678 679 1400021e0-1400021e7 677->679 678->679 680 1400021fc-140002209 678->680 679->675 679->677 680->679
                          APIs
                          Memory Dump Source
                          • Source File: 00000002.00000002.342290062.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_2_2_140000000_explorer.jbxd
                          Similarity
                          • API ID: CriticalSection$EnterErrorLastLeaveValue
                          • String ID:
                          • API String ID: 682475483-0
                          • Opcode ID: 837875c97af9d2ceab75c0a42d09724638dc2a665089ec76705c6c65c2cb8ae7
                          • Instruction ID: e8b9f2a18180fc22e2290d52c92760c9d9332fbbf2eab5ea0f5c1b0595ae7fa6
                          • Opcode Fuzzy Hash: 837875c97af9d2ceab75c0a42d09724638dc2a665089ec76705c6c65c2cb8ae7
                          • Instruction Fuzzy Hash: 2501E4B5305A0496FA57DB57FD487D86360B75CBD1F854022EF09537B4DFB48A96C200
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Execution Graph

                          Execution Coverage:46.5%
                          Dynamic/Decrypted Code Coverage:0%
                          Signature Coverage:46.8%
                          Total number of Nodes:263
                          Total number of Limit Nodes:36
                          execution_graph 516 140002524 517 140002531 516->517 518 140002539 516->518 520 1400010c0 517->520 521 1400018ac 3 API calls 520->521 522 14000110e 521->522 523 1400014ba 522->523 524 140001122 OpenProcess 522->524 523->518 524->523 525 14000113e OpenProcess 524->525 526 140001161 K32GetModuleFileNameExW 525->526 527 1400011fd NtQueryInformationProcess 525->527 528 1400011aa CloseHandle 526->528 529 14000117a PathFindFileNameW lstrlenW 526->529 530 1400014b1 CloseHandle 527->530 531 140001224 527->531 528->527 533 1400011b8 528->533 529->528 532 140001197 StrCpyW 529->532 530->523 531->530 534 140001230 OpenProcessToken 531->534 532->528 533->527 535 1400011d8 StrCmpIW 533->535 534->530 536 14000124e GetTokenInformation 534->536 535->530 535->533 537 1400012f1 536->537 538 140001276 GetLastError 536->538 539 1400012f8 CloseHandle 537->539 538->537 540 140001281 LocalAlloc 538->540 539->530 545 14000130c 539->545 540->537 541 140001297 GetTokenInformation 540->541 542 1400012df 541->542 543 1400012bf GetSidSubAuthorityCount GetSidSubAuthority 541->543 544 1400012e6 LocalFree 542->544 543->544 544->539 545->530 546 14000139b StrStrA 545->546 547 1400013c3 545->547 546->545 548 1400013c8 546->548 547->530 548->530 549 1400013f3 VirtualAllocEx 548->549 549->530 550 140001420 WriteProcessMemory 549->550 550->530 551 14000143b 550->551 552 14000211c 2 API calls 551->552 553 14000145b 552->553 553->530 554 140001478 WaitForSingleObject 553->554 557 140001471 CloseHandle 553->557 556 140001487 GetExitCodeThread 554->556 554->557 556->557 557->530 382 140002bf8 383 140002c05 382->383 385 140002c25 ConnectNamedPipe 383->385 386 140002c1a Sleep 383->386 392 140001b54 AllocateAndInitializeSid 383->392 387 140002c83 Sleep 385->387 388 140002c34 ReadFile 385->388 386->383 390 140002c8e DisconnectNamedPipe 387->390 389 140002c57 WriteFile 388->389 388->390 389->390 390->385 393 140001bb1 SetEntriesInAclW 392->393 394 140001c6f 392->394 393->394 395 140001bf5 LocalAlloc 393->395 394->383 395->394 396 140001c09 InitializeSecurityDescriptor 395->396 396->394 397 140001c19 SetSecurityDescriptorDacl 396->397 397->394 398 140001c30 CreateNamedPipeW 397->398 398->394 399 140002b38 GetProcessHeap HeapAlloc GetProcessHeap HeapAlloc 400 140002b8e K32EnumProcesses 399->400 401 140002beb Sleep 400->401 403 140002ba3 400->403 401->400 403->401 404 140002258 407 14000226c 404->407 431 140001f2c 407->431 410 140001f2c 14 API calls 411 14000228f GetCurrentProcessId OpenProcess 410->411 412 140002321 FindResourceA 411->412 413 1400022af OpenProcessToken 411->413 414 140002341 SizeofResource 412->414 415 140002261 ExitProcess 412->415 416 1400022c3 LookupPrivilegeValueW 413->416 417 140002318 CloseHandle 413->417 414->415 418 14000235a LoadResource 414->418 416->417 419 1400022da AdjustTokenPrivileges 416->419 417->412 418->415 420 14000236e LockResource GetCurrentProcessId 418->420 419->417 421 140002312 GetLastError 419->421 445 1400017ec GetProcessHeap HeapAlloc 420->445 421->417 423 14000238b RegCreateKeyExW 424 140002489 CreateThread GetProcessHeap HeapAlloc CreateThread CreateThread 423->424 425 1400023cc ConvertStringSecurityDescriptorToSecurityDescriptorW 423->425 428 14000250f SleepEx 424->428 426 1400023f4 RegSetKeySecurity LocalFree 425->426 427 14000240e RegCreateKeyExW 425->427 426->427 429 140002448 GetCurrentProcessId RegSetValueExW RegCloseKey 427->429 430 14000247f RegCloseKey 427->430 428->428 429->430 430->424 432 140001f35 StrCpyW StrCatW GetModuleHandleW 431->432 433 1400020ff 431->433 432->433 434 140001f86 GetCurrentProcess K32GetModuleInformation 432->434 433->410 435 1400020f6 FreeLibrary 434->435 436 140001fb6 CreateFileW 434->436 435->433 436->435 437 140001feb CreateFileMappingW 436->437 438 140002014 MapViewOfFile 437->438 439 1400020ed CloseHandle 437->439 440 1400020e4 CloseHandle 438->440 441 140002037 438->441 439->435 440->439 441->440 442 140002050 lstrcmpi 441->442 444 14000208e 441->444 442->441 443 140002090 VirtualProtect VirtualProtect 442->443 443->440 444->440 451 1400014d8 GetProcessHeap HeapAlloc GetProcessHeap HeapAlloc K32EnumProcesses 445->451 447 140001885 GetProcessHeap HeapFree 448 140001830 448->447 449 140001851 OpenProcess 448->449 449->448 450 140001867 TerminateProcess CloseHandle 449->450 450->448 452 14000162f GetProcessHeap HeapFree GetProcessHeap HeapFree 451->452 457 140001565 451->457 452->448 453 14000157a OpenProcess 454 140001597 K32EnumProcessModules 453->454 453->457 455 14000161a CloseHandle 454->455 454->457 455->457 456 1400015c9 ReadProcessMemory 456->457 457->452 457->453 457->455 457->456 458 1400021d0 459 1400021dd 458->459 460 140001b54 6 API calls 459->460 461 1400021f2 Sleep 459->461 462 1400021fd ConnectNamedPipe 459->462 460->459 461->459 463 140002241 Sleep 462->463 464 14000220c ReadFile 462->464 465 14000224c DisconnectNamedPipe 463->465 464->465 466 14000222f 464->466 465->462 466->465 467 1400010c0 505 1400018ac OpenProcess 467->505 470 1400014ba 471 140001122 OpenProcess 471->470 472 14000113e OpenProcess 471->472 473 140001161 K32GetModuleFileNameExW 472->473 474 1400011fd NtQueryInformationProcess 472->474 475 1400011aa CloseHandle 473->475 476 14000117a PathFindFileNameW lstrlenW 473->476 477 1400014b1 CloseHandle 474->477 478 140001224 474->478 475->474 480 1400011b8 475->480 476->475 479 140001197 StrCpyW 476->479 477->470 478->477 481 140001230 OpenProcessToken 478->481 479->475 480->474 482 1400011d8 StrCmpIW 480->482 481->477 483 14000124e GetTokenInformation 481->483 482->477 482->480 484 1400012f1 483->484 485 140001276 GetLastError 483->485 486 1400012f8 CloseHandle 484->486 485->484 487 140001281 LocalAlloc 485->487 486->477 492 14000130c 486->492 487->484 488 140001297 GetTokenInformation 487->488 489 1400012df 488->489 490 1400012bf GetSidSubAuthorityCount GetSidSubAuthority 488->490 491 1400012e6 LocalFree 489->491 490->491 491->486 492->477 493 14000139b StrStrA 492->493 494 1400013c3 492->494 493->492 495 1400013c8 493->495 494->477 495->477 496 1400013f3 VirtualAllocEx 495->496 496->477 497 140001420 WriteProcessMemory 496->497 497->477 498 14000143b 497->498 510 14000211c 498->510 500 14000145b 500->477 501 140001478 WaitForSingleObject 500->501 504 140001471 CloseHandle 500->504 503 140001487 GetExitCodeThread 501->503 501->504 503->504 504->477 506 14000110e 505->506 507 1400018d8 IsWow64Process 505->507 506->470 506->471 508 1400018f8 CloseHandle 507->508 509 1400018ea 507->509 508->506 509->508 513 140001914 GetModuleHandleA 510->513 514 140001934 GetProcAddress 513->514 515 14000193d 513->515 514->515 558 140002540 559 140002558 558->559 560 14000254d 558->560 561 1400010c0 30 API calls 560->561 561->559 562 140002560 563 140002592 562->563 564 14000273a 562->564 565 1400026c6 GetProcessHeap HeapAlloc K32EnumProcesses 563->565 566 140002598 563->566 567 140002748 564->567 568 14000297e ReadFile 564->568 569 140002633 565->569 571 140002704 565->571 572 1400025a5 566->572 573 1400026bd ExitProcess 566->573 574 140002751 567->574 575 140002974 567->575 568->569 570 1400029a8 568->570 570->569 583 1400018ac 3 API calls 570->583 571->569 585 1400010c0 30 API calls 571->585 579 1400025ae 572->579 580 140002660 RegOpenKeyExW 572->580 576 140002919 574->576 577 14000275c 574->577 578 14000175c 22 API calls 575->578 584 140001944 ReadFile 576->584 581 140002761 577->581 582 14000279d 577->582 578->569 579->569 595 1400025cb ReadFile 579->595 586 1400026a1 580->586 587 14000268d RegDeleteValueW 580->587 581->569 644 14000217c 581->644 647 140001944 582->647 588 1400029c7 583->588 590 140002928 584->590 585->571 631 1400019c4 SysAllocString SysAllocString CoInitializeEx 586->631 587->586 588->569 599 1400029db GetProcessHeap HeapAlloc 588->599 600 140002638 588->600 590->569 602 140001944 ReadFile 590->602 594 1400026a6 639 14000175c GetProcessHeap HeapAlloc 594->639 595->569 597 1400025f5 595->597 597->569 609 1400018ac 3 API calls 597->609 605 1400014d8 13 API calls 599->605 611 140002a90 4 API calls 600->611 601 1400027b4 ReadFile 601->569 606 1400027dc 601->606 607 14000293f 602->607 622 140002a14 605->622 606->569 612 1400027e9 GetProcessHeap HeapAlloc ReadFile 606->612 607->569 613 140002947 ShellExecuteW 607->613 615 140002614 609->615 611->569 617 14000290b GetProcessHeap 612->617 618 14000282d 612->618 613->569 615->569 615->600 621 140002624 615->621 616 140002a49 GetProcessHeap 619 140002a52 HeapFree 616->619 617->619 618->617 623 140002881 lstrlenW GetProcessHeap HeapAlloc 618->623 624 14000285e 618->624 619->569 625 1400010c0 30 API calls 621->625 622->616 671 1400016cc 622->671 665 140002a90 CreateFileW 623->665 624->617 651 140001c88 624->651 625->569 632 140001a11 CoInitializeSecurity 631->632 633 140001b2c SysFreeString SysFreeString 631->633 634 140001a59 CoCreateInstance 632->634 635 140001a4d 632->635 633->594 636 140001b26 CoUninitialize 634->636 637 140001a88 VariantInit 634->637 635->634 635->636 636->633 638 140001ade 637->638 638->636 640 1400014d8 13 API calls 639->640 642 14000179a 640->642 641 1400017c8 GetProcessHeap HeapFree 642->641 643 1400016cc 5 API calls 642->643 643->642 645 140001914 2 API calls 644->645 646 140002191 645->646 648 140001968 ReadFile 647->648 649 14000198b 648->649 650 1400019a5 648->650 649->648 649->650 650->569 650->601 657 140001cbb 651->657 652 140001cce CreateProcessW 653 140001d2b VirtualAllocEx 652->653 652->657 655 140001d60 WriteProcessMemory 653->655 653->657 654 140001e97 654->617 655->657 656 140001e62 OpenProcess 656->657 658 140001e78 TerminateProcess 656->658 657->652 657->654 657->656 659 140001dd2 VirtualAlloc 657->659 661 140001d8c WriteProcessMemory 657->661 658->657 659->657 660 140001df1 GetThreadContext 659->660 660->657 662 140001e09 WriteProcessMemory 660->662 661->657 662->657 663 140001e30 SetThreadContext 662->663 663->657 664 140001e4e ResumeThread 663->664 664->654 664->657 666 1400028f7 GetProcessHeap HeapFree 665->666 667 140002ada WriteFile 665->667 666->617 668 140002b1c CloseHandle 667->668 669 140002afe 667->669 668->666 669->668 670 140002b02 WriteFile 669->670 670->668 672 140001745 671->672 673 1400016eb OpenProcess 671->673 672->616 673->672 674 140001703 673->674 675 14000211c 2 API calls 674->675 676 140001723 675->676 677 14000173c CloseHandle 676->677 678 140001731 CloseHandle 676->678 677->672 678->677

                          Callgraph

                          Executed Functions

                          Function 000000014000226C Relevance: 61.4, APIs: 27, Strings: 8, Instructions: 165registrymemorythreadCOMMON
                          Download Yara Rule

                          Control-flow Graph

                          APIs
                          Strings
                          Memory Dump Source
                          • Source File: 00000003.00000002.603836085.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true
                          • Associated: 00000003.00000002.603775004.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
                          • Associated: 00000003.00000002.603884582.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
                          • Associated: 00000003.00000002.603923715.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_140000000_dialer.jbxd
                          Similarity
                          • API ID: CreateProcess$Close$CurrentHandleResource$FileSecurityThread$DescriptorFreeHeapModuleOpenProtectTokenValueVirtual$AdjustAllocConvertErrorFindInformationLastLibraryLoadLocalLockLookupMappingPrivilegePrivilegesSizeofSleepStringViewlstrcmpi
                          • String ID: D:(A;OICI;GA;;;AU)(A;OICI;GA;;;BA)$DLL$SOFTWARE\dialerconfig$SeDebugPrivilege$kernel32.dll$ntdll.dll$pid$svc64
                          • API String ID: 4177739653-1130149537
                          • Opcode ID: d90b24f95a95c841a2e029a5b4d6274d008a65fb61feaf57b7d2a555975f1ca1
                          • Instruction ID: c2e61514e361dd61edc66d1a85693de1d2c237bf329a5b31df93bef4cff25afe
                          • Opcode Fuzzy Hash: d90b24f95a95c841a2e029a5b4d6274d008a65fb61feaf57b7d2a555975f1ca1
                          • Instruction Fuzzy Hash: B781E4B6200B4196EB26CF62F8547D977A9F78CBD8F44512AEB4A43A78DF38C148C740
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 00000001400010C0 Relevance: 51.0, APIs: 25, Strings: 4, Instructions: 257memorystringnativeCOMMON
                          Download Yara Rule

                          Control-flow Graph

                          • Executed
                          • Not Executed
                          control_flow_graph 24 1400010c0-140001110 call 1400018ac 27 140001116-14000111c 24->27 28 1400014ba-1400014d6 24->28 27->28 29 140001122-140001138 OpenProcess 27->29 29->28 30 14000113e-14000115b OpenProcess 29->30 31 140001161-140001178 K32GetModuleFileNameExW 30->31 32 1400011fd-14000121e NtQueryInformationProcess 30->32 33 1400011aa-1400011b6 CloseHandle 31->33 34 14000117a-140001195 PathFindFileNameW lstrlenW 31->34 35 1400014b1-1400014b4 CloseHandle 32->35 36 140001224-14000122a 32->36 33->32 38 1400011b8-1400011d3 33->38 34->33 37 140001197-1400011a7 StrCpyW 34->37 35->28 36->35 39 140001230-140001248 OpenProcessToken 36->39 37->33 40 1400011d8-1400011ea StrCmpIW 38->40 39->35 41 14000124e-140001274 GetTokenInformation 39->41 40->35 42 1400011f0-1400011fb 40->42 43 1400012f1 41->43 44 140001276-14000127f GetLastError 41->44 42->32 42->40 45 1400012f8-140001306 CloseHandle 43->45 44->43 46 140001281-140001295 LocalAlloc 44->46 45->35 47 14000130c-140001313 45->47 46->43 48 140001297-1400012bd GetTokenInformation 46->48 47->35 51 140001319-140001324 47->51 49 1400012df 48->49 50 1400012bf-1400012dd GetSidSubAuthorityCount GetSidSubAuthority 48->50 52 1400012e6-1400012ef LocalFree 49->52 50->52 51->35 53 14000132a-140001334 51->53 52->45 53->35 54 14000133a-140001344 53->54 54->35 55 14000134a-14000138a call 140001ec4 * 3 54->55 55->35 62 140001390-1400013b0 call 140001ec4 StrStrA 55->62 65 1400013b2-1400013c1 62->65 66 1400013c8-1400013ed call 140001ec4 * 2 62->66 65->62 67 1400013c3 65->67 66->35 72 1400013f3-14000141a VirtualAllocEx 66->72 67->35 72->35 73 140001420-140001439 WriteProcessMemory 72->73 73->35 74 14000143b-14000145d call 14000211c 73->74 74->35 77 14000145f-140001467 74->77 77->35 78 140001469-14000146f 77->78 79 140001471-140001476 78->79 80 140001478-140001485 WaitForSingleObject 78->80 81 1400014ab CloseHandle 79->81 82 1400014a6 80->82 83 140001487-14000149b GetExitCodeThread 80->83 81->35 82->81 83->82 84 14000149d-1400014a3 83->84 84->82
                          APIs
                          Strings
                          Memory Dump Source
                          • Source File: 00000003.00000002.603836085.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true
                          • Associated: 00000003.00000002.603775004.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
                          • Associated: 00000003.00000002.603884582.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
                          • Associated: 00000003.00000002.603923715.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_140000000_dialer.jbxd
                          Similarity
                          • API ID: Process$CloseHandle$Open$InformationToken$AllocAuthorityFileLocalName$CodeCountErrorExitFindFreeLastMemoryModuleObjectPathQuerySingleThreadVirtualWaitWow64Writelstrlen
                          • String ID: @$MSBuild.exe$ReflectiveDllMain$dialer.exe
                          • API String ID: 2561231171-3753927220
                          • Opcode ID: 0577da8a6dab89cee6e9ad54b472e69925a8a9fa9a84297e512ce95199d2773e
                          • Instruction ID: 2175fd9260984ecd3e092ef955109d5d50fbfcc0bf213717558b1eb8b1c9701c
                          • Opcode Fuzzy Hash: 0577da8a6dab89cee6e9ad54b472e69925a8a9fa9a84297e512ce95199d2773e
                          • Instruction Fuzzy Hash: 40B138B260468186EB26DF27F8947E927A9FB8CBC4F404125AF4A477B4EF38C645C740
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 00000001400014D8 Relevance: 19.6, APIs: 13, Instructions: 130memoryCOMMON
                          Download Yara Rule

                          Control-flow Graph

                          APIs
                          Memory Dump Source
                          • Source File: 00000003.00000002.603836085.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true
                          • Associated: 00000003.00000002.603775004.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
                          • Associated: 00000003.00000002.603884582.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
                          • Associated: 00000003.00000002.603923715.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_140000000_dialer.jbxd
                          Similarity
                          • API ID: Heap$Process$AllocEnumFree$CloseHandleMemoryModulesOpenProcessesRead
                          • String ID:
                          • API String ID: 4084875642-0
                          • Opcode ID: 3ba232721d1513b5cedada72c6e24bd118260bd52d62463099d565cdd5ea385d
                          • Instruction ID: 4858e5a3d965c592fcd1f5951e26bd94c88d4916acf90710a0b336d1aa1e032e
                          • Opcode Fuzzy Hash: 3ba232721d1513b5cedada72c6e24bd118260bd52d62463099d565cdd5ea385d
                          • Instruction Fuzzy Hash: E6519DB2711A819AEB66CF63E8587EA22A5F78DBC4F444025EF4947764DF38C545C700
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 0000000140001B54 Relevance: 9.1, APIs: 6, Instructions: 82memorypipeCOMMON
                          Download Yara Rule

                          Control-flow Graph

                          APIs
                          Memory Dump Source
                          • Source File: 00000003.00000002.603836085.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true
                          • Associated: 00000003.00000002.603775004.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
                          • Associated: 00000003.00000002.603884582.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
                          • Associated: 00000003.00000002.603923715.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_140000000_dialer.jbxd
                          Similarity
                          • API ID: DescriptorInitializeSecurity$AllocAllocateCreateDaclEntriesLocalNamedPipe
                          • String ID:
                          • API String ID: 3197395349-0
                          • Opcode ID: 488be1c38cf594ed0d3f6a94cbc7f0150440055c9cb1e58666deddfd8d25be8b
                          • Instruction ID: 21eaad2a8fcaa81d39f01622d1c01d05a8059e075f91819b3ade9b41c51f013a
                          • Opcode Fuzzy Hash: 488be1c38cf594ed0d3f6a94cbc7f0150440055c9cb1e58666deddfd8d25be8b
                          • Instruction Fuzzy Hash: FA318D72215691CAE761CF25F490BDE77A5F748B98F40521AFB4947FA8EB78C208CB40
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 0000000140001F2C Relevance: 28.1, APIs: 14, Strings: 2, Instructions: 124filememorystringCOMMON
                          Download Yara Rule

                          Control-flow Graph

                          APIs
                          Strings
                          Memory Dump Source
                          • Source File: 00000003.00000002.603836085.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true
                          • Associated: 00000003.00000002.603775004.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
                          • Associated: 00000003.00000002.603884582.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
                          • Associated: 00000003.00000002.603923715.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_140000000_dialer.jbxd
                          Similarity
                          • API ID: FileHandle$CloseCreateModuleProtectVirtual$CurrentFreeInformationLibraryMappingProcessViewlstrcmpi
                          • String ID: .text$C:\Windows\System32\
                          • API String ID: 2721474350-832442975
                          • Opcode ID: ea51ffa9aeaeb0e2cf226d8574d2fabd87300f6e212f2c78447215b36c46b769
                          • Instruction ID: 0b364bd3c89a37fdd3fa7b369e4888cbeb1e5b170dc00cf86e963973e9165d3d
                          • Opcode Fuzzy Hash: ea51ffa9aeaeb0e2cf226d8574d2fabd87300f6e212f2c78447215b36c46b769
                          • Instruction Fuzzy Hash: CC518BB2204B8096EB62CF16F8587DAB3A5F78CBD4F444525AF4A03B68DF38C549C700
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 0000000140002BF8 Relevance: 14.0, APIs: 6, Strings: 2, Instructions: 40sleepfilepipeCOMMON
                          Download Yara Rule

                          Control-flow Graph

                          APIs
                          Strings
                          Memory Dump Source
                          • Source File: 00000003.00000002.603836085.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true
                          • Associated: 00000003.00000002.603775004.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
                          • Associated: 00000003.00000002.603884582.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
                          • Associated: 00000003.00000002.603923715.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_140000000_dialer.jbxd
                          Similarity
                          • API ID: NamedPipe$DescriptorFileInitializeSecuritySleep$AllocAllocateConnectCreateDaclDisconnectEntriesLocalReadWrite
                          • String ID: M$\\.\pipe\dialerchildproc64
                          • API String ID: 2203880229-3489460547
                          • Opcode ID: 180580de56f56ab00dd4d516fca46f959342e05f281243e0c5337f45e18aa23b
                          • Instruction ID: 6dc3dc8c0bd617ca7cbe615ebfcb02ed857a87361961821bc60a1768ee808972
                          • Opcode Fuzzy Hash: 180580de56f56ab00dd4d516fca46f959342e05f281243e0c5337f45e18aa23b
                          • Instruction Fuzzy Hash: C01139B1218A8492F716DB22F8047EE6764A78DBE0F444225BB66036F4DF7CC548C700
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 00000001400021D0 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36sleeppipefileCOMMON
                          Download Yara Rule

                          Control-flow Graph

                          • Executed
                          • Not Executed
                          control_flow_graph 128 1400021d0-1400021da 129 1400021dd-1400021f0 call 140001b54 128->129 132 1400021f2-1400021fb Sleep 129->132 133 1400021fd-14000220a ConnectNamedPipe 129->133 132->129 134 140002241-140002246 Sleep 133->134 135 14000220c-14000222d ReadFile 133->135 136 14000224c-140002255 DisconnectNamedPipe 134->136 135->136 137 14000222f-140002234 135->137 136->133 137->136 138 140002236-14000223f 137->138 138->136
                          APIs
                          Strings
                          Memory Dump Source
                          • Source File: 00000003.00000002.603836085.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true
                          • Associated: 00000003.00000002.603775004.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
                          • Associated: 00000003.00000002.603884582.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
                          • Associated: 00000003.00000002.603923715.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_140000000_dialer.jbxd
                          Similarity
                          • API ID: NamedPipe$DescriptorInitializeSecuritySleep$AllocAllocateConnectCreateDaclDisconnectEntriesFileLocalRead
                          • String ID: \\.\pipe\dialercontrol_redirect64
                          • API String ID: 2071455217-3440882674
                          • Opcode ID: 33f89feb9858a4e39e6e7226b1872fe8dc0a47489d7e71beaca7a62b826bfc15
                          • Instruction ID: d66e41e89491d3fe39127ed5f8ff24c46c9ecc4af95d447005e5476a51c55f6d
                          • Opcode Fuzzy Hash: 33f89feb9858a4e39e6e7226b1872fe8dc0a47489d7e71beaca7a62b826bfc15
                          • Instruction Fuzzy Hash: 42014BB1204A40A2EA17EB63F8443E9B365A79DBE0F144235FB66476F4DF78C488C700
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 0000000140002B38 Relevance: 9.1, APIs: 6, Instructions: 58memorysleepCOMMON
                          Download Yara Rule

                          Control-flow Graph

                          • Executed
                          • Not Executed
                          control_flow_graph 148 140002b38-140002b8c GetProcessHeap HeapAlloc GetProcessHeap HeapAlloc 149 140002b8e-140002ba1 K32EnumProcesses 148->149 150 140002ba3-140002bb2 149->150 151 140002beb-140002bf4 Sleep 149->151 152 140002bb4-140002bb8 150->152 153 140002bdc-140002be7 150->153 151->149 154 140002bba 152->154 155 140002bcb-140002bd2 152->155 153->151 156 140002bbe-140002bc3 154->156 158 140002bd6-140002bda 155->158 157 140002bc5-140002bc9 156->157 156->158 157->155 157->156 158->152 158->153
                          APIs
                          Memory Dump Source
                          • Source File: 00000003.00000002.603836085.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true
                          • Associated: 00000003.00000002.603775004.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
                          • Associated: 00000003.00000002.603884582.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
                          • Associated: 00000003.00000002.603923715.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_140000000_dialer.jbxd
                          Similarity
                          • API ID: Heap$AllocProcess$EnumProcessesSleep
                          • String ID:
                          • API String ID: 3676546796-0
                          • Opcode ID: 8f13c2487408d17cabd0d6010e800d760c40d8336c2ba260ca50616313c4bb70
                          • Instruction ID: 9c67988e037e7d22bad9650836966df18df348572cafe7f0e6f30b42da554bff
                          • Opcode Fuzzy Hash: 8f13c2487408d17cabd0d6010e800d760c40d8336c2ba260ca50616313c4bb70
                          • Instruction Fuzzy Hash: 3A115CB26006518AE72ACF17F85579A77A6F78DBC1F154028EB4607B68CF39D881CB40
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 0000000140001914 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 14libraryloaderCOMMON
                          Download Yara Rule

                          Control-flow Graph

                          • Executed
                          • Not Executed
                          control_flow_graph 160 140001914-140001932 GetModuleHandleA 161 140001934-140001937 GetProcAddress 160->161 162 14000193d-140001942 160->162 161->162
                          APIs
                          Strings
                          Memory Dump Source
                          • Source File: 00000003.00000002.603836085.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true
                          • Associated: 00000003.00000002.603775004.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
                          • Associated: 00000003.00000002.603884582.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
                          • Associated: 00000003.00000002.603923715.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_140000000_dialer.jbxd
                          Similarity
                          • API ID: AddressHandleModuleProc
                          • String ID: ntdll.dll
                          • API String ID: 1646373207-2227199552
                          • Opcode ID: 91777f2b0607ee1fe6466092eca8f752b6e1633f4feaae27b681225476bf4cba
                          • Instruction ID: 7108e587e86fbdef38877cdd133235ae9a077454219746bc209a409130a8dfa8
                          • Opcode Fuzzy Hash: 91777f2b0607ee1fe6466092eca8f752b6e1633f4feaae27b681225476bf4cba
                          • Instruction Fuzzy Hash: 5BD0C9F471260582EE1BDBA378643E552996B5CBC5F884020AE164B360DA38C1998600
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 00000001400018AC Relevance: 4.5, APIs: 3, Instructions: 30COMMON
                          Download Yara Rule

                          Control-flow Graph

                          • Executed
                          • Not Executed
                          control_flow_graph 163 1400018ac-1400018d6 OpenProcess 164 140001901-140001912 163->164 165 1400018d8-1400018e8 IsWow64Process 163->165 166 1400018f8-1400018fb CloseHandle 165->166 167 1400018ea-1400018f3 165->167 166->164 167->166
                          APIs
                          Memory Dump Source
                          • Source File: 00000003.00000002.603836085.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true
                          • Associated: 00000003.00000002.603775004.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
                          • Associated: 00000003.00000002.603884582.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
                          • Associated: 00000003.00000002.603923715.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_140000000_dialer.jbxd
                          Similarity
                          • API ID: Process$CloseHandleOpenWow64
                          • String ID:
                          • API String ID: 10462204-0
                          • Opcode ID: 6d646fbe37808f9b584e9cbd293ea6613d1d1a58a609fbda32c726050c0f507a
                          • Instruction ID: a864651f2e5c17a125c4a55b2f5ca9b47fcd1256b8d640ad9fe9232b2a40a049
                          • Opcode Fuzzy Hash: 6d646fbe37808f9b584e9cbd293ea6613d1d1a58a609fbda32c726050c0f507a
                          • Instruction Fuzzy Hash: 77F01D7170578192EB56CF17B584399A665E78CBC0F449039EB8943768DF39C4858700
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Non-executed Functions

                          Function 0000000140002560 Relevance: 47.5, APIs: 24, Strings: 3, Instructions: 296memoryregistryfileCOMMON
                          Download Yara Rule

                          Control-flow Graph

                          • Executed
                          • Not Executed
                          control_flow_graph 168 140002560-14000258c 169 140002592 168->169 170 14000273a-140002742 168->170 171 1400026c6-1400026fe GetProcessHeap HeapAlloc K32EnumProcesses 169->171 172 140002598-14000259f 169->172 173 140002748-14000274b 170->173 174 14000297e-1400029a2 ReadFile 170->174 175 140002a74-140002a8e 171->175 177 140002704-140002715 171->177 178 1400025a5-1400025a8 172->178 179 1400026bd-1400026bf ExitProcess 172->179 180 140002751-140002756 173->180 181 140002974-140002979 call 14000175c 173->181 174->175 176 1400029a8-1400029af 174->176 176->175 185 1400029b5-1400029c9 call 1400018ac 176->185 177->175 186 14000271b-140002733 call 1400010c0 177->186 187 1400025ae-1400025b1 178->187 188 140002660-14000268b RegOpenKeyExW 178->188 182 140002919-14000292c call 140001944 180->182 183 14000275c-14000275f 180->183 181->175 182->175 210 140002932-140002941 call 140001944 182->210 189 140002761-140002766 183->189 190 14000279d-1400027ae call 140001944 183->190 185->175 208 1400029cf-1400029d5 185->208 211 140002735 186->211 197 140002651-14000265b 187->197 198 1400025b7-1400025ba 187->198 195 1400026a1-1400026b8 call 1400019c4 call 14000175c call 140001000 call 1400017ec 188->195 196 14000268d-14000269b RegDeleteValueW 188->196 189->175 199 14000276c-140002796 call 14000217c call 1400021a8 ExitProcess 189->199 190->175 219 1400027b4-1400027d6 ReadFile 190->219 195->175 196->195 197->175 205 140002644-14000264c 198->205 206 1400025c0-1400025c5 198->206 205->175 206->175 213 1400025cb-1400025ef ReadFile 206->213 217 1400029db-140002a16 GetProcessHeap HeapAlloc call 1400014d8 208->217 218 140002a5f 208->218 210->175 234 140002947-14000296f ShellExecuteW 210->234 211->175 213->175 215 1400025f5-1400025fc 213->215 215->175 222 140002602-140002616 call 1400018ac 215->222 237 140002a18-140002a1e 217->237 238 140002a49-140002a4f GetProcessHeap 217->238 224 140002a66-140002a6f call 140002a90 218->224 219->175 226 1400027dc-1400027e3 219->226 222->175 243 14000261c-140002622 222->243 224->175 226->175 233 1400027e9-140002827 GetProcessHeap HeapAlloc ReadFile 226->233 239 14000290b-140002914 GetProcessHeap 233->239 240 14000282d-140002839 233->240 234->175 237->238 244 140002a20-140002a32 237->244 241 140002a52-140002a5d HeapFree 238->241 239->241 240->239 245 14000283f-14000284b 240->245 241->175 247 140002624-140002633 call 1400010c0 243->247 248 140002638-14000263f 243->248 249 140002a34-140002a36 244->249 250 140002a38-140002a40 244->250 245->239 251 140002851-14000285c 245->251 247->175 248->224 249->250 255 140002a44 call 1400016cc 249->255 250->238 256 140002a42 250->256 252 140002881-140002905 lstrlenW GetProcessHeap HeapAlloc call 140002a90 GetProcessHeap HeapFree 251->252 253 14000285e-140002869 251->253 252->239 253->239 257 14000286f-14000287c call 140001c88 253->257 255->238 256->244 257->239
                          APIs
                          Strings
                          Memory Dump Source
                          • Source File: 00000003.00000002.603836085.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true
                          • Associated: 00000003.00000002.603775004.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
                          • Associated: 00000003.00000002.603884582.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
                          • Associated: 00000003.00000002.603923715.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_140000000_dialer.jbxd
                          Similarity
                          • API ID: Process$Open$File$CloseExitHandleHeapName$AllocDeleteEnumFindInformationModulePathProcessesQueryReadTokenValueWow64lstrlen
                          • String ID: SOFTWARE$dialerstager$open
                          • API String ID: 3276259517-3931493855
                          • Opcode ID: ae79544a1ca264f77e0040c582fad8c70a14f3da5095032f2fa0f831f935a8fc
                          • Instruction ID: ae65b9042581f7dc9e2ee581e3d1b52dcddb088aa692a5b8ad70e1a65f9de3a1
                          • Opcode Fuzzy Hash: ae79544a1ca264f77e0040c582fad8c70a14f3da5095032f2fa0f831f935a8fc
                          • Instruction Fuzzy Hash: 91D14DB13046818BEB7BDF26B8143E92269F74DBC8F404125BB4A47AB9DE78C605C741
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 0000000140001C88 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 154injectionthreadmemoryCOMMON
                          Download Yara Rule

                          Control-flow Graph

                          • Executed
                          • Not Executed
                          control_flow_graph 264 140001c88-140001cb8 265 140001cbb-140001cc8 264->265 266 140001e8c-140001e91 265->266 267 140001cce-140001d25 CreateProcessW 265->267 266->265 270 140001e97 266->270 268 140001e88 267->268 269 140001d2b-140001d5a VirtualAllocEx 267->269 268->266 271 140001e5d-140001e60 269->271 272 140001d60-140001d7b WriteProcessMemory 269->272 273 140001e99-140001eb9 270->273 274 140001e62-140001e76 OpenProcess 271->274 275 140001e85 271->275 272->271 276 140001d81-140001d87 272->276 274->268 277 140001e78-140001e83 TerminateProcess 274->277 275->268 278 140001dd2-140001def VirtualAlloc 276->278 279 140001d89 276->279 277->268 278->271 280 140001df1-140001e07 GetThreadContext 278->280 281 140001d8c-140001dba WriteProcessMemory 279->281 280->271 283 140001e09-140001e2e WriteProcessMemory 280->283 281->271 282 140001dc0-140001dcc 281->282 282->281 284 140001dce 282->284 283->271 285 140001e30-140001e4c SetThreadContext 283->285 284->278 285->271 286 140001e4e-140001e5b ResumeThread 285->286 286->271 287 140001eba-140001ebf 286->287 287->273
                          APIs
                          Strings
                          Memory Dump Source
                          • Source File: 00000003.00000002.603836085.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true
                          • Associated: 00000003.00000002.603775004.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
                          • Associated: 00000003.00000002.603884582.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
                          • Associated: 00000003.00000002.603923715.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_140000000_dialer.jbxd
                          Similarity
                          • API ID: Process$MemoryThreadWrite$AllocContextVirtual$CreateOpenResumeTerminate
                          • String ID: @
                          • API String ID: 3462610200-2766056989
                          • Opcode ID: 9e87a73b0eb69cfa39acb8f7a19e25e40ab225c9e7017233cfa86b54780bd9da
                          • Instruction ID: 5c16bc39e07cf5e776479c29415d8ab36f8b64b080a4e80c067f24e51f003d21
                          • Opcode Fuzzy Hash: 9e87a73b0eb69cfa39acb8f7a19e25e40ab225c9e7017233cfa86b54780bd9da
                          • Instruction Fuzzy Hash: B55122B2700A808AEB52CF66E8447DE77A5FB88BD8F054125EF4997B68DF38C855C700
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 00000001400019C4 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 102memorycomCOMMON
                          Download Yara Rule

                          Control-flow Graph

                          APIs
                          Strings
                          Memory Dump Source
                          • Source File: 00000003.00000002.603836085.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true
                          • Associated: 00000003.00000002.603775004.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
                          • Associated: 00000003.00000002.603884582.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
                          • Associated: 00000003.00000002.603923715.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_140000000_dialer.jbxd
                          Similarity
                          • API ID: String$AllocFreeInitialize$CreateInitInstanceSecurityUninitializeVariant
                          • String ID: dialersvc64
                          • API String ID: 4184240511-3881820561
                          • Opcode ID: c5773a1fcac1982b1b845e0e6ec66c21fb3e8571a559d525fc626bf24240b323
                          • Instruction ID: f04b9e4fe08d72b668f3c34f73b3c63bb96ebc933f76805d9c48aa5d26f439e8
                          • Opcode Fuzzy Hash: c5773a1fcac1982b1b845e0e6ec66c21fb3e8571a559d525fc626bf24240b323
                          • Instruction Fuzzy Hash: 69415A72704A819AE712CF6AE8543DD73B5FB89B89F044125EF4E47A64DF38D149C300
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 0000000140001000 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 37registryCOMMON
                          Download Yara Rule

                          Control-flow Graph

                          • Executed
                          • Not Executed
                          control_flow_graph 302 140001000-14000103c RegOpenKeyExW 303 140001099-1400010be RegDeleteKeyExW 302->303 304 14000103e 302->304 305 14000104b-140001091 RegEnumKeyExW 304->305 306 140001093 RegCloseKey 305->306 307 140001040-140001045 RegDeleteKeyW 305->307 306->303 307->305
                          APIs
                          Strings
                          Memory Dump Source
                          • Source File: 00000003.00000002.603836085.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true
                          • Associated: 00000003.00000002.603775004.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
                          • Associated: 00000003.00000002.603884582.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
                          • Associated: 00000003.00000002.603923715.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_140000000_dialer.jbxd
                          Similarity
                          • API ID: Delete$CloseEnumOpen
                          • String ID: SOFTWARE\dialerconfig
                          • API String ID: 3013565938-461861421
                          • Opcode ID: 771b17fd0f1a16041f26a54d46b0ec7916154baef178d5f18a2b3dcc43556395
                          • Instruction ID: 8f4ace04a6ff3505bb025a84b088d585f414f6eddbaae7ea6d4a7c6b6057ac94
                          • Opcode Fuzzy Hash: 771b17fd0f1a16041f26a54d46b0ec7916154baef178d5f18a2b3dcc43556395
                          • Instruction Fuzzy Hash: 2F1186B2714A8486E762CF26F8557E92378F78C7D8F404215A74D0BAA8DF7CC248CB54
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 00000001400017EC Relevance: 9.1, APIs: 6, Instructions: 55memoryCOMMON
                          Download Yara Rule

                          Control-flow Graph

                          APIs
                          • GetProcessHeap.KERNEL32(?,00000000,?,000000014000238B,?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 0000000140001801
                          • HeapAlloc.KERNEL32(?,00000000,?,000000014000238B,?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 0000000140001812
                            • Part of subcall function 00000001400014D8: GetProcessHeap.KERNEL32 ref: 000000014000150B
                            • Part of subcall function 00000001400014D8: HeapAlloc.KERNEL32 ref: 000000014000151E
                            • Part of subcall function 00000001400014D8: GetProcessHeap.KERNEL32 ref: 000000014000152C
                            • Part of subcall function 00000001400014D8: HeapAlloc.KERNEL32 ref: 000000014000153D
                            • Part of subcall function 00000001400014D8: K32EnumProcesses.KERNEL32 ref: 0000000140001557
                            • Part of subcall function 00000001400014D8: OpenProcess.KERNEL32 ref: 0000000140001585
                            • Part of subcall function 00000001400014D8: K32EnumProcessModules.KERNEL32 ref: 00000001400015AA
                            • Part of subcall function 00000001400014D8: ReadProcessMemory.KERNELBASE ref: 00000001400015E1
                            • Part of subcall function 00000001400014D8: CloseHandle.KERNELBASE ref: 000000014000161D
                            • Part of subcall function 00000001400014D8: GetProcessHeap.KERNEL32 ref: 000000014000162F
                            • Part of subcall function 00000001400014D8: HeapFree.KERNEL32 ref: 000000014000163D
                            • Part of subcall function 00000001400014D8: GetProcessHeap.KERNEL32 ref: 0000000140001643
                            • Part of subcall function 00000001400014D8: HeapFree.KERNEL32 ref: 0000000140001651
                          • OpenProcess.KERNEL32 ref: 0000000140001859
                          • TerminateProcess.KERNEL32 ref: 000000014000186C
                          • CloseHandle.KERNEL32 ref: 0000000140001875
                          • GetProcessHeap.KERNEL32 ref: 0000000140001885
                          Memory Dump Source
                          • Source File: 00000003.00000002.603836085.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true
                          • Associated: 00000003.00000002.603775004.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
                          • Associated: 00000003.00000002.603884582.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
                          • Associated: 00000003.00000002.603923715.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_140000000_dialer.jbxd
                          Similarity
                          • API ID: HeapProcess$Alloc$CloseEnumFreeHandleOpen$MemoryModulesProcessesReadTerminate
                          • String ID:
                          • API String ID: 1323846700-0
                          • Opcode ID: 292de27f87d02887c134cd68883e15ba7f6a186f84d3e8f804eb1f1d2b0452f5
                          • Instruction ID: e8e8f15008253283e0d5a10c8ea57e573901c1344bffe788f1ea91b5e390c365
                          • Opcode Fuzzy Hash: 292de27f87d02887c134cd68883e15ba7f6a186f84d3e8f804eb1f1d2b0452f5
                          • Instruction Fuzzy Hash: C8115BB1B05A4186FB1ADF27F8443D966A6ABCDBC4F188038EF09037B5DE38C5868700
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 0000000140002A90 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 42fileCOMMON
                          Download Yara Rule
                          APIs
                          Strings
                          Memory Dump Source
                          • Source File: 00000003.00000002.603836085.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true
                          • Associated: 00000003.00000002.603775004.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
                          • Associated: 00000003.00000002.603884582.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
                          • Associated: 00000003.00000002.603923715.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_3_2_140000000_dialer.jbxd
                          Similarity
                          • API ID: File$Write$CloseCreateHandle
                          • String ID: \\.\pipe\dialercontrol_redirect64
                          • API String ID: 148219782-3440882674
                          • Opcode ID: 883fb3da148993cb75da2269ecc4fc0d73b62e41bf5aa7103fd26e0bcaccd1b9
                          • Instruction ID: c657f3a7a6ba8077c0f3fca19c98ae9a251d12aa6ce49f65425284bb78429f7a
                          • Opcode Fuzzy Hash: 883fb3da148993cb75da2269ecc4fc0d73b62e41bf5aa7103fd26e0bcaccd1b9
                          • Instruction Fuzzy Hash: AE1139B6720B5082EB16CF16F818399A764F78DFE4F544215AB6907BA4CF78C549CB40
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Execution Graph

                          Execution Coverage:1.5%
                          Dynamic/Decrypted Code Coverage:0%
                          Signature Coverage:0%
                          Total number of Nodes:57
                          Total number of Limit Nodes:12
                          execution_graph 14931 1c273c 14933 1c276a 14931->14933 14932 1c28d4 14933->14932 14934 1c2858 LoadLibraryA 14933->14934 14934->14933 14935 1ff394 14936 1ff3f1 __vcrt_InitializeCriticalSectionEx 14935->14936 14941 1ff3ec __vcrt_InitializeCriticalSectionEx 14935->14941 14937 1ff421 LoadLibraryExW 14938 1ff4f6 14937->14938 14939 1ff446 GetLastError 14937->14939 14938->14936 14940 1ff50d FreeLibrary 14938->14940 14939->14941 14940->14936 14941->14936 14941->14937 14942 1ff480 LoadLibraryExW 14941->14942 14942->14938 14942->14941 14943 1f2244 GetProcessIdOfThread GetCurrentProcessId 14944 1f2275 14943->14944 14945 1f2312 14943->14945 14950 1f1934 OpenProcess 14944->14950 14948 1f2287 CreateFileW 14948->14945 14949 1f22cb WriteFile ReadFile CloseHandle 14948->14949 14949->14945 14951 1f1989 14950->14951 14952 1f1960 IsWow64Process 14950->14952 14951->14945 14951->14948 14953 1f1972 14952->14953 14954 1f1980 CloseHandle 14952->14954 14953->14954 14954->14951 14955 1f9dc4 14957 1f9ecd __vcrt_InitializeCriticalSectionEx 14955->14957 14961 1f9e08 __vcrt_InitializeCriticalSectionEx 14955->14961 14956 1f9e36 LoadLibraryExW 14958 1f9ead 14956->14958 14959 1f9e57 GetLastError 14956->14959 14958->14957 14960 1f9ec4 FreeLibrary 14958->14960 14959->14961 14960->14957 14961->14956 14961->14957 14962 1f9e79 LoadLibraryExW 14961->14962 14962->14958 14962->14961 14963 1f2330 14964 1f23ae _invalid_parameter_noinfo 14963->14964 14965 1f2413 GetFileType 14964->14965 14972 1f24ea 14964->14972 14966 1f2435 14965->14966 14967 1f2421 StrCpyW 14965->14967 14974 1f1a40 GetFinalPathNameByHandleW 14966->14974 14971 1f2442 14967->14971 14971->14972 14979 1f3844 14971->14979 14982 1f3044 StrCmpIW 14971->14982 14986 1f1cac 14971->14986 14975 1f1a6a StrCmpNIW 14974->14975 14976 1f1aa9 14974->14976 14975->14976 14977 1f1a84 lstrlenW 14975->14977 14976->14971 14977->14976 14978 1f1a96 StrCpyW 14977->14978 14978->14976 14980 1f3866 14979->14980 14981 1f3851 StrCmpNIW 14979->14981 14980->14971 14981->14980 14983 1f308d PathCombineW 14982->14983 14984 1f3076 StrCpyW StrCatW 14982->14984 14985 1f3096 14983->14985 14984->14985 14985->14971 14987 1f1ccc 14986->14987 14988 1f1cc3 14986->14988 14987->14971 14990 1f152c 14988->14990 14991 1f157c 14990->14991 14992 1f1546 14990->14992 14991->14987 14992->14991 14993 1f155d StrCmpIW 14992->14993 14994 1f1565 StrCmpW 14992->14994 14993->14992 14994->14992

                          Executed Functions

                          Function 001F2244 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 52filethreadCOMMON
                          Download Yara Rule

                          Control-flow Graph

                          APIs
                          • GetProcessIdOfThread.KERNEL32 ref: 001F2259
                          • GetCurrentProcessId.KERNEL32 ref: 001F2263
                            • Part of subcall function 001F1934: OpenProcess.KERNEL32 ref: 001F1952
                            • Part of subcall function 001F1934: IsWow64Process.KERNEL32 ref: 001F1968
                            • Part of subcall function 001F1934: CloseHandle.KERNEL32 ref: 001F1983
                          • CreateFileW.KERNEL32 ref: 001F22BC
                          • WriteFile.KERNEL32 ref: 001F22E4
                          • ReadFile.KERNEL32 ref: 001F2303
                          • CloseHandle.KERNEL32 ref: 001F230C
                          Strings
                          • \\.\pipe\dialerchildproc64, xrefs: 001F228C
                          • \\.\pipe\dialerchildproc32, xrefs: 001F2293
                          Memory Dump Source
                          • Source File: 00000006.00000002.603066398.00000000001F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 001F0000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_6_2_1f0000_services.jbxd
                          Similarity
                          • API ID: Process$File$CloseHandle$CreateCurrentOpenReadThreadWow64Write
                          • String ID: \\.\pipe\dialerchildproc32$\\.\pipe\dialerchildproc64
                          • API String ID: 2171963597-1373409510
                          • Opcode ID: d76f145db3bc14c8b60d6abb5b011cd5988a1ad04fc2d4b7169b2a78ec3c4c79
                          • Instruction ID: 85df23a7ba4f1d0a82d62d61fa308176f1b6227a37db76e535b815bc3c185fb0
                          • Opcode Fuzzy Hash: d76f145db3bc14c8b60d6abb5b011cd5988a1ad04fc2d4b7169b2a78ec3c4c79
                          • Instruction Fuzzy Hash: 40214776618B5483FB10CB25F44C36AB7A1F799BA4F504216EB9A03BA9DF7CC159CB00
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 001F2330 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 141COMMON
                          Download Yara Rule

                          Control-flow Graph

                          • Executed
                          • Not Executed
                          control_flow_graph 117 1f2330-1f23b2 call 212cf8 120 1f2518-1f253a 117->120 121 1f23b8-1f23bb 117->121 121->120 122 1f23c1-1f23cf 121->122 122->120 123 1f23d5-1f241f call 1f8c60 * 3 GetFileType 122->123 130 1f2435-1f243d call 1f1a40 123->130 131 1f2421-1f2433 StrCpyW 123->131 132 1f2442-1f2447 130->132 131->132 134 1f2449-1f244c 132->134 135 1f2466 132->135 134->135 136 1f244e-1f2451 134->136 137 1f2469-1f2485 call 1f30a8 call 1f3844 135->137 136->135 138 1f2453-1f2456 136->138 146 1f24cc-1f24ce 137->146 147 1f2487-1f24b8 call 1f30a8 call 1f3044 call 1f1cac 137->147 138->135 140 1f2458-1f245b 138->140 140->135 142 1f245d-1f2460 140->142 142->135 144 1f2462-1f2464 142->144 144->137 149 1f24ea-1f24ed 146->149 150 1f24d0-1f24e5 146->150 147->146 164 1f24ba-1f24c5 147->164 152 1f24ef-1f24f4 149->152 153 1f24f6-1f24f9 149->153 150->132 152->120 155 1f24fb-1f24fe 153->155 156 1f2514 153->156 155->156 158 1f2500-1f2503 155->158 156->120 158->156 159 1f2505-1f2508 158->159 159->156 161 1f250a-1f250d 159->161 161->156 163 1f250f-1f2512 161->163 163->120 163->156 164->120 165 1f24c7 164->165 165->132
                          APIs
                          Strings
                          Memory Dump Source
                          • Source File: 00000006.00000002.603066398.00000000001F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 001F0000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_6_2_1f0000_services.jbxd
                          Similarity
                          • API ID: FileType
                          • String ID: \\.\pipe\
                          • API String ID: 3081899298-91387939
                          • Opcode ID: 002250ee4f7fb53d82cbff54f4c55d9c13c210cbd3ade0a461cf797918ee8e55
                          • Instruction ID: 969a3f772d874326ce351da094ba704e4cab8c0dc80cf13df610b71e543326b9
                          • Opcode Fuzzy Hash: 002250ee4f7fb53d82cbff54f4c55d9c13c210cbd3ade0a461cf797918ee8e55
                          • Instruction Fuzzy Hash: 11410832208789C2DA38DF2AE4683BEAB51F3D5780F550125DF5903B19DF79C905C780
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 001F1628 Relevance: 50.9, APIs: 20, Strings: 9, Instructions: 157registrymemoryCOMMON
                          Download Yara Rule

                          Control-flow Graph

                          APIs
                          • GetProcessHeap.KERNEL32 ref: 001F1633
                          • HeapAlloc.KERNEL32 ref: 001F1642
                            • Part of subcall function 001F1268: GetProcessHeap.KERNEL32 ref: 001F126E
                            • Part of subcall function 001F1268: HeapAlloc.KERNEL32 ref: 001F127D
                            • Part of subcall function 001F1268: GetProcessHeap.KERNEL32 ref: 001F1297
                            • Part of subcall function 001F1268: HeapAlloc.KERNEL32 ref: 001F12A8
                            • Part of subcall function 001F1000: GetProcessHeap.KERNEL32 ref: 001F1006
                            • Part of subcall function 001F1000: HeapAlloc.KERNEL32 ref: 001F1015
                            • Part of subcall function 001F1000: GetProcessHeap.KERNEL32 ref: 001F1028
                            • Part of subcall function 001F1000: HeapAlloc.KERNEL32 ref: 001F1037
                          • RegOpenKeyExW.ADVAPI32 ref: 001F16B2
                          • RegOpenKeyExW.ADVAPI32 ref: 001F16DF
                          • RegCloseKey.ADVAPI32 ref: 001F16F9
                          • RegOpenKeyExW.ADVAPI32 ref: 001F1719
                          • RegCloseKey.ADVAPI32 ref: 001F1734
                          • RegOpenKeyExW.ADVAPI32 ref: 001F1754
                          • RegCloseKey.ADVAPI32 ref: 001F176F
                          • RegOpenKeyExW.ADVAPI32 ref: 001F178F
                          • RegCloseKey.ADVAPI32 ref: 001F17AA
                          • RegOpenKeyExW.ADVAPI32 ref: 001F17CA
                          • RegCloseKey.ADVAPI32 ref: 001F17E5
                          • RegOpenKeyExW.ADVAPI32 ref: 001F1805
                          • RegCloseKey.ADVAPI32 ref: 001F1820
                          • RegOpenKeyExW.ADVAPI32 ref: 001F1840
                          • RegCloseKey.ADVAPI32 ref: 001F185B
                          • RegOpenKeyExW.ADVAPI32 ref: 001F187B
                          • RegCloseKey.ADVAPI32 ref: 001F1896
                          • RegCloseKey.ADVAPI32 ref: 001F18A0
                            • Part of subcall function 001F12BC: RegQueryInfoKeyW.ADVAPI32 ref: 001F1319
                            • Part of subcall function 001F12BC: GetProcessHeap.KERNEL32 ref: 001F1327
                            • Part of subcall function 001F12BC: HeapAlloc.KERNEL32 ref: 001F1338
                            • Part of subcall function 001F12BC: RegEnumValueW.ADVAPI32 ref: 001F1397
                            • Part of subcall function 001F12BC: GetProcessHeap.KERNEL32 ref: 001F13DF
                            • Part of subcall function 001F12BC: HeapAlloc.KERNEL32 ref: 001F13ED
                            • Part of subcall function 001F12BC: GetProcessHeap.KERNEL32 ref: 001F140A
                            • Part of subcall function 001F12BC: HeapFree.KERNEL32 ref: 001F1418
                            • Part of subcall function 001F12BC: lstrlenW.KERNEL32 ref: 001F1421
                            • Part of subcall function 001F12BC: GetProcessHeap.KERNEL32 ref: 001F142F
                            • Part of subcall function 001F12BC: HeapAlloc.KERNEL32 ref: 001F143D
                          Strings
                          Memory Dump Source
                          • Source File: 00000006.00000002.603066398.00000000001F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 001F0000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_6_2_1f0000_services.jbxd
                          Similarity
                          • API ID: Heap$CloseOpenProcess$Alloc$EnumFreeInfoQueryValuelstrlen
                          • String ID: SOFTWARE\dialerconfig$paths$pid$process_names$service_names$startup$tcp_local$tcp_remote$udp
                          • API String ID: 2135414181-2879589442
                          • Opcode ID: 84d977f69669bb910c18c90d9c150143eff6fe6f95bc9245a9bd4b5f56132143
                          • Instruction ID: 60c199fd2daff5ac496e66baf8b95b8f06750cbe23dbc4f8f8cf49e360dc0423
                          • Opcode Fuzzy Hash: 84d977f69669bb910c18c90d9c150143eff6fe6f95bc9245a9bd4b5f56132143
                          • Instruction Fuzzy Hash: D271F836311B14D6EB20AF66E89876D3375FB98B88F405122EE4E57B29DF38C454C740
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 001FF394 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117libraryloaderCOMMON
                          Download Yara Rule

                          Control-flow Graph

                          • Executed
                          • Not Executed
                          control_flow_graph 60 1ff394-1ff3e6 61 1ff3ec-1ff3ef 60->61 62 1ff4d7 60->62 63 1ff3f9-1ff3fc 61->63 64 1ff3f1-1ff3f4 61->64 65 1ff4d9-1ff4f5 62->65 66 1ff4bc-1ff4cf 63->66 67 1ff402-1ff411 63->67 64->65 66->62 68 1ff413-1ff416 67->68 69 1ff421-1ff440 LoadLibraryExW 67->69 70 1ff41c 68->70 71 1ff516-1ff525 call 206090 68->71 72 1ff4f6-1ff50b 69->72 73 1ff446-1ff44f GetLastError 69->73 74 1ff4a8-1ff4af 70->74 79 1ff4b5 71->79 82 1ff527-1ff54e 71->82 72->71 75 1ff50d-1ff510 FreeLibrary 72->75 77 1ff496-1ff4a0 73->77 78 1ff451-1ff468 call 1fc928 73->78 74->67 74->79 75->71 77->74 78->77 84 1ff46a-1ff47e call 1fc928 78->84 79->66 82->65 84->77 87 1ff480-1ff494 LoadLibraryExW 84->87 87->72 87->77
                          APIs
                          Strings
                          Memory Dump Source
                          • Source File: 00000006.00000002.603066398.00000000001F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 001F0000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_6_2_1f0000_services.jbxd
                          Similarity
                          • API ID: AddressFreeLibraryProc
                          • String ID: api-ms-$ext-ms-
                          • API String ID: 3013587201-537541572
                          • Opcode ID: a0f3cb97d83f084b5c078ea606d329a918e0789490c159543aff3f4a2fa5ff9f
                          • Instruction ID: 59c893f3220eab161ce5a8602426e0ba9ad04165c76e3d9b45f04ae8f1e9b2e4
                          • Opcode Fuzzy Hash: a0f3cb97d83f084b5c078ea606d329a918e0789490c159543aff3f4a2fa5ff9f
                          • Instruction Fuzzy Hash: 9841D032311B1492EB16CF26AC087A66395FB49BE0F0942399F0E87759EF7CC44A8354
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 001F9DC4 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE
                          Download Yara Rule

                          Control-flow Graph

                          • Executed
                          • Not Executed
                          control_flow_graph 88 1f9dc4-1f9e02 89 1f9e08-1f9e0b 88->89 90 1f9ef3 88->90 91 1f9ef5-1f9f11 89->91 92 1f9e11 89->92 90->91 93 1f9e14 92->93 94 1f9eeb 93->94 95 1f9e1a-1f9e29 93->95 94->90 96 1f9e2b-1f9e2e 95->96 97 1f9e36-1f9e55 LoadLibraryExW 95->97 98 1f9ecd-1f9edc call 206090 96->98 99 1f9e34 96->99 100 1f9ead-1f9ec2 97->100 101 1f9e57-1f9e60 GetLastError 97->101 98->94 109 1f9ede-1f9ee9 98->109 104 1f9ea1-1f9ea8 99->104 100->98 102 1f9ec4-1f9ec7 FreeLibrary 100->102 105 1f9e8f-1f9e99 101->105 106 1f9e62-1f9e77 call 1fc928 101->106 102->98 104->93 105->104 106->105 111 1f9e79-1f9e8d LoadLibraryExW 106->111 109->91 111->100 111->105
                          APIs
                          Strings
                          Memory Dump Source
                          • Source File: 00000006.00000002.603066398.00000000001F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 001F0000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_6_2_1f0000_services.jbxd
                          Similarity
                          • API ID: Library$Load$AddressErrorFreeLastProc
                          • String ID: api-ms-
                          • API String ID: 2559590344-2084034818
                          • Opcode ID: 1bec38bed2a9dad19cb8167f1bbce1e92081cdd400658c61ccc26499447e47b7
                          • Instruction ID: c5125490ed0d1d21606304b4d6c62a4a4cf53186a2e90087b82b4a172f5dd1ad
                          • Opcode Fuzzy Hash: 1bec38bed2a9dad19cb8167f1bbce1e92081cdd400658c61ccc26499447e47b7
                          • Instruction Fuzzy Hash: 3C31E831312B44E1DF16EB42A8447B57394F748BA4F590A35EE2E4B756EF39C499C310
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 001F1A40 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 30stringCOMMON
                          Download Yara Rule

                          Control-flow Graph

                          • Executed
                          • Not Executed
                          control_flow_graph 112 1f1a40-1f1a68 GetFinalPathNameByHandleW 113 1f1a6a-1f1a82 StrCmpNIW 112->113 114 1f1aa9-1f1abb 112->114 113->114 115 1f1a84-1f1a94 lstrlenW 113->115 115->114 116 1f1a96-1f1aa4 StrCpyW 115->116 116->114
                          APIs
                          Strings
                          Memory Dump Source
                          • Source File: 00000006.00000002.603066398.00000000001F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 001F0000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_6_2_1f0000_services.jbxd
                          Similarity
                          • API ID: FinalHandleNamePathlstrlen
                          • String ID: \\?\
                          • API String ID: 2719912262-4282027825
                          • Opcode ID: c1daab9146f2a1614ef605d22fd4f721266e20aa8a0235322e79b2424596649d
                          • Instruction ID: 205488e95d9aea44f168a37b7296d3a341bc2f6463f45a45b0150a6f39784129
                          • Opcode Fuzzy Hash: c1daab9146f2a1614ef605d22fd4f721266e20aa8a0235322e79b2424596649d
                          • Instruction Fuzzy Hash: 4CF06D32304785D2EB209F61F8DC76A6721F748B88F848020DA4987A59DF3CC69DCB00
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 001F328C Relevance: 4.5, APIs: 3, Instructions: 43threadCOMMON
                          Download Yara Rule

                          Control-flow Graph

                          • Executed
                          • Not Executed
                          control_flow_graph 166 1f328c-1f329b 167 1f3323-1f3325 166->167 168 1f32a1-1f32b6 GetModuleFileNameW 166->168 169 1f332c 167->169 170 1f3327 call 1f36c8 167->170 171 1f331f-1f3321 168->171 172 1f32b8-1f32cd PathFindFileNameW call 1f3844 168->172 173 1f3331-1f3339 169->173 170->169 171->173 172->171 177 1f32cf-1f32d6 call 1f3790 172->177 177->171 180 1f32d8-1f32df 177->180 180->169 181 1f32e1-1f3318 CreateThread call 1f1d14 180->181 183 1f331d 181->183 183->169
                          APIs
                          • GetModuleFileNameW.KERNEL32 ref: 001F32AE
                          • PathFindFileNameW.SHLWAPI ref: 001F32BD
                            • Part of subcall function 001F3844: StrCmpNIW.SHLWAPI ref: 001F385C
                            • Part of subcall function 001F3790: GetModuleHandleW.KERNEL32 ref: 001F379E
                            • Part of subcall function 001F3790: GetCurrentProcess.KERNEL32 ref: 001F37CC
                            • Part of subcall function 001F3790: VirtualProtectEx.KERNEL32 ref: 001F37EE
                            • Part of subcall function 001F3790: GetCurrentProcess.KERNEL32 ref: 001F3809
                            • Part of subcall function 001F3790: VirtualProtectEx.KERNEL32 ref: 001F382A
                          • CreateThread.KERNEL32 ref: 001F330B
                            • Part of subcall function 001F1D14: GetCurrentThread.KERNEL32 ref: 001F1D1F
                          Memory Dump Source
                          • Source File: 00000006.00000002.603066398.00000000001F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 001F0000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_6_2_1f0000_services.jbxd
                          Similarity
                          • API ID: Current$FileModuleNameProcessProtectThreadVirtual$CreateFindHandlePath
                          • String ID:
                          • API String ID: 1683269324-0
                          • Opcode ID: c94412c55dcd243bcd3fbe265bea19663896af10ab27123b85acb7154d5eea14
                          • Instruction ID: 9d4b000e7c41a37706c311819d4cfcae822b7c88d9c34a18f47649e563707f31
                          • Opcode Fuzzy Hash: c94412c55dcd243bcd3fbe265bea19663896af10ab27123b85acb7154d5eea14
                          • Instruction Fuzzy Hash: C801A271B14749C2FB24EB31F84D3B932A4BBA8745F504229EB6682665EF7CC258C750
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 001F1934 Relevance: 4.5, APIs: 3, Instructions: 30COMMON
                          Download Yara Rule

                          Control-flow Graph

                          • Executed
                          • Not Executed
                          control_flow_graph 184 1f1934-1f195e OpenProcess 185 1f1989-1f199a 184->185 186 1f1960-1f1970 IsWow64Process 184->186 187 1f1972-1f197b 186->187 188 1f1980-1f1983 CloseHandle 186->188 187->188 188->185
                          APIs
                          Memory Dump Source
                          • Source File: 00000006.00000002.603066398.00000000001F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 001F0000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_6_2_1f0000_services.jbxd
                          Similarity
                          • API ID: Process$CloseHandleOpenWow64
                          • String ID:
                          • API String ID: 10462204-0
                          • Opcode ID: 7d0b437a59a4fff8aaeab8a545a29b95f500e974967cf24a4602cff355e313bd
                          • Instruction ID: ebaa2deb1c13721707523eb3796a044521a704a7c342c3f87b70208131827381
                          • Opcode Fuzzy Hash: 7d0b437a59a4fff8aaeab8a545a29b95f500e974967cf24a4602cff355e313bd
                          • Instruction Fuzzy Hash: 7EF0D031705781C3EB14CF56B598359A661F788BD1F489039EF8943B59DF79C495C700
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 001F1ABC Relevance: 3.1, APIs: 2, Instructions: 68sleepCOMMON
                          Download Yara Rule

                          Control-flow Graph

                          • Executed
                          • Not Executed
                          control_flow_graph 189 1f1abc-1f1acb call 1f1628 192 1f1ad2-1f1aef Sleep SleepEx 189->192 193 1f1baa 192->193 194 1f1af5-1f1af8 192->194 195 1f1bad-1f1bb5 call 1f18b4 193->195 196 1f1afe-1f1b01 194->196 197 1f1ba1-1f1ba8 194->197 195->192 196->197 199 1f1b07-1f1b14 call 1f1598 196->199 197->195 203 1f1b16-1f1b25 call 1f1220 199->203 204 1f1b94 199->204 203->204 209 1f1b27-1f1b36 call 1f1598 203->209 206 1f1b96-1f1b98 204->206 206->193 208 1f1b9a 206->208 208->197 209->204 212 1f1b38-1f1b47 call 1f1598 209->212 212->204 215 1f1b49-1f1b58 call 1f1598 212->215 215->204 218 1f1b5a-1f1b69 call 1f1220 215->218 218->204 221 1f1b6b-1f1b7a call 1f1220 218->221 221->204 224 1f1b7c-1f1b8b call 1f1220 221->224 224->204 227 1f1b8d-1f1b92 224->227 227->206
                          APIs
                            • Part of subcall function 001F1628: GetProcessHeap.KERNEL32 ref: 001F1633
                            • Part of subcall function 001F1628: HeapAlloc.KERNEL32 ref: 001F1642
                            • Part of subcall function 001F1628: RegOpenKeyExW.ADVAPI32 ref: 001F16B2
                            • Part of subcall function 001F1628: RegOpenKeyExW.ADVAPI32 ref: 001F16DF
                            • Part of subcall function 001F1628: RegCloseKey.ADVAPI32 ref: 001F16F9
                            • Part of subcall function 001F1628: RegOpenKeyExW.ADVAPI32 ref: 001F1719
                            • Part of subcall function 001F1628: RegCloseKey.ADVAPI32 ref: 001F1734
                            • Part of subcall function 001F1628: RegOpenKeyExW.ADVAPI32 ref: 001F1754
                            • Part of subcall function 001F1628: RegCloseKey.ADVAPI32 ref: 001F176F
                            • Part of subcall function 001F1628: RegOpenKeyExW.ADVAPI32 ref: 001F178F
                            • Part of subcall function 001F1628: RegCloseKey.ADVAPI32 ref: 001F17AA
                            • Part of subcall function 001F1628: RegOpenKeyExW.ADVAPI32 ref: 001F17CA
                          • Sleep.KERNEL32 ref: 001F1AD7
                          • SleepEx.KERNEL32 ref: 001F1ADD
                            • Part of subcall function 001F1628: RegCloseKey.ADVAPI32 ref: 001F17E5
                            • Part of subcall function 001F1628: RegOpenKeyExW.ADVAPI32 ref: 001F1805
                            • Part of subcall function 001F1628: RegCloseKey.ADVAPI32 ref: 001F1820
                            • Part of subcall function 001F1628: RegOpenKeyExW.ADVAPI32 ref: 001F1840
                            • Part of subcall function 001F1628: RegCloseKey.ADVAPI32 ref: 001F185B
                            • Part of subcall function 001F1628: RegOpenKeyExW.ADVAPI32 ref: 001F187B
                            • Part of subcall function 001F1628: RegCloseKey.ADVAPI32 ref: 001F1896
                            • Part of subcall function 001F1628: RegCloseKey.ADVAPI32 ref: 001F18A0
                          Memory Dump Source
                          • Source File: 00000006.00000002.603066398.00000000001F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 001F0000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_6_2_1f0000_services.jbxd
                          Similarity
                          • API ID: CloseOpen$HeapSleep$AllocProcess
                          • String ID:
                          • API String ID: 1534210851-0
                          • Opcode ID: ad614115fa5d2181ccf7742c52f053f5bbac07b16a2f1961ccdf1ed8f9939afa
                          • Instruction ID: 05a88adc397697ecead18cb9757749097ed9d53c92f049f66760900eed82770e
                          • Opcode Fuzzy Hash: ad614115fa5d2181ccf7742c52f053f5bbac07b16a2f1961ccdf1ed8f9939afa
                          • Instruction Fuzzy Hash: 3821E072301A49E2DF14DB27DA513BE2376EBA8BD1F5854229F0A87755FF24C861C310
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 001F3844 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 15COMMON
                          Download Yara Rule

                          Control-flow Graph

                          • Executed
                          • Not Executed
                          control_flow_graph 228 1f3844-1f384f 229 1f3869-1f3870 228->229 230 1f3851-1f3864 StrCmpNIW 228->230 230->229 231 1f3866 230->231 231->229
                          APIs
                          Strings
                          Memory Dump Source
                          • Source File: 00000006.00000002.603066398.00000000001F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 001F0000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_6_2_1f0000_services.jbxd
                          Similarity
                          • API ID:
                          • String ID: dialer
                          • API String ID: 0-3528709123
                          • Opcode ID: 9b5e3636378cdd7d8ee1592d3b6b4394701c72bdb5eb6129fb1ea8dd817c1f4c
                          • Instruction ID: 9e37a4c06ae77011351f6e7ed398dd426fc9558f747cfc12a5e2e3e310ed7c74
                          • Opcode Fuzzy Hash: 9b5e3636378cdd7d8ee1592d3b6b4394701c72bdb5eb6129fb1ea8dd817c1f4c
                          • Instruction Fuzzy Hash: 55D0C7A171178AC6FF14DFE698CD7746310EB14B94F885125DA1045150DB5C9E9DE710
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 001C273C Relevance: 1.7, APIs: 1, Instructions: 187libraryCOMMON
                          Download Yara Rule

                          Control-flow Graph

                          • Executed
                          • Not Executed
                          control_flow_graph 232 1c273c-1c27a4 call 1c29d4 * 4 241 1c27aa-1c27ad 232->241 242 1c29b2 232->242 241->242 243 1c27b3-1c27b6 241->243 244 1c29b4-1c29d0 242->244 243->242 245 1c27bc-1c27bf 243->245 245->242 246 1c27c5-1c27e6 245->246 246->242 248 1c27ec-1c280c 246->248 249 1c280e-1c2836 248->249 250 1c2838-1c283f 248->250 249->249 249->250 251 1c28df-1c28e6 250->251 252 1c2845-1c2852 250->252 254 1c28ec-1c2901 251->254 255 1c2992-1c29b0 251->255 252->251 253 1c2858-1c286a LoadLibraryA 252->253 256 1c286c-1c2878 253->256 257 1c28ca-1c28d2 253->257 254->255 258 1c2907 254->258 255->244 259 1c28c5-1c28c8 256->259 257->253 260 1c28d4-1c28d9 257->260 262 1c290d-1c2921 258->262 259->257 263 1c287a-1c287d 259->263 260->251 264 1c2982-1c298c 262->264 265 1c2923-1c2934 262->265 268 1c287f-1c28a5 263->268 269 1c28a7-1c28b7 263->269 264->255 264->262 266 1c293f-1c2943 265->266 267 1c2936-1c293d 265->267 272 1c294d-1c2951 266->272 273 1c2945-1c294b 266->273 271 1c2970-1c2980 267->271 274 1c28ba-1c28c1 268->274 269->274 271->264 271->265 275 1c2963-1c2967 272->275 276 1c2953-1c2961 272->276 273->271 274->259 275->271 278 1c2969-1c296c 275->278 276->271 278->271
                          APIs
                          Memory Dump Source
                          • Source File: 00000006.00000002.602862348.00000000001C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 001C0000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_6_2_1c0000_services.jbxd
                          Similarity
                          • API ID: LibraryLoad
                          • String ID:
                          • API String ID: 1029625771-0
                          • Opcode ID: 8c1c9448f3dd1088c887dafc1273d9eb4da1e6d2ce59199f574756fa2a1f07a1
                          • Instruction ID: a544883009bfde080ceaa11c282408c443b3959e5eea6e4601f3b17d3f65662d
                          • Opcode Fuzzy Hash: 8c1c9448f3dd1088c887dafc1273d9eb4da1e6d2ce59199f574756fa2a1f07a1
                          • Instruction Fuzzy Hash: 2F61D876B016A487CB18CF15D550F3DB3A2FB64BA8F588129DF5917748DB38D852C740
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Non-executed Functions

                          Function 001F2B2C Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 264stringlibraryloaderCOMMON
                          Download Yara Rule
                          APIs
                          • GetModuleHandleA.KERNEL32 ref: 001F2BD0
                          • lstrlenW.KERNEL32 ref: 001F2E0A
                            • Part of subcall function 001F199C: OpenProcess.KERNEL32 ref: 001F19C2
                            • Part of subcall function 001F199C: K32GetModuleFileNameExW.KERNEL32 ref: 001F19E0
                            • Part of subcall function 001F199C: PathFindFileNameW.SHLWAPI ref: 001F19EF
                            • Part of subcall function 001F199C: lstrlenW.KERNEL32 ref: 001F19FB
                            • Part of subcall function 001F199C: StrCpyW.SHLWAPI ref: 001F1A0E
                            • Part of subcall function 001F199C: CloseHandle.KERNEL32 ref: 001F1A1C
                          • GetProcAddress.KERNEL32 ref: 001F2BE5
                            • Part of subcall function 001F152C: StrCmpIW.SHLWAPI ref: 001F155D
                            • Part of subcall function 001F3844: StrCmpNIW.SHLWAPI ref: 001F385C
                          • StrCmpNIW.SHLWAPI ref: 001F2C28
                          • lstrlenW.KERNEL32 ref: 001F2D50
                          Strings
                          Memory Dump Source
                          • Source File: 00000006.00000002.603066398.00000000001F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 001F0000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_6_2_1f0000_services.jbxd
                          Similarity
                          • API ID: lstrlen$FileHandleModuleName$AddressCloseFindOpenPathProcProcess
                          • String ID: NtQueryObject$\Device\Nsi$ntdll.dll
                          • API String ID: 2119608203-3850299575
                          • Opcode ID: 4f621fb1587c0d31dffa94ac8be990c76594e3be50ef12941f5ce2f96c448f72
                          • Instruction ID: fea10a954b9d21a27cb938ea5ed30210515015834a2100a53e06f9361b8765e0
                          • Opcode Fuzzy Hash: 4f621fb1587c0d31dffa94ac8be990c76594e3be50ef12941f5ce2f96c448f72
                          • Instruction Fuzzy Hash: A7A1BC72321B9882DB28CF65D8547B9B365FB54B88F545026EF0A57B29EF38CC80C340
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 001F7D90 Relevance: 10.6, APIs: 7, Instructions: 72COMMON
                          Download Yara Rule
                          APIs
                          • IsProcessorFeaturePresent.KERNEL32 ref: 001F7DAC
                          • RtlCaptureContext.NTDLL ref: 001F7DD9
                          • RtlLookupFunctionEntry.NTDLL ref: 001F7DF3
                          • RtlVirtualUnwind.NTDLL ref: 001F7E34
                          • IsDebuggerPresent.KERNEL32 ref: 001F7E88
                          • SetUnhandledExceptionFilter.KERNEL32 ref: 001F7EA9
                          • UnhandledExceptionFilter.KERNEL32 ref: 001F7EB4
                          Memory Dump Source
                          • Source File: 00000006.00000002.603066398.00000000001F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 001F0000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_6_2_1f0000_services.jbxd
                          Similarity
                          • API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
                          • String ID:
                          • API String ID: 3140674995-0
                          • Opcode ID: 781d1b9bde8934adc12bfa83d35ad1be64d2520f1bd2f9e02f1b4bb1ea1a0257
                          • Instruction ID: 61f3e64fea68a27b96e6e66226bc645bba7be03e97f9811baef5bb11c7ba3eda
                          • Opcode Fuzzy Hash: 781d1b9bde8934adc12bfa83d35ad1be64d2520f1bd2f9e02f1b4bb1ea1a0257
                          • Instruction Fuzzy Hash: 9D316B72305B848AEB60DF60E8847EE7364F794748F44442ADB4E57B99EF38C658C710
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 001FD2A4 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE
                          Download Yara Rule
                          APIs
                          • RtlCaptureContext.NTDLL ref: 001FD31D
                          • RtlLookupFunctionEntry.NTDLL ref: 001FD335
                          • RtlVirtualUnwind.NTDLL ref: 001FD370
                          • IsDebuggerPresent.KERNEL32 ref: 001FD3A9
                          • SetUnhandledExceptionFilter.KERNEL32 ref: 001FD3B3
                          • UnhandledExceptionFilter.KERNEL32 ref: 001FD3BE
                          Memory Dump Source
                          • Source File: 00000006.00000002.603066398.00000000001F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 001F0000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_6_2_1f0000_services.jbxd
                          Similarity
                          • API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
                          • String ID:
                          • API String ID: 1239891234-0
                          • Opcode ID: 056b8809331e045eb0ff6df28b8a67c6be047fb713c0be5e5acd4a9b147221bc
                          • Instruction ID: 2991d8c29b84c2f20bc4422d8796573860974a064456fa6f1a973f3659e3b237
                          • Opcode Fuzzy Hash: 056b8809331e045eb0ff6df28b8a67c6be047fb713c0be5e5acd4a9b147221bc
                          • Instruction Fuzzy Hash: 8E319276214F848ADB20CF25E8843AE73A4F799758F540126EF9D47B69EF38C555CB00
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 001F12BC Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 120memoryregistrystringCOMMON
                          Download Yara Rule

                          Control-flow Graph

                          • Executed
                          • Not Executed
                          control_flow_graph 279 1f12bc-1f1321 RegQueryInfoKeyW 280 1f148a-1f14a0 279->280 281 1f1327-1f134c GetProcessHeap HeapAlloc 279->281 282 1f1476-1f1484 GetProcessHeap call 206180 281->282 283 1f1352-1f139f RegEnumValueW 281->283 282->280 284 1f1465-1f1470 283->284 285 1f13a5-1f13aa 283->285 284->282 284->283 285->284 287 1f13b0-1f13bd call 1f152c 285->287 287->284 290 1f13c3-1f13c6 287->290 290->284 291 1f13cc-1f13d1 290->291 292 1f141e-1f145f lstrlenW GetProcessHeap HeapAlloc StrCpyW 291->292 293 1f13d3-1f1418 GetProcessHeap HeapAlloc GetProcessHeap call 206180 291->293 292->284 293->292
                          APIs
                          Strings
                          Memory Dump Source
                          • Source File: 00000006.00000002.603066398.00000000001F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 001F0000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_6_2_1f0000_services.jbxd
                          Similarity
                          • API ID: Heap$Process$Alloc$Free$EnumInfoQueryValuelstrlen
                          • String ID: d
                          • API String ID: 2005889112-2564639436
                          • Opcode ID: 8b653d2a3574a9b9f54f76d34c9bbade1314fe17b6e977058bb62b7e32ce9810
                          • Instruction ID: 59d72ffd4cec2ec44b4ad56ec35a125c542e053c9a63bcbfa398ddbaf9b84cce
                          • Opcode Fuzzy Hash: 8b653d2a3574a9b9f54f76d34c9bbade1314fe17b6e977058bb62b7e32ce9810
                          • Instruction Fuzzy Hash: 96512C76604B88D6EB14CF62E54C36AB7A1F789F99F448124DE4A07729DF3CC059CB00
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 001F1D14 Relevance: 22.8, APIs: 1, Strings: 12, Instructions: 65threadCOMMON
                          Download Yara Rule

                          Control-flow Graph

                          APIs
                          • GetCurrentThread.KERNEL32 ref: 001F1D1F
                            • Part of subcall function 001F1FD4: GetModuleHandleA.KERNEL32 ref: 001F1FEC
                            • Part of subcall function 001F1FD4: GetProcAddress.KERNEL32 ref: 001F1FFD
                            • Part of subcall function 001F5B30: GetCurrentThreadId.KERNEL32 ref: 001F5B6B
                          Strings
                          Memory Dump Source
                          • Source File: 00000006.00000002.603066398.00000000001F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 001F0000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_6_2_1f0000_services.jbxd
                          Similarity
                          • API ID: CurrentThread$AddressHandleModuleProc
                          • String ID: EnumServiceGroupW$EnumServicesStatusExW$NtDeviceIoControlFile$NtEnumerateKey$NtEnumerateValueKey$NtQueryDirectoryFile$NtQueryDirectoryFileEx$NtQuerySystemInformation$NtResumeThread$advapi32.dll$ntdll.dll$sechost.dll
                          • API String ID: 4175298099-1975688563
                          • Opcode ID: 848021bf4701eae64bbfc749c93af06548ec6c37c79a2989ab503d46e0816dd6
                          • Instruction ID: 01265c0b89cf15d72fab351abe3fc649dc7cc5fc286bbe96701339717c685b23
                          • Opcode Fuzzy Hash: 848021bf4701eae64bbfc749c93af06548ec6c37c79a2989ab503d46e0816dd6
                          • Instruction Fuzzy Hash: AB317374211A4BE1EB05EFA5E8697F87321B764388FC15423EA1913536EF78C65EC390
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 001C6910 Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 230COMMON
                          Download Yara Rule

                          Control-flow Graph

                          • Executed
                          • Not Executed
                          control_flow_graph 323 1c6910-1c6916 324 1c6918-1c691b 323->324 325 1c6951-1c695b 323->325 326 1c691d-1c6920 324->326 327 1c6945-1c6984 call 1c6fc0 324->327 328 1c6a78-1c6a8d 325->328 329 1c6938 __scrt_dllmain_crt_thread_attach 326->329 330 1c6922-1c6925 326->330 343 1c698a-1c699f call 1c6e54 327->343 344 1c6a52 327->344 331 1c6a9c-1c6ab6 call 1c6e54 328->331 332 1c6a8f 328->332 339 1c693d-1c6944 329->339 335 1c6927-1c6930 330->335 336 1c6931-1c6936 call 1c6f04 330->336 346 1c6aef-1c6b20 call 1c7190 331->346 347 1c6ab8-1c6aed call 1c6f7c call 1c6e1c call 1c7318 call 1c7130 call 1c7154 call 1c6fac 331->347 337 1c6a91-1c6a9b 332->337 336->339 355 1c6a6a-1c6a77 call 1c7190 343->355 356 1c69a5-1c69b6 call 1c6ec4 343->356 348 1c6a54-1c6a69 344->348 357 1c6b31-1c6b37 346->357 358 1c6b22-1c6b28 346->358 347->337 355->328 376 1c69b8-1c69dc call 1c72dc call 1c6e0c call 1c6e38 call 1cac0c 356->376 377 1c6a07-1c6a11 call 1c7130 356->377 364 1c6b7e-1c6b94 call 1c268c 357->364 365 1c6b39-1c6b43 357->365 358->357 363 1c6b2a-1c6b2c 358->363 372 1c6c1f-1c6c2c 363->372 384 1c6bcc-1c6bce 364->384 385 1c6b96-1c6b98 364->385 366 1c6b4f-1c6b5d call 1d5780 365->366 367 1c6b45-1c6b4d 365->367 373 1c6b63-1c6b78 call 1c6910 366->373 388 1c6c15-1c6c1d 366->388 367->373 373->364 373->388 376->377 425 1c69de-1c69e5 __scrt_dllmain_after_initialize_c 376->425 377->344 396 1c6a13-1c6a1f call 1c7180 377->396 386 1c6bd5-1c6bea call 1c6910 384->386 387 1c6bd0-1c6bd3 384->387 385->384 393 1c6b9a-1c6bbc call 1c268c call 1c6a78 385->393 386->388 405 1c6bec-1c6bf6 386->405 387->386 387->388 388->372 393->384 417 1c6bbe-1c6bc6 call 1d5780 393->417 413 1c6a45-1c6a50 396->413 414 1c6a21-1c6a2b call 1c7098 396->414 410 1c6bf8-1c6bff 405->410 411 1c6c01-1c6c11 call 1d5780 405->411 410->388 411->388 413->348 414->413 426 1c6a2d-1c6a3b 414->426 417->384 425->377 427 1c69e7-1c6a04 call 1cabc8 425->427 426->413 427->377
                          APIs
                          • __scrt_dllmain_crt_thread_attach.LIBCMT ref: 001C6938
                          • __scrt_acquire_startup_lock.LIBCMT ref: 001C698A
                          • _RTC_Initialize.LIBCMT ref: 001C69B8
                          • __scrt_dllmain_after_initialize_c.LIBCMT ref: 001C69DE
                          • __scrt_release_startup_lock.LIBCMT ref: 001C6A09
                          Strings
                          Memory Dump Source
                          • Source File: 00000006.00000002.602862348.00000000001C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 001C0000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_6_2_1c0000_services.jbxd
                          Similarity
                          • API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
                          • String ID: `dynamic initializer for '$`eh vector copy constructor iterator'$`eh vector vbase copy constructor iterator'$scriptor'
                          • API String ID: 190073905-1786718095
                          • Opcode ID: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
                          • Instruction ID: 9d1d180cbb8b65de42f5584bdc9b4c0a67697ae33e8e1eec00cdda817b13026d
                          • Opcode Fuzzy Hash: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
                          • Instruction Fuzzy Hash: 59714871704741CAEB14EB66E441B9933A1FBB9B84F58842EEE4987716DF7CC8858700
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 001FCE28 Relevance: 18.1, APIs: 12, Instructions: 112COMMONLIBRARYCODE
                          Download Yara Rule

                          Control-flow Graph

                          • Executed
                          • Not Executed
                          control_flow_graph 430 1fce28-1fce4a GetLastError 431 1fce4c-1fce57 FlsGetValue 430->431 432 1fce69-1fce74 FlsSetValue 430->432 433 1fce59-1fce61 431->433 434 1fce63 431->434 435 1fce7b-1fce80 432->435 436 1fce76-1fce79 432->436 437 1fced5-1fcee0 call 206130 433->437 434->432 438 1fce85 call 1fd6cc 435->438 436->437 444 1fcef5-1fcf0b call 1fc748 437->444 445 1fcee2-1fcef4 437->445 440 1fce8a-1fce96 438->440 442 1fcea8-1fceb2 FlsSetValue 440->442 443 1fce98-1fce9f FlsSetValue 440->443 447 1fcec6-1fced0 call 1fcb94 call 1fd744 442->447 448 1fceb4-1fcec4 FlsSetValue 442->448 446 1fcea1-1fcea6 call 1fd744 443->446 457 1fcf0d-1fcf18 FlsGetValue 444->457 458 1fcf28-1fcf33 FlsSetValue 444->458 446->436 447->437 448->446 459 1fcf1a-1fcf1e 457->459 460 1fcf22 457->460 461 1fcf98-1fcf9f call 1fc748 458->461 462 1fcf35-1fcf3a 458->462 459->461 463 1fcf20 459->463 460->458 465 1fcf3f call 1fd6cc 462->465 467 1fcf8f-1fcf97 463->467 466 1fcf44-1fcf50 465->466 469 1fcf62-1fcf6c FlsSetValue 466->469 470 1fcf52-1fcf59 FlsSetValue 466->470 472 1fcf6e-1fcf7e FlsSetValue 469->472 473 1fcf80-1fcf8a call 1fcb94 call 1fd744 469->473 471 1fcf5b-1fcf60 call 1fd744 470->471 471->461 472->471 473->467
                          APIs
                          • GetLastError.KERNEL32 ref: 001FCE37
                          • FlsGetValue.KERNEL32(?,?,?,00200A6B,?,?,?,0020045C,?,?,?,001FC84F), ref: 001FCE4C
                          • FlsSetValue.KERNEL32(?,?,?,00200A6B,?,?,?,0020045C,?,?,?,001FC84F), ref: 001FCE6D
                          • FlsSetValue.KERNEL32(?,?,?,00200A6B,?,?,?,0020045C,?,?,?,001FC84F), ref: 001FCE9A
                          • FlsSetValue.KERNEL32(?,?,?,00200A6B,?,?,?,0020045C,?,?,?,001FC84F), ref: 001FCEAB
                          • FlsSetValue.KERNEL32(?,?,?,00200A6B,?,?,?,0020045C,?,?,?,001FC84F), ref: 001FCEBC
                          • SetLastError.KERNEL32 ref: 001FCED7
                          • FlsGetValue.KERNEL32(?,?,?,?,?,?,?,00200A6B,?,?,?,0020045C,?,?,?,001FC84F), ref: 001FCF0D
                          • FlsSetValue.KERNEL32(?,?,00000001,001FECCC,?,?,?,?,001FBF9F,?,?,?,?,?,001F7AB0), ref: 001FCF2C
                            • Part of subcall function 001FD6CC: HeapAlloc.KERNEL32 ref: 001FD721
                          • FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00200A6B,?,?,?,0020045C,?,?,?,001FC84F), ref: 001FCF54
                            • Part of subcall function 001FD744: HeapFree.KERNEL32 ref: 001FD75A
                            • Part of subcall function 001FD744: GetLastError.KERNEL32 ref: 001FD764
                          • FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00200A6B,?,?,?,0020045C,?,?,?,001FC84F), ref: 001FCF65
                          • FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00200A6B,?,?,?,0020045C,?,?,?,001FC84F), ref: 001FCF76
                          Memory Dump Source
                          • Source File: 00000006.00000002.603066398.00000000001F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 001F0000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_6_2_1f0000_services.jbxd
                          Similarity
                          • API ID: Value$ErrorLast$Heap$AllocFree
                          • String ID:
                          • API String ID: 570795689-0
                          • Opcode ID: 81ae7dfa4ed2d3c1f1356864241e8c9d76a8deab2a50f3105871727dc9b84e00
                          • Instruction ID: 03bf99ba91a90ac201adaf0aead1a86ff708ffd30f3d9bbd2aa1ca3ea3e6699c
                          • Opcode Fuzzy Hash: 81ae7dfa4ed2d3c1f1356864241e8c9d76a8deab2a50f3105871727dc9b84e00
                          • Instruction Fuzzy Hash: 9831937070164C82EE28B7355A9533962535FA97B4F140738AF3A4B7E6DF78D442A780
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 001FA544 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 317COMMON
                          Download Yara Rule
                          APIs
                          • __FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 001FA5A1
                            • Part of subcall function 001FB414: __GetUnwindTryBlock.LIBCMT ref: 001FB457
                            • Part of subcall function 001FB414: __SetUnwindTryBlock.LIBVCRUNTIME ref: 001FB47C
                          • Is_bad_exception_allowed.LIBVCRUNTIME ref: 001FA679
                          • __FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 001FA8CE
                          • std::bad_alloc::bad_alloc.LIBCMT ref: 001FA9DA
                          Strings
                          Memory Dump Source
                          • Source File: 00000006.00000002.603066398.00000000001F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 001F0000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_6_2_1f0000_services.jbxd
                          Similarity
                          • API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
                          • String ID: csm$csm$csm
                          • API String ID: 849930591-393685449
                          • Opcode ID: 147a5c394ba4e007c258850d6061d542d969719de9d23a8e277659d08661d77f
                          • Instruction ID: 435fa735ea07750ba47ba57da4d8cb5e7f5c7e09e32e314d9eae1bf1506a5605
                          • Opcode Fuzzy Hash: 147a5c394ba4e007c258850d6061d542d969719de9d23a8e277659d08661d77f
                          • Instruction Fuzzy Hash: 8DD1A1B2604B888ADB20DF65D4803BD77B4FB99B98F540116EF8D97B19CB38D591CB02
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 001C9944 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 317COMMON
                          Download Yara Rule
                          APIs
                          • __FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 001C99A1
                            • Part of subcall function 001CA814: __GetUnwindTryBlock.LIBCMT ref: 001CA857
                            • Part of subcall function 001CA814: __SetUnwindTryBlock.LIBVCRUNTIME ref: 001CA87C
                          • Is_bad_exception_allowed.LIBVCRUNTIME ref: 001C9A79
                          • __FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 001C9CCE
                          • std::bad_alloc::bad_alloc.LIBCMT ref: 001C9DDA
                          Strings
                          Memory Dump Source
                          • Source File: 00000006.00000002.602862348.00000000001C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 001C0000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_6_2_1c0000_services.jbxd
                          Similarity
                          • API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
                          • String ID: csm$csm$csm
                          • API String ID: 849930591-393685449
                          • Opcode ID: 65b39982983e806640910362ba4e105e6dc551b6220b15538d356c191c28ac3a
                          • Instruction ID: 4af7bd53750beb79667fcf67cff83c8a1f1049746da1682f8ab70e5328f68204
                          • Opcode Fuzzy Hash: 65b39982983e806640910362ba4e105e6dc551b6220b15538d356c191c28ac3a
                          • Instruction Fuzzy Hash: 57D1B072604B808ADB20DF65E485BAE77A4F7B9B98F10111EEF8A57B19CF38C591C700
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 001F104C Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 99memoryregistryCOMMON
                          Download Yara Rule
                          APIs
                          Strings
                          Memory Dump Source
                          • Source File: 00000006.00000002.603066398.00000000001F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 001F0000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_6_2_1f0000_services.jbxd
                          Similarity
                          • API ID: Heap$Process$AllocEnumFreeInfoQueryValue
                          • String ID: d
                          • API String ID: 3743429067-2564639436
                          • Opcode ID: 0cc5ceb7d92555702a84a43de404567f212e32e90d8a90c8922560dee2c01182
                          • Instruction ID: 1026cb285315ef95753ac747825da10223c2412e3b0bea108e256b9e0418649c
                          • Opcode Fuzzy Hash: 0cc5ceb7d92555702a84a43de404567f212e32e90d8a90c8922560dee2c01182
                          • Instruction Fuzzy Hash: 00415173214B84D6E760CF61E4487AEB7A1F389B99F448129EB8907B18DF3CC599CB40
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 001FD068 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 54COMMONLIBRARYCODE
                          Download Yara Rule
                          APIs
                          • FlsGetValue.KERNEL32(?,?,?,001FC7DE,?,?,?,?,?,?,?,?,001FCF9D,?,?,00000001), ref: 001FD087
                          • FlsSetValue.KERNEL32(?,?,?,001FC7DE,?,?,?,?,?,?,?,?,001FCF9D,?,?,00000001), ref: 001FD0A6
                          • FlsSetValue.KERNEL32(?,?,?,001FC7DE,?,?,?,?,?,?,?,?,001FCF9D,?,?,00000001), ref: 001FD0CE
                          • FlsSetValue.KERNEL32(?,?,?,001FC7DE,?,?,?,?,?,?,?,?,001FCF9D,?,?,00000001), ref: 001FD0DF
                          • FlsSetValue.KERNEL32(?,?,?,001FC7DE,?,?,?,?,?,?,?,?,001FCF9D,?,?,00000001), ref: 001FD0F0
                          Strings
                          Memory Dump Source
                          • Source File: 00000006.00000002.603066398.00000000001F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 001F0000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_6_2_1f0000_services.jbxd
                          Similarity
                          • API ID: Value
                          • String ID: 1%$Y%
                          • API String ID: 3702945584-1395475152
                          • Opcode ID: eaed261e9eff258ccad1ac5f7a99306e4284ed666e6615725d2dc279c7a103a4
                          • Instruction ID: f1148494e8813164cf3b5ba47c6517fa816c2e19e84de04518292d6945221001
                          • Opcode Fuzzy Hash: eaed261e9eff258ccad1ac5f7a99306e4284ed666e6615725d2dc279c7a103a4
                          • Instruction Fuzzy Hash: B911863070424C41EA28A736B99633D62575FA47F0F184339AB3E477E9DF68C4438700
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 001F7510 Relevance: 12.2, APIs: 8, Instructions: 230COMMON
                          Download Yara Rule
                          APIs
                          • __scrt_dllmain_crt_thread_attach.LIBCMT ref: 001F7538
                          • __scrt_acquire_startup_lock.LIBCMT ref: 001F758A
                          • _RTC_Initialize.LIBCMT ref: 001F75B8
                          • __scrt_dllmain_after_initialize_c.LIBCMT ref: 001F75DE
                          • __scrt_release_startup_lock.LIBCMT ref: 001F7609
                          Memory Dump Source
                          • Source File: 00000006.00000002.603066398.00000000001F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 001F0000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_6_2_1f0000_services.jbxd
                          Similarity
                          • API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
                          • String ID:
                          • API String ID: 190073905-0
                          • Opcode ID: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
                          • Instruction ID: 409227a986d79e14aba8e16ef493f510383a1f9696b5f50c1c6bbf2c6cb6ce55
                          • Opcode Fuzzy Hash: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
                          • Instruction Fuzzy Hash: DF71673170C70D8AEB14AF69A84937937A1BBA5BC0F588425EB08877E6EF78C855C700
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 00203DB4 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON
                          Download Yara Rule
                          APIs
                          Strings
                          Memory Dump Source
                          • Source File: 00000006.00000002.603066398.00000000001F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 001F0000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_6_2_1f0000_services.jbxd
                          Similarity
                          • API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
                          • String ID: CONOUT$
                          • API String ID: 3230265001-3130406586
                          • Opcode ID: ea8503a65e9befc0d33d9332805196394b6329e0df61646a9863ad39bb9ae76f
                          • Instruction ID: 9ea76cbfddfbfe813d15a2c92c135e6a5a25da5f7097b5ee028f824ac8ee915c
                          • Opcode Fuzzy Hash: ea8503a65e9befc0d33d9332805196394b6329e0df61646a9863ad39bb9ae76f
                          • Instruction Fuzzy Hash: E2119E32320B8186E7508F56E858319B7A4F798FE4F044324EE6E87BA6CF38C9248740
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 001F3790 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 44COMMON
                          Download Yara Rule
                          APIs
                          Strings
                          Memory Dump Source
                          • Source File: 00000006.00000002.603066398.00000000001F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 001F0000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_6_2_1f0000_services.jbxd
                          Similarity
                          • API ID: CurrentProcessProtectVirtual$HandleModule
                          • String ID: wr
                          • API String ID: 1092925422-2678910430
                          • Opcode ID: d5ed198cecc284837a9554765ab7ffb778fa62629811cf0fe5ebc999f83bf42b
                          • Instruction ID: 5b165e6b4bb3fb1238d91bdc6698ebf103eaab82faeb6a25fa10f67c43cb1c0f
                          • Opcode Fuzzy Hash: d5ed198cecc284837a9554765ab7ffb778fa62629811cf0fe5ebc999f83bf42b
                          • Instruction Fuzzy Hash: 1A01573A704B8582EF149B22E408369B265FB88B85F484129EF9907B65EF3DC615C704
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 001F5B30 Relevance: 9.2, APIs: 6, Instructions: 240threadCOMMON
                          Download Yara Rule
                          APIs
                          • GetCurrentThreadId.KERNEL32 ref: 001F5B6B
                          • GetThreadContext.KERNEL32 ref: 001F5CD5
                            • Part of subcall function 001F5960: GetCurrentThreadId.KERNEL32 ref: 001F5964
                          Memory Dump Source
                          • Source File: 00000006.00000002.603066398.00000000001F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 001F0000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_6_2_1f0000_services.jbxd
                          Similarity
                          • API ID: Thread$Current$Context
                          • String ID:
                          • API String ID: 1666949209-0
                          • Opcode ID: 542e600666cb1ac52823d1f72aa5ca11f47e3ee1f4dc73a6c07a176fbafbfe1c
                          • Instruction ID: 27f6309c659192688ada5eed1d8bac594d74ccb9145b11a8e6e189d4c9534459
                          • Opcode Fuzzy Hash: 542e600666cb1ac52823d1f72aa5ca11f47e3ee1f4dc73a6c07a176fbafbfe1c
                          • Instruction Fuzzy Hash: 02C17576209F8886DB30DB1AE49436ABBA1F798B84F110216EBCD47B69DF7CC551CB40
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 001F2F04 Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 93memoryCOMMON
                          Download Yara Rule
                          APIs
                          Strings
                          Memory Dump Source
                          • Source File: 00000006.00000002.603066398.00000000001F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 001F0000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_6_2_1f0000_services.jbxd
                          Similarity
                          • API ID: Heap$Process$AllocFree
                          • String ID: dialer
                          • API String ID: 756756679-3528709123
                          • Opcode ID: 2e24de9146afbba5105044d4fd5602f1f9f0ed558a5ed62472976580c3eaf0ad
                          • Instruction ID: c08c864aa55b29c073f4354175b1e0a4939c08b15921f297cfcebd99c272361d
                          • Opcode Fuzzy Hash: 2e24de9146afbba5105044d4fd5602f1f9f0ed558a5ed62472976580c3eaf0ad
                          • Instruction Fuzzy Hash: E631AD32711B59C3EB25DF66E94877AA760FB58B84F088125EF4847B26EF38C4A5C740
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 001FCFA0 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE
                          Download Yara Rule
                          APIs
                          • GetLastError.KERNEL32 ref: 001FCFAF
                          • FlsSetValue.KERNEL32(?,?,?,001FD6B5,?,?,?,?,001FD778), ref: 001FCFE5
                          • FlsSetValue.KERNEL32(?,?,?,001FD6B5,?,?,?,?,001FD778), ref: 001FD012
                          • FlsSetValue.KERNEL32(?,?,?,001FD6B5,?,?,?,?,001FD778), ref: 001FD023
                          • FlsSetValue.KERNEL32(?,?,?,001FD6B5,?,?,?,?,001FD778), ref: 001FD034
                          • SetLastError.KERNEL32 ref: 001FD04F
                          Memory Dump Source
                          • Source File: 00000006.00000002.603066398.00000000001F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 001F0000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_6_2_1f0000_services.jbxd
                          Similarity
                          • API ID: Value$ErrorLast
                          • String ID:
                          • API String ID: 2506987500-0
                          • Opcode ID: 4f148fb448054b99fdb5313590ff83f86fc6d8762bc770a772f95ba4b575ef67
                          • Instruction ID: f93f381683c17b4328aedf2f8024370c609420af09d16685d5d4c351b5c068d5
                          • Opcode Fuzzy Hash: 4f148fb448054b99fdb5313590ff83f86fc6d8762bc770a772f95ba4b575ef67
                          • Instruction Fuzzy Hash: A211983070174C82EA18A731665933962536FA97F4F144724AB36477E9DF68C452D740
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 001F199C Relevance: 9.0, APIs: 6, Instructions: 42stringCOMMON
                          Download Yara Rule
                          APIs
                          Memory Dump Source
                          • Source File: 00000006.00000002.603066398.00000000001F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 001F0000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_6_2_1f0000_services.jbxd
                          Similarity
                          • API ID: FileName$CloseFindHandleModuleOpenPathProcesslstrlen
                          • String ID:
                          • API String ID: 517849248-0
                          • Opcode ID: 01214db588610ff501214a343c1506f8e4016efad0e64bbd234dc336c45f59d3
                          • Instruction ID: 15f789370e20503786efbc589b2b62eaf841ebf00f446fbc6e33668849f86d14
                          • Opcode Fuzzy Hash: 01214db588610ff501214a343c1506f8e4016efad0e64bbd234dc336c45f59d3
                          • Instruction Fuzzy Hash: 23014831701B8482EB24DB52A89C75AA3A5F788FC4F888035DE8D53B56DF3CC999C740
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 001F36C8 Relevance: 9.0, APIs: 6, Instructions: 38threadCOMMON
                          Download Yara Rule
                          APIs
                          Memory Dump Source
                          • Source File: 00000006.00000002.603066398.00000000001F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 001F0000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_6_2_1f0000_services.jbxd
                          Similarity
                          • API ID: CurrentProcessProtectVirtual$HandleModuleTerminateThread
                          • String ID:
                          • API String ID: 449555515-0
                          • Opcode ID: 33edae7e4393505c590e6bdf894c2b6337bb17a10dfae21a600636dc78c73843
                          • Instruction ID: 6879a9431adffbdb012dbe1894f7c1cab10a1e86580eaea4869dbde21f1b0462
                          • Opcode Fuzzy Hash: 33edae7e4393505c590e6bdf894c2b6337bb17a10dfae21a600636dc78c73843
                          • Instruction Fuzzy Hash: 590156B5311B44C2EF24AB22F80C32A73A1BB99B86F084529DE5D07766EF3DC128C700
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 00202980 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 218COMMON
                          Download Yara Rule
                          APIs
                          Strings
                          Memory Dump Source
                          • Source File: 00000006.00000002.603066398.00000000001F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 001F0000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_6_2_1f0000_services.jbxd
                          Similarity
                          • API ID: ConsoleErrorLastMode
                          • String ID: pq.
                          • API String ID: 953036326-1094906938
                          • Opcode ID: c5ecde4312ccfa2e1ed1a2c608d038f857b097ec6549ceb78086129b2e572a94
                          • Instruction ID: 918cff15419c85b43a542c716b042aed77770ff2ea22443f85824161a53ec71b
                          • Opcode Fuzzy Hash: c5ecde4312ccfa2e1ed1a2c608d038f857b097ec6549ceb78086129b2e572a94
                          • Instruction Fuzzy Hash: 2A810472720B55C9EB20DF7594883AD3BA5F754B8CF24410BDE4A67B96DB34C8AAC700
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 001F8FE8 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 144COMMON
                          Download Yara Rule
                          APIs
                          • __except_validate_context_record.LIBVCRUNTIME ref: 001F9013
                          • _IsNonwritableInCurrentImage.LIBCMT ref: 001F90A8
                          • RtlUnwindEx.NTDLL ref: 001F90F7
                          Strings
                          Memory Dump Source
                          • Source File: 00000006.00000002.603066398.00000000001F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 001F0000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_6_2_1f0000_services.jbxd
                          Similarity
                          • API ID: CurrentImageNonwritableUnwind__except_validate_context_record
                          • String ID: csm$f
                          • API String ID: 2395640692-629598281
                          • Opcode ID: cf88226c4e0499e864df13b9fa0a288c301b8b6e63eb257c90d52d35e879efeb
                          • Instruction ID: 889e8ef0951408aa745a05a9dfa64fe9c531c6abd7208f4c867aec954c5ef711
                          • Opcode Fuzzy Hash: cf88226c4e0499e864df13b9fa0a288c301b8b6e63eb257c90d52d35e879efeb
                          • Instruction Fuzzy Hash: A751023270560A8ACB18EF25E848B793B6AF344BE8F558534EF0A47708EB35CC81CB00
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 001F3044 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 27COMMON
                          Download Yara Rule
                          APIs
                          Strings
                          Memory Dump Source
                          • Source File: 00000006.00000002.603066398.00000000001F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 001F0000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_6_2_1f0000_services.jbxd
                          Similarity
                          • API ID: CombinePath
                          • String ID: \\.\pipe\
                          • API String ID: 3422762182-91387939
                          • Opcode ID: 8c685e1f0b85bfe06f91eeefbd03c12bff8419d51c8b157116edbf6ca1c9c829
                          • Instruction ID: f5abdbc8739fa557c4b373e8a13376b232a328219a254f1b4a90aa6f6048ff67
                          • Opcode Fuzzy Hash: 8c685e1f0b85bfe06f91eeefbd03c12bff8419d51c8b157116edbf6ca1c9c829
                          • Instruction Fuzzy Hash: C8F03064714B9482EA048F53B95C32A6761BB48FD0F089171EE5A47B1ADF3CC5598740
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 001FBC98 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON
                          Download Yara Rule
                          APIs
                          Strings
                          Memory Dump Source
                          • Source File: 00000006.00000002.603066398.00000000001F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 001F0000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_6_2_1f0000_services.jbxd
                          Similarity
                          • API ID: AddressFreeHandleLibraryModuleProc
                          • String ID: CorExitProcess$mscoree.dll
                          • API String ID: 4061214504-1276376045
                          • Opcode ID: 95c54818ea39ae4ab476006ce308989d1f654d2f667890579c20066112978b6c
                          • Instruction ID: f69e7292c0bc63ffe8ba92281e5f0a194dfc74c811024cf710a8331f8b6aecf8
                          • Opcode Fuzzy Hash: 95c54818ea39ae4ab476006ce308989d1f654d2f667890579c20066112978b6c
                          • Instruction Fuzzy Hash: 47F0BE61315B0882EF108F28E88C36A6321FB88BA1F540219CA6A462F6CF3DC459C350
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 001F50D0 Relevance: 7.8, APIs: 5, Instructions: 318threadCOMMON
                          Download Yara Rule
                          APIs
                          • GetCurrentThreadId.KERNEL32 ref: 001F5156
                          Memory Dump Source
                          • Source File: 00000006.00000002.603066398.00000000001F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 001F0000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_6_2_1f0000_services.jbxd
                          Similarity
                          • API ID: CurrentThread
                          • String ID:
                          • API String ID: 2882836952-0
                          • Opcode ID: e13ad259af2044a9722e5c88be2fea28068701e2040856c8b7ebe2328a6e9181
                          • Instruction ID: 1c1645cf421a38f435cecbc563317d95c93cf4e5708f6a6ce43e22bce4350973
                          • Opcode Fuzzy Hash: e13ad259af2044a9722e5c88be2fea28068701e2040856c8b7ebe2328a6e9181
                          • Instruction Fuzzy Hash: 27F1B332219B8886DB60CB59F49476ABBA1F3C5B94F104116EB8E87B68DF7CC494CF00
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 001F5710 Relevance: 7.6, APIs: 5, Instructions: 124threadCOMMON
                          Download Yara Rule
                          APIs
                          • GetCurrentThreadId.KERNEL32 ref: 001F5726
                          Memory Dump Source
                          • Source File: 00000006.00000002.603066398.00000000001F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 001F0000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_6_2_1f0000_services.jbxd
                          Similarity
                          • API ID: CurrentThread
                          • String ID:
                          • API String ID: 2882836952-0
                          • Opcode ID: b02f694671304b5a077fe24bce3094f0c3b02718cee177a37b7a7da192a85efa
                          • Instruction ID: 26aa8bb68d399f61caa974230946a99fd38d2728fcc00fac6ea492c508b6d6f1
                          • Opcode Fuzzy Hash: b02f694671304b5a077fe24bce3094f0c3b02718cee177a37b7a7da192a85efa
                          • Instruction Fuzzy Hash: 6F51B736619F88C6DB64DB16E45432ABBA1F3D8794F501216EB8E87B68DB7CC550CF00
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 00204104 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE
                          Download Yara Rule
                          APIs
                          Memory Dump Source
                          • Source File: 00000006.00000002.603066398.00000000001F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 001F0000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_6_2_1f0000_services.jbxd
                          Similarity
                          • API ID: _set_statfp
                          • String ID:
                          • API String ID: 1156100317-0
                          • Opcode ID: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
                          • Instruction ID: aa34fb5c00d37bd20c8009bbd9ef6f1cb2d3171919b4d7e08dc61629ec95c8a3
                          • Opcode Fuzzy Hash: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
                          • Instruction Fuzzy Hash: 8E01CCF2A30F5121EB243968F85136591056B783F8F18CA38AB7E07BD7CB64C8E14600
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 001D3504 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE
                          Download Yara Rule
                          APIs
                          Memory Dump Source
                          • Source File: 00000006.00000002.602862348.00000000001C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 001C0000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_6_2_1c0000_services.jbxd
                          Similarity
                          • API ID: _set_statfp
                          • String ID:
                          • API String ID: 1156100317-0
                          • Opcode ID: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
                          • Instruction ID: 837f0c8eb845cf039b1b81d8aa9cc241dc29e1754677db0d6c2832ab0a34fc10
                          • Opcode Fuzzy Hash: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
                          • Instruction Fuzzy Hash: 7801D672A24F5261EF581528F45233911816B683B4F898B3BAE77177E6CB2CCB419203
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 001F9650 Relevance: 7.6, APIs: 5, Instructions: 53COMMONLIBRARYCODE
                          Download Yara Rule
                          APIs
                          Memory Dump Source
                          • Source File: 00000006.00000002.603066398.00000000001F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 001F0000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_6_2_1f0000_services.jbxd
                          Similarity
                          • API ID: ErrorLast
                          • String ID:
                          • API String ID: 1452528299-0
                          • Opcode ID: 46c896f13dff0714c7ccebb8ca9383bb675cc38bcf091c92c481f4a556b8b138
                          • Instruction ID: 3d5e86db0d0e6ff18c4b0cfdb817992d1e78819e2f62b7a134e808fdbf09f28b
                          • Opcode Fuzzy Hash: 46c896f13dff0714c7ccebb8ca9383bb675cc38bcf091c92c481f4a556b8b138
                          • Instruction Fuzzy Hash: 0011773071138842EE14F726A88977526556BA8BF4F184624DF6687BD9DF3CC852C700
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 001CF040 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 182COMMON
                          Download Yara Rule
                          APIs
                          • _invalid_parameter_noinfo.LIBCMT ref: 001CF124
                          Strings
                          Memory Dump Source
                          • Source File: 00000006.00000002.602862348.00000000001C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 001C0000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_6_2_1c0000_services.jbxd
                          Similarity
                          • API ID: _invalid_parameter_noinfo
                          • String ID: Tuesday$Wednesday$or copy constructor iterator'
                          • API String ID: 3215553584-4202648911
                          • Opcode ID: 9e57f18f61c22f0406784eb273be7b0d6046b42052b72e443b30de0c50228f55
                          • Instruction ID: e8af858d67ff2d3125de36f7b1e0a1649be2dca3cc991fc378bee204e04c0dad
                          • Opcode Fuzzy Hash: 9e57f18f61c22f0406784eb273be7b0d6046b42052b72e443b30de0c50228f55
                          • Instruction Fuzzy Hash: 0D51433660064082EB29DB69E585F3E6B63F7B5B80F59843EDE0A13728DB38C947C300
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 001FAA1C Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 147COMMON
                          Download Yara Rule
                          APIs
                          • EncodePointer.KERNEL32 ref: 001FAA68
                          • _CallSETranslator.LIBVCRUNTIME ref: 001FAAB7
                          Strings
                          Memory Dump Source
                          • Source File: 00000006.00000002.603066398.00000000001F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 001F0000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_6_2_1f0000_services.jbxd
                          Similarity
                          • API ID: CallEncodePointerTranslator
                          • String ID: MOC$RCC
                          • API String ID: 3544855599-2084237596
                          • Opcode ID: afa423ce38c0d5e6a55dfbc7a81328fa63e7332d8ee03f3f3ca57a2373e92492
                          • Instruction ID: 63de2e5b784602831eac9c1d1d51a948225f01880c2d84cb6b120a81879f61fc
                          • Opcode Fuzzy Hash: afa423ce38c0d5e6a55dfbc7a81328fa63e7332d8ee03f3f3ca57a2373e92492
                          • Instruction Fuzzy Hash: B3518B73600B888AEB20DF65D4807AD7BA0FB58B8CF444216EF8E17B58DB38D595C741
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 001FAD78 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMON
                          Download Yara Rule
                          APIs
                          • __except_validate_context_record.LIBVCRUNTIME ref: 001FADA0
                          • __FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 001FAE88
                          Strings
                          Memory Dump Source
                          • Source File: 00000006.00000002.603066398.00000000001F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 001F0000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_6_2_1f0000_services.jbxd
                          Similarity
                          • API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
                          • String ID: csm$csm
                          • API String ID: 3896166516-3733052814
                          • Opcode ID: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
                          • Instruction ID: 25bab69c29f3a4fe0a3649fe4ed72bee019a6e72636bf34f220ac822fbf40fea
                          • Opcode Fuzzy Hash: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
                          • Instruction Fuzzy Hash: D451D5B6200388CACB348F25D59437D77A0FBA4B95F984216EB9D8BB55CB3CD491CB02
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 001CA178 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMON
                          Download Yara Rule
                          APIs
                          • __except_validate_context_record.LIBVCRUNTIME ref: 001CA1A0
                          • __FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 001CA288
                          Strings
                          Memory Dump Source
                          • Source File: 00000006.00000002.602862348.00000000001C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 001C0000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_6_2_1c0000_services.jbxd
                          Similarity
                          • API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
                          • String ID: csm$csm
                          • API String ID: 3896166516-3733052814
                          • Opcode ID: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
                          • Instruction ID: f227e03fe88e8b635d7cc7b681926d4efd19cae8d551bbce2dd5b0fac9b9a368
                          • Opcode Fuzzy Hash: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
                          • Instruction Fuzzy Hash: E151AF321003C8CACB358F65D554B6D77A0FB75B98F98921EDB9987B95CB38D4A0CB02
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 001C8405 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 135COMMON
                          Download Yara Rule
                          APIs
                          • __except_validate_context_record.LIBVCRUNTIME ref: 001C8413
                          • _IsNonwritableInCurrentImage.LIBCMT ref: 001C84A8
                          Strings
                          Memory Dump Source
                          • Source File: 00000006.00000002.602862348.00000000001C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 001C0000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_6_2_1c0000_services.jbxd
                          Similarity
                          • API ID: CurrentImageNonwritable__except_validate_context_record
                          • String ID: csm$f
                          • API String ID: 3242871069-629598281
                          • Opcode ID: 114af5d7cf0438a1297bb8b9b6869ba79c6078414514cf9bb502ab9f42d0baed
                          • Instruction ID: 73a19d914d6bd0e7cfcd8d121074547a82977b492ea308c152a52993ea8d57cb
                          • Opcode Fuzzy Hash: 114af5d7cf0438a1297bb8b9b6869ba79c6078414514cf9bb502ab9f42d0baed
                          • Instruction Fuzzy Hash: E051AA327126108BCB19DF25E480F693766F364B98F558129EE1A47B08EFB4DD81CB44
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 002026F0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 100fileCOMMON
                          Download Yara Rule
                          APIs
                          Strings
                          Memory Dump Source
                          • Source File: 00000006.00000002.603066398.00000000001F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 001F0000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_6_2_1f0000_services.jbxd
                          Similarity
                          • API ID: ErrorFileLastWrite
                          • String ID: U$pq.
                          • API String ID: 442123175-2218977559
                          • Opcode ID: 94e3e9b2e49fb54f8b51ea0afa049cb5a9b4caf00c445db25a5723c425a58a56
                          • Instruction ID: 51e7aa42875d6868e928faf9b355583a1f7b4d99d4598dc4d604f08fd2aaeb3d
                          • Opcode Fuzzy Hash: 94e3e9b2e49fb54f8b51ea0afa049cb5a9b4caf00c445db25a5723c425a58a56
                          • Instruction Fuzzy Hash: C031F672724B80C6DB20DF25E8483AAB7A5F798794F408022EE4D87B98EF7CC455CB50
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 001C83E8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 75COMMON
                          Download Yara Rule
                          APIs
                          • __except_validate_context_record.LIBVCRUNTIME ref: 001C8413
                          • _IsNonwritableInCurrentImage.LIBCMT ref: 001C84A8
                          Strings
                          Memory Dump Source
                          • Source File: 00000006.00000002.602862348.00000000001C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 001C0000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_6_2_1c0000_services.jbxd
                          Similarity
                          • API ID: CurrentImageNonwritable__except_validate_context_record
                          • String ID: csm$f
                          • API String ID: 3242871069-629598281
                          • Opcode ID: 0036035fc280b7a5a111a049c7edfc77b7be6b9ab52e14187ebc45e366edaa55
                          • Instruction ID: 3d34fdfa75dd5b6dfd79be606ddc1bde8cb99d37b74f3c99d2e3f5752df262a1
                          • Opcode Fuzzy Hash: 0036035fc280b7a5a111a049c7edfc77b7be6b9ab52e14187ebc45e366edaa55
                          • Instruction Fuzzy Hash: 70318932211B40D6CB18DF12E884F6A7765F760B98F558118EE5A47B08DF78C941CB04
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 00202058 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON
                          Download Yara Rule
                          APIs
                          Memory Dump Source
                          • Source File: 00000006.00000002.603066398.00000000001F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 001F0000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_6_2_1f0000_services.jbxd
                          Similarity
                          • API ID: FileWrite$ConsoleErrorLastOutput
                          • String ID:
                          • API String ID: 2718003287-0
                          • Opcode ID: d9b1ad1a373a674d1985cb33d71231f2b71aece2c14fe5b700ae80922c385091
                          • Instruction ID: 671da97065e92398e896efc8c6c6a831b2040578a3a2bc394fa9bc84d6f44e10
                          • Opcode Fuzzy Hash: d9b1ad1a373a674d1985cb33d71231f2b71aece2c14fe5b700ae80922c385091
                          • Instruction Fuzzy Hash: 85C1F132B24B80CAD711CFB9D4443AC3BB5F354BD8B148256DE5D97B9ADA34C42AC740
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 001F7960 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMONLIBRARYCODE
                          Download Yara Rule
                          APIs
                          • GetSystemTimeAsFileTime.KERNEL32 ref: 001F798C
                          • GetCurrentThreadId.KERNEL32 ref: 001F799A
                          • GetCurrentProcessId.KERNEL32 ref: 001F79A6
                          • QueryPerformanceCounter.KERNEL32 ref: 001F79B6
                          Memory Dump Source
                          • Source File: 00000006.00000002.603066398.00000000001F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 001F0000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_6_2_1f0000_services.jbxd
                          Similarity
                          • API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
                          • String ID:
                          • API String ID: 2933794660-0
                          • Opcode ID: 561ac6f4885ef0f33bff27beb4ddb95e6a253367b5c72fac45fcb4617ca9122b
                          • Instruction ID: b24b0d37f3d2c84610f44e37111d50a911257cb17e6eb8e154bd97d35685a0f4
                          • Opcode Fuzzy Hash: 561ac6f4885ef0f33bff27beb4ddb95e6a253367b5c72fac45fcb4617ca9122b
                          • Instruction Fuzzy Hash: A4110C36B10F058AEB00CF60E8593A833A4F759768F441E25DF6D467A5DF78C2A88380
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 001FED0C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 194COMMON
                          Download Yara Rule
                          APIs
                            • Part of subcall function 001FE668: GetOEMCP.KERNEL32 ref: 001FE692
                          • IsValidCodePage.KERNEL32 ref: 001FED79
                          • GetCPInfo.KERNEL32 ref: 001FEDBD
                          Strings
                          Memory Dump Source
                          • Source File: 00000006.00000002.603066398.00000000001F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 001F0000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_6_2_1f0000_services.jbxd
                          Similarity
                          • API ID: CodeInfoPageValid
                          • String ID: y
                          • API String ID: 546120528-564295403
                          • Opcode ID: 6822e0a37001ac49409c30972473f96305db3612451a533fd16fefc89a3cd06d
                          • Instruction ID: 7e27b4dbeca4758e9a8c8448d577c791ac4743dbecbf9549568e1292568f0fee
                          • Opcode Fuzzy Hash: 6822e0a37001ac49409c30972473f96305db3612451a533fd16fefc89a3cd06d
                          • Instruction Fuzzy Hash: 257122B260578C86EB39CF29E444379BBE1F358B80F598026DB8A47672DB3DDA45C301
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 001F253C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 185COMMON
                          Download Yara Rule
                          APIs
                          Strings
                          Memory Dump Source
                          • Source File: 00000006.00000002.603066398.00000000001F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 001F0000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_6_2_1f0000_services.jbxd
                          Similarity
                          • API ID: FileType
                          • String ID: \\.\pipe\
                          • API String ID: 3081899298-91387939
                          • Opcode ID: 41f2590248caa42fa42cbc4740ff50b79ee080d5b4a351d521f36d41c2820f1b
                          • Instruction ID: d7707ada13725fde9dc7fe0951fe6a8591ce4fb7d1239f4afdde3e13d7787558
                          • Opcode Fuzzy Hash: 41f2590248caa42fa42cbc4740ff50b79ee080d5b4a351d521f36d41c2820f1b
                          • Instruction Fuzzy Hash: EF61C437200B8986CB35EF26E8543BAB764F3A9B94F950226EF1A57B18DF35C645C700
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 001C9E1C Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 147COMMON
                          Download Yara Rule
                          APIs
                          • _CallSETranslator.LIBVCRUNTIME ref: 001C9EB7
                          Strings
                          Memory Dump Source
                          • Source File: 00000006.00000002.602862348.00000000001C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 001C0000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_6_2_1c0000_services.jbxd
                          Similarity
                          • API ID: CallTranslator
                          • String ID: MOC$RCC
                          • API String ID: 3163161869-2084237596
                          • Opcode ID: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
                          • Instruction ID: bf9a96dac27c2fb5689e25a7a442448603ff61bf75b1efc8eeabc4183bd95566
                          • Opcode Fuzzy Hash: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
                          • Instruction Fuzzy Hash: 21518B33A04B84CADB20DF65D480B9D7BA0F768B8CF14421AEF4917B58DB78D595C700
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 002025D4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 77fileCOMMON
                          Download Yara Rule
                          APIs
                          Strings
                          Memory Dump Source
                          • Source File: 00000006.00000002.603066398.00000000001F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 001F0000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_6_2_1f0000_services.jbxd
                          Similarity
                          • API ID: ErrorFileLastWrite
                          • String ID: pq.
                          • API String ID: 442123175-1094906938
                          • Opcode ID: 6a8b7be37c354b90c3c58bec20d11a7fb2faf8562248a756045ffe1d95056732
                          • Instruction ID: 3b3b416d4487c56caafd551a0a95042833d5438cb7038ce85fe6688e5f5582ba
                          • Opcode Fuzzy Hash: 6a8b7be37c354b90c3c58bec20d11a7fb2faf8562248a756045ffe1d95056732
                          • Instruction Fuzzy Hash: BD21D872721B40C7CB10AF19E8883D973A9F758784F549026EF4D87765EB39C565CB00
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 002024D0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 74fileCOMMON
                          Download Yara Rule
                          APIs
                          Strings
                          Memory Dump Source
                          • Source File: 00000006.00000002.603066398.00000000001F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 001F0000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_6_2_1f0000_services.jbxd
                          Similarity
                          • API ID: ErrorFileLastWrite
                          • String ID: pq.
                          • API String ID: 442123175-1094906938
                          • Opcode ID: 9a54b18a8e95195701766736d0ee8c69aa1558165b06a77f74fea7402753075b
                          • Instruction ID: 21cb95c4dac4cf86b4a38d34305a364715b00f39ecd8970a3fbe43ff17bf5f3c
                          • Opcode Fuzzy Hash: 9a54b18a8e95195701766736d0ee8c69aa1558165b06a77f74fea7402753075b
                          • Instruction Fuzzy Hash: F521E772325B84CACB149F19E8883C9BBA5F75C780F945022EF4E83B55DB38C56ACB04
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 001FF948 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 71COMMON
                          Download Yara Rule
                          APIs
                          Strings
                          Memory Dump Source
                          • Source File: 00000006.00000002.603066398.00000000001F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 001F0000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_6_2_1f0000_services.jbxd
                          Similarity
                          • API ID: FileHandleType
                          • String ID: pq.
                          • API String ID: 3000768030-1094906938
                          • Opcode ID: a07d0c2e6d1ea39fb6922406f7202b79799826504b1902530f517849248bbcbd
                          • Instruction ID: 255532bc2645f218764a902aaf9916cc4b70688d07196c60c24a834909574871
                          • Opcode Fuzzy Hash: a07d0c2e6d1ea39fb6922406f7202b79799826504b1902530f517849248bbcbd
                          • Instruction Fuzzy Hash: 0121A232624F5892CB248B1595843787A50FB49BB4F69131EEBAE473E0CBB5D8A2D340
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 001FF858 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 64COMMON
                          Download Yara Rule
                          APIs
                          • GetStartupInfoW.KERNEL32 ref: 001FF878
                            • Part of subcall function 00201D0C: _invalid_parameter_noinfo.LIBCMT ref: 00201D37
                          • GetFileType.KERNEL32 ref: 001FF8E3
                          Strings
                          Memory Dump Source
                          • Source File: 00000006.00000002.603066398.00000000001F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 001F0000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_6_2_1f0000_services.jbxd
                          Similarity
                          • API ID: FileInfoStartupType_invalid_parameter_noinfo
                          • String ID: pq.
                          • API String ID: 3015670849-1094906938
                          • Opcode ID: fd9f19cf680c58398aebcc958da36468d3e027ed025034a817fc60e74b98066e
                          • Instruction ID: f67fdecfd779c159c8d3eae547eb3423777b2b8e8eec1294cfd55d4c53d63a51
                          • Opcode Fuzzy Hash: fd9f19cf680c58398aebcc958da36468d3e027ed025034a817fc60e74b98066e
                          • Instruction Fuzzy Hash: 26218B36600B4895DB118F15E44436837A0F798FA8F5A422ADBAD133A1CF78D997C341
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 00203394 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47COMMON
                          Download Yara Rule
                          APIs
                          Strings
                          Memory Dump Source
                          • Source File: 00000006.00000002.603066398.00000000001F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 001F0000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_6_2_1f0000_services.jbxd
                          Similarity
                          • API ID: ErrorFileLastPointer
                          • String ID: pq.
                          • API String ID: 2976181284-1094906938
                          • Opcode ID: ee06cf56793c0d49bec16673e50e77014a4cc6b54853e90c28242225926c7685
                          • Instruction ID: acc5d77848d3ead7ad10498c28f1f41eac50cc62e44ffb56ec5272ed7f03a328
                          • Opcode Fuzzy Hash: ee06cf56793c0d49bec16673e50e77014a4cc6b54853e90c28242225926c7685
                          • Instruction Fuzzy Hash: 8511A072324B8081CB10CB25F888369A766B744FF4F585311EE7A4B7EADF78C5658780
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 001F94A0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMONLIBRARYCODE
                          Download Yara Rule
                          APIs
                          Strings
                          Memory Dump Source
                          • Source File: 00000006.00000002.603066398.00000000001F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 001F0000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_6_2_1f0000_services.jbxd
                          Similarity
                          • API ID: ExceptionFileHeaderRaise
                          • String ID: csm
                          • API String ID: 2573137834-1018135373
                          • Opcode ID: 596d8aa0106168f831d5a6617a756b303fb26e5894bac8705379b132699e985d
                          • Instruction ID: 05a510c2de6e1d7d1a218ad19efd29b9342aaf5ec9b0d8cc8c6623831c3a45b1
                          • Opcode Fuzzy Hash: 596d8aa0106168f831d5a6617a756b303fb26e5894bac8705379b132699e985d
                          • Instruction Fuzzy Hash: 12111836214B8482DB218F25F54436AB7A5FB88B94F584225EF8D07B29DF3CC566CB00
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 00201F38 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 40COMMON
                          Download Yara Rule
                          APIs
                          Strings
                          Memory Dump Source
                          • Source File: 00000006.00000002.603066398.00000000001F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 001F0000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_6_2_1f0000_services.jbxd
                          Similarity
                          • API ID: BuffersErrorFileFlushLast
                          • String ID: pq.
                          • API String ID: 1917127615-1094906938
                          • Opcode ID: de06bf8897cc540b75826308fcf267bc1d6ef71e98a5ba454639789c43433901
                          • Instruction ID: ca8fb4563d935812ebc0658fc2b06b4e3ac1563744a18b98c84e290d44808ed3
                          • Opcode Fuzzy Hash: de06bf8897cc540b75826308fcf267bc1d6ef71e98a5ba454639789c43433901
                          • Instruction Fuzzy Hash: 14018FB1720B8982DB00EF66E48836C3362BB98B90F854124EB4A4B3A7DB7CC474C700
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 001C7356 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 18COMMON
                          Download Yara Rule
                          APIs
                          • __std_exception_copy.LIBVCRUNTIME ref: 001C737C
                          Strings
                          Memory Dump Source
                          • Source File: 00000006.00000002.602862348.00000000001C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 001C0000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_6_2_1c0000_services.jbxd
                          Similarity
                          • API ID: __std_exception_copy
                          • String ID: ierarchy Descriptor'$riptor at (
                          • API String ID: 592178966-758928094
                          • Opcode ID: 13d46e236c22f038e3183f277bc937bc0c01c293d14bd07e4c5c2ea041926035
                          • Instruction ID: 6fba17b2ee403d0ee3f37521f59598505e4beea91c7f4d6ed612fd46a8e4bec4
                          • Opcode Fuzzy Hash: 13d46e236c22f038e3183f277bc937bc0c01c293d14bd07e4c5c2ea041926035
                          • Instruction Fuzzy Hash: FCE08C61A40B48D0DF068F22E8903D833A1EBA8B68F9891229A5C06310FB38D2E9C300
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 001C73B4 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 17COMMON
                          Download Yara Rule
                          APIs
                          • __std_exception_copy.LIBVCRUNTIME ref: 001C73D8
                          Strings
                          Memory Dump Source
                          • Source File: 00000006.00000002.602862348.00000000001C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 001C0000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_6_2_1c0000_services.jbxd
                          Similarity
                          • API ID: __std_exception_copy
                          • String ID: Locator'$riptor at (
                          • API String ID: 592178966-4215709766
                          • Opcode ID: af0f0512ca75cd806a30771dd11e2a0f17b9e6725b3a9df23089972a8cb9d3f7
                          • Instruction ID: 04e926060213cf38ffa423239a086c880811b200f812eb4be81c6ca1c634350a
                          • Opcode Fuzzy Hash: af0f0512ca75cd806a30771dd11e2a0f17b9e6725b3a9df23089972a8cb9d3f7
                          • Instruction Fuzzy Hash: CBE0EC61A51F48D4DF068F61E89039873A5EB68B68F989122DA5C46355FB38D1E9C300
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 001F1BF4 Relevance: 5.1, APIs: 4, Instructions: 52memoryCOMMON
                          Download Yara Rule
                          APIs
                          • GetProcessHeap.KERNEL32 ref: 001F1C2D
                          • HeapAlloc.KERNEL32 ref: 001F1C3B
                          • GetProcessHeap.KERNEL32 ref: 001F1C77
                          • HeapFree.KERNEL32 ref: 001F1C85
                            • Part of subcall function 001F152C: StrCmpIW.SHLWAPI ref: 001F155D
                          Memory Dump Source
                          • Source File: 00000006.00000002.603066398.00000000001F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 001F0000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_6_2_1f0000_services.jbxd
                          Similarity
                          • API ID: Heap$Process$AllocFree
                          • String ID:
                          • API String ID: 756756679-0
                          • Opcode ID: e6b128499454e36a5cfdb4ce6de946333e896a2fc86765bea62df52d9c8f7d1a
                          • Instruction ID: 63086a88e506747b30a91bca6e79bb79164cf2423e001a08986fe2e8be78f231
                          • Opcode Fuzzy Hash: e6b128499454e36a5cfdb4ce6de946333e896a2fc86765bea62df52d9c8f7d1a
                          • Instruction Fuzzy Hash: 1B115A35601B88D5EA04DB66A80837AB7A1FB89FD0F584029EF4E57726DF38C452C340
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 001F1268 Relevance: 5.0, APIs: 4, Instructions: 21memoryCOMMON
                          Download Yara Rule
                          APIs
                          Memory Dump Source
                          • Source File: 00000006.00000002.603066398.00000000001F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 001F0000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_6_2_1f0000_services.jbxd
                          Similarity
                          • API ID: Heap$AllocProcess
                          • String ID:
                          • API String ID: 1617791916-0
                          • Opcode ID: c7b0d7b4e65e150846e46a28cdf479c2d04166a2b9ed3272f310b0e97a34ba1d
                          • Instruction ID: 69b95f7d2b369cd4e56d8da77fdd32de249094b9aa262e45f06e936e6799c24c
                          • Opcode Fuzzy Hash: c7b0d7b4e65e150846e46a28cdf479c2d04166a2b9ed3272f310b0e97a34ba1d
                          • Instruction Fuzzy Hash: 91E01A75A11B0486EB089F62D81C35AB6E1FB8DF56F49C024C94D07362DF7D84E9CB90
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 001F1000 Relevance: 5.0, APIs: 4, Instructions: 20memoryCOMMON
                          Download Yara Rule
                          APIs
                          Memory Dump Source
                          • Source File: 00000006.00000002.603066398.00000000001F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 001F0000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_6_2_1f0000_services.jbxd
                          Similarity
                          • API ID: Heap$AllocProcess
                          • String ID:
                          • API String ID: 1617791916-0
                          • Opcode ID: 952b2c0fe5133ab7956e2ef84fe5bf2b2b692290a663e8cebccb5d827e1e35ea
                          • Instruction ID: 29ac2ae8f46404a49fcb430b907a7f6bb2e73290e8bba681fa85751029aa7fa2
                          • Opcode Fuzzy Hash: 952b2c0fe5133ab7956e2ef84fe5bf2b2b692290a663e8cebccb5d827e1e35ea
                          • Instruction Fuzzy Hash: 1AE01A75611B0487EB089F62D80C35AB6E1FB8CF16F488024C90D07322EE3C84A9CB20
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Execution Graph

                          Execution Coverage:2.4%
                          Dynamic/Decrypted Code Coverage:0%
                          Signature Coverage:0%
                          Total number of Nodes:1590
                          Total number of Limit Nodes:23
                          execution_graph 9417 248c5cc 9418 248d744 Concurrency::details::SchedulerProxy::DeleteThis 8 API calls 9417->9418 9419 248c5dc 9418->9419 9420 248d744 Concurrency::details::SchedulerProxy::DeleteThis 8 API calls 9419->9420 9421 248c5f0 9420->9421 9422 248d744 Concurrency::details::SchedulerProxy::DeleteThis 8 API calls 9421->9422 9423 248c604 9422->9423 9424 248d744 Concurrency::details::SchedulerProxy::DeleteThis 8 API calls 9423->9424 9425 248c618 9424->9425 9022 248554d 9024 2485554 9022->9024 9023 24855bb 9024->9023 9025 2485637 VirtualProtect 9024->9025 9026 2485671 9025->9026 9027 2485663 GetLastError 9025->9027 9027->9026 7732 248fc40 7733 248fc70 7732->7733 7735 248fc97 7732->7735 7733->7735 7738 248fc84 7733->7738 7750 248cfa0 GetLastError 7733->7750 7741 248fd6c 7735->7741 7772 248c99c EnterCriticalSection 7735->7772 7736 248fcd4 7738->7735 7738->7736 7739 248fd19 7738->7739 7766 248d6ac 7739->7766 7742 248fea0 7741->7742 7748 248fdd3 7741->7748 7774 248ce28 GetLastError 7741->7774 7746 248fdc3 7747 248ce28 _invalid_parameter_noinfo 19 API calls 7746->7747 7747->7748 7749 248ce28 19 API calls _invalid_parameter_noinfo 7748->7749 7749->7748 7751 248cfe1 FlsSetValue 7750->7751 7754 248cfc4 7750->7754 7752 248cff3 7751->7752 7755 248cfd1 _invalid_parameter_noinfo 7751->7755 7808 248d6cc 7752->7808 7754->7751 7754->7755 7755->7738 7757 248d020 FlsSetValue 7759 248d02c FlsSetValue 7757->7759 7760 248d03e 7757->7760 7758 248d010 FlsSetValue 7761 248d019 7758->7761 7759->7761 7821 248cb94 7760->7821 7815 248d744 7761->7815 7765 248d744 Concurrency::details::SchedulerProxy::DeleteThis 3 API calls 7765->7755 7767 248cfa0 __std_exception_copy 8 API calls 7766->7767 7768 248d6b5 7767->7768 7769 248d570 7768->7769 7956 248d408 7769->7956 7773 2496240 7772->7773 7775 248ce69 FlsSetValue 7774->7775 7776 248ce4c FlsGetValue 7774->7776 7778 248ce7b 7775->7778 7789 248ce59 _invalid_parameter_noinfo 7775->7789 7777 248ce63 7776->7777 7776->7789 7777->7775 7779 248d6cc __std_exception_copy 8 API calls 7778->7779 7780 248ce8a 7779->7780 7781 248cea8 FlsSetValue 7780->7781 7782 248ce98 FlsSetValue 7780->7782 7784 248ceb4 FlsSetValue 7781->7784 7785 248cec6 7781->7785 7783 248cea1 7782->7783 7787 248d744 Concurrency::details::SchedulerProxy::DeleteThis 8 API calls 7783->7787 7784->7783 7788 248cb94 __std_exception_copy 8 API calls 7785->7788 7786 248cee2 7786->7746 7787->7789 7790 248cece 7788->7790 7789->7786 7792 248cf28 FlsSetValue 7789->7792 7793 248cf0d FlsGetValue 7789->7793 7791 248d744 Concurrency::details::SchedulerProxy::DeleteThis 8 API calls 7790->7791 7791->7789 7795 248cf35 7792->7795 7796 248cf1a 7792->7796 7794 248cf22 7793->7794 7793->7796 7794->7792 7797 248d6cc __std_exception_copy 8 API calls 7795->7797 7796->7746 7798 248cf44 7797->7798 7799 248cf62 FlsSetValue 7798->7799 7800 248cf52 FlsSetValue 7798->7800 7801 248cf6e FlsSetValue 7799->7801 7802 248cf80 7799->7802 7803 248cf5b 7800->7803 7801->7803 7804 248cb94 __std_exception_copy 8 API calls 7802->7804 7805 248d744 Concurrency::details::SchedulerProxy::DeleteThis 8 API calls 7803->7805 7806 248cf88 7804->7806 7805->7796 7807 248d744 Concurrency::details::SchedulerProxy::DeleteThis 8 API calls 7806->7807 7807->7796 7813 248d6dd __std_exception_copy 7808->7813 7809 248d72e 7812 248d6ac __std_exception_copy 7 API calls 7809->7812 7810 248d712 HeapAlloc 7811 248d002 7810->7811 7810->7813 7811->7757 7811->7758 7812->7811 7813->7809 7813->7810 7826 248b85c 7813->7826 7816 248d749 Concurrency::details::SchedulerProxy::DeleteThis 7815->7816 7817 248d77a 7815->7817 7816->7817 7818 248d764 GetLastError 7816->7818 7817->7755 7819 248d771 Concurrency::details::SchedulerProxy::DeleteThis 7818->7819 7820 248d6ac __std_exception_copy 7 API calls 7819->7820 7820->7817 7832 248ca6c 7821->7832 7823 248cc46 7835 248caec 7823->7835 7825 248cc5b 7825->7765 7829 248b89c 7826->7829 7828 248b86e 7828->7813 7830 248c99c Concurrency::details::SchedulerProxy::DeleteThis EnterCriticalSection 7829->7830 7831 248b8a9 7830->7831 7831->7828 7833 248c99c Concurrency::details::SchedulerProxy::DeleteThis EnterCriticalSection 7832->7833 7834 248ca88 7833->7834 7834->7823 7836 248c99c Concurrency::details::SchedulerProxy::DeleteThis EnterCriticalSection 7835->7836 7837 248cb08 7836->7837 7840 248cd7c 7837->7840 7839 248cb1e 7839->7825 7841 248cdc4 Concurrency::details::SchedulerProxy::DeleteThis 7840->7841 7842 248cd98 Concurrency::details::SchedulerProxy::DeleteThis 7840->7842 7841->7839 7842->7841 7844 24907b4 7842->7844 7845 2490850 7844->7845 7846 24907d7 7844->7846 7847 24908a3 7845->7847 7849 248d744 Concurrency::details::SchedulerProxy::DeleteThis 8 API calls 7845->7849 7846->7845 7852 2490816 7846->7852 7855 248d744 Concurrency::details::SchedulerProxy::DeleteThis 8 API calls 7846->7855 7910 2490954 7847->7910 7850 2490874 7849->7850 7853 248d744 Concurrency::details::SchedulerProxy::DeleteThis 8 API calls 7850->7853 7851 2490838 7854 248d744 Concurrency::details::SchedulerProxy::DeleteThis 8 API calls 7851->7854 7852->7851 7858 248d744 Concurrency::details::SchedulerProxy::DeleteThis 8 API calls 7852->7858 7856 2490888 7853->7856 7860 2490844 7854->7860 7861 249080a 7855->7861 7857 248d744 Concurrency::details::SchedulerProxy::DeleteThis 8 API calls 7856->7857 7862 2490897 7857->7862 7863 249082c 7858->7863 7859 249090e 7864 248d744 Concurrency::details::SchedulerProxy::DeleteThis 8 API calls 7860->7864 7870 2492fc8 7861->7870 7867 248d744 Concurrency::details::SchedulerProxy::DeleteThis 8 API calls 7862->7867 7898 24930d4 7863->7898 7864->7845 7865 248d744 8 API calls Concurrency::details::SchedulerProxy::DeleteThis 7869 24908af 7865->7869 7867->7847 7869->7859 7869->7865 7871 2492fd1 7870->7871 7896 24930cc 7870->7896 7872 2492feb 7871->7872 7873 248d744 Concurrency::details::SchedulerProxy::DeleteThis 8 API calls 7871->7873 7874 2492ffd 7872->7874 7875 248d744 Concurrency::details::SchedulerProxy::DeleteThis 8 API calls 7872->7875 7873->7872 7876 249300f 7874->7876 7877 248d744 Concurrency::details::SchedulerProxy::DeleteThis 8 API calls 7874->7877 7875->7874 7878 2493021 7876->7878 7880 248d744 Concurrency::details::SchedulerProxy::DeleteThis 8 API calls 7876->7880 7877->7876 7879 2493033 7878->7879 7881 248d744 Concurrency::details::SchedulerProxy::DeleteThis 8 API calls 7878->7881 7882 2493045 7879->7882 7883 248d744 Concurrency::details::SchedulerProxy::DeleteThis 8 API calls 7879->7883 7880->7878 7881->7879 7884 2493057 7882->7884 7885 248d744 Concurrency::details::SchedulerProxy::DeleteThis 8 API calls 7882->7885 7883->7882 7886 2493069 7884->7886 7887 248d744 Concurrency::details::SchedulerProxy::DeleteThis 8 API calls 7884->7887 7885->7884 7888 249307b 7886->7888 7890 248d744 Concurrency::details::SchedulerProxy::DeleteThis 8 API calls 7886->7890 7887->7886 7889 249308d 7888->7889 7891 248d744 Concurrency::details::SchedulerProxy::DeleteThis 8 API calls 7888->7891 7892 24930a2 7889->7892 7893 248d744 Concurrency::details::SchedulerProxy::DeleteThis 8 API calls 7889->7893 7890->7888 7891->7889 7894 24930b7 7892->7894 7895 248d744 Concurrency::details::SchedulerProxy::DeleteThis 8 API calls 7892->7895 7893->7892 7894->7896 7897 248d744 Concurrency::details::SchedulerProxy::DeleteThis 8 API calls 7894->7897 7895->7894 7896->7852 7897->7896 7899 24930d9 7898->7899 7908 249313a 7898->7908 7900 24930f2 7899->7900 7901 248d744 Concurrency::details::SchedulerProxy::DeleteThis 8 API calls 7899->7901 7902 2493104 7900->7902 7903 248d744 Concurrency::details::SchedulerProxy::DeleteThis 8 API calls 7900->7903 7901->7900 7904 248d744 Concurrency::details::SchedulerProxy::DeleteThis 8 API calls 7902->7904 7906 2493116 7902->7906 7903->7902 7904->7906 7905 2493128 7905->7908 7909 248d744 Concurrency::details::SchedulerProxy::DeleteThis 8 API calls 7905->7909 7906->7905 7907 248d744 Concurrency::details::SchedulerProxy::DeleteThis 8 API calls 7906->7907 7907->7905 7908->7851 7909->7908 7911 2490959 7910->7911 7912 2490985 7910->7912 7911->7912 7916 2493174 7911->7916 7912->7869 7915 248d744 Concurrency::details::SchedulerProxy::DeleteThis 8 API calls 7915->7912 7917 249097d 7916->7917 7918 249317d 7916->7918 7917->7915 7952 2493140 7918->7952 7921 2493140 Concurrency::details::SchedulerProxy::DeleteThis 8 API calls 7922 24931a6 7921->7922 7923 2493140 Concurrency::details::SchedulerProxy::DeleteThis 8 API calls 7922->7923 7924 24931b4 7923->7924 7925 2493140 Concurrency::details::SchedulerProxy::DeleteThis 8 API calls 7924->7925 7926 24931c2 7925->7926 7927 2493140 Concurrency::details::SchedulerProxy::DeleteThis 8 API calls 7926->7927 7928 24931d1 7927->7928 7929 248d744 Concurrency::details::SchedulerProxy::DeleteThis 8 API calls 7928->7929 7930 24931dd 7929->7930 7931 248d744 Concurrency::details::SchedulerProxy::DeleteThis 8 API calls 7930->7931 7932 24931e9 7931->7932 7933 248d744 Concurrency::details::SchedulerProxy::DeleteThis 8 API calls 7932->7933 7934 24931f5 7933->7934 7935 2493140 Concurrency::details::SchedulerProxy::DeleteThis 8 API calls 7934->7935 7936 2493203 7935->7936 7937 2493140 Concurrency::details::SchedulerProxy::DeleteThis 8 API calls 7936->7937 7938 2493211 7937->7938 7939 2493140 Concurrency::details::SchedulerProxy::DeleteThis 8 API calls 7938->7939 7940 249321f 7939->7940 7941 2493140 Concurrency::details::SchedulerProxy::DeleteThis 8 API calls 7940->7941 7942 249322d 7941->7942 7943 2493140 Concurrency::details::SchedulerProxy::DeleteThis 8 API calls 7942->7943 7944 249323c 7943->7944 7945 248d744 Concurrency::details::SchedulerProxy::DeleteThis 8 API calls 7944->7945 7946 2493248 7945->7946 7947 248d744 Concurrency::details::SchedulerProxy::DeleteThis 8 API calls 7946->7947 7948 2493254 7947->7948 7949 248d744 Concurrency::details::SchedulerProxy::DeleteThis 8 API calls 7948->7949 7950 2493260 7949->7950 7951 248d744 Concurrency::details::SchedulerProxy::DeleteThis 8 API calls 7950->7951 7951->7917 7953 2493167 7952->7953 7954 2493156 7952->7954 7953->7921 7954->7953 7955 248d744 Concurrency::details::SchedulerProxy::DeleteThis 8 API calls 7954->7955 7955->7954 7957 248d433 7956->7957 7964 248d4a4 7957->7964 7959 248d45a 7962 248d47d 7959->7962 7974 248c7a0 7959->7974 7961 248d492 7961->7736 7962->7961 7963 248c7a0 _invalid_parameter_noinfo 23 API calls 7962->7963 7963->7961 7986 248d1ec 7964->7986 7966 248d4ce 7970 248d4df 7966->7970 7991 248d258 7966->7991 7968 248d52b 7968->7970 7994 248d590 7968->7994 7970->7959 7975 248c7f8 7974->7975 7976 248c7af GetLastError 7974->7976 7975->7962 7977 248c7c4 7976->7977 7978 248d068 _invalid_parameter_noinfo 11 API calls 7977->7978 7979 248c7de _invalid_parameter_noinfo 7978->7979 7979->7975 7980 248c7a0 _invalid_parameter_noinfo 22 API calls 7979->7980 7981 248c827 7980->7981 8036 2490430 7981->8036 7987 248d208 GetLastError 7986->7987 7988 248d233 _invalid_parameter_noinfo 7986->7988 7989 248d218 7987->7989 7988->7966 8000 248d068 7989->8000 7992 248d274 GetLastError 7991->7992 7993 248d28a _invalid_parameter_noinfo 7991->7993 7992->7993 7993->7968 7995 248d59f _log10_special 7994->7995 8014 248d2a4 7995->8014 7997 248d5be __raise_securityfailure 7998 248d5c4 TerminateProcess 7997->7998 7999 2496158 7998->7999 8001 248d087 FlsGetValue 8000->8001 8003 248d09c 8000->8003 8002 248d094 8001->8002 8001->8003 8002->7988 8003->8002 8004 248d6cc __std_exception_copy 8 API calls 8003->8004 8005 248d0be 8004->8005 8006 248d0dc FlsSetValue 8005->8006 8009 248d0cc 8005->8009 8007 248d0e8 FlsSetValue 8006->8007 8008 248d0fa 8006->8008 8007->8009 8010 248cb94 __std_exception_copy 8 API calls 8008->8010 8011 248d744 Concurrency::details::SchedulerProxy::DeleteThis 8 API calls 8009->8011 8012 248d102 8010->8012 8011->8002 8013 248d744 Concurrency::details::SchedulerProxy::DeleteThis 8 API calls 8012->8013 8013->8002 8015 248d2de _invalid_parameter_noinfo 8014->8015 8016 248d306 RtlCaptureContext 8015->8016 8017 248d33b capture_previous_context _invalid_parameter_noinfo 8016->8017 8018 248d3af SetUnhandledExceptionFilter UnhandledExceptionFilter 8017->8018 8019 248d3c8 _invalid_parameter_noinfo 8018->8019 8022 2487940 8019->8022 8024 2487949 _log10_special 8022->8024 8023 2487954 8023->7997 8024->8023 8029 2488320 RtlCaptureContext 8024->8029 8026 2488157 8031 24880f8 SetUnhandledExceptionFilter UnhandledExceptionFilter 8026->8031 8030 248833a capture_previous_context 8029->8030 8030->8026 8035 2496038 8031->8035 8037 2490449 8036->8037 8038 248c84f 8036->8038 8037->8038 8044 2490a5c 8037->8044 8040 249049c 8038->8040 8041 248c85f 8040->8041 8042 24904b5 8040->8042 8041->7962 8042->8041 8055 248ecf0 8042->8055 8045 248ce28 _invalid_parameter_noinfo 19 API calls 8044->8045 8046 2490a6b 8045->8046 8047 248c99c Concurrency::details::SchedulerProxy::DeleteThis EnterCriticalSection 8046->8047 8050 2490aa4 8046->8050 8048 2490a94 8047->8048 8051 2490acc 8048->8051 8050->8038 8052 2490ade Concurrency::details::SchedulerProxy::DeleteThis 8051->8052 8054 2490aeb 8051->8054 8053 24907b4 Concurrency::details::SchedulerProxy::DeleteThis 8 API calls 8052->8053 8052->8054 8053->8054 8054->8050 8056 248ce28 _invalid_parameter_noinfo 19 API calls 8055->8056 8057 248ecf9 8056->8057 8408 2491ac1 8409 248d6ac __std_exception_copy 8 API calls 8408->8409 8410 2491ac6 8409->8410 8411 248d570 _invalid_parameter_noinfo 33 API calls 8410->8411 8412 2491ad1 8411->8412 8058 2491040 8059 249105f 8058->8059 8060 24910d8 8059->8060 8063 249106f 8059->8063 8066 2488200 8060->8066 8064 2487940 _log10_special 4 API calls 8063->8064 8065 24910ce 8064->8065 8069 2488214 8066->8069 8070 2488227 _log10_special 8069->8070 8075 24882b0 RtlCaptureContext 8070->8075 8072 248823f 8073 24880f8 __raise_securityfailure 3 API calls 8072->8073 8074 248820e 8073->8074 8076 24882db capture_previous_context 8075->8076 8076->8072 9028 2490b40 9029 2490b6d 9028->9029 9030 248d6ac __std_exception_copy 8 API calls 9029->9030 9035 2490b82 9029->9035 9031 2490b77 9030->9031 9032 248d570 _invalid_parameter_noinfo 33 API calls 9031->9032 9032->9035 9033 2487940 _log10_special 4 API calls 9034 2490f40 9033->9034 9035->9033 7704 2482244 GetProcessIdOfThread GetCurrentProcessId 7705 2482312 7704->7705 7706 2482275 7704->7706 7711 2481934 OpenProcess 7706->7711 7709 2482287 CreateFileW 7709->7705 7710 24822cb WriteFile ReadFile CloseHandle 7709->7710 7710->7705 7712 2481989 7711->7712 7713 2481960 IsWow64Process 7711->7713 7712->7705 7712->7709 7714 2481980 CloseHandle 7713->7714 7715 2481972 7713->7715 7714->7712 7715->7714 7716 2489dc4 7720 2489ecd __vcrt_FlsSetValue 7716->7720 7721 2489e08 __vcrt_FlsSetValue 7716->7721 7717 2489e36 LoadLibraryExW 7718 2489ead 7717->7718 7719 2489e57 GetLastError 7717->7719 7718->7720 7722 2489ec4 FreeLibrary 7718->7722 7719->7721 7721->7717 7721->7720 7723 2489e79 LoadLibraryExW 7721->7723 7722->7720 7723->7718 7723->7721 9426 2494dd8 9429 248b200 9426->9429 9430 248b21f 9429->9430 9432 248b270 9429->9432 9431 2489634 ExFilterRethrow 6 API calls 9430->9431 9430->9432 9431->9432 8413 2487adc 8420 248925c 8413->8420 8416 2487ae9 8421 2489650 ExFilterRethrow 6 API calls 8420->8421 8422 2487ae5 8421->8422 8422->8416 8423 248c63c 8422->8423 8424 248cfa0 __std_exception_copy 8 API calls 8423->8424 8425 2487af2 8424->8425 8425->8416 8426 2489270 8425->8426 8429 24895ec 8426->8429 8428 2489279 8428->8416 8430 24895fd 8429->8430 8434 2489612 __vcrt_freefls 8429->8434 8431 2489fa4 ExFilterRethrow 5 API calls 8430->8431 8432 2489602 8431->8432 8435 2489fec 8432->8435 8434->8428 8436 2489dc4 __vcrt_FlsSetValue 4 API calls 8435->8436 8437 248a01a __vcrt_FlsSetValue _RTC_Initialize 8436->8437 8437->8434 8077 248fa50 8078 248c99c Concurrency::details::SchedulerProxy::DeleteThis EnterCriticalSection 8077->8078 8079 248fa60 8078->8079 8086 2491d0c 8079->8086 8081 248fa69 8082 248fa77 8081->8082 8096 248f858 GetStartupInfoW 8081->8096 8087 2491d2b 8086->8087 8088 2491d54 8086->8088 8089 248d6ac __std_exception_copy 8 API calls 8087->8089 8090 248c99c Concurrency::details::SchedulerProxy::DeleteThis EnterCriticalSection 8088->8090 8091 2491d30 8089->8091 8095 2491d5e 8090->8095 8092 248d570 _invalid_parameter_noinfo 33 API calls 8091->8092 8093 2491d3c 8092->8093 8093->8081 8095->8093 8107 2491c14 8095->8107 8097 248f88d 8096->8097 8098 248f927 8096->8098 8097->8098 8099 2491d0c 38 API calls 8097->8099 8102 248f948 8098->8102 8100 248f8b6 8099->8100 8100->8098 8101 248f8e0 GetFileType 8100->8101 8101->8100 8103 248f966 8102->8103 8104 248f9c1 GetStdHandle 8103->8104 8105 248fa35 8103->8105 8104->8103 8106 248f9d4 GetFileType 8104->8106 8105->8082 8106->8103 8108 248d6cc __std_exception_copy 8 API calls 8107->8108 8111 2491c35 8108->8111 8109 2491c97 8110 248d744 Concurrency::details::SchedulerProxy::DeleteThis 8 API calls 8109->8110 8112 2491ca1 8110->8112 8111->8109 8114 248f60c 8111->8114 8112->8095 8119 248f394 8114->8119 8116 248f642 8117 248f661 InitializeCriticalSectionAndSpinCount 8116->8117 8118 248f647 8116->8118 8117->8118 8118->8111 8121 248f3f1 __vcrt_FlsSetValue 8119->8121 8125 248f3ec __vcrt_FlsSetValue 8119->8125 8120 248f421 LoadLibraryExW 8122 248f4f6 8120->8122 8123 248f446 GetLastError 8120->8123 8121->8116 8122->8121 8124 248f50d FreeLibrary 8122->8124 8123->8125 8124->8121 8125->8120 8125->8121 8126 248f480 LoadLibraryExW 8125->8126 8126->8122 8126->8125 8127 2494c51 __scrt_dllmain_exception_filter 8128 248f054 GetCommandLineA GetCommandLineW 9036 248c954 9037 248c95c 9036->9037 9038 248f60c 5 API calls 9037->9038 9039 248c98d 9037->9039 9040 248c989 9037->9040 9038->9037 9042 248c9b8 9039->9042 9043 248c9e3 9042->9043 9044 248c9c6 DeleteCriticalSection 9043->9044 9045 248c9e7 9043->9045 9044->9043 9045->9040 9046 2487f56 9047 24893e8 __std_exception_copy 33 API calls 9046->9047 9048 2487f81 9047->9048 8129 2490268 8130 2490292 8129->8130 8131 248d6cc __std_exception_copy 8 API calls 8130->8131 8132 24902b1 8131->8132 8133 248d744 Concurrency::details::SchedulerProxy::DeleteThis 8 API calls 8132->8133 8134 24902bf 8133->8134 8135 248d6cc __std_exception_copy 8 API calls 8134->8135 8139 24902e9 8134->8139 8137 24902db 8135->8137 8136 248f60c 5 API calls 8136->8139 8138 248d744 Concurrency::details::SchedulerProxy::DeleteThis 8 API calls 8137->8138 8138->8139 8139->8136 8140 24902f2 8139->8140 9433 248f7ec 9434 248f825 9433->9434 9436 248f7f6 9433->9436 9435 248f80b FreeLibrary 9435->9436 9436->9434 9436->9435 9437 2483be0 9440 2483b2d _invalid_parameter_noinfo 9437->9440 9438 2483b97 9439 2483b7d VirtualQuery 9439->9438 9439->9440 9440->9438 9440->9439 9441 2483be2 GetLastError 9440->9441 9441->9438 9441->9440 8141 2494a60 8151 2488fe8 8141->8151 8143 2494a88 8146 2494a98 8147 2489634 ExFilterRethrow 6 API calls 8146->8147 8148 2494aa1 8147->8148 8158 248c6a8 8148->8158 8154 2489018 __CxxCallCatchBlock _IsNonwritableInCurrentImage __except_validate_context_record 8151->8154 8152 2489109 8152->8143 8155 2489634 8152->8155 8153 24890d4 RtlUnwindEx 8153->8154 8154->8152 8154->8153 8161 2489650 8155->8161 8157 248963d 8157->8146 8159 248ce28 _invalid_parameter_noinfo 19 API calls 8158->8159 8160 248c6b1 8159->8160 8162 2489668 _invalid_parameter_noinfo __vcrt_freefls 8161->8162 8163 248966f GetLastError 8161->8163 8162->8157 8171 2489fa4 8163->8171 8176 2489dc4 8171->8176 8173 2489fcb TlsGetValue 8175 2496268 8173->8175 8180 2489ecd __vcrt_FlsSetValue 8176->8180 8181 2489e08 __vcrt_FlsSetValue 8176->8181 8177 2489e36 LoadLibraryExW 8178 2489ead 8177->8178 8179 2489e57 GetLastError 8177->8179 8178->8180 8182 2489ec4 FreeLibrary 8178->8182 8179->8181 8180->8173 8181->8177 8181->8180 8183 2489e79 LoadLibraryExW 8181->8183 8182->8180 8183->8178 8183->8181 9442 24949e0 9443 2494a18 __GSHandlerCheckCommon 9442->9443 9444 2494a44 9443->9444 9446 2489d3c 9443->9446 9447 2489634 ExFilterRethrow 6 API calls 9446->9447 9448 2489d66 9447->9448 9449 2489634 ExFilterRethrow 6 API calls 9448->9449 9450 2489d73 9449->9450 9451 2489634 ExFilterRethrow 6 API calls 9450->9451 9452 2489d7c 9451->9452 9452->9444 8184 248cc64 8185 248cc69 8184->8185 8186 248cc7e 8184->8186 8190 248cc84 8185->8190 8189 248d744 Concurrency::details::SchedulerProxy::DeleteThis 8 API calls 8189->8186 8191 248ccce 8190->8191 8192 248ccc6 8190->8192 8194 248d744 Concurrency::details::SchedulerProxy::DeleteThis 8 API calls 8191->8194 8193 248d744 Concurrency::details::SchedulerProxy::DeleteThis 8 API calls 8192->8193 8193->8191 8195 248ccdb 8194->8195 8196 248d744 Concurrency::details::SchedulerProxy::DeleteThis 8 API calls 8195->8196 8197 248cce8 8196->8197 8198 248d744 Concurrency::details::SchedulerProxy::DeleteThis 8 API calls 8197->8198 8199 248ccf5 8198->8199 8200 248d744 Concurrency::details::SchedulerProxy::DeleteThis 8 API calls 8199->8200 8201 248cd02 8200->8201 8202 248d744 Concurrency::details::SchedulerProxy::DeleteThis 8 API calls 8201->8202 8203 248cd0f 8202->8203 8204 248d744 Concurrency::details::SchedulerProxy::DeleteThis 8 API calls 8203->8204 8205 248cd1c 8204->8205 8206 248d744 Concurrency::details::SchedulerProxy::DeleteThis 8 API calls 8205->8206 8207 248cd29 8206->8207 8208 248d744 Concurrency::details::SchedulerProxy::DeleteThis 8 API calls 8207->8208 8209 248cd39 8208->8209 8210 248d744 Concurrency::details::SchedulerProxy::DeleteThis 8 API calls 8209->8210 8211 248cd49 8210->8211 8216 248cb34 8211->8216 8213 248cd5e 8221 248caac 8213->8221 8215 248cc76 8215->8189 8217 248c99c Concurrency::details::SchedulerProxy::DeleteThis EnterCriticalSection 8216->8217 8219 248cb50 8217->8219 8218 248cb80 8218->8213 8219->8218 8220 248d744 Concurrency::details::SchedulerProxy::DeleteThis 8 API calls 8219->8220 8220->8218 8222 248c99c Concurrency::details::SchedulerProxy::DeleteThis EnterCriticalSection 8221->8222 8223 248cac8 8222->8223 8224 248cd7c Concurrency::details::SchedulerProxy::DeleteThis 8 API calls 8223->8224 8225 248cad6 8224->8225 8225->8215 8438 248c0e4 8439 248c0f9 8438->8439 8440 248c0fd 8438->8440 8453 248ec90 8440->8453 8445 248c11b 8479 248c158 8445->8479 8446 248c10f 8447 248d744 Concurrency::details::SchedulerProxy::DeleteThis 8 API calls 8446->8447 8447->8439 8450 248d744 Concurrency::details::SchedulerProxy::DeleteThis 8 API calls 8451 248c142 8450->8451 8452 248d744 Concurrency::details::SchedulerProxy::DeleteThis 8 API calls 8451->8452 8452->8439 8454 248c102 8453->8454 8455 248ec9d 8453->8455 8459 248f1ec GetEnvironmentStringsW 8454->8459 8498 248cefc 8455->8498 8457 248eccc 8515 248e968 8457->8515 8460 248f21c 8459->8460 8461 248c107 8459->8461 8462 248f10c WideCharToMultiByte 8460->8462 8461->8445 8461->8446 8463 248f26d 8462->8463 8464 248f274 FreeEnvironmentStringsW 8463->8464 8465 248ca0c 9 API calls 8463->8465 8464->8461 8466 248f287 8465->8466 8467 248f298 8466->8467 8468 248f28f 8466->8468 8470 248f10c WideCharToMultiByte 8467->8470 8469 248d744 Concurrency::details::SchedulerProxy::DeleteThis 8 API calls 8468->8469 8471 248f296 8469->8471 8472 248f2bb 8470->8472 8471->8464 8473 248f2c9 8472->8473 8474 248f2bf 8472->8474 8476 248d744 Concurrency::details::SchedulerProxy::DeleteThis 8 API calls 8473->8476 8475 248d744 Concurrency::details::SchedulerProxy::DeleteThis 8 API calls 8474->8475 8477 248f2c7 FreeEnvironmentStringsW 8475->8477 8476->8477 8477->8461 8480 248c17d 8479->8480 8481 248d6cc __std_exception_copy 8 API calls 8480->8481 8493 248c1b3 8481->8493 8482 248c1bb 8483 248d744 Concurrency::details::SchedulerProxy::DeleteThis 8 API calls 8482->8483 8484 248c123 8483->8484 8484->8450 8485 248c22e 8486 248d744 Concurrency::details::SchedulerProxy::DeleteThis 8 API calls 8485->8486 8486->8484 8487 248d6cc __std_exception_copy 8 API calls 8487->8493 8488 248c21d 8682 248c268 8488->8682 8490 248c6e8 __std_exception_copy 33 API calls 8490->8493 8492 248d744 Concurrency::details::SchedulerProxy::DeleteThis 8 API calls 8492->8482 8493->8482 8493->8485 8493->8487 8493->8488 8493->8490 8494 248c253 8493->8494 8496 248d744 Concurrency::details::SchedulerProxy::DeleteThis 8 API calls 8493->8496 8495 248d590 _invalid_parameter_noinfo 8 API calls 8494->8495 8497 248c266 8495->8497 8496->8493 8499 248cf28 FlsSetValue 8498->8499 8500 248cf0d FlsGetValue 8498->8500 8502 248cf35 8499->8502 8504 248cf1a 8499->8504 8501 248cf22 8500->8501 8500->8504 8501->8499 8503 248d6cc __std_exception_copy 8 API calls 8502->8503 8505 248cf44 8503->8505 8504->8457 8506 248cf62 FlsSetValue 8505->8506 8507 248cf52 FlsSetValue 8505->8507 8508 248cf6e FlsSetValue 8506->8508 8509 248cf80 8506->8509 8510 248cf5b 8507->8510 8508->8510 8511 248cb94 __std_exception_copy 8 API calls 8509->8511 8512 248d744 Concurrency::details::SchedulerProxy::DeleteThis 8 API calls 8510->8512 8513 248cf88 8511->8513 8512->8504 8514 248d744 Concurrency::details::SchedulerProxy::DeleteThis 8 API calls 8513->8514 8514->8504 8538 248ebd8 8515->8538 8517 248e99d 8549 248e668 8517->8549 8520 248e9ba 8520->8454 8523 248e9d3 8524 248d744 Concurrency::details::SchedulerProxy::DeleteThis 8 API calls 8523->8524 8524->8520 8525 248e9e2 8525->8525 8563 248ed0c 8525->8563 8528 248eade 8529 248d6ac __std_exception_copy 8 API calls 8528->8529 8530 248eae3 8529->8530 8533 248d744 Concurrency::details::SchedulerProxy::DeleteThis 8 API calls 8530->8533 8531 248eb39 8532 248eba0 8531->8532 8574 248e498 8531->8574 8537 248d744 Concurrency::details::SchedulerProxy::DeleteThis 8 API calls 8532->8537 8533->8520 8534 248eaf8 8534->8531 8535 248d744 Concurrency::details::SchedulerProxy::DeleteThis 8 API calls 8534->8535 8535->8531 8537->8520 8539 248ebfb 8538->8539 8540 248c99c Concurrency::details::SchedulerProxy::DeleteThis EnterCriticalSection 8539->8540 8544 248ec05 8539->8544 8542 248ec18 8540->8542 8541 248ec77 8541->8517 8542->8544 8545 248d744 Concurrency::details::SchedulerProxy::DeleteThis 8 API calls 8542->8545 8543 248ece2 8543->8517 8544->8541 8544->8543 8546 248cefc 13 API calls 8544->8546 8545->8544 8547 248eccc 8546->8547 8548 248e968 52 API calls 8547->8548 8548->8543 8587 248e1b4 8549->8587 8552 248e688 GetOEMCP 8554 248e6af 8552->8554 8553 248e69a 8553->8554 8555 248e69f GetACP 8553->8555 8554->8520 8556 248ca0c 8554->8556 8555->8554 8557 248ca57 8556->8557 8561 248ca1b __std_exception_copy 8556->8561 8559 248d6ac __std_exception_copy 8 API calls 8557->8559 8558 248ca3e HeapAlloc 8560 248ca55 8558->8560 8558->8561 8559->8560 8560->8523 8560->8525 8561->8557 8561->8558 8562 248b85c __std_exception_copy EnterCriticalSection 8561->8562 8562->8561 8564 248e668 21 API calls 8563->8564 8565 248ed39 8564->8565 8567 248ed76 IsValidCodePage 8565->8567 8572 248ee8f 8565->8572 8573 248ed90 _invalid_parameter_noinfo 8565->8573 8566 2487940 _log10_special 4 API calls 8568 248ead5 8566->8568 8569 248ed87 8567->8569 8567->8572 8568->8528 8568->8534 8570 248edb6 GetCPInfo 8569->8570 8569->8573 8570->8572 8570->8573 8572->8566 8603 248e780 8573->8603 8575 248c99c Concurrency::details::SchedulerProxy::DeleteThis EnterCriticalSection 8574->8575 8576 248e4b4 _invalid_parameter_noinfo 8575->8576 8577 248d6ac __std_exception_copy 8 API calls 8576->8577 8580 248e4e1 _invalid_parameter_noinfo 8576->8580 8578 248e550 8577->8578 8579 248d570 _invalid_parameter_noinfo 33 API calls 8578->8579 8579->8580 8581 248e593 8580->8581 8582 248d6ac __std_exception_copy 8 API calls 8580->8582 8581->8581 8585 248e62d 8581->8585 8586 248d744 Concurrency::details::SchedulerProxy::DeleteThis 8 API calls 8581->8586 8583 248e5f1 8582->8583 8584 248d570 _invalid_parameter_noinfo 33 API calls 8583->8584 8584->8581 8585->8532 8586->8585 8588 248e1d8 8587->8588 8594 248e1d3 8587->8594 8589 248ce28 _invalid_parameter_noinfo 19 API calls 8588->8589 8588->8594 8590 248e1f3 8589->8590 8595 24903fc 8590->8595 8594->8552 8594->8553 8596 2490411 8595->8596 8597 248e216 8595->8597 8596->8597 8598 2490a5c _invalid_parameter_noinfo 19 API calls 8596->8598 8599 2490468 8597->8599 8598->8597 8600 249047d 8599->8600 8601 2490490 8599->8601 8600->8601 8602 248ecf0 _invalid_parameter_noinfo 19 API calls 8600->8602 8601->8594 8602->8601 8604 248e7bd GetCPInfo 8603->8604 8613 248e8b3 8603->8613 8605 248e7d0 8604->8605 8604->8613 8614 2491544 8605->8614 8606 2487940 _log10_special 4 API calls 8608 248e952 8606->8608 8608->8572 8613->8606 8615 248e1b4 19 API calls 8614->8615 8616 2491586 8615->8616 8634 248f07c 8616->8634 8636 248f085 8634->8636 8635 248f0cd MultiByteToWideChar 8635->8636 8636->8635 8637 24962e0 8636->8637 8686 248c26d 8682->8686 8687 248c225 8682->8687 8683 248c296 8685 248d744 Concurrency::details::SchedulerProxy::DeleteThis 8 API calls 8683->8685 8684 248d744 Concurrency::details::SchedulerProxy::DeleteThis 8 API calls 8684->8686 8685->8687 8686->8683 8686->8684 8687->8492 9049 248ad78 9050 248ada5 __except_validate_context_record 9049->9050 9051 2489634 ExFilterRethrow 6 API calls 9050->9051 9052 248adaa 9051->9052 9055 248ae04 9052->9055 9056 248ae92 9052->9056 9063 248ae58 _RTC_Initialize 9052->9063 9053 248af00 9053->9063 9090 248a544 9053->9090 9054 248ae7f 9078 24898e0 9054->9078 9055->9054 9055->9063 9064 248ae26 __GetCurrentState 9055->9064 9060 248aeb1 9056->9060 9084 2489ce4 9056->9084 9060->9053 9060->9063 9087 2489cf8 9060->9087 9062 248afa9 9064->9062 9066 248b288 9064->9066 9067 2489ce4 Is_bad_exception_allowed 6 API calls 9066->9067 9068 248b2b7 __GetCurrentState 9067->9068 9069 2489634 ExFilterRethrow 6 API calls 9068->9069 9075 248b2d4 __CxxCallCatchBlock __FrameHandler3::GetHandlerSearchState 9069->9075 9070 248b3cb 9071 2489634 ExFilterRethrow 6 API calls 9070->9071 9072 248b3d0 9071->9072 9073 2489634 ExFilterRethrow 6 API calls 9072->9073 9074 248b3db __FrameHandler3::GetHandlerSearchState 9072->9074 9073->9074 9074->9063 9075->9070 9075->9074 9076 2489ce4 6 API calls Is_bad_exception_allowed 9075->9076 9144 2489d0c 9075->9144 9076->9075 9079 24898ff __FrameHandler3::FrameUnwindToEmptyState 9078->9079 9147 2489850 9079->9147 9082 248b288 __FrameHandler3::FrameUnwindToEmptyState 6 API calls 9083 2489934 9082->9083 9083->9063 9085 2489634 ExFilterRethrow 6 API calls 9084->9085 9086 2489ced 9085->9086 9086->9060 9088 2489634 ExFilterRethrow 6 API calls 9087->9088 9089 2489d01 9088->9089 9089->9053 9094 248a5a6 __FrameHandler3::GetHandlerSearchState 9090->9094 9091 248aa12 9092 248a963 9092->9091 9130 248a961 9092->9130 9192 248aa1c 9092->9192 9093 248a68b 9093->9092 9134 248a6c3 9093->9134 9094->9091 9094->9093 9097 2489634 ExFilterRethrow 6 API calls 9094->9097 9095 2489634 ExFilterRethrow 6 API calls 9099 248a9a5 9095->9099 9096 248a894 9102 248a8b1 9096->9102 9105 2489ce4 Is_bad_exception_allowed 6 API calls 9096->9105 9096->9130 9100 248a5f2 9097->9100 9099->9091 9101 2487940 _log10_special 4 API calls 9099->9101 9100->9099 9103 2489634 ExFilterRethrow 6 API calls 9100->9103 9104 248a9b8 9101->9104 9108 248a8d3 9102->9108 9102->9130 9185 24898b4 9102->9185 9107 248a602 9103->9107 9104->9063 9105->9102 9109 2489634 ExFilterRethrow 6 API calls 9107->9109 9110 248a8e9 9108->9110 9111 248a9f5 9108->9111 9108->9130 9112 248a60b 9109->9112 9113 248a8f4 9110->9113 9116 2489ce4 Is_bad_exception_allowed 6 API calls 9110->9116 9114 2489634 ExFilterRethrow 6 API calls 9111->9114 9151 2489d24 9112->9151 9120 248b4ac 6 API calls 9113->9120 9117 248a9fb 9114->9117 9116->9113 9119 2489634 ExFilterRethrow 6 API calls 9117->9119 9122 248aa04 9119->9122 9126 248a90b __FrameHandler3::FrameUnwindToEmptyState 9120->9126 9121 2489cf8 6 API calls 9121->9134 9124 248c6a8 19 API calls 9122->9124 9123 2489634 ExFilterRethrow 6 API calls 9125 248a64d 9123->9125 9124->9091 9125->9093 9127 2489634 ExFilterRethrow 6 API calls 9125->9127 9126->9130 9189 2489b50 RtlUnwindEx 9126->9189 9129 248a659 9127->9129 9131 2489634 ExFilterRethrow 6 API calls 9129->9131 9130->9095 9133 248a662 9131->9133 9154 248b4ac 9133->9154 9134->9096 9134->9121 9165 248ac38 9134->9165 9179 248a470 9134->9179 9138 248a676 9161 248b59c 9138->9161 9140 248a9ef 9141 248c6a8 19 API calls 9140->9141 9141->9111 9142 248a67e __CxxCallCatchBlock std::bad_alloc::bad_alloc 9142->9140 9143 24894a0 Concurrency::cancel_current_task RtlPcToFileHeader 9142->9143 9143->9140 9145 2489634 ExFilterRethrow 6 API calls 9144->9145 9146 2489d1a 9145->9146 9146->9075 9148 248986e 9147->9148 9149 248989b 9148->9149 9150 2489634 ExFilterRethrow 6 API calls 9148->9150 9149->9082 9150->9148 9152 2489634 ExFilterRethrow 6 API calls 9151->9152 9153 2489d32 9152->9153 9153->9091 9153->9123 9156 248b593 9154->9156 9158 248b4d7 9154->9158 9155 248a672 9155->9093 9155->9138 9157 2489cf8 6 API calls 9157->9158 9158->9155 9158->9157 9159 2489ce4 Is_bad_exception_allowed 6 API calls 9158->9159 9160 248ac38 6 API calls 9158->9160 9159->9158 9160->9158 9162 248b5b9 Is_bad_exception_allowed 9161->9162 9164 248b609 9161->9164 9163 2489ce4 6 API calls Is_bad_exception_allowed 9162->9163 9162->9164 9163->9162 9164->9142 9166 248acf4 9165->9166 9167 248ac65 9165->9167 9166->9134 9168 2489ce4 Is_bad_exception_allowed 6 API calls 9167->9168 9169 248ac6e 9168->9169 9169->9166 9170 2489ce4 Is_bad_exception_allowed 6 API calls 9169->9170 9171 248ac87 9169->9171 9170->9171 9171->9166 9172 248acb3 9171->9172 9173 2489ce4 Is_bad_exception_allowed 6 API calls 9171->9173 9174 2489cf8 6 API calls 9172->9174 9173->9172 9175 248acc7 9174->9175 9175->9166 9176 248ace0 9175->9176 9177 2489ce4 Is_bad_exception_allowed 6 API calls 9175->9177 9178 2489cf8 6 API calls 9176->9178 9177->9176 9178->9166 9180 248a4ad __FrameHandler3::FrameUnwindToEmptyState 9179->9180 9181 2489ce4 Is_bad_exception_allowed 6 API calls 9180->9181 9182 248a4e5 9181->9182 9183 2489b50 5 API calls 9182->9183 9184 248a529 9183->9184 9184->9134 9186 24898c8 __FrameHandler3::FrameUnwindToEmptyState 9185->9186 9187 2489850 __FrameHandler3::FrameUnwindToEmptyState 6 API calls 9186->9187 9188 24898d2 9187->9188 9188->9108 9190 2487940 _log10_special 4 API calls 9189->9190 9191 2489c4a 9190->9191 9191->9130 9193 248aa52 9192->9193 9198 248aac0 9192->9198 9194 2489634 ExFilterRethrow 6 API calls 9193->9194 9195 248aa57 9194->9195 9196 248aa66 EncodePointer 9195->9196 9199 248aabc 9195->9199 9197 2489634 ExFilterRethrow 6 API calls 9196->9197 9200 248aa76 9197->9200 9198->9130 9199->9198 9202 2489ce4 6 API calls Is_bad_exception_allowed 9199->9202 9203 248a470 11 API calls 9199->9203 9200->9199 9204 24897fc 9200->9204 9202->9199 9203->9199 9205 2489634 ExFilterRethrow 6 API calls 9204->9205 9206 2489828 _RTC_Initialize 9205->9206 9206->9199 8688 248f2fc 8689 248f31e 8688->8689 8693 248f33b 8688->8693 8690 248f32c 8689->8690 8689->8693 8691 248d6ac __std_exception_copy 8 API calls 8690->8691 8694 248f331 _invalid_parameter_noinfo 8691->8694 8695 2491af4 8693->8695 8696 2491b09 8695->8696 8697 2491b13 8695->8697 8698 248ca0c 9 API calls 8696->8698 8699 2491b18 8697->8699 8705 2491b1f __std_exception_copy 8697->8705 8703 2491b11 8698->8703 8702 248d744 Concurrency::details::SchedulerProxy::DeleteThis 8 API calls 8699->8702 8700 2491b52 HeapReAlloc 8700->8703 8700->8705 8701 2491b25 8704 248d6ac __std_exception_copy 8 API calls 8701->8704 8702->8703 8703->8694 8704->8703 8705->8700 8705->8701 8706 248b85c __std_exception_copy EnterCriticalSection 8705->8706 8706->8705 9453 24827fc 9454 2482842 9453->9454 9455 24828a8 9454->9455 9456 2483844 StrCmpNIW 9454->9456 9456->9454 9457 2494dfd 9458 2489c90 __CxxCallCatchBlock 6 API calls 9457->9458 9461 2494e10 9458->9461 9459 2494e4f __CxxCallCatchBlock 9460 2489634 ExFilterRethrow 6 API calls 9459->9460 9462 2494e63 9460->9462 9461->9459 9464 2489320 __CxxCallCatchBlock 6 API calls 9461->9464 9463 2489634 ExFilterRethrow 6 API calls 9462->9463 9465 2494e73 9463->9465 9464->9459 8707 2485cf0 8708 2485cfd 8707->8708 8709 2485d09 8708->8709 8717 2485e1a 8708->8717 8710 2485d8d 8709->8710 8711 2485d66 SetThreadContext 8709->8711 8711->8710 8712 2485efe 8714 2485f1e 8712->8714 8723 24843e0 8712->8723 8713 2485e41 VirtualProtect FlushInstructionCache 8713->8717 8727 2484df0 GetCurrentProcess 8714->8727 8717->8712 8717->8713 8718 2485f77 8721 2487940 _log10_special 4 API calls 8718->8721 8719 2485f37 ResumeThread 8720 2485f23 8719->8720 8720->8718 8720->8719 8722 2485fbf 8721->8722 8725 24843fc 8723->8725 8724 248445f 8724->8714 8725->8724 8726 2484412 VirtualFree 8725->8726 8726->8725 8728 2484e0c 8727->8728 8729 2484e22 VirtualProtect FlushInstructionCache 8728->8729 8730 2484e53 8728->8730 8729->8728 8730->8720 9466 248fbf0 9469 248fba8 9466->9469 9468 248fc19 9470 248c99c Concurrency::details::SchedulerProxy::DeleteThis EnterCriticalSection 9469->9470 9471 248fbc1 9470->9471 9471->9468 8731 24906f0 8734 2490674 8731->8734 8733 2490719 8735 248c99c Concurrency::details::SchedulerProxy::DeleteThis EnterCriticalSection 8734->8735 8737 2490692 8735->8737 8736 24906cb 8736->8733 8737->8736 8738 2490acc _invalid_parameter_noinfo 8 API calls 8737->8738 8738->8737 9207 248bb71 9208 248c6a8 19 API calls 9207->9208 9209 248bb76 9208->9209 9210 248bb9d GetModuleHandleW 9209->9210 9211 248bbe7 9209->9211 9210->9211 9217 248bbaa 9210->9217 9223 248ba74 9211->9223 9213 248bc23 9214 248bc2a 9213->9214 9228 248bc40 9213->9228 9217->9211 9219 248bc98 GetModuleHandleExW 9217->9219 9222 248bccc __vcrt_FlsSetValue 9219->9222 9220 248bcfa FreeLibrary 9221 248bd01 9220->9221 9221->9211 9222->9220 9222->9221 9224 248c99c Concurrency::details::SchedulerProxy::DeleteThis EnterCriticalSection 9223->9224 9225 248ba90 9224->9225 9234 248baac 9225->9234 9227 248ba99 9227->9213 9230 248bc4d __raise_securityfailure 9228->9230 9229 248bc62 9231 248bc98 2 API calls 9229->9231 9230->9229 9232 248bc57 TerminateProcess 9230->9232 9233 248bc69 ExitProcess 9231->9233 9232->9229 9235 248bb25 9234->9235 9236 248bac2 9234->9236 9235->9227 9236->9235 9238 248c48c 9236->9238 9241 248c330 9238->9241 9240 248c4c9 9240->9235 9242 248c99c Concurrency::details::SchedulerProxy::DeleteThis EnterCriticalSection 9241->9242 9243 248c34c 9242->9243 9246 248c36c 9243->9246 9245 248c355 9245->9240 9247 248c39a 9246->9247 9248 248c392 9246->9248 9247->9248 9249 248d744 Concurrency::details::SchedulerProxy::DeleteThis 8 API calls 9247->9249 9248->9245 9249->9248 9250 2483774 9253 24836c8 9250->9253 9254 24836db GetModuleHandleW 9253->9254 9255 248376d FreeLibraryAndExitThread 9253->9255 9256 2483759 TerminateThread 9254->9256 9257 24836f2 __raise_securityfailure 9254->9257 9262 2481e6c 9256->9262 9259 24836f8 VirtualProtectEx 9257->9259 9259->9256 9260 248371e __raise_securityfailure 9259->9260 9261 2483738 VirtualProtectEx 9260->9261 9261->9256 9289 2485ab0 9262->9289 9266 2481e88 9269 2481ea8 9266->9269 9299 2485710 GetCurrentThreadId 9266->9299 9268 2481ec8 9271 2481ee8 9268->9271 9272 2485710 5 API calls 9268->9272 9269->9268 9270 2485710 5 API calls 9269->9270 9270->9268 9273 2481f08 9271->9273 9275 2485710 5 API calls 9271->9275 9272->9271 9274 2481f28 9273->9274 9276 2485710 5 API calls 9273->9276 9277 2481f48 9274->9277 9278 2485710 5 API calls 9274->9278 9275->9273 9276->9274 9279 2481f68 9277->9279 9280 2485710 5 API calls 9277->9280 9278->9277 9281 2481f88 9279->9281 9282 2485710 5 API calls 9279->9282 9280->9279 9283 2481fa8 9281->9283 9285 2485710 5 API calls 9281->9285 9282->9281 9284 2481fc8 9283->9284 9286 2485710 5 API calls 9283->9286 9306 2485b30 9284->9306 9285->9283 9286->9284 9288 2485b2b 9288->9255 9290 2485ac4 9289->9290 9291 2481e7a GetCurrentThread 9289->9291 9290->9291 9329 2485030 9290->9329 9293 2485fd0 9291->9293 9294 2485fed 9293->9294 9297 2485fe2 9293->9297 9295 2487870 2 API calls 9294->9295 9294->9297 9296 248600a 9295->9296 9296->9297 9298 248607d GetLastError 9296->9298 9297->9266 9298->9297 9300 248573d 9299->9300 9302 2485733 9299->9302 9301 2487870 2 API calls 9300->9301 9300->9302 9303 24857b1 type_info::_name_internal_method 9301->9303 9302->9269 9303->9302 9304 24858c0 VirtualProtect 9303->9304 9304->9302 9305 24858e9 GetLastError 9304->9305 9305->9302 9307 2485b59 9306->9307 9308 2485b6b GetCurrentThreadId 9306->9308 9307->9308 9309 2485b78 9308->9309 9310 2485b82 9308->9310 9313 2487940 _log10_special 4 API calls 9309->9313 9311 2485b8b 9310->9311 9315 2485b9b 9310->9315 9334 2485960 GetCurrentThreadId 9311->9334 9314 2485fbf 9313->9314 9314->9288 9316 2485cbc GetThreadContext 9315->9316 9317 2485e1a 9315->9317 9316->9317 9318 2485ce2 9316->9318 9319 2485efe 9317->9319 9320 2485e41 VirtualProtect FlushInstructionCache 9317->9320 9318->9317 9322 2485d09 9318->9322 9321 2485f1e 9319->9321 9325 24843e0 VirtualFree 9319->9325 9320->9317 9323 2484df0 3 API calls 9321->9323 9324 2485d8d 9322->9324 9326 2485d66 SetThreadContext 9322->9326 9328 2485f23 9323->9328 9324->9288 9325->9321 9326->9324 9327 2485f37 ResumeThread 9327->9328 9328->9309 9328->9327 9330 2485042 9329->9330 9331 2485058 VirtualProtect 9330->9331 9332 248507f 9330->9332 9331->9330 9333 2485076 GetLastError 9331->9333 9332->9291 9333->9332 9335 2485971 9334->9335 9338 248597b 9334->9338 9335->9309 9336 2485993 VirtualProtect 9336->9338 9337 2485a25 9339 2484df0 3 API calls 9337->9339 9338->9336 9338->9337 9341 2485a35 9339->9341 9340 2485a49 ResumeThread 9340->9341 9341->9335 9341->9340 9472 2490388 9473 2490393 9472->9473 9481 2492c88 9473->9481 9475 2490398 9488 2492d3c 9475->9488 9478 24903c9 9479 248d744 Concurrency::details::SchedulerProxy::DeleteThis 8 API calls 9478->9479 9480 24903d5 9479->9480 9482 248c99c Concurrency::details::SchedulerProxy::DeleteThis EnterCriticalSection 9481->9482 9487 2492ca1 9482->9487 9483 2492d21 9483->9475 9484 2492cec DeleteCriticalSection 9486 248d744 Concurrency::details::SchedulerProxy::DeleteThis 8 API calls 9484->9486 9486->9487 9487->9483 9487->9484 9492 24934fc 9487->9492 9489 24903aa DeleteCriticalSection 9488->9489 9490 2492d50 9488->9490 9489->9475 9489->9478 9490->9489 9491 248d744 Concurrency::details::SchedulerProxy::DeleteThis 8 API calls 9490->9491 9491->9489 9493 249352c 9492->9493 9500 24933d8 9493->9500 9495 2493545 9496 249356a 9495->9496 9497 248c7a0 _invalid_parameter_noinfo 23 API calls 9495->9497 9498 249357f 9496->9498 9499 248c7a0 _invalid_parameter_noinfo 23 API calls 9496->9499 9497->9496 9498->9487 9499->9498 9501 2493421 9500->9501 9502 24933f3 9500->9502 9509 2493413 9501->9509 9510 24903e4 EnterCriticalSection 9501->9510 9503 248d4a4 _invalid_parameter_noinfo 33 API calls 9502->9503 9503->9509 9509->9495 9511 2496240 9510->9511 8739 248fa8c 8740 248fa98 8739->8740 8742 248fabf 8740->8742 8743 2491cbc 8740->8743 8744 2491cfc 8743->8744 8745 2491cc1 8743->8745 8744->8740 8746 2491ce2 DeleteCriticalSection 8745->8746 8747 2491cf4 8745->8747 8746->8746 8746->8747 8748 248d744 Concurrency::details::SchedulerProxy::DeleteThis 8 API calls 8747->8748 8748->8744 8749 248588c 8750 2485893 8749->8750 8751 24858c0 VirtualProtect 8750->8751 8753 24857d0 8750->8753 8752 24858e9 GetLastError 8751->8752 8751->8753 8752->8753 9512 248c58c 9513 248c5bd 9512->9513 9514 248c5a5 9512->9514 9514->9513 9515 248d744 Concurrency::details::SchedulerProxy::DeleteThis 8 API calls 9514->9515 9515->9513 8754 249148c 8755 249149e 8754->8755 8756 24914c5 8755->8756 8758 24914de 8755->8758 8757 248d6ac __std_exception_copy 8 API calls 8756->8757 8759 24914ca 8757->8759 8761 248e1b4 19 API calls 8758->8761 8762 24914d5 8758->8762 8760 248d570 _invalid_parameter_noinfo 33 API calls 8759->8760 8760->8762 8761->8762 9342 248b10e 9343 2489634 ExFilterRethrow 6 API calls 9342->9343 9344 248b11b __CxxCallCatchBlock Concurrency::cancel_current_task 9343->9344 9345 2489c90 __CxxCallCatchBlock 6 API calls 9344->9345 9348 248b18e 9345->9348 9346 2489634 ExFilterRethrow 6 API calls 9347 248b1ca 9346->9347 9349 2489634 ExFilterRethrow 6 API calls 9347->9349 9350 2489320 __CxxCallCatchBlock 6 API calls 9348->9350 9352 248b1b7 __CxxCallCatchBlock 9348->9352 9351 248b1d3 9349->9351 9350->9352 9352->9346 8763 2494e83 8766 2489374 8763->8766 8767 248938c 8766->8767 8768 248939e 8766->8768 8767->8768 8769 2489394 8767->8769 8770 2489634 ExFilterRethrow 6 API calls 8768->8770 8771 248939c 8769->8771 8773 2489634 ExFilterRethrow 6 API calls 8769->8773 8772 24893a3 8770->8772 8772->8771 8775 2489634 ExFilterRethrow 6 API calls 8772->8775 8774 24893c3 8773->8774 8776 2489634 ExFilterRethrow 6 API calls 8774->8776 8775->8771 8777 24893d0 8776->8777 8778 248c6a8 19 API calls 8777->8778 8779 24893d9 8778->8779 8780 248c6a8 19 API calls 8779->8780 8781 24893e5 8780->8781 8782 2494e99 8783 2489634 ExFilterRethrow 6 API calls 8782->8783 8784 2494ea7 8783->8784 8785 2494eb2 8784->8785 8786 2489634 ExFilterRethrow 6 API calls 8784->8786 8786->8785 9516 2493d98 9517 2493da9 CloseHandle 9516->9517 9518 2493daf 9516->9518 9517->9518 8787 248da9c 8788 248dac1 8787->8788 8796 248dad8 8787->8796 8789 248d6ac __std_exception_copy 8 API calls 8788->8789 8790 248dac6 8789->8790 8792 248d570 _invalid_parameter_noinfo 33 API calls 8790->8792 8791 248db90 8837 248befc 8791->8837 8814 248dad1 8792->8814 8795 248dbf0 8798 248d744 Concurrency::details::SchedulerProxy::DeleteThis 8 API calls 8795->8798 8796->8791 8802 248db68 8796->8802 8804 248db25 8796->8804 8819 248dce0 8796->8819 8811 248dbf7 8798->8811 8799 248dc81 8800 248d744 Concurrency::details::SchedulerProxy::DeleteThis 8 API calls 8799->8800 8803 248dc8c 8800->8803 8801 248db48 8808 248d744 Concurrency::details::SchedulerProxy::DeleteThis 8 API calls 8801->8808 8802->8801 8806 248d744 Concurrency::details::SchedulerProxy::DeleteThis 8 API calls 8802->8806 8807 248dca5 8803->8807 8812 248d744 Concurrency::details::SchedulerProxy::DeleteThis 8 API calls 8803->8812 8804->8801 8809 248d744 Concurrency::details::SchedulerProxy::DeleteThis 8 API calls 8804->8809 8805 248d744 Concurrency::details::SchedulerProxy::DeleteThis 8 API calls 8805->8811 8806->8802 8813 248d744 Concurrency::details::SchedulerProxy::DeleteThis 8 API calls 8807->8813 8808->8814 8809->8804 8811->8801 8811->8805 8812->8803 8813->8814 8815 248dc22 8815->8799 8816 248dcc7 8815->8816 8843 2490f50 8815->8843 8817 248d590 _invalid_parameter_noinfo 8 API calls 8816->8817 8818 248dcdc 8817->8818 8820 248dd0e 8819->8820 8820->8820 8821 248d6cc __std_exception_copy 8 API calls 8820->8821 8822 248dd59 8821->8822 8823 2490f50 33 API calls 8822->8823 8824 248dd8f 8823->8824 8825 248d590 _invalid_parameter_noinfo 8 API calls 8824->8825 8826 248de63 8825->8826 8827 248e1b4 19 API calls 8826->8827 8828 248df46 8827->8828 8852 248d794 8828->8852 8831 248e00d 8832 248e1b4 19 API calls 8831->8832 8833 248e03d 8832->8833 8874 248d910 8833->8874 8836 248dce0 38 API calls 8838 248bf14 8837->8838 8842 248bf4c 8837->8842 8839 248d6cc __std_exception_copy 8 API calls 8838->8839 8838->8842 8840 248bf42 8839->8840 8841 248d744 Concurrency::details::SchedulerProxy::DeleteThis 8 API calls 8840->8841 8841->8842 8842->8795 8842->8815 8848 2490f6d 8843->8848 8844 2490f72 8845 2490f88 8844->8845 8846 248d6ac __std_exception_copy 8 API calls 8844->8846 8845->8815 8847 2490f7c 8846->8847 8849 248d570 _invalid_parameter_noinfo 33 API calls 8847->8849 8848->8844 8848->8845 8850 2490fbc 8848->8850 8849->8845 8850->8845 8851 248d6ac __std_exception_copy 8 API calls 8850->8851 8851->8847 8853 248d7be 8852->8853 8854 248d7e2 8852->8854 8857 248d744 Concurrency::details::SchedulerProxy::DeleteThis 8 API calls 8853->8857 8858 248d7cd FindFirstFileExW 8853->8858 8855 248d83c 8854->8855 8860 248d7e7 8854->8860 8856 248f07c MultiByteToWideChar 8855->8856 8869 248d858 8856->8869 8857->8858 8858->8831 8859 248d7fc 8861 248ca0c 9 API calls 8859->8861 8860->8858 8860->8859 8863 248d744 Concurrency::details::SchedulerProxy::DeleteThis 8 API calls 8860->8863 8861->8858 8862 248d85f GetLastError 8896 248d620 8862->8896 8863->8859 8865 248d89a 8865->8858 8866 248f07c MultiByteToWideChar 8865->8866 8871 248d8de 8866->8871 8868 248d88d 8870 248ca0c 9 API calls 8868->8870 8869->8862 8869->8865 8869->8868 8873 248d744 Concurrency::details::SchedulerProxy::DeleteThis 8 API calls 8869->8873 8870->8865 8871->8858 8871->8862 8872 248d6ac __std_exception_copy 8 API calls 8872->8858 8873->8868 8875 248d93a 8874->8875 8876 248d95e 8874->8876 8880 248d744 Concurrency::details::SchedulerProxy::DeleteThis 8 API calls 8875->8880 8885 248d949 8875->8885 8877 248d9b8 8876->8877 8878 248d964 8876->8878 8879 248f10c WideCharToMultiByte 8877->8879 8881 248d979 8878->8881 8882 248d744 Concurrency::details::SchedulerProxy::DeleteThis 8 API calls 8878->8882 8878->8885 8889 248d9dc 8879->8889 8880->8885 8883 248ca0c 9 API calls 8881->8883 8882->8881 8883->8885 8884 248d9e3 GetLastError 8887 248d620 8 API calls 8884->8887 8885->8836 8886 248da20 8886->8885 8890 248f10c WideCharToMultiByte 8886->8890 8891 248d9f0 8887->8891 8888 248da14 8894 248ca0c 9 API calls 8888->8894 8889->8884 8889->8886 8889->8888 8893 248d744 Concurrency::details::SchedulerProxy::DeleteThis 8 API calls 8889->8893 8895 248da6c 8890->8895 8892 248d6ac __std_exception_copy 8 API calls 8891->8892 8892->8885 8893->8888 8894->8886 8895->8884 8895->8885 8897 248cfa0 __std_exception_copy 8 API calls 8896->8897 8898 248d62d Concurrency::details::SchedulerProxy::DeleteThis 8897->8898 8899 248cfa0 __std_exception_copy 8 API calls 8898->8899 8900 248d64f 8899->8900 8900->8872 9353 2487b1c 9354 2487b40 _RTC_Initialize __scrt_release_startup_lock 9353->9354 9355 248b8e5 9354->9355 9356 248cfa0 __std_exception_copy 8 API calls 9354->9356 9357 248b90e 9356->9357 8901 2494c9f 8902 2494cb7 8901->8902 8908 2494d22 8901->8908 8903 2489634 ExFilterRethrow 6 API calls 8902->8903 8902->8908 8904 2494d04 8903->8904 8905 2489634 ExFilterRethrow 6 API calls 8904->8905 8906 2494d19 8905->8906 8907 248c6a8 19 API calls 8906->8907 8907->8908 8226 2488010 8229 24893e8 8226->8229 8228 2488039 8230 248943e __vcrt_freefls 8229->8230 8231 2489409 8229->8231 8230->8228 8231->8230 8233 248c6e8 8231->8233 8234 248c6ff 8233->8234 8235 248c6f5 8233->8235 8236 248d6ac __std_exception_copy 8 API calls 8234->8236 8235->8234 8239 248c71a 8235->8239 8241 248c706 8236->8241 8237 248d570 _invalid_parameter_noinfo 33 API calls 8238 248c712 8237->8238 8238->8230 8239->8238 8240 248d6ac __std_exception_copy 8 API calls 8239->8240 8240->8241 8241->8237 8909 2487a90 8910 2487a99 __scrt_release_startup_lock 8909->8910 8912 2487a9d 8910->8912 8913 248bf5c 8910->8913 8914 248bf7c 8913->8914 8915 248bf93 8913->8915 8916 248bf9a 8914->8916 8917 248bf84 8914->8917 8915->8912 8919 248ec90 52 API calls 8916->8919 8918 248d6ac __std_exception_copy 8 API calls 8917->8918 8920 248bf89 8918->8920 8921 248bf9f 8919->8921 8922 248d570 _invalid_parameter_noinfo 33 API calls 8920->8922 8944 248e374 GetModuleFileNameW 8921->8944 8922->8915 8927 248befc 8 API calls 8928 248c009 8927->8928 8929 248c029 8928->8929 8930 248c011 8928->8930 8932 248bd34 19 API calls 8929->8932 8931 248d6ac __std_exception_copy 8 API calls 8930->8931 8933 248c016 8931->8933 8936 248c045 8932->8936 8934 248d744 Concurrency::details::SchedulerProxy::DeleteThis 8 API calls 8933->8934 8934->8915 8935 248c04b 8937 248d744 Concurrency::details::SchedulerProxy::DeleteThis 8 API calls 8935->8937 8936->8935 8938 248c090 8936->8938 8939 248c077 8936->8939 8937->8915 8942 248d744 Concurrency::details::SchedulerProxy::DeleteThis 8 API calls 8938->8942 8940 248d744 Concurrency::details::SchedulerProxy::DeleteThis 8 API calls 8939->8940 8941 248c080 8940->8941 8943 248d744 Concurrency::details::SchedulerProxy::DeleteThis 8 API calls 8941->8943 8942->8935 8943->8915 8945 248e3b9 GetLastError 8944->8945 8946 248e3cd 8944->8946 8948 248d620 8 API calls 8945->8948 8947 248e1b4 19 API calls 8946->8947 8952 248e3fb 8947->8952 8949 248e3c6 8948->8949 8950 2487940 _log10_special 4 API calls 8949->8950 8951 248bfb6 8950->8951 8954 248bd34 8951->8954 8960 248e258 8952->8960 8956 248bd72 8954->8956 8958 248bdde 8956->8958 8974 248f040 8956->8974 8957 248becf 8957->8927 8958->8957 8959 248f040 19 API calls 8958->8959 8959->8958 8961 248e297 8960->8961 8964 248e27c 8960->8964 8962 248e29c 8961->8962 8963 248f10c WideCharToMultiByte 8961->8963 8962->8964 8967 248d6ac __std_exception_copy 8 API calls 8962->8967 8966 248e2f3 8963->8966 8964->8949 8965 248e2fa GetLastError 8968 248d620 8 API calls 8965->8968 8966->8962 8966->8965 8969 248e325 8966->8969 8967->8964 8970 248e307 8968->8970 8971 248f10c WideCharToMultiByte 8969->8971 8972 248d6ac __std_exception_copy 8 API calls 8970->8972 8973 248e34c 8971->8973 8972->8964 8973->8964 8973->8965 8975 248efcc 8974->8975 8976 248e1b4 19 API calls 8975->8976 8977 248eff0 8976->8977 8977->8956 9519 2482990 9521 24829e4 9519->9521 9520 24829ff 9521->9520 9523 2483130 9521->9523 9524 24831c6 9523->9524 9526 2483155 9523->9526 9524->9520 9525 2483844 StrCmpNIW 9525->9526 9526->9524 9526->9525 9527 2481ce0 StrCmpIW StrCmpW 9526->9527 9527->9526 7724 248f394 7726 248f3f1 __vcrt_FlsSetValue 7724->7726 7730 248f3ec __vcrt_FlsSetValue 7724->7730 7725 248f421 LoadLibraryExW 7727 248f4f6 7725->7727 7728 248f446 GetLastError 7725->7728 7727->7726 7729 248f50d FreeLibrary 7727->7729 7728->7730 7729->7726 7730->7725 7730->7726 7731 248f480 LoadLibraryExW 7730->7731 7731->7727 7731->7730 8251 248b014 8252 2489634 ExFilterRethrow 6 API calls 8251->8252 8253 248b049 8252->8253 8254 2489634 ExFilterRethrow 6 API calls 8253->8254 8255 248b057 __except_validate_context_record 8254->8255 8256 2489634 ExFilterRethrow 6 API calls 8255->8256 8257 248b09b 8256->8257 8258 2489634 ExFilterRethrow 6 API calls 8257->8258 8259 248b0a4 8258->8259 8260 2489634 ExFilterRethrow 6 API calls 8259->8260 8261 248b0ad 8260->8261 8274 2489c54 8261->8274 8264 2489634 ExFilterRethrow 6 API calls 8265 248b0dd __CxxCallCatchBlock 8264->8265 8281 2489c90 8265->8281 8267 248b1b7 __CxxCallCatchBlock 8268 2489634 ExFilterRethrow 6 API calls 8267->8268 8269 248b1ca 8268->8269 8271 2489634 ExFilterRethrow 6 API calls 8269->8271 8273 248b1d3 8271->8273 8275 2489634 ExFilterRethrow 6 API calls 8274->8275 8276 2489c65 8275->8276 8277 2489c70 8276->8277 8278 2489634 ExFilterRethrow 6 API calls 8276->8278 8279 2489634 ExFilterRethrow 6 API calls 8277->8279 8278->8277 8280 2489c81 8279->8280 8280->8264 8280->8265 8282 2489634 ExFilterRethrow 6 API calls 8281->8282 8283 2489ca2 8282->8283 8284 2489cdd 8283->8284 8285 2489634 ExFilterRethrow 6 API calls 8283->8285 8286 2489cad 8285->8286 8286->8284 8287 2489634 ExFilterRethrow 6 API calls 8286->8287 8288 2489cce 8287->8288 8288->8267 8289 2489320 8288->8289 8290 2489634 ExFilterRethrow 6 API calls 8289->8290 8291 248932e 8290->8291 8291->8267 9358 248d128 9359 248d138 9358->9359 9360 248cfa0 __std_exception_copy 8 API calls 9359->9360 9361 248d143 __vcrt_uninitialize_ptd 9359->9361 9360->9361 9528 24935ab 9529 24935eb 9528->9529 9530 2493850 9528->9530 9529->9530 9532 249361f 9529->9532 9533 2493832 9529->9533 9531 2493846 9530->9531 9535 2494360 _log10_special 12 API calls 9530->9535 9536 2494360 9533->9536 9535->9531 9539 2494380 9536->9539 9540 249439a 9539->9540 9541 249437b 9540->9541 9543 24941c0 9540->9543 9541->9531 9544 2494200 _raise_exc _log10_special 9543->9544 9545 24942a9 9544->9545 9547 2494279 9544->9547 9556 24947b0 9545->9556 9552 249409c 9547->9552 9549 24942a7 _log10_special 9550 2487940 _log10_special 4 API calls 9549->9550 9551 24942d1 9550->9551 9551->9541 9553 24940e0 _log10_special 9552->9553 9554 24940f5 9553->9554 9555 24947b0 _log10_special 8 API calls 9553->9555 9554->9549 9555->9554 9557 24947b9 9556->9557 9558 24947d0 9556->9558 9560 24947c8 9557->9560 9561 248d6ac __std_exception_copy 8 API calls 9557->9561 9559 248d6ac __std_exception_copy 8 API calls 9558->9559 9559->9560 9560->9549 9561->9560 7644 248202c 7645 248205d 7644->7645 7646 248213e 7645->7646 7647 2482173 7645->7647 7654 2482081 7645->7654 7648 2482178 7647->7648 7649 24821e7 7647->7649 7665 2482f04 GetProcessHeap HeapAlloc 7648->7665 7649->7646 7651 24821ec 7649->7651 7653 2482f04 9 API calls 7651->7653 7652 24820b9 StrCmpNIW 7652->7654 7656 2482190 7653->7656 7654->7646 7654->7652 7655 24820e0 7654->7655 7655->7654 7658 2481bf4 7655->7658 7656->7646 7656->7656 7659 2481c1b GetProcessHeap HeapAlloc 7658->7659 7660 2481c8b Concurrency::details::SchedulerProxy::DeleteThis 7658->7660 7659->7660 7661 2481c56 7659->7661 7660->7655 7662 2481c77 GetProcessHeap 7661->7662 7672 248152c 7661->7672 7662->7660 7671 2482f57 7665->7671 7666 2483015 GetProcessHeap 7667 2483029 Concurrency::details::SchedulerProxy::DeleteThis 7666->7667 7667->7656 7668 2483010 7668->7666 7669 2482fa2 StrCmpNIW 7669->7671 7670 2481bf4 5 API calls 7670->7671 7671->7666 7671->7668 7671->7669 7671->7670 7673 2481546 7672->7673 7676 248157c 7672->7676 7674 248155d StrCmpIW 7673->7674 7675 2481565 StrCmpW 7673->7675 7673->7676 7674->7673 7675->7673 7676->7662 9362 2482b2c 9364 2482b9d 9362->9364 9363 2482ee0 9364->9363 9365 2482bc9 GetModuleHandleA 9364->9365 9366 2482bdb __vcrt_FlsSetValue 9365->9366 9366->9363 9367 2482c14 StrCmpNIW 9366->9367 9367->9363 9373 2482c39 9367->9373 9368 248199c 6 API calls 9368->9373 9369 2482d4b lstrlenW 9369->9373 9370 2482e05 lstrlenW 9370->9373 9371 2483844 StrCmpNIW 9371->9373 9372 248152c StrCmpIW StrCmpW 9372->9373 9373->9363 9373->9368 9373->9369 9373->9370 9373->9371 9373->9372 8987 2482aa0 8989 2482afd 8987->8989 8988 2482b18 8989->8988 8990 24831e4 3 API calls 8989->8990 8990->8988 8991 2491aa0 8992 248ec90 52 API calls 8991->8992 8993 2491aa9 8992->8993 8994 2485ca3 8995 2485cb0 8994->8995 8996 2485cbc GetThreadContext 8995->8996 9002 2485e1a 8995->9002 8997 2485ce2 8996->8997 8996->9002 9001 2485d09 8997->9001 8997->9002 8998 2485efe 9000 2485f1e 8998->9000 9005 24843e0 VirtualFree 8998->9005 8999 2485e41 VirtualProtect FlushInstructionCache 8999->9002 9004 2484df0 3 API calls 9000->9004 9003 2485d8d 9001->9003 9007 2485d66 SetThreadContext 9001->9007 9002->8998 9002->8999 9006 2485f23 9004->9006 9005->9000 9008 2485f37 ResumeThread 9006->9008 9009 2485f77 9006->9009 9007->9003 9008->9006 9010 2487940 _log10_special 4 API calls 9009->9010 9011 2485fbf 9010->9011 9562 248b3a4 9569 248b2d7 __CxxCallCatchBlock __FrameHandler3::GetHandlerSearchState 9562->9569 9563 248b3cb 9564 2489634 ExFilterRethrow 6 API calls 9563->9564 9565 248b3d0 9564->9565 9566 248b3db __FrameHandler3::GetHandlerSearchState 9565->9566 9567 2489634 ExFilterRethrow 6 API calls 9565->9567 9567->9566 9568 2489ce4 6 API calls Is_bad_exception_allowed 9568->9569 9569->9563 9569->9566 9569->9568 9570 2489d0c __FrameHandler3::FrameUnwindToEmptyState 6 API calls 9569->9570 9570->9569 9012 2483ab9 9015 2483a06 _invalid_parameter_noinfo 9012->9015 9013 2483a70 9014 2483a56 VirtualQuery 9014->9013 9014->9015 9015->9013 9015->9014 9016 2483a8a VirtualAlloc 9015->9016 9016->9013 9017 2483abb GetLastError 9016->9017 9017->9015 9018 24858b9 9019 24858c0 VirtualProtect 9018->9019 9020 24858e9 GetLastError 9019->9020 9021 24857d0 9019->9021 9020->9021 9374 248253c 9376 24825bb _invalid_parameter_noinfo 9374->9376 9375 24827aa 9376->9375 9377 248261d GetFileType 9376->9377 9378 248262b StrCpyW 9377->9378 9379 2482641 9377->9379 9380 2482650 9378->9380 9381 2481a40 4 API calls 9379->9381 9384 248265a 9380->9384 9388 24826ff 9380->9388 9381->9380 9382 2483844 StrCmpNIW 9382->9384 9383 2483844 StrCmpNIW 9383->9388 9384->9375 9384->9382 9385 2483044 4 API calls 9384->9385 9386 2481cac 2 API calls 9384->9386 9385->9384 9386->9384 9387 2483044 4 API calls 9387->9388 9388->9375 9388->9383 9388->9387 9389 2481cac 2 API calls 9388->9389 9389->9388 7677 2482330 7678 24823ae _invalid_parameter_noinfo 7677->7678 7679 2482413 GetFileType 7678->7679 7685 24824ea 7678->7685 7680 2482421 StrCpyW 7679->7680 7681 2482435 7679->7681 7686 2482442 7680->7686 7688 2481a40 GetFinalPathNameByHandleW 7681->7688 7686->7685 7693 2483844 7686->7693 7696 2483044 StrCmpIW 7686->7696 7700 2481cac 7686->7700 7689 2481aa9 7688->7689 7690 2481a6a StrCmpNIW 7688->7690 7689->7686 7690->7689 7691 2481a84 lstrlenW 7690->7691 7691->7689 7692 2481a96 StrCpyW 7691->7692 7692->7689 7694 2483866 7693->7694 7695 2483851 StrCmpNIW 7693->7695 7694->7686 7695->7694 7697 248308d PathCombineW 7696->7697 7698 2483076 StrCpyW StrCatW 7696->7698 7699 2483096 7697->7699 7698->7699 7699->7686 7701 2481cc3 7700->7701 7702 2481ccc 7700->7702 7703 248152c 2 API calls 7701->7703 7702->7686 7703->7702 8292 2487830 8293 248784c 8292->8293 8294 2487851 8292->8294 8296 2487960 8293->8296 8297 2487983 GetSystemTimeAsFileTime GetCurrentThreadId GetCurrentProcessId QueryPerformanceCounter 8296->8297 8298 24879f7 8296->8298 8297->8298 8298->8294 8299 248f830 GetProcessHeap 8300 2485234 8301 248523a 8300->8301 8312 2487870 8301->8312 8305 248529e 8307 2485337 _invalid_parameter_noinfo 8307->8305 8309 24854bd 8307->8309 8325 2487440 8307->8325 8308 24855bb 8309->8308 8310 2485637 VirtualProtect 8309->8310 8310->8305 8311 2485663 GetLastError 8310->8311 8311->8305 8313 248787b 8312->8313 8314 248527d 8313->8314 8315 248b85c __std_exception_copy EnterCriticalSection 8313->8315 8316 248789a 8313->8316 8314->8305 8321 2483cc0 8314->8321 8315->8313 8317 24878a5 8316->8317 8331 248809c 8316->8331 8335 24880bc 8317->8335 8323 2483cdd 8321->8323 8322 2483d4c _invalid_parameter_noinfo 8322->8307 8323->8322 8343 2483f30 8323->8343 8326 2487487 8325->8326 8368 2487210 8326->8368 8329 2487940 _log10_special 4 API calls 8330 24874b1 8329->8330 8330->8307 8332 24880aa std::bad_alloc::bad_alloc 8331->8332 8339 24894a0 8332->8339 8334 24880bb 8336 24880ca std::bad_alloc::bad_alloc 8335->8336 8337 24894a0 Concurrency::cancel_current_task RtlPcToFileHeader 8336->8337 8338 24878ab 8337->8338 8340 24894bf _RTC_Initialize 8339->8340 8341 24894e8 RtlPcToFileHeader 8340->8341 8342 2489500 Concurrency::cancel_current_task 8340->8342 8341->8342 8342->8334 8344 2483f77 8343->8344 8345 2483f54 8343->8345 8346 2483fad 8344->8346 8363 2483b10 8344->8363 8345->8344 8357 24839e0 8345->8357 8349 2483b10 2 API calls 8346->8349 8350 2483fdd 8346->8350 8349->8350 8353 24839e0 3 API calls 8350->8353 8356 2484013 8350->8356 8351 24839e0 3 API calls 8354 248402f 8351->8354 8352 248404b 8352->8322 8353->8356 8354->8352 8355 2483b10 2 API calls 8354->8355 8355->8352 8356->8351 8356->8354 8362 2483a01 _invalid_parameter_noinfo 8357->8362 8358 2483a70 8358->8344 8359 2483a56 VirtualQuery 8359->8358 8359->8362 8360 2483a8a VirtualAlloc 8360->8358 8361 2483abb GetLastError 8360->8361 8361->8362 8362->8358 8362->8359 8362->8360 8366 2483b28 _invalid_parameter_noinfo 8363->8366 8364 2483b97 8364->8346 8365 2483b7d VirtualQuery 8365->8364 8365->8366 8366->8364 8366->8365 8367 2483be2 GetLastError 8366->8367 8367->8364 8367->8366 8369 248722b 8368->8369 8370 248724f 8369->8370 8371 2487241 SetLastError 8369->8371 8370->8329 8371->8370 8372 2489234 8379 248977c 8372->8379 8375 2489241 8380 2489784 8379->8380 8382 24897b5 8380->8382 8383 248923d 8380->8383 8394 248a040 8380->8394 8384 24897c4 __vcrt_uninitialize_locks DeleteCriticalSection 8382->8384 8383->8375 8385 2489710 8383->8385 8384->8383 8399 2489f14 8385->8399 8395 2489dc4 __vcrt_FlsSetValue 4 API calls 8394->8395 8396 248a076 8395->8396 8397 248a08b InitializeCriticalSectionAndSpinCount 8396->8397 8398 248a080 _RTC_Initialize 8396->8398 8397->8398 8398->8380 8400 2489dc4 __vcrt_FlsSetValue 4 API calls 8399->8400 8401 2489f39 TlsAlloc 8400->8401 8403 2496260 8401->8403 9390 248c534 9393 248c2e4 9390->9393 9400 248c2ac 9393->9400 9398 248c268 8 API calls 9399 248c317 9398->9399 9401 248c2bc 9400->9401 9402 248c2c1 9400->9402 9403 248c268 8 API calls 9401->9403 9404 248c2c8 9402->9404 9403->9402 9405 248c2d8 9404->9405 9406 248c2dd 9404->9406 9407 248c268 8 API calls 9405->9407 9406->9398 9407->9406 9408 2494d35 9409 2489634 ExFilterRethrow 6 API calls 9408->9409 9410 2494d4d 9409->9410 9411 2489634 ExFilterRethrow 6 API calls 9410->9411 9412 2494d68 9411->9412 9413 2489634 ExFilterRethrow 6 API calls 9412->9413 9414 2494d7c 9413->9414 9415 2489634 ExFilterRethrow 6 API calls 9414->9415 9416 2494dbe 9415->9416

                          Executed Functions

                          Function 02482244 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 52filethreadCOMMON
                          Download Yara Rule

                          Control-flow Graph

                          APIs
                          • GetProcessIdOfThread.KERNEL32 ref: 02482259
                          • GetCurrentProcessId.KERNEL32 ref: 02482263
                            • Part of subcall function 02481934: OpenProcess.KERNEL32 ref: 02481952
                            • Part of subcall function 02481934: IsWow64Process.KERNEL32 ref: 02481968
                            • Part of subcall function 02481934: CloseHandle.KERNEL32 ref: 02481983
                          • CreateFileW.KERNEL32 ref: 024822BC
                          • WriteFile.KERNEL32 ref: 024822E4
                          • ReadFile.KERNEL32 ref: 02482303
                          • CloseHandle.KERNEL32 ref: 0248230C
                          Strings
                          • \\.\pipe\dialerchildproc64, xrefs: 0248228C
                          • \\.\pipe\dialerchildproc32, xrefs: 02482293
                          Memory Dump Source
                          • Source File: 0000000A.00000002.373001997.0000000002480000.00000040.00001000.00020000.00000000.sdmp, Offset: 02480000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_10_2_2480000_WerFault.jbxd
                          Similarity
                          • API ID: Process$File$CloseHandle$CreateCurrentOpenReadThreadWow64Write
                          • String ID: \\.\pipe\dialerchildproc32$\\.\pipe\dialerchildproc64
                          • API String ID: 2171963597-1373409510
                          • Opcode ID: d76f145db3bc14c8b60d6abb5b011cd5988a1ad04fc2d4b7169b2a78ec3c4c79
                          • Instruction ID: ca524b514e8bda719210d6cbc2108998c72deeebf0ba0587d9578a9429586726
                          • Opcode Fuzzy Hash: d76f145db3bc14c8b60d6abb5b011cd5988a1ad04fc2d4b7169b2a78ec3c4c79
                          • Instruction Fuzzy Hash: 57214D36624B4083EB10DB25F55836A77A5F789BE4F504216EE5903BA8DF7CC189CF00
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 02482330 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 141COMMON
                          Download Yara Rule

                          Control-flow Graph

                          • Executed
                          • Not Executed
                          control_flow_graph 117 2482330-24823b2 call 24a2cf8 120 2482518-248253a 117->120 121 24823b8-24823bb 117->121 121->120 122 24823c1-24823cf 121->122 122->120 123 24823d5-248241f call 2488c60 * 3 GetFileType 122->123 130 2482421-2482433 StrCpyW 123->130 131 2482435-248243d call 2481a40 123->131 132 2482442-2482447 130->132 131->132 134 2482449-248244c 132->134 135 2482466 132->135 134->135 137 248244e-2482451 134->137 136 2482469-2482485 call 24830a8 call 2483844 135->136 146 24824cc-24824ce 136->146 147 2482487-24824b8 call 24830a8 call 2483044 call 2481cac 136->147 137->135 139 2482453-2482456 137->139 139->135 141 2482458-248245b 139->141 141->135 143 248245d-2482460 141->143 143->135 145 2482462-2482464 143->145 145->136 149 24824ea-24824ed 146->149 150 24824d0-24824e5 146->150 147->146 164 24824ba-24824c5 147->164 151 24824ef-24824f4 149->151 152 24824f6-24824f9 149->152 150->132 151->120 154 24824fb-24824fe 152->154 155 2482514 152->155 154->155 157 2482500-2482503 154->157 155->120 157->155 159 2482505-2482508 157->159 159->155 161 248250a-248250d 159->161 161->155 163 248250f-2482512 161->163 163->120 163->155 164->120 165 24824c7 164->165 165->132
                          APIs
                          Strings
                          Memory Dump Source
                          • Source File: 0000000A.00000002.373001997.0000000002480000.00000040.00001000.00020000.00000000.sdmp, Offset: 02480000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_10_2_2480000_WerFault.jbxd
                          Similarity
                          • API ID: FileType
                          • String ID: \\.\pipe\
                          • API String ID: 3081899298-91387939
                          • Opcode ID: 002250ee4f7fb53d82cbff54f4c55d9c13c210cbd3ade0a461cf797918ee8e55
                          • Instruction ID: 1a3aa0181f396a32dd559f2e8e0394eb22db58d88bab0d11d2a5cbfaba799915
                          • Opcode Fuzzy Hash: 002250ee4f7fb53d82cbff54f4c55d9c13c210cbd3ade0a461cf797918ee8e55
                          • Instruction Fuzzy Hash: 2041B4326287C181D634FE2AE5A836FAB55F385B88F85012BCE5A13B18DFB9C145CB50
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 0248202C Relevance: 4.7, APIs: 1, Strings: 2, Instructions: 162COMMON
                          Download Yara Rule

                          Control-flow Graph

                          • Executed
                          • Not Executed
                          control_flow_graph 166 248202c-2482057 call 24a2d00 168 248205d-2482066 166->168 169 2482068-248206c 168->169 170 248206f-2482072 168->170 169->170 171 2482078-248207b 170->171 172 2482223-2482243 170->172 173 2482081-2482093 171->173 174 2482173-2482176 171->174 173->172 177 2482099-24820a5 173->177 175 2482178-2482192 call 2482f04 174->175 176 24821e7-24821ea 174->176 175->172 186 2482198-24821ae 175->186 176->172 181 24821ec-24821ff call 2482f04 176->181 179 24820d3-24820de call 2481bbc 177->179 180 24820a7-24820b7 177->180 187 24820ff-2482111 179->187 194 24820e0-24820f8 call 2481bf4 179->194 180->179 183 24820b9-24820d1 StrCmpNIW 180->183 181->172 193 2482201-2482209 181->193 183->179 183->187 186->172 192 24821b0-24821cc 186->192 190 2482121-2482123 187->190 191 2482113-2482115 187->191 197 248212a 190->197 198 2482125-2482128 190->198 195 248211c-248211f 191->195 196 2482117-248211a 191->196 199 24821d0-24821e3 192->199 193->172 200 248220b-2482213 193->200 194->187 206 24820fa-24820fd 194->206 203 248212d-2482130 195->203 196->203 197->203 198->203 199->199 204 24821e5 199->204 205 2482216-2482221 200->205 207 248213e-2482141 203->207 208 2482132-2482138 203->208 204->172 205->172 205->205 206->203 207->172 209 2482147-248214b 207->209 208->177 208->207 210 248214d-2482150 209->210 211 2482162-248216e 209->211 210->172 212 2482156-248215b 210->212 211->172 212->209 213 248215d 212->213 213->172
                          APIs
                          • StrCmpNIW.SHLWAPI ref: 024820C6
                            • Part of subcall function 02482F04: GetProcessHeap.KERNEL32 ref: 02482F27
                            • Part of subcall function 02482F04: HeapAlloc.KERNEL32 ref: 02482F3A
                            • Part of subcall function 02482F04: StrCmpNIW.SHLWAPI ref: 02482FAF
                            • Part of subcall function 02482F04: GetProcessHeap.KERNEL32 ref: 02483015
                            • Part of subcall function 02482F04: HeapFree.KERNEL32 ref: 02483023
                          Strings
                          Memory Dump Source
                          • Source File: 0000000A.00000002.373001997.0000000002480000.00000040.00001000.00020000.00000000.sdmp, Offset: 02480000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_10_2_2480000_WerFault.jbxd
                          Similarity
                          • API ID: Heap$Process$AllocFree
                          • String ID: S$dialer
                          • API String ID: 756756679-3873981283
                          • Opcode ID: 70aaf0ea3b7fa533d75c0d245cd217bd05d7e66dae07399e04aa4c2d98613c2d
                          • Instruction ID: ca7d9c71b31cda1020e7ef37edcd66206085e8efe2c2985f07360bd90c8da121
                          • Opcode Fuzzy Hash: 70aaf0ea3b7fa533d75c0d245cd217bd05d7e66dae07399e04aa4c2d98613c2d
                          • Instruction Fuzzy Hash: 4151B132F30BA486DB22EF26E84467E73B5F704788B159516DF4967B08DBB5C892C740
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 02481628 Relevance: 50.9, APIs: 20, Strings: 9, Instructions: 157registrymemoryCOMMON
                          Download Yara Rule

                          Control-flow Graph

                          APIs
                          • GetProcessHeap.KERNEL32 ref: 02481633
                          • HeapAlloc.KERNEL32 ref: 02481642
                            • Part of subcall function 02481268: GetProcessHeap.KERNEL32 ref: 0248126E
                            • Part of subcall function 02481268: HeapAlloc.KERNEL32 ref: 0248127D
                            • Part of subcall function 02481268: GetProcessHeap.KERNEL32 ref: 02481297
                            • Part of subcall function 02481268: HeapAlloc.KERNEL32 ref: 024812A8
                            • Part of subcall function 02481000: GetProcessHeap.KERNEL32 ref: 02481006
                            • Part of subcall function 02481000: HeapAlloc.KERNEL32 ref: 02481015
                            • Part of subcall function 02481000: GetProcessHeap.KERNEL32 ref: 02481028
                            • Part of subcall function 02481000: HeapAlloc.KERNEL32 ref: 02481037
                          • RegOpenKeyExW.ADVAPI32 ref: 024816B2
                          • RegOpenKeyExW.ADVAPI32 ref: 024816DF
                          • RegCloseKey.ADVAPI32 ref: 024816F9
                          • RegOpenKeyExW.ADVAPI32 ref: 02481719
                          • RegCloseKey.ADVAPI32 ref: 02481734
                          • RegOpenKeyExW.ADVAPI32 ref: 02481754
                          • RegCloseKey.ADVAPI32 ref: 0248176F
                          • RegOpenKeyExW.ADVAPI32 ref: 0248178F
                          • RegCloseKey.ADVAPI32 ref: 024817AA
                          • RegOpenKeyExW.ADVAPI32 ref: 024817CA
                          • RegCloseKey.ADVAPI32 ref: 024817E5
                          • RegOpenKeyExW.ADVAPI32 ref: 02481805
                          • RegCloseKey.ADVAPI32 ref: 02481820
                          • RegOpenKeyExW.ADVAPI32 ref: 02481840
                          • RegCloseKey.ADVAPI32 ref: 0248185B
                          • RegOpenKeyExW.ADVAPI32 ref: 0248187B
                          • RegCloseKey.ADVAPI32 ref: 02481896
                          • RegCloseKey.ADVAPI32 ref: 024818A0
                            • Part of subcall function 024812BC: RegQueryInfoKeyW.ADVAPI32 ref: 02481319
                            • Part of subcall function 024812BC: GetProcessHeap.KERNEL32 ref: 02481327
                            • Part of subcall function 024812BC: HeapAlloc.KERNEL32 ref: 02481338
                            • Part of subcall function 024812BC: RegEnumValueW.ADVAPI32 ref: 02481397
                            • Part of subcall function 024812BC: GetProcessHeap.KERNEL32 ref: 024813DF
                            • Part of subcall function 024812BC: HeapAlloc.KERNEL32 ref: 024813ED
                            • Part of subcall function 024812BC: GetProcessHeap.KERNEL32 ref: 0248140A
                            • Part of subcall function 024812BC: HeapFree.KERNEL32 ref: 02481418
                            • Part of subcall function 024812BC: lstrlenW.KERNEL32 ref: 02481421
                            • Part of subcall function 024812BC: GetProcessHeap.KERNEL32 ref: 0248142F
                            • Part of subcall function 024812BC: HeapAlloc.KERNEL32 ref: 0248143D
                          Strings
                          Memory Dump Source
                          • Source File: 0000000A.00000002.373001997.0000000002480000.00000040.00001000.00020000.00000000.sdmp, Offset: 02480000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_10_2_2480000_WerFault.jbxd
                          Similarity
                          • API ID: Heap$CloseOpenProcess$Alloc$EnumFreeInfoQueryValuelstrlen
                          • String ID: SOFTWARE\dialerconfig$paths$pid$process_names$service_names$startup$tcp_local$tcp_remote$udp
                          • API String ID: 2135414181-2879589442
                          • Opcode ID: 84d977f69669bb910c18c90d9c150143eff6fe6f95bc9245a9bd4b5f56132143
                          • Instruction ID: 431581f5e4b48990a06a500afd6bf24af7c9c4b34526055d3604ae4e0c10ecb8
                          • Opcode Fuzzy Hash: 84d977f69669bb910c18c90d9c150143eff6fe6f95bc9245a9bd4b5f56132143
                          • Instruction Fuzzy Hash: 9D71C736721A5186EB10EF66E89475E3369FB88B8CF411126DE4E57B28EF38C495CB40
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 0248F394 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117libraryloaderCOMMON
                          Download Yara Rule

                          Control-flow Graph

                          • Executed
                          • Not Executed
                          control_flow_graph 60 248f394-248f3e6 61 248f3ec-248f3ef 60->61 62 248f4d7 60->62 64 248f3f9-248f3fc 61->64 65 248f3f1-248f3f4 61->65 63 248f4d9-248f4f5 62->63 66 248f4bc-248f4cf 64->66 67 248f402-248f411 64->67 65->63 66->62 68 248f421-248f440 LoadLibraryExW 67->68 69 248f413-248f416 67->69 72 248f4f6-248f50b 68->72 73 248f446-248f44f GetLastError 68->73 70 248f41c 69->70 71 248f516-248f525 call 2496090 69->71 74 248f4a8-248f4af 70->74 81 248f4b5 71->81 82 248f527-248f54e 71->82 72->71 75 248f50d-248f510 FreeLibrary 72->75 77 248f451-248f468 call 248c928 73->77 78 248f496-248f4a0 73->78 74->67 74->81 75->71 77->78 84 248f46a-248f47e call 248c928 77->84 78->74 81->66 82->63 84->78 87 248f480-248f494 LoadLibraryExW 84->87 87->72 87->78
                          APIs
                          Strings
                          Memory Dump Source
                          • Source File: 0000000A.00000002.373001997.0000000002480000.00000040.00001000.00020000.00000000.sdmp, Offset: 02480000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_10_2_2480000_WerFault.jbxd
                          Similarity
                          • API ID: AddressFreeLibraryProc
                          • String ID: api-ms-$ext-ms-
                          • API String ID: 3013587201-537541572
                          • Opcode ID: a0f3cb97d83f084b5c078ea606d329a918e0789490c159543aff3f4a2fa5ff9f
                          • Instruction ID: 8a7bbe90aec039eea650ab2b3a28fe2ec2b258558991b6f1a7c10c632f83884b
                          • Opcode Fuzzy Hash: a0f3cb97d83f084b5c078ea606d329a918e0789490c159543aff3f4a2fa5ff9f
                          • Instruction Fuzzy Hash: 4941D322331A1091EB16EB66A80875B7395FB49BE4F9A412B9D0E97B54EF3CC0898710
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 02489DC4 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE
                          Download Yara Rule

                          Control-flow Graph

                          • Executed
                          • Not Executed
                          control_flow_graph 88 2489dc4-2489e02 89 2489e08-2489e0b 88->89 90 2489ef3 88->90 91 2489e11 89->91 92 2489ef5-2489f11 89->92 90->92 93 2489e14 91->93 94 2489e1a-2489e29 93->94 95 2489eeb 93->95 96 2489e2b-2489e2e 94->96 97 2489e36-2489e55 LoadLibraryExW 94->97 95->90 100 2489ecd-2489edc call 2496090 96->100 101 2489e34 96->101 98 2489ead-2489ec2 97->98 99 2489e57-2489e60 GetLastError 97->99 98->100 104 2489ec4-2489ec7 FreeLibrary 98->104 102 2489e8f-2489e99 99->102 103 2489e62-2489e77 call 248c928 99->103 100->95 110 2489ede-2489ee9 100->110 106 2489ea1-2489ea8 101->106 102->106 103->102 111 2489e79-2489e8d LoadLibraryExW 103->111 104->100 106->93 110->92 111->98 111->102
                          APIs
                          Strings
                          Memory Dump Source
                          • Source File: 0000000A.00000002.373001997.0000000002480000.00000040.00001000.00020000.00000000.sdmp, Offset: 02480000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_10_2_2480000_WerFault.jbxd
                          Similarity
                          • API ID: Library$Load$AddressErrorFreeLastProc
                          • String ID: api-ms-
                          • API String ID: 2559590344-2084034818
                          • Opcode ID: 1bec38bed2a9dad19cb8167f1bbce1e92081cdd400658c61ccc26499447e47b7
                          • Instruction ID: 802583e041f9388c8998b2e02d0c153a30ee23f718b547aa930530205f5686ef
                          • Opcode Fuzzy Hash: 1bec38bed2a9dad19cb8167f1bbce1e92081cdd400658c61ccc26499447e47b7
                          • Instruction Fuzzy Hash: D831C732332E40E1DF16EB46A94477E6798F748BA4F590526DD6E4B790EF39C085C710
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 02481A40 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 30stringCOMMON
                          Download Yara Rule

                          Control-flow Graph

                          • Executed
                          • Not Executed
                          control_flow_graph 112 2481a40-2481a68 GetFinalPathNameByHandleW 113 2481aa9-2481abb 112->113 114 2481a6a-2481a82 StrCmpNIW 112->114 114->113 115 2481a84-2481a94 lstrlenW 114->115 115->113 116 2481a96-2481aa4 StrCpyW 115->116 116->113
                          APIs
                          Strings
                          Memory Dump Source
                          • Source File: 0000000A.00000002.373001997.0000000002480000.00000040.00001000.00020000.00000000.sdmp, Offset: 02480000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_10_2_2480000_WerFault.jbxd
                          Similarity
                          • API ID: FinalHandleNamePathlstrlen
                          • String ID: \\?\
                          • API String ID: 2719912262-4282027825
                          • Opcode ID: c1daab9146f2a1614ef605d22fd4f721266e20aa8a0235322e79b2424596649d
                          • Instruction ID: d5bfc79f02b5d8a7a6fd905d28921d4157a1f2b087a1985ef9ecc04835077e6b
                          • Opcode Fuzzy Hash: c1daab9146f2a1614ef605d22fd4f721266e20aa8a0235322e79b2424596649d
                          • Instruction Fuzzy Hash: EAF06D6271464192EB309F21F9C875F6725F788BC8F848022DA4D46A58DF7CC6CECB00
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 0248328C Relevance: 4.5, APIs: 3, Instructions: 43threadCOMMON
                          Download Yara Rule

                          Control-flow Graph

                          • Executed
                          • Not Executed
                          control_flow_graph 214 248328c-248329b 215 24832a1-24832b6 GetModuleFileNameW 214->215 216 2483323-2483325 214->216 219 24832b8-24832cd PathFindFileNameW call 2483844 215->219 220 248331f-2483321 215->220 217 248332c 216->217 218 2483327 call 24836c8 216->218 221 2483331-2483339 217->221 218->217 219->220 225 24832cf-24832d6 call 2483790 219->225 220->221 225->220 228 24832d8-24832df 225->228 228->217 229 24832e1-2483318 CreateThread call 2481d14 228->229 231 248331d 229->231 231->217
                          APIs
                          • GetModuleFileNameW.KERNEL32 ref: 024832AE
                          • PathFindFileNameW.SHLWAPI ref: 024832BD
                            • Part of subcall function 02483844: StrCmpNIW.SHLWAPI ref: 0248385C
                            • Part of subcall function 02483790: GetModuleHandleW.KERNEL32 ref: 0248379E
                            • Part of subcall function 02483790: GetCurrentProcess.KERNEL32 ref: 024837CC
                            • Part of subcall function 02483790: VirtualProtectEx.KERNEL32 ref: 024837EE
                            • Part of subcall function 02483790: GetCurrentProcess.KERNEL32 ref: 02483809
                            • Part of subcall function 02483790: VirtualProtectEx.KERNEL32 ref: 0248382A
                          • CreateThread.KERNEL32 ref: 0248330B
                            • Part of subcall function 02481D14: GetCurrentThread.KERNEL32 ref: 02481D1F
                          Memory Dump Source
                          • Source File: 0000000A.00000002.373001997.0000000002480000.00000040.00001000.00020000.00000000.sdmp, Offset: 02480000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_10_2_2480000_WerFault.jbxd
                          Similarity
                          • API ID: Current$FileModuleNameProcessProtectThreadVirtual$CreateFindHandlePath
                          • String ID:
                          • API String ID: 1683269324-0
                          • Opcode ID: c94412c55dcd243bcd3fbe265bea19663896af10ab27123b85acb7154d5eea14
                          • Instruction ID: 9c45980d95c4efcc1f6bee7269a4955a2e57db43b15ebf0f9310aadc5cfe9fd2
                          • Opcode Fuzzy Hash: c94412c55dcd243bcd3fbe265bea19663896af10ab27123b85acb7154d5eea14
                          • Instruction Fuzzy Hash: 8A017171A3474182EB20FF22F84C76E2A95BB84B49F40416BDA4A81A50EFFCC088CA11
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 02481934 Relevance: 4.5, APIs: 3, Instructions: 30COMMON
                          Download Yara Rule

                          Control-flow Graph

                          • Executed
                          • Not Executed
                          control_flow_graph 232 2481934-248195e OpenProcess 233 2481989-248199a 232->233 234 2481960-2481970 IsWow64Process 232->234 235 2481980-2481983 CloseHandle 234->235 236 2481972-248197b 234->236 235->233 236->235
                          APIs
                          Memory Dump Source
                          • Source File: 0000000A.00000002.373001997.0000000002480000.00000040.00001000.00020000.00000000.sdmp, Offset: 02480000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_10_2_2480000_WerFault.jbxd
                          Similarity
                          • API ID: Process$CloseHandleOpenWow64
                          • String ID:
                          • API String ID: 10462204-0
                          • Opcode ID: 7d0b437a59a4fff8aaeab8a545a29b95f500e974967cf24a4602cff355e313bd
                          • Instruction ID: 1a63a23f61a75168ae1b74100569a018a6c2fddc545caf8782b3fce0fed8a459
                          • Opcode Fuzzy Hash: 7d0b437a59a4fff8aaeab8a545a29b95f500e974967cf24a4602cff355e313bd
                          • Instruction Fuzzy Hash: 82F0543171578183EB14CF56B58431AA665F788BC0F48903AEE8D43759DF3CC485CB00
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 02481ABC Relevance: 3.1, APIs: 2, Instructions: 68sleepCOMMON
                          Download Yara Rule

                          Control-flow Graph

                          • Executed
                          • Not Executed
                          control_flow_graph 237 2481abc-2481acb call 2481628 240 2481ad2-2481aef Sleep SleepEx 237->240 241 2481baa 240->241 242 2481af5-2481af8 240->242 243 2481bad-2481bb5 call 24818b4 241->243 244 2481afe-2481b01 242->244 245 2481ba1-2481ba8 242->245 243->240 244->245 247 2481b07-2481b14 call 2481598 244->247 245->243 251 2481b94 247->251 252 2481b16-2481b25 call 2481220 247->252 254 2481b96-2481b98 251->254 252->251 257 2481b27-2481b36 call 2481598 252->257 254->241 256 2481b9a 254->256 256->245 257->251 260 2481b38-2481b47 call 2481598 257->260 260->251 263 2481b49-2481b58 call 2481598 260->263 263->251 266 2481b5a-2481b69 call 2481220 263->266 266->251 269 2481b6b-2481b7a call 2481220 266->269 269->251 272 2481b7c-2481b8b call 2481220 269->272 272->251 275 2481b8d-2481b92 272->275 275->254
                          APIs
                            • Part of subcall function 02481628: GetProcessHeap.KERNEL32 ref: 02481633
                            • Part of subcall function 02481628: HeapAlloc.KERNEL32 ref: 02481642
                            • Part of subcall function 02481628: RegOpenKeyExW.ADVAPI32 ref: 024816B2
                            • Part of subcall function 02481628: RegOpenKeyExW.ADVAPI32 ref: 024816DF
                            • Part of subcall function 02481628: RegCloseKey.ADVAPI32 ref: 024816F9
                            • Part of subcall function 02481628: RegOpenKeyExW.ADVAPI32 ref: 02481719
                            • Part of subcall function 02481628: RegCloseKey.ADVAPI32 ref: 02481734
                            • Part of subcall function 02481628: RegOpenKeyExW.ADVAPI32 ref: 02481754
                            • Part of subcall function 02481628: RegCloseKey.ADVAPI32 ref: 0248176F
                            • Part of subcall function 02481628: RegOpenKeyExW.ADVAPI32 ref: 0248178F
                            • Part of subcall function 02481628: RegCloseKey.ADVAPI32 ref: 024817AA
                            • Part of subcall function 02481628: RegOpenKeyExW.ADVAPI32 ref: 024817CA
                          • Sleep.KERNEL32 ref: 02481AD7
                          • SleepEx.KERNEL32 ref: 02481ADD
                            • Part of subcall function 02481628: RegCloseKey.ADVAPI32 ref: 024817E5
                            • Part of subcall function 02481628: RegOpenKeyExW.ADVAPI32 ref: 02481805
                            • Part of subcall function 02481628: RegCloseKey.ADVAPI32 ref: 02481820
                            • Part of subcall function 02481628: RegOpenKeyExW.ADVAPI32 ref: 02481840
                            • Part of subcall function 02481628: RegCloseKey.ADVAPI32 ref: 0248185B
                            • Part of subcall function 02481628: RegOpenKeyExW.ADVAPI32 ref: 0248187B
                            • Part of subcall function 02481628: RegCloseKey.ADVAPI32 ref: 02481896
                            • Part of subcall function 02481628: RegCloseKey.ADVAPI32 ref: 024818A0
                          Memory Dump Source
                          • Source File: 0000000A.00000002.373001997.0000000002480000.00000040.00001000.00020000.00000000.sdmp, Offset: 02480000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_10_2_2480000_WerFault.jbxd
                          Similarity
                          • API ID: CloseOpen$HeapSleep$AllocProcess
                          • String ID:
                          • API String ID: 1534210851-0
                          • Opcode ID: ad614115fa5d2181ccf7742c52f053f5bbac07b16a2f1961ccdf1ed8f9939afa
                          • Instruction ID: 01685470016fe205a922f20943e19fd7b5dd37b62913fe16d6d8f47635380837
                          • Opcode Fuzzy Hash: ad614115fa5d2181ccf7742c52f053f5bbac07b16a2f1961ccdf1ed8f9939afa
                          • Instruction Fuzzy Hash: 6321B961331A4192DF11FB2BEA9036E63A6EB88BE4F0854278E0E87755FF24C493C611
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Non-executed Functions

                          Function 02482B2C Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 264stringlibraryloaderCOMMON
                          Download Yara Rule

                          Control-flow Graph

                          • Executed
                          • Not Executed
                          control_flow_graph 369 2482b2c-2482ba5 call 24a2ce0 372 2482bab-2482bb1 369->372 373 2482ee0-2482f03 369->373 372->373 374 2482bb7-2482bba 372->374 374->373 375 2482bc0-2482bc3 374->375 375->373 376 2482bc9-2482bd9 GetModuleHandleA 375->376 377 2482bdb-2482beb call 2496090 376->377 378 2482bed 376->378 380 2482bf0-2482c0e 377->380 378->380 380->373 383 2482c14-2482c33 StrCmpNIW 380->383 383->373 384 2482c39-2482c3d 383->384 384->373 385 2482c43-2482c4d 384->385 385->373 386 2482c53-2482c5a 385->386 386->373 387 2482c60-2482c73 386->387 388 2482c83 387->388 389 2482c75-2482c81 387->389 390 2482c86-2482c8a 388->390 389->390 391 2482c9a 390->391 392 2482c8c-2482c98 390->392 393 2482c9d-2482ca7 391->393 392->393 394 2482d9d-2482da1 393->394 395 2482cad-2482cb0 393->395 398 2482ed2-2482eda 394->398 399 2482da7-2482daa 394->399 396 2482cc2-2482ccc 395->396 397 2482cb2-2482cbf call 248199c 395->397 401 2482cce-2482cdb 396->401 402 2482d00-2482d0a 396->402 397->396 398->373 398->387 403 2482dbb-2482dc5 399->403 404 2482dac-2482db8 call 248199c 399->404 401->402 409 2482cdd-2482cea 401->409 410 2482d3a-2482d3d 402->410 411 2482d0c-2482d19 402->411 406 2482df5-2482df8 403->406 407 2482dc7-2482dd4 403->407 404->403 416 2482dfa-2482e03 call 2481bbc 406->416 417 2482e05-2482e12 lstrlenW 406->417 407->406 415 2482dd6-2482de3 407->415 418 2482ced-2482cf3 409->418 413 2482d4b-2482d58 lstrlenW 410->413 414 2482d3f-2482d49 call 2481bbc 410->414 411->410 419 2482d1b-2482d28 411->419 421 2482d5a-2482d64 413->421 422 2482d7b-2482d8d call 2483844 413->422 414->413 426 2482d93-2482d98 414->426 423 2482de6-2482dec 415->423 416->417 433 2482e4a-2482e55 416->433 427 2482e14-2482e1e 417->427 428 2482e35-2482e3f call 2483844 417->428 425 2482cf9-2482cfe 418->425 418->426 429 2482d2b-2482d31 419->429 421->422 432 2482d66-2482d79 call 248152c 421->432 422->426 437 2482e42-2482e44 422->437 423->433 434 2482dee-2482df3 423->434 425->402 425->418 426->437 427->428 438 2482e20-2482e33 call 248152c 427->438 428->437 429->426 439 2482d33-2482d38 429->439 432->422 432->426 441 2482ecc-2482ed0 433->441 442 2482e57-2482e5b 433->442 434->406 434->423 437->398 437->433 438->428 438->433 439->410 439->429 441->398 446 2482e5d-2482e61 442->446 447 2482e63-2482e7d call 24885c0 442->447 446->447 450 2482e80-2482e83 446->450 447->450 453 2482e85-2482ea3 call 24885c0 450->453 454 2482ea6-2482ea9 450->454 453->454 454->441 456 2482eab-2482ec9 call 24885c0 454->456 456->441
                          APIs
                          • GetModuleHandleA.KERNEL32 ref: 02482BD0
                          • lstrlenW.KERNEL32 ref: 02482E0A
                            • Part of subcall function 0248199C: OpenProcess.KERNEL32 ref: 024819C2
                            • Part of subcall function 0248199C: K32GetModuleFileNameExW.KERNEL32 ref: 024819E0
                            • Part of subcall function 0248199C: PathFindFileNameW.SHLWAPI ref: 024819EF
                            • Part of subcall function 0248199C: lstrlenW.KERNEL32 ref: 024819FB
                            • Part of subcall function 0248199C: StrCpyW.SHLWAPI ref: 02481A0E
                            • Part of subcall function 0248199C: CloseHandle.KERNEL32 ref: 02481A1C
                          • GetProcAddress.KERNEL32 ref: 02482BE5
                            • Part of subcall function 0248152C: StrCmpIW.SHLWAPI ref: 0248155D
                            • Part of subcall function 02483844: StrCmpNIW.SHLWAPI ref: 0248385C
                          • StrCmpNIW.SHLWAPI ref: 02482C28
                          • lstrlenW.KERNEL32 ref: 02482D50
                          Strings
                          Memory Dump Source
                          • Source File: 0000000A.00000002.373001997.0000000002480000.00000040.00001000.00020000.00000000.sdmp, Offset: 02480000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_10_2_2480000_WerFault.jbxd
                          Similarity
                          • API ID: lstrlen$FileHandleModuleName$AddressCloseFindOpenPathProcProcess
                          • String ID: NtQueryObject$\Device\Nsi$ntdll.dll
                          • API String ID: 2119608203-3850299575
                          • Opcode ID: 4f621fb1587c0d31dffa94ac8be990c76594e3be50ef12941f5ce2f96c448f72
                          • Instruction ID: f30f6356383fec13ef1f99f1a085fbd6acac6001aef2618a70738d0bee1a6875
                          • Opcode Fuzzy Hash: 4f621fb1587c0d31dffa94ac8be990c76594e3be50ef12941f5ce2f96c448f72
                          • Instruction Fuzzy Hash: 9FA1A076230AD086DB69EF2AD8447AE77A5FB44F88F44501BEE0957B14EFB4C981C740
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 02487D90 Relevance: 10.6, APIs: 7, Instructions: 72COMMON
                          Download Yara Rule
                          APIs
                          • IsProcessorFeaturePresent.KERNEL32 ref: 02487DAC
                          • RtlCaptureContext.NTDLL ref: 02487DD9
                          • RtlLookupFunctionEntry.NTDLL ref: 02487DF3
                          • RtlVirtualUnwind.NTDLL ref: 02487E34
                          • IsDebuggerPresent.KERNEL32 ref: 02487E88
                          • SetUnhandledExceptionFilter.KERNEL32 ref: 02487EA9
                          • UnhandledExceptionFilter.KERNEL32 ref: 02487EB4
                          Memory Dump Source
                          • Source File: 0000000A.00000002.373001997.0000000002480000.00000040.00001000.00020000.00000000.sdmp, Offset: 02480000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_10_2_2480000_WerFault.jbxd
                          Similarity
                          • API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
                          • String ID:
                          • API String ID: 3140674995-0
                          • Opcode ID: 781d1b9bde8934adc12bfa83d35ad1be64d2520f1bd2f9e02f1b4bb1ea1a0257
                          • Instruction ID: 1c8cac38b6b9cb68efb77325ad5ca0dd933b6d8f3fed3411b6e7fa60e9bd9def
                          • Opcode Fuzzy Hash: 781d1b9bde8934adc12bfa83d35ad1be64d2520f1bd2f9e02f1b4bb1ea1a0257
                          • Instruction Fuzzy Hash: C7316176215B808AEB70EF61E8947EE7365F784748F44442ADB4E57B98EF38C648CB10
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 0248D2A4 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE
                          Download Yara Rule
                          APIs
                          • RtlCaptureContext.NTDLL ref: 0248D31D
                          • RtlLookupFunctionEntry.NTDLL ref: 0248D335
                          • RtlVirtualUnwind.NTDLL ref: 0248D370
                          • IsDebuggerPresent.KERNEL32 ref: 0248D3A9
                          • SetUnhandledExceptionFilter.KERNEL32 ref: 0248D3B3
                          • UnhandledExceptionFilter.KERNEL32 ref: 0248D3BE
                          Memory Dump Source
                          • Source File: 0000000A.00000002.373001997.0000000002480000.00000040.00001000.00020000.00000000.sdmp, Offset: 02480000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_10_2_2480000_WerFault.jbxd
                          Similarity
                          • API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
                          • String ID:
                          • API String ID: 1239891234-0
                          • Opcode ID: 056b8809331e045eb0ff6df28b8a67c6be047fb713c0be5e5acd4a9b147221bc
                          • Instruction ID: 1d14e69b207ad0c55b095db445e9420d4d788f9c46a8f6e067589ecc7f798691
                          • Opcode Fuzzy Hash: 056b8809331e045eb0ff6df28b8a67c6be047fb713c0be5e5acd4a9b147221bc
                          • Instruction Fuzzy Hash: 74318036615F8086DB20DF35E8843AE73A4F789798F50012AEA9D47B58EF78C155CB00
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 024812BC Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 120memoryregistrystringCOMMON
                          Download Yara Rule

                          Control-flow Graph

                          APIs
                          Strings
                          Memory Dump Source
                          • Source File: 0000000A.00000002.373001997.0000000002480000.00000040.00001000.00020000.00000000.sdmp, Offset: 02480000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_10_2_2480000_WerFault.jbxd
                          Similarity
                          • API ID: Heap$Process$Alloc$Free$EnumInfoQueryValuelstrlen
                          • String ID: d
                          • API String ID: 2005889112-2564639436
                          • Opcode ID: 8b653d2a3574a9b9f54f76d34c9bbade1314fe17b6e977058bb62b7e32ce9810
                          • Instruction ID: 402c262f70fa25bf36f5d6c0ca332843905151697d458a1362856ecddfbd29bf
                          • Opcode Fuzzy Hash: 8b653d2a3574a9b9f54f76d34c9bbade1314fe17b6e977058bb62b7e32ce9810
                          • Instruction Fuzzy Hash: 66514936614B8486EB15DF62E54939BB7A5F789FD9F058126DE4A07728DF3CC08ACB00
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 02481D14 Relevance: 22.8, APIs: 1, Strings: 12, Instructions: 65threadCOMMON
                          Download Yara Rule

                          Control-flow Graph

                          APIs
                          • GetCurrentThread.KERNEL32 ref: 02481D1F
                            • Part of subcall function 02481FD4: GetModuleHandleA.KERNEL32 ref: 02481FEC
                            • Part of subcall function 02481FD4: GetProcAddress.KERNEL32 ref: 02481FFD
                            • Part of subcall function 02485B30: GetCurrentThreadId.KERNEL32 ref: 02485B6B
                          Strings
                          Memory Dump Source
                          • Source File: 0000000A.00000002.373001997.0000000002480000.00000040.00001000.00020000.00000000.sdmp, Offset: 02480000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_10_2_2480000_WerFault.jbxd
                          Similarity
                          • API ID: CurrentThread$AddressHandleModuleProc
                          • String ID: EnumServiceGroupW$EnumServicesStatusExW$NtDeviceIoControlFile$NtEnumerateKey$NtEnumerateValueKey$NtQueryDirectoryFile$NtQueryDirectoryFileEx$NtQuerySystemInformation$NtResumeThread$advapi32.dll$ntdll.dll$sechost.dll
                          • API String ID: 4175298099-1975688563
                          • Opcode ID: 848021bf4701eae64bbfc749c93af06548ec6c37c79a2989ab503d46e0816dd6
                          • Instruction ID: 30f8cfb68efa8d1e0df66ddcb0c8ffd3e0f92955e884e999d7a8ab2eff9ab85f
                          • Opcode Fuzzy Hash: 848021bf4701eae64bbfc749c93af06548ec6c37c79a2989ab503d46e0816dd6
                          • Instruction Fuzzy Hash: B73185A4660A4AE0EA45FFAAED687E96321FB44344FC05027CD1E13534AFB8C68ED751
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 0248CE28 Relevance: 18.1, APIs: 12, Instructions: 112COMMONLIBRARYCODE
                          Download Yara Rule

                          Control-flow Graph

                          APIs
                          • GetLastError.KERNEL32 ref: 0248CE37
                          • FlsGetValue.KERNEL32(?,?,?,02490A6B,?,?,?,0249045C,?,?,?,0248C84F), ref: 0248CE4C
                          • FlsSetValue.KERNEL32(?,?,?,02490A6B,?,?,?,0249045C,?,?,?,0248C84F), ref: 0248CE6D
                          • FlsSetValue.KERNEL32(?,?,?,02490A6B,?,?,?,0249045C,?,?,?,0248C84F), ref: 0248CE9A
                          • FlsSetValue.KERNEL32(?,?,?,02490A6B,?,?,?,0249045C,?,?,?,0248C84F), ref: 0248CEAB
                          • FlsSetValue.KERNEL32(?,?,?,02490A6B,?,?,?,0249045C,?,?,?,0248C84F), ref: 0248CEBC
                          • SetLastError.KERNEL32 ref: 0248CED7
                          • FlsGetValue.KERNEL32(?,?,?,?,?,?,?,02490A6B,?,?,?,0249045C,?,?,?,0248C84F), ref: 0248CF0D
                          • FlsSetValue.KERNEL32(?,?,00000001,0248ECCC,?,?,?,?,0248BF9F,?,?,?,?,?,02487AB0), ref: 0248CF2C
                            • Part of subcall function 0248D6CC: HeapAlloc.KERNEL32 ref: 0248D721
                          • FlsSetValue.KERNEL32(?,?,?,?,?,?,?,02490A6B,?,?,?,0249045C,?,?,?,0248C84F), ref: 0248CF54
                            • Part of subcall function 0248D744: HeapFree.KERNEL32 ref: 0248D75A
                            • Part of subcall function 0248D744: GetLastError.KERNEL32 ref: 0248D764
                          • FlsSetValue.KERNEL32(?,?,?,?,?,?,?,02490A6B,?,?,?,0249045C,?,?,?,0248C84F), ref: 0248CF65
                          • FlsSetValue.KERNEL32(?,?,?,?,?,?,?,02490A6B,?,?,?,0249045C,?,?,?,0248C84F), ref: 0248CF76
                          Memory Dump Source
                          • Source File: 0000000A.00000002.373001997.0000000002480000.00000040.00001000.00020000.00000000.sdmp, Offset: 02480000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_10_2_2480000_WerFault.jbxd
                          Similarity
                          • API ID: Value$ErrorLast$Heap$AllocFree
                          • String ID:
                          • API String ID: 570795689-0
                          • Opcode ID: 81ae7dfa4ed2d3c1f1356864241e8c9d76a8deab2a50f3105871727dc9b84e00
                          • Instruction ID: 513883698a371bf9e596adfb657141ac87be5a9fe1df343ee588b20faa84b4b5
                          • Opcode Fuzzy Hash: 81ae7dfa4ed2d3c1f1356864241e8c9d76a8deab2a50f3105871727dc9b84e00
                          • Instruction Fuzzy Hash: E731922577164482EA2DB736D59433E22439F84BB4F54072B9D3B6BBE4EF68D042CB11
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 0248A544 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 317COMMON
                          Download Yara Rule

                          Control-flow Graph

                          • Executed
                          • Not Executed
                          control_flow_graph 460 248a544-248a5ac call 248b414 463 248a5b2-248a5b5 460->463 464 248aa13-248aa1b call 248c748 460->464 463->464 465 248a5bb-248a5c1 463->465 468 248a690-248a6a2 465->468 469 248a5c7-248a5cb 465->469 470 248a6a8-248a6ac 468->470 471 248a963-248a967 468->471 469->468 472 248a5d1-248a5dc 469->472 470->471 475 248a6b2-248a6bd 470->475 473 248a969-248a970 471->473 474 248a9a0-248a9aa call 2489634 471->474 472->468 476 248a5e2-248a5e7 472->476 473->464 478 248a976-248a99b call 248aa1c 473->478 474->464 488 248a9ac-248a9cb call 2487940 474->488 475->471 480 248a6c3-248a6ca 475->480 476->468 477 248a5ed-248a5f7 call 2489634 476->477 477->488 491 248a5fd-248a628 call 2489634 * 2 call 2489d24 477->491 478->474 481 248a6d0-248a707 call 2489a10 480->481 482 248a894-248a8a0 480->482 481->482 496 248a70d-248a715 481->496 482->474 489 248a8a6-248a8aa 482->489 493 248a8ba-248a8c2 489->493 494 248a8ac-248a8b8 call 2489ce4 489->494 528 248a648-248a652 call 2489634 491->528 529 248a62a-248a62e 491->529 493->474 495 248a8c8-248a8d5 call 24898b4 493->495 494->493 504 248a8db-248a8e3 494->504 495->474 495->504 502 248a719-248a74b 496->502 506 248a751-248a75c 502->506 507 248a887-248a88e 502->507 509 248a8e9-248a8ed 504->509 510 248a9f6-248aa12 call 2489634 * 2 call 248c6a8 504->510 506->507 511 248a762-248a77b 506->511 507->482 507->502 513 248a8ef-248a8fe call 2489ce4 509->513 514 248a900 509->514 510->464 515 248a781-248a7c6 call 2489cf8 * 2 511->515 516 248a874-248a879 511->516 524 248a903-248a90d call 248b4ac 513->524 514->524 542 248a7c8-248a7ee call 2489cf8 call 248ac38 515->542 543 248a804-248a80a 515->543 521 248a884 516->521 521->507 524->474 539 248a913-248a961 call 2489944 call 2489b50 524->539 528->468 541 248a654-248a674 call 2489634 * 2 call 248b4ac 528->541 529->528 533 248a630-248a63b 529->533 533->528 538 248a63d-248a642 533->538 538->464 538->528 539->474 566 248a68b 541->566 567 248a676-248a680 call 248b59c 541->567 560 248a7f0-248a802 542->560 561 248a815-248a872 call 248a470 542->561 548 248a87b 543->548 549 248a80c-248a810 543->549 553 248a880 548->553 549->515 553->521 560->542 560->543 561->553 566->468 570 248a9f0-248a9f5 call 248c6a8 567->570 571 248a686-248a9ef call 24892ac call 248aff4 call 24894a0 567->571 570->510 571->570
                          APIs
                          • __FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 0248A5A1
                            • Part of subcall function 0248B414: __GetUnwindTryBlock.LIBCMT ref: 0248B457
                            • Part of subcall function 0248B414: __SetUnwindTryBlock.LIBVCRUNTIME ref: 0248B47C
                          • Is_bad_exception_allowed.LIBVCRUNTIME ref: 0248A679
                          • __FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 0248A8CE
                          • std::bad_alloc::bad_alloc.LIBCMT ref: 0248A9DA
                          Strings
                          Memory Dump Source
                          • Source File: 0000000A.00000002.373001997.0000000002480000.00000040.00001000.00020000.00000000.sdmp, Offset: 02480000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_10_2_2480000_WerFault.jbxd
                          Similarity
                          • API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
                          • String ID: csm$csm$csm
                          • API String ID: 849930591-393685449
                          • Opcode ID: 147a5c394ba4e007c258850d6061d542d969719de9d23a8e277659d08661d77f
                          • Instruction ID: f8b6bcaf688e4500a8c73d6e32e88d9739d8a61d11ec215bf0b112a6a3e9378a
                          • Opcode Fuzzy Hash: 147a5c394ba4e007c258850d6061d542d969719de9d23a8e277659d08661d77f
                          • Instruction Fuzzy Hash: BBD1C172624B908ADB20EF6AD4803AE77B1F745B98F14051BDF8967B18CF78D191CB41
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 0248104C Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 99memoryregistryCOMMON
                          Download Yara Rule
                          APIs
                          Strings
                          Memory Dump Source
                          • Source File: 0000000A.00000002.373001997.0000000002480000.00000040.00001000.00020000.00000000.sdmp, Offset: 02480000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_10_2_2480000_WerFault.jbxd
                          Similarity
                          • API ID: Heap$Process$AllocEnumFreeInfoQueryValue
                          • String ID: d
                          • API String ID: 3743429067-2564639436
                          • Opcode ID: 0cc5ceb7d92555702a84a43de404567f212e32e90d8a90c8922560dee2c01182
                          • Instruction ID: 174cb0bcee65513e55c6e709ecfae1b178f12378d2b5abf7c1f9183266a942c6
                          • Opcode Fuzzy Hash: 0cc5ceb7d92555702a84a43de404567f212e32e90d8a90c8922560dee2c01182
                          • Instruction Fuzzy Hash: 93416D73614B84C6E761DF21E4447AF77A5F389B98F44812ADA8E07B18DF38C589CB40
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 0248D068 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 54COMMONLIBRARYCODE
                          Download Yara Rule
                          APIs
                          • FlsGetValue.KERNEL32(?,?,?,0248C7DE,?,?,?,?,?,?,?,?,0248CF9D,?,?,00000001), ref: 0248D087
                          • FlsSetValue.KERNEL32(?,?,?,0248C7DE,?,?,?,?,?,?,?,?,0248CF9D,?,?,00000001), ref: 0248D0A6
                          • FlsSetValue.KERNEL32(?,?,?,0248C7DE,?,?,?,?,?,?,?,?,0248CF9D,?,?,00000001), ref: 0248D0CE
                          • FlsSetValue.KERNEL32(?,?,?,0248C7DE,?,?,?,?,?,?,?,?,0248CF9D,?,?,00000001), ref: 0248D0DF
                          • FlsSetValue.KERNEL32(?,?,?,0248C7DE,?,?,?,?,?,?,?,?,0248CF9D,?,?,00000001), ref: 0248D0F0
                          Strings
                          Memory Dump Source
                          • Source File: 0000000A.00000002.373001997.0000000002480000.00000040.00001000.00020000.00000000.sdmp, Offset: 02480000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_10_2_2480000_WerFault.jbxd
                          Similarity
                          • API ID: Value
                          • String ID: 1%$Y%
                          • API String ID: 3702945584-1395475152
                          • Opcode ID: eaed261e9eff258ccad1ac5f7a99306e4284ed666e6615725d2dc279c7a103a4
                          • Instruction ID: 3603d21c860cc9b9d2af6cd8e63eac9bdbbe0a8a5a52a66e716b5dab2670f3d7
                          • Opcode Fuzzy Hash: eaed261e9eff258ccad1ac5f7a99306e4284ed666e6615725d2dc279c7a103a4
                          • Instruction Fuzzy Hash: 12117320B2664481EA29B737A95533E62435F897F4F58532B983E67BE8DF68C4438E01
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 02487510 Relevance: 12.2, APIs: 8, Instructions: 230COMMON
                          Download Yara Rule
                          APIs
                          • __scrt_dllmain_crt_thread_attach.LIBCMT ref: 02487538
                          • __scrt_acquire_startup_lock.LIBCMT ref: 0248758A
                          • _RTC_Initialize.LIBCMT ref: 024875B8
                          • __scrt_dllmain_after_initialize_c.LIBCMT ref: 024875DE
                          • __scrt_release_startup_lock.LIBCMT ref: 02487609
                          Memory Dump Source
                          • Source File: 0000000A.00000002.373001997.0000000002480000.00000040.00001000.00020000.00000000.sdmp, Offset: 02480000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_10_2_2480000_WerFault.jbxd
                          Similarity
                          • API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
                          • String ID:
                          • API String ID: 190073905-0
                          • Opcode ID: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
                          • Instruction ID: 871bd73798efcd4a0dbb53d1c7867f4779fe5be3806c5388c3b86c11938f2919
                          • Opcode Fuzzy Hash: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
                          • Instruction Fuzzy Hash: 6C71082973074186EB10FF6AA87036EE792FB85BD4F74842BCA0957755EB78C485CB10
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 02493DB4 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON
                          Download Yara Rule
                          APIs
                          Strings
                          Memory Dump Source
                          • Source File: 0000000A.00000002.373001997.0000000002480000.00000040.00001000.00020000.00000000.sdmp, Offset: 02480000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_10_2_2480000_WerFault.jbxd
                          Similarity
                          • API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
                          • String ID: CONOUT$
                          • API String ID: 3230265001-3130406586
                          • Opcode ID: ea8503a65e9befc0d33d9332805196394b6329e0df61646a9863ad39bb9ae76f
                          • Instruction ID: 24cc721ef19b52f963d0575df1dc974bffaf5bd3b939d24673c87fc1635f2f7b
                          • Opcode Fuzzy Hash: ea8503a65e9befc0d33d9332805196394b6329e0df61646a9863ad39bb9ae76f
                          • Instruction Fuzzy Hash: 4A119131710B4086EB508F52E84831A77A8F788FE4F044225EE5E877A4CF38C454CB44
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 02483790 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 44COMMON
                          Download Yara Rule
                          APIs
                          Strings
                          Memory Dump Source
                          • Source File: 0000000A.00000002.373001997.0000000002480000.00000040.00001000.00020000.00000000.sdmp, Offset: 02480000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_10_2_2480000_WerFault.jbxd
                          Similarity
                          • API ID: CurrentProcessProtectVirtual$HandleModule
                          • String ID: wr
                          • API String ID: 1092925422-2678910430
                          • Opcode ID: d5ed198cecc284837a9554765ab7ffb778fa62629811cf0fe5ebc999f83bf42b
                          • Instruction ID: 9223ebac4d10ac8d30bb4acd88894a44c5e4f5fffc5568296cbe6ad7dd0ff1a8
                          • Opcode Fuzzy Hash: d5ed198cecc284837a9554765ab7ffb778fa62629811cf0fe5ebc999f83bf42b
                          • Instruction Fuzzy Hash: A001692A714B8182EF149F25F40876A76B4FB88F85F454029DE8907B64EF3DC545CB04
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 02485B30 Relevance: 9.2, APIs: 6, Instructions: 240threadCOMMON
                          Download Yara Rule
                          APIs
                          • GetCurrentThreadId.KERNEL32 ref: 02485B6B
                          • GetThreadContext.KERNEL32 ref: 02485CD5
                            • Part of subcall function 02485960: GetCurrentThreadId.KERNEL32 ref: 02485964
                          Memory Dump Source
                          • Source File: 0000000A.00000002.373001997.0000000002480000.00000040.00001000.00020000.00000000.sdmp, Offset: 02480000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_10_2_2480000_WerFault.jbxd
                          Similarity
                          • API ID: Thread$Current$Context
                          • String ID:
                          • API String ID: 1666949209-0
                          • Opcode ID: 542e600666cb1ac52823d1f72aa5ca11f47e3ee1f4dc73a6c07a176fbafbfe1c
                          • Instruction ID: e29ccf0c6840d351fbac02dcf7c9e6d47303a2181a961e891e294ab07cc14147
                          • Opcode Fuzzy Hash: 542e600666cb1ac52823d1f72aa5ca11f47e3ee1f4dc73a6c07a176fbafbfe1c
                          • Instruction Fuzzy Hash: B2C18776219B8882DB30EB0AE49435EB7A1F388B88F514116EACE47B68DF7CC541CF10
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 02482F04 Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 93memoryCOMMON
                          Download Yara Rule
                          APIs
                          Strings
                          Memory Dump Source
                          • Source File: 0000000A.00000002.373001997.0000000002480000.00000040.00001000.00020000.00000000.sdmp, Offset: 02480000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_10_2_2480000_WerFault.jbxd
                          Similarity
                          • API ID: Heap$Process$AllocFree
                          • String ID: dialer
                          • API String ID: 756756679-3528709123
                          • Opcode ID: 2e24de9146afbba5105044d4fd5602f1f9f0ed558a5ed62472976580c3eaf0ad
                          • Instruction ID: 95d54da14fe197dab6407347fee81aeff84e8504a8c889bcd8656524279fbd2d
                          • Opcode Fuzzy Hash: 2e24de9146afbba5105044d4fd5602f1f9f0ed558a5ed62472976580c3eaf0ad
                          • Instruction Fuzzy Hash: C631A232B11B9583DB15EF16E54472F6761FB44B88F084126DF4947B29EF78C4A1DB00
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 0248CFA0 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE
                          Download Yara Rule
                          APIs
                          • GetLastError.KERNEL32 ref: 0248CFAF
                          • FlsSetValue.KERNEL32(?,?,?,0248D6B5,?,?,?,?,0248D778), ref: 0248CFE5
                          • FlsSetValue.KERNEL32(?,?,?,0248D6B5,?,?,?,?,0248D778), ref: 0248D012
                          • FlsSetValue.KERNEL32(?,?,?,0248D6B5,?,?,?,?,0248D778), ref: 0248D023
                          • FlsSetValue.KERNEL32(?,?,?,0248D6B5,?,?,?,?,0248D778), ref: 0248D034
                          • SetLastError.KERNEL32 ref: 0248D04F
                          Memory Dump Source
                          • Source File: 0000000A.00000002.373001997.0000000002480000.00000040.00001000.00020000.00000000.sdmp, Offset: 02480000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_10_2_2480000_WerFault.jbxd
                          Similarity
                          • API ID: Value$ErrorLast
                          • String ID:
                          • API String ID: 2506987500-0
                          • Opcode ID: 4f148fb448054b99fdb5313590ff83f86fc6d8762bc770a772f95ba4b575ef67
                          • Instruction ID: 00c16467b57455a7736fd7ed37c1dfa8e9114c3e191c9c3e2704b1facf8855ab
                          • Opcode Fuzzy Hash: 4f148fb448054b99fdb5313590ff83f86fc6d8762bc770a772f95ba4b575ef67
                          • Instruction Fuzzy Hash: C711C820765640C1EA19B736959433E22436F85BF4F14072BDD3B67BE5DE68C442CF00
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 0248199C Relevance: 9.0, APIs: 6, Instructions: 42stringCOMMON
                          Download Yara Rule
                          APIs
                          Memory Dump Source
                          • Source File: 0000000A.00000002.373001997.0000000002480000.00000040.00001000.00020000.00000000.sdmp, Offset: 02480000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_10_2_2480000_WerFault.jbxd
                          Similarity
                          • API ID: FileName$CloseFindHandleModuleOpenPathProcesslstrlen
                          • String ID:
                          • API String ID: 517849248-0
                          • Opcode ID: 01214db588610ff501214a343c1506f8e4016efad0e64bbd234dc336c45f59d3
                          • Instruction ID: 6f69d1769499edcdb4eff4e28be132062ad7d66e923195deb34fe32d3acb1776
                          • Opcode Fuzzy Hash: 01214db588610ff501214a343c1506f8e4016efad0e64bbd234dc336c45f59d3
                          • Instruction Fuzzy Hash: 88015A71710A8082EB24DB52F89875A63A9F788FC4F894036DE9E53765DF3CC58ACB50
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 024836C8 Relevance: 9.0, APIs: 6, Instructions: 38threadCOMMON
                          Download Yara Rule
                          APIs
                          Memory Dump Source
                          • Source File: 0000000A.00000002.373001997.0000000002480000.00000040.00001000.00020000.00000000.sdmp, Offset: 02480000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_10_2_2480000_WerFault.jbxd
                          Similarity
                          • API ID: CurrentProcessProtectVirtual$HandleModuleTerminateThread
                          • String ID:
                          • API String ID: 449555515-0
                          • Opcode ID: 33edae7e4393505c590e6bdf894c2b6337bb17a10dfae21a600636dc78c73843
                          • Instruction ID: 63a0d75e533adb16fa603c6ad229181543c197cf129fdfdfffaaf1f2b18ee232
                          • Opcode Fuzzy Hash: 33edae7e4393505c590e6bdf894c2b6337bb17a10dfae21a600636dc78c73843
                          • Instruction Fuzzy Hash: 58014865722B4082EF24EB22E84D71A77A4BB49B86F04442ACE4D07764EF7DC148CB00
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 02488FE8 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 144COMMON
                          Download Yara Rule
                          APIs
                          • __except_validate_context_record.LIBVCRUNTIME ref: 02489013
                          • _IsNonwritableInCurrentImage.LIBCMT ref: 024890A8
                          • RtlUnwindEx.NTDLL ref: 024890F7
                          Strings
                          Memory Dump Source
                          • Source File: 0000000A.00000002.373001997.0000000002480000.00000040.00001000.00020000.00000000.sdmp, Offset: 02480000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_10_2_2480000_WerFault.jbxd
                          Similarity
                          • API ID: CurrentImageNonwritableUnwind__except_validate_context_record
                          • String ID: csm$f
                          • API String ID: 2395640692-629598281
                          • Opcode ID: cf88226c4e0499e864df13b9fa0a288c301b8b6e63eb257c90d52d35e879efeb
                          • Instruction ID: de3dcc5e5782cab4eb9a7637c21c4c77d234c404921fd3ab53e0e24f9655f42c
                          • Opcode Fuzzy Hash: cf88226c4e0499e864df13b9fa0a288c301b8b6e63eb257c90d52d35e879efeb
                          • Instruction Fuzzy Hash: 36511432725A009BDB16EF25E848B3E37A6F344BD8F558526DE5747708EB75C881CB00
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 02483044 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 27COMMON
                          Download Yara Rule
                          APIs
                          Strings
                          Memory Dump Source
                          • Source File: 0000000A.00000002.373001997.0000000002480000.00000040.00001000.00020000.00000000.sdmp, Offset: 02480000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_10_2_2480000_WerFault.jbxd
                          Similarity
                          • API ID: CombinePath
                          • String ID: \\.\pipe\
                          • API String ID: 3422762182-91387939
                          • Opcode ID: 8c685e1f0b85bfe06f91eeefbd03c12bff8419d51c8b157116edbf6ca1c9c829
                          • Instruction ID: 98a4a1ade69910bcc4c98392ef2fc8b97289f376097ac98624ae57ecafe4476b
                          • Opcode Fuzzy Hash: 8c685e1f0b85bfe06f91eeefbd03c12bff8419d51c8b157116edbf6ca1c9c829
                          • Instruction Fuzzy Hash: AFF0A020B14B8482EA109F13B90831B6764BB48FC0F098131EE5A07B18DF7CC0C5CB00
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 0248BC98 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON
                          Download Yara Rule
                          APIs
                          Strings
                          Memory Dump Source
                          • Source File: 0000000A.00000002.373001997.0000000002480000.00000040.00001000.00020000.00000000.sdmp, Offset: 02480000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_10_2_2480000_WerFault.jbxd
                          Similarity
                          • API ID: AddressFreeHandleLibraryModuleProc
                          • String ID: CorExitProcess$mscoree.dll
                          • API String ID: 4061214504-1276376045
                          • Opcode ID: 95c54818ea39ae4ab476006ce308989d1f654d2f667890579c20066112978b6c
                          • Instruction ID: ee5d23a2073898a975fb59bd6a47872490f6f3399c75ee0d4e5fa812bef720a1
                          • Opcode Fuzzy Hash: 95c54818ea39ae4ab476006ce308989d1f654d2f667890579c20066112978b6c
                          • Instruction Fuzzy Hash: C7F03061321B0581EB149F24E84936B6324EB89BB9F55021ADA6A462F4DF7CC189C740
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 024850D0 Relevance: 7.8, APIs: 5, Instructions: 318threadCOMMON
                          Download Yara Rule
                          APIs
                          • GetCurrentThreadId.KERNEL32 ref: 02485156
                          Memory Dump Source
                          • Source File: 0000000A.00000002.373001997.0000000002480000.00000040.00001000.00020000.00000000.sdmp, Offset: 02480000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_10_2_2480000_WerFault.jbxd
                          Similarity
                          • API ID: CurrentThread
                          • String ID:
                          • API String ID: 2882836952-0
                          • Opcode ID: e13ad259af2044a9722e5c88be2fea28068701e2040856c8b7ebe2328a6e9181
                          • Instruction ID: f29fe0770f5e3ab4a3dc87fb84e6debc65775f53dc4954c7f371630d711f34b6
                          • Opcode Fuzzy Hash: e13ad259af2044a9722e5c88be2fea28068701e2040856c8b7ebe2328a6e9181
                          • Instruction Fuzzy Hash: BCF1C736629B8486DB60DB5AF49435EB7A1F3C4B94F51401AEA8E87B68DF7CC484CF01
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 02485710 Relevance: 7.6, APIs: 5, Instructions: 124threadCOMMON
                          Download Yara Rule
                          APIs
                          • GetCurrentThreadId.KERNEL32 ref: 02485726
                          Memory Dump Source
                          • Source File: 0000000A.00000002.373001997.0000000002480000.00000040.00001000.00020000.00000000.sdmp, Offset: 02480000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_10_2_2480000_WerFault.jbxd
                          Similarity
                          • API ID: CurrentThread
                          • String ID:
                          • API String ID: 2882836952-0
                          • Opcode ID: b02f694671304b5a077fe24bce3094f0c3b02718cee177a37b7a7da192a85efa
                          • Instruction ID: 3fd0e4b08d82145f8358be4917755b834ed9358236a4b8b14b3d21d095da3e4b
                          • Opcode Fuzzy Hash: b02f694671304b5a077fe24bce3094f0c3b02718cee177a37b7a7da192a85efa
                          • Instruction Fuzzy Hash: 8C51E936629B84C6DB60DB16E49431EB7A1F388794F91411BEA8E87B68DB7CC490CF01
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 02494104 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE
                          Download Yara Rule
                          APIs
                          Memory Dump Source
                          • Source File: 0000000A.00000002.373001997.0000000002480000.00000040.00001000.00020000.00000000.sdmp, Offset: 02480000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_10_2_2480000_WerFault.jbxd
                          Similarity
                          • API ID: _set_statfp
                          • String ID:
                          • API String ID: 1156100317-0
                          • Opcode ID: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
                          • Instruction ID: de0483c0198edaf80b267b9c357064f152f44d34942bbc42d06ab5687717d09d
                          • Opcode Fuzzy Hash: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
                          • Instruction Fuzzy Hash: 1801DF36A20F9112EF2A5669D56F3661D016BA83FCF08073BD977277D5CB24C4438E00
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 02489650 Relevance: 7.6, APIs: 5, Instructions: 53COMMONLIBRARYCODE
                          Download Yara Rule
                          APIs
                          Memory Dump Source
                          • Source File: 0000000A.00000002.373001997.0000000002480000.00000040.00001000.00020000.00000000.sdmp, Offset: 02480000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_10_2_2480000_WerFault.jbxd
                          Similarity
                          • API ID: ErrorLast
                          • String ID:
                          • API String ID: 1452528299-0
                          • Opcode ID: 46c896f13dff0714c7ccebb8ca9383bb675cc38bcf091c92c481f4a556b8b138
                          • Instruction ID: 5ded9faa93d3bba8bb76027be3566ea43b2554e671cf6f7554b7b41108d4dafb
                          • Opcode Fuzzy Hash: 46c896f13dff0714c7ccebb8ca9383bb675cc38bcf091c92c481f4a556b8b138
                          • Instruction Fuzzy Hash: D8113734725AC142EE14BB26A88473E32566B48FE4F18462ADD6E377D9DF3CD442CB10
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 0248AA1C Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 147COMMON
                          Download Yara Rule
                          APIs
                          • EncodePointer.KERNEL32 ref: 0248AA68
                          • _CallSETranslator.LIBVCRUNTIME ref: 0248AAB7
                          Strings
                          Memory Dump Source
                          • Source File: 0000000A.00000002.373001997.0000000002480000.00000040.00001000.00020000.00000000.sdmp, Offset: 02480000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_10_2_2480000_WerFault.jbxd
                          Similarity
                          • API ID: CallEncodePointerTranslator
                          • String ID: MOC$RCC
                          • API String ID: 3544855599-2084237596
                          • Opcode ID: afa423ce38c0d5e6a55dfbc7a81328fa63e7332d8ee03f3f3ca57a2373e92492
                          • Instruction ID: fd556b35dc58cbce257da66ddcb362676cca9a6d949fcf5a3a77c93eb796c5bb
                          • Opcode Fuzzy Hash: afa423ce38c0d5e6a55dfbc7a81328fa63e7332d8ee03f3f3ca57a2373e92492
                          • Instruction Fuzzy Hash: 31515A33A15B948AEB20EF66D4807AE77A1F748B8CF045217DF4A17B58DBB8D195C700
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 0248AD78 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMON
                          Download Yara Rule
                          APIs
                          • __except_validate_context_record.LIBVCRUNTIME ref: 0248ADA0
                          • __FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 0248AE88
                          Strings
                          Memory Dump Source
                          • Source File: 0000000A.00000002.373001997.0000000002480000.00000040.00001000.00020000.00000000.sdmp, Offset: 02480000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_10_2_2480000_WerFault.jbxd
                          Similarity
                          • API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
                          • String ID: csm$csm
                          • API String ID: 3896166516-3733052814
                          • Opcode ID: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
                          • Instruction ID: 7ebbfc790b960962f9726ccec58727f1c12729dc67f100ffd15e5542dff36a41
                          • Opcode Fuzzy Hash: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
                          • Instruction Fuzzy Hash: 6751A573220790CACB34AF26D58436E77A1F754B99F18521BDF9A87B54CBB8D091CB01
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 02492058 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON
                          Download Yara Rule
                          APIs
                          Memory Dump Source
                          • Source File: 0000000A.00000002.373001997.0000000002480000.00000040.00001000.00020000.00000000.sdmp, Offset: 02480000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_10_2_2480000_WerFault.jbxd
                          Similarity
                          • API ID: FileWrite$ConsoleErrorLastOutput
                          • String ID:
                          • API String ID: 2718003287-0
                          • Opcode ID: d9b1ad1a373a674d1985cb33d71231f2b71aece2c14fe5b700ae80922c385091
                          • Instruction ID: 1fa686db1fdc283d332ad0f0accaaf2f7fe5986d592c750195d28f57a58fecda
                          • Opcode Fuzzy Hash: d9b1ad1a373a674d1985cb33d71231f2b71aece2c14fe5b700ae80922c385091
                          • Instruction Fuzzy Hash: 89C10332B14B80AAEB11CFB9D4403AD3BB6F745BD8B148216CE5E97B98DB74C156CB40
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 02492980 Relevance: 6.2, APIs: 4, Instructions: 218COMMON
                          Download Yara Rule
                          APIs
                          Memory Dump Source
                          • Source File: 0000000A.00000002.373001997.0000000002480000.00000040.00001000.00020000.00000000.sdmp, Offset: 02480000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_10_2_2480000_WerFault.jbxd
                          Similarity
                          • API ID: ConsoleErrorLastMode
                          • String ID:
                          • API String ID: 953036326-0
                          • Opcode ID: c5ecde4312ccfa2e1ed1a2c608d038f857b097ec6549ceb78086129b2e572a94
                          • Instruction ID: 214857bbc77a152c2b0fd0a79a787337287be039389b488df4184238fe58a3ab
                          • Opcode Fuzzy Hash: c5ecde4312ccfa2e1ed1a2c608d038f857b097ec6549ceb78086129b2e572a94
                          • Instruction Fuzzy Hash: E881D072B10A54A9EF20DF7AD8847AE3FA5F745B98F14410BDE0A67B58DBB4C486C700
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 02487960 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMONLIBRARYCODE
                          Download Yara Rule
                          APIs
                          • GetSystemTimeAsFileTime.KERNEL32 ref: 0248798C
                          • GetCurrentThreadId.KERNEL32 ref: 0248799A
                          • GetCurrentProcessId.KERNEL32 ref: 024879A6
                          • QueryPerformanceCounter.KERNEL32 ref: 024879B6
                          Memory Dump Source
                          • Source File: 0000000A.00000002.373001997.0000000002480000.00000040.00001000.00020000.00000000.sdmp, Offset: 02480000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_10_2_2480000_WerFault.jbxd
                          Similarity
                          • API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
                          • String ID:
                          • API String ID: 2933794660-0
                          • Opcode ID: 561ac6f4885ef0f33bff27beb4ddb95e6a253367b5c72fac45fcb4617ca9122b
                          • Instruction ID: bfa6d32233b63f939337b549738b82e3d762b74662ba2aeea1ee9a77095288da
                          • Opcode Fuzzy Hash: 561ac6f4885ef0f33bff27beb4ddb95e6a253367b5c72fac45fcb4617ca9122b
                          • Instruction Fuzzy Hash: 5E115E26B55F018AEF00CF60E8593A933A4F719758F440E25DE6D46BA4DF78C1988780
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 0248253C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 185COMMON
                          Download Yara Rule
                          APIs
                          Strings
                          Memory Dump Source
                          • Source File: 0000000A.00000002.373001997.0000000002480000.00000040.00001000.00020000.00000000.sdmp, Offset: 02480000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_10_2_2480000_WerFault.jbxd
                          Similarity
                          • API ID: FileType
                          • String ID: \\.\pipe\
                          • API String ID: 3081899298-91387939
                          • Opcode ID: 41f2590248caa42fa42cbc4740ff50b79ee080d5b4a351d521f36d41c2820f1b
                          • Instruction ID: ed3170b1f7534129bf88b38be5a53d35f84645ede89578442e7920bbc8c9c054
                          • Opcode Fuzzy Hash: 41f2590248caa42fa42cbc4740ff50b79ee080d5b4a351d521f36d41c2820f1b
                          • Instruction Fuzzy Hash: A0618336620BC186C725EF27E8543AE6795F389B88F45002BDE4A57B18DFB5C645CB00
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 024926F0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON
                          Download Yara Rule
                          APIs
                          Strings
                          Memory Dump Source
                          • Source File: 0000000A.00000002.373001997.0000000002480000.00000040.00001000.00020000.00000000.sdmp, Offset: 02480000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_10_2_2480000_WerFault.jbxd
                          Similarity
                          • API ID: ErrorFileLastWrite
                          • String ID: U
                          • API String ID: 442123175-4171548499
                          • Opcode ID: 94e3e9b2e49fb54f8b51ea0afa049cb5a9b4caf00c445db25a5723c425a58a56
                          • Instruction ID: eb5727ec9660eb69ef2e2917f13a6ab0823a1b0654a19acf7e36dbdb574bc4ff
                          • Opcode Fuzzy Hash: 94e3e9b2e49fb54f8b51ea0afa049cb5a9b4caf00c445db25a5723c425a58a56
                          • Instruction Fuzzy Hash: B631E832725B8096DB20DF25E8443AABBA1F7887D4F514126EE4D87B58EF7DC541CB40
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 024894A0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMONLIBRARYCODE
                          Download Yara Rule
                          APIs
                          Strings
                          Memory Dump Source
                          • Source File: 0000000A.00000002.373001997.0000000002480000.00000040.00001000.00020000.00000000.sdmp, Offset: 02480000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_10_2_2480000_WerFault.jbxd
                          Similarity
                          • API ID: ExceptionFileHeaderRaise
                          • String ID: csm
                          • API String ID: 2573137834-1018135373
                          • Opcode ID: 596d8aa0106168f831d5a6617a756b303fb26e5894bac8705379b132699e985d
                          • Instruction ID: fceb0a4d045d6c32fbda97b23248946f892b88dad2809a71cd288c6522a22003
                          • Opcode Fuzzy Hash: 596d8aa0106168f831d5a6617a756b303fb26e5894bac8705379b132699e985d
                          • Instruction Fuzzy Hash: 05110A36218B8092DB219F15F44435AB7E5FB88B98F594225EE8D07B29DF3CC551CB00
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 02481BF4 Relevance: 5.1, APIs: 4, Instructions: 52memoryCOMMON
                          Download Yara Rule
                          APIs
                          • GetProcessHeap.KERNEL32 ref: 02481C2D
                          • HeapAlloc.KERNEL32 ref: 02481C3B
                          • GetProcessHeap.KERNEL32 ref: 02481C77
                          • HeapFree.KERNEL32 ref: 02481C85
                            • Part of subcall function 0248152C: StrCmpIW.SHLWAPI ref: 0248155D
                          Memory Dump Source
                          • Source File: 0000000A.00000002.373001997.0000000002480000.00000040.00001000.00020000.00000000.sdmp, Offset: 02480000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_10_2_2480000_WerFault.jbxd
                          Similarity
                          • API ID: Heap$Process$AllocFree
                          • String ID:
                          • API String ID: 756756679-0
                          • Opcode ID: e6b128499454e36a5cfdb4ce6de946333e896a2fc86765bea62df52d9c8f7d1a
                          • Instruction ID: 42372ac4a5aad705c821fd1931833f0f95d1fd4cfbb9eb7f915a827e509f66bb
                          • Opcode Fuzzy Hash: e6b128499454e36a5cfdb4ce6de946333e896a2fc86765bea62df52d9c8f7d1a
                          • Instruction Fuzzy Hash: D6117025A11B4481EB05EF6AA80932E77A5FB89FC4F59402ADF4D97735DF78C482D700
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 02481268 Relevance: 5.0, APIs: 4, Instructions: 21memoryCOMMON
                          Download Yara Rule
                          APIs
                          Memory Dump Source
                          • Source File: 0000000A.00000002.373001997.0000000002480000.00000040.00001000.00020000.00000000.sdmp, Offset: 02480000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_10_2_2480000_WerFault.jbxd
                          Similarity
                          • API ID: Heap$AllocProcess
                          • String ID:
                          • API String ID: 1617791916-0
                          • Opcode ID: c7b0d7b4e65e150846e46a28cdf479c2d04166a2b9ed3272f310b0e97a34ba1d
                          • Instruction ID: d14c54807eb0d05a680db9611162e577ee9eed254d572ea11cc37c25f3d2e02c
                          • Opcode Fuzzy Hash: c7b0d7b4e65e150846e46a28cdf479c2d04166a2b9ed3272f310b0e97a34ba1d
                          • Instruction Fuzzy Hash: 59E09A35A01A0486EB098F62D80D34B36E5FB8DF4AF0AC024C90907361DF7D88D9CB90
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 02481000 Relevance: 5.0, APIs: 4, Instructions: 20memoryCOMMON
                          Download Yara Rule
                          APIs
                          Memory Dump Source
                          • Source File: 0000000A.00000002.373001997.0000000002480000.00000040.00001000.00020000.00000000.sdmp, Offset: 02480000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_10_2_2480000_WerFault.jbxd
                          Similarity
                          • API ID: Heap$AllocProcess
                          • String ID:
                          • API String ID: 1617791916-0
                          • Opcode ID: 952b2c0fe5133ab7956e2ef84fe5bf2b2b692290a663e8cebccb5d827e1e35ea
                          • Instruction ID: f6c05156ee363711e6d3439019619fb93320db1ff87d5fc5a02702ba3d9753e9
                          • Opcode Fuzzy Hash: 952b2c0fe5133ab7956e2ef84fe5bf2b2b692290a663e8cebccb5d827e1e35ea
                          • Instruction Fuzzy Hash: 2DE01A75A11A0487EB0A9F62D80935B76E5FB8CF56F4A8024C90907325EE3C88D9CB20
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Execution Graph

                          Execution Coverage:1.9%
                          Dynamic/Decrypted Code Coverage:91.5%
                          Signature Coverage:0%
                          Total number of Nodes:71
                          Total number of Limit Nodes:18
                          execution_graph 14960 9828c8 14961 98290e 14960->14961 14962 982970 14961->14962 14964 983844 14961->14964 14965 983866 14964->14965 14966 983851 StrCmpNIW 14964->14966 14965->14961 14966->14965 14967 983ab9 14968 983a06 _invalid_parameter_noinfo 14967->14968 14969 983a56 VirtualQuery 14968->14969 14970 983a70 14968->14970 14971 983a8a VirtualAlloc 14968->14971 14969->14968 14969->14970 14971->14970 14972 983abb GetLastError 14971->14972 14972->14968 14972->14970 14973 98554d 14975 985554 14973->14975 14974 9855bb 14975->14974 14976 985637 VirtualProtect 14975->14976 14977 985671 14976->14977 14978 985663 GetLastError 14976->14978 14978->14977 14979 985cf0 14980 985cfd 14979->14980 14981 985d09 14980->14981 14987 985e1a 14980->14987 14982 985d3e 14981->14982 14983 985d8d 14981->14983 14984 985d66 SetThreadContext 14982->14984 14984->14983 14985 985efe 14988 985f1e 14985->14988 15001 9843e0 14985->15001 14986 985e41 VirtualProtect FlushInstructionCache 14986->14987 14987->14985 14987->14986 14997 984df0 GetCurrentProcess 14988->14997 14990 985f23 14992 985f77 14990->14992 14993 985f37 ResumeThread 14990->14993 15005 987940 14992->15005 14994 985f6b 14993->14994 14994->14990 14998 984e0c 14997->14998 14999 984e22 VirtualProtect FlushInstructionCache 14998->14999 15000 984e53 14998->15000 14999->14998 15000->14990 15003 9843fc 15001->15003 15002 98445f 15002->14988 15003->15002 15004 984412 VirtualFree 15003->15004 15004->15003 15006 987949 _invalid_parameter_noinfo 15005->15006 15007 985fbf 15006->15007 15012 988320 RtlCaptureContext 15006->15012 15009 988157 15014 9880f8 15009->15014 15013 98833a capture_previous_context 15012->15013 15013->15009 15015 988109 __raise_securityfailure 15014->15015 15016 988118 TerminateProcess 15015->15016 15017 95273c 15018 95276a 15017->15018 15019 9527c5 VirtualAlloc 15018->15019 15020 9528d4 15018->15020 15019->15020 15022 9527ec 15019->15022 15021 952858 LoadLibraryA 15021->15022 15022->15020 15022->15021 15023 98f394 15024 98f3f1 __vcrt_InitializeCriticalSectionEx 15023->15024 15026 98f3ec __vcrt_InitializeCriticalSectionEx 15023->15026 15025 98f421 LoadLibraryExW 15027 98f4f6 15025->15027 15028 98f446 GetLastError 15025->15028 15026->15024 15026->15025 15030 98f480 LoadLibraryExW 15026->15030 15027->15024 15029 98f50d FreeLibrary 15027->15029 15028->15026 15029->15024 15030->15026 15030->15027 15031 989dc4 15035 989ecd __vcrt_InitializeCriticalSectionEx 15031->15035 15036 989e08 __vcrt_InitializeCriticalSectionEx 15031->15036 15032 989e36 LoadLibraryExW 15033 989ead 15032->15033 15034 989e57 GetLastError 15032->15034 15033->15035 15037 989ec4 FreeLibrary 15033->15037 15034->15036 15036->15032 15036->15035 15038 989e79 LoadLibraryExW 15036->15038 15037->15035 15038->15033 15038->15036

                          Executed Functions

                          Function 00981628 Relevance: 50.9, APIs: 20, Strings: 9, Instructions: 157registrymemoryCOMMON
                          Download Yara Rule

                          Control-flow Graph

                          APIs
                          • GetProcessHeap.KERNEL32 ref: 00981633
                          • HeapAlloc.KERNEL32 ref: 00981642
                            • Part of subcall function 00981268: GetProcessHeap.KERNEL32 ref: 0098126E
                            • Part of subcall function 00981268: HeapAlloc.KERNEL32 ref: 0098127D
                            • Part of subcall function 00981268: GetProcessHeap.KERNEL32 ref: 00981297
                            • Part of subcall function 00981268: HeapAlloc.KERNEL32 ref: 009812A8
                            • Part of subcall function 00981000: GetProcessHeap.KERNEL32 ref: 00981006
                            • Part of subcall function 00981000: HeapAlloc.KERNEL32 ref: 00981015
                            • Part of subcall function 00981000: GetProcessHeap.KERNEL32 ref: 00981028
                            • Part of subcall function 00981000: HeapAlloc.KERNEL32 ref: 00981037
                          • RegOpenKeyExW.ADVAPI32 ref: 009816B2
                          • RegOpenKeyExW.ADVAPI32 ref: 009816DF
                          • RegCloseKey.ADVAPI32 ref: 009816F9
                          • RegOpenKeyExW.ADVAPI32 ref: 00981719
                          • RegCloseKey.ADVAPI32 ref: 00981734
                          • RegOpenKeyExW.ADVAPI32 ref: 00981754
                          • RegCloseKey.ADVAPI32 ref: 0098176F
                          • RegOpenKeyExW.ADVAPI32 ref: 0098178F
                          • RegCloseKey.ADVAPI32 ref: 009817AA
                          • RegOpenKeyExW.ADVAPI32 ref: 009817CA
                          • RegCloseKey.ADVAPI32 ref: 009817E5
                          • RegOpenKeyExW.ADVAPI32 ref: 00981805
                          • RegCloseKey.ADVAPI32 ref: 00981820
                          • RegOpenKeyExW.ADVAPI32 ref: 00981840
                          • RegCloseKey.ADVAPI32 ref: 0098185B
                          • RegOpenKeyExW.ADVAPI32 ref: 0098187B
                          • RegCloseKey.ADVAPI32 ref: 00981896
                          • RegCloseKey.ADVAPI32 ref: 009818A0
                            • Part of subcall function 009812BC: RegQueryInfoKeyW.ADVAPI32 ref: 00981319
                            • Part of subcall function 009812BC: GetProcessHeap.KERNEL32 ref: 00981327
                            • Part of subcall function 009812BC: HeapAlloc.KERNEL32 ref: 00981338
                            • Part of subcall function 009812BC: RegEnumValueW.ADVAPI32 ref: 00981397
                            • Part of subcall function 009812BC: GetProcessHeap.KERNEL32 ref: 009813DF
                            • Part of subcall function 009812BC: HeapAlloc.KERNEL32 ref: 009813ED
                            • Part of subcall function 009812BC: GetProcessHeap.KERNEL32 ref: 0098140A
                            • Part of subcall function 009812BC: HeapFree.KERNEL32 ref: 00981418
                            • Part of subcall function 009812BC: lstrlenW.KERNEL32 ref: 00981421
                            • Part of subcall function 009812BC: GetProcessHeap.KERNEL32 ref: 0098142F
                            • Part of subcall function 009812BC: HeapAlloc.KERNEL32 ref: 0098143D
                          Strings
                          Memory Dump Source
                          • Source File: 0000000C.00000002.606295374.0000000000980000.00000040.00000001.00020000.00000000.sdmp, Offset: 00980000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_12_2_980000_winlogon.jbxd
                          Similarity
                          • API ID: Heap$CloseOpenProcess$Alloc$EnumFreeInfoQueryValuelstrlen
                          • String ID: SOFTWARE\dialerconfig$paths$pid$process_names$service_names$startup$tcp_local$tcp_remote$udp
                          • API String ID: 2135414181-2879589442
                          • Opcode ID: 84d977f69669bb910c18c90d9c150143eff6fe6f95bc9245a9bd4b5f56132143
                          • Instruction ID: c82509e9acb43df186f02982eefe282d42185f7347b3616a2f14ea50f7d5ab69
                          • Opcode Fuzzy Hash: 84d977f69669bb910c18c90d9c150143eff6fe6f95bc9245a9bd4b5f56132143
                          • Instruction Fuzzy Hash: 2A71D936711A5186EB20AF7AE89175D3378FB88B88F401125DE4E97B29EF38C495C740
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 0098F394 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117libraryloaderCOMMON
                          Download Yara Rule

                          Control-flow Graph

                          • Executed
                          • Not Executed
                          control_flow_graph 51 98f394-98f3e6 52 98f3ec-98f3ef 51->52 53 98f4d7 51->53 54 98f3f9-98f3fc 52->54 55 98f3f1-98f3f4 52->55 56 98f4d9-98f4f5 53->56 57 98f4bc-98f4cf 54->57 58 98f402-98f411 54->58 55->56 57->53 59 98f421-98f440 LoadLibraryExW 58->59 60 98f413-98f416 58->60 61 98f4f6-98f50b 59->61 62 98f446-98f44f GetLastError 59->62 63 98f41c 60->63 64 98f516-98f525 call 996090 60->64 61->64 68 98f50d-98f510 FreeLibrary 61->68 65 98f451-98f468 call 98c928 62->65 66 98f496-98f4a0 62->66 69 98f4a8-98f4af 63->69 72 98f4b5 64->72 74 98f527-98f54e 64->74 65->66 75 98f46a-98f47e call 98c928 65->75 66->69 68->64 69->58 69->72 72->57 74->56 75->66 78 98f480-98f494 LoadLibraryExW 75->78 78->61 78->66
                          APIs
                          Strings
                          Memory Dump Source
                          • Source File: 0000000C.00000002.606295374.0000000000980000.00000040.00000001.00020000.00000000.sdmp, Offset: 00980000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_12_2_980000_winlogon.jbxd
                          Similarity
                          • API ID: AddressFreeLibraryProc
                          • String ID: api-ms-$ext-ms-
                          • API String ID: 3013587201-537541572
                          • Opcode ID: a0f3cb97d83f084b5c078ea606d329a918e0789490c159543aff3f4a2fa5ff9f
                          • Instruction ID: 75ddeb78369dc0b73a69a185a051b64259c02be0ac9043b38d9b39b33b608c92
                          • Opcode Fuzzy Hash: a0f3cb97d83f084b5c078ea606d329a918e0789490c159543aff3f4a2fa5ff9f
                          • Instruction Fuzzy Hash: D6412522311A1081EB16EF6AA8287567399FB8ABE0F19653ADD0E87765EF3CC445C350
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 00989DC4 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE
                          Download Yara Rule

                          Control-flow Graph

                          • Executed
                          • Not Executed
                          control_flow_graph 79 989dc4-989e02 80 989e08-989e0b 79->80 81 989ef3 79->81 82 989e11 80->82 83 989ef5-989f11 80->83 81->83 84 989e14 82->84 85 989e1a-989e29 84->85 86 989eeb 84->86 87 989e2b-989e2e 85->87 88 989e36-989e55 LoadLibraryExW 85->88 86->81 91 989ecd-989edc call 996090 87->91 92 989e34 87->92 89 989ead-989ec2 88->89 90 989e57-989e60 GetLastError 88->90 89->91 95 989ec4-989ec7 FreeLibrary 89->95 93 989e8f-989e99 90->93 94 989e62-989e77 call 98c928 90->94 91->86 101 989ede-989ee9 91->101 97 989ea1-989ea8 92->97 93->97 94->93 102 989e79-989e8d LoadLibraryExW 94->102 95->91 97->84 101->83 102->89 102->93
                          APIs
                          Strings
                          Memory Dump Source
                          • Source File: 0000000C.00000002.606295374.0000000000980000.00000040.00000001.00020000.00000000.sdmp, Offset: 00980000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_12_2_980000_winlogon.jbxd
                          Similarity
                          • API ID: Library$Load$AddressErrorFreeLastProc
                          • String ID: api-ms-
                          • API String ID: 2559590344-2084034818
                          • Opcode ID: 1bec38bed2a9dad19cb8167f1bbce1e92081cdd400658c61ccc26499447e47b7
                          • Instruction ID: d59adf91c6b730eb860e20485fc3413cba0435db7f150e88b605c6d4ab96896d
                          • Opcode Fuzzy Hash: 1bec38bed2a9dad19cb8167f1bbce1e92081cdd400658c61ccc26499447e47b7
                          • Instruction Fuzzy Hash: E0310522312B40E1DF22EB46A840B756798FB88BA0F5D4A29DD6E4B753EF39C495C310
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 00983790 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 44COMMON
                          Download Yara Rule

                          Control-flow Graph

                          • Executed
                          • Not Executed
                          control_flow_graph 103 983790-9837aa GetModuleHandleW 104 9837b0-9837c0 103->104 105 983835-983841 103->105 106 9837cc-9837f6 call 996038 VirtualProtectEx 104->106 107 9837c2-9837ca 104->107 106->105 110 9837f8-983830 call 996038 VirtualProtectEx 106->110 107->105 107->106 110->105
                          APIs
                          Strings
                          Memory Dump Source
                          • Source File: 0000000C.00000002.606295374.0000000000980000.00000040.00000001.00020000.00000000.sdmp, Offset: 00980000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_12_2_980000_winlogon.jbxd
                          Similarity
                          • API ID: CurrentProcessProtectVirtual$HandleModule
                          • String ID: wr
                          • API String ID: 1092925422-2678910430
                          • Opcode ID: d5ed198cecc284837a9554765ab7ffb778fa62629811cf0fe5ebc999f83bf42b
                          • Instruction ID: cfdb0f9a854990306eed00ae9d75fbb4a71bb40274fc7a12ce7782ade1650e12
                          • Opcode Fuzzy Hash: d5ed198cecc284837a9554765ab7ffb778fa62629811cf0fe5ebc999f83bf42b
                          • Instruction Fuzzy Hash: 8101692A704B8182EF24AB26F40876972B4FB88F85F44402DEE8907B65EF3DC605C704
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 00985B30 Relevance: 9.2, APIs: 6, Instructions: 240threadCOMMON
                          Download Yara Rule

                          Control-flow Graph

                          • Executed
                          • Not Executed
                          control_flow_graph 113 985b30-985b57 114 985b59-985b68 113->114 115 985b6b-985b76 GetCurrentThreadId 113->115 114->115 116 985b78-985b7d 115->116 117 985b82-985b89 115->117 118 985faf-985fc6 call 987940 116->118 119 985b9b-985baf 117->119 120 985b8b-985b96 call 985960 117->120 123 985bbe-985bc4 119->123 120->118 126 985bca-985bd3 123->126 127 985c95-985cb6 123->127 129 985c1a-985c8d call 984510 call 9844b0 call 984470 126->129 130 985bd5-985c18 call 9885c0 126->130 133 985cbc-985cdc GetThreadContext 127->133 134 985e1f-985e30 call 9874bf 127->134 141 985c90 129->141 130->141 138 985e1a 133->138 139 985ce2-985d03 133->139 144 985e35-985e3b 134->144 138->134 139->138 147 985d09-985d12 139->147 141->123 150 985efe-985f0e 144->150 151 985e41-985e98 VirtualProtect FlushInstructionCache 144->151 148 985d92-985da3 147->148 149 985d14-985d25 147->149 157 985e15 148->157 158 985da5-985dc3 148->158 153 985d8d 149->153 154 985d27-985d3c 149->154 160 985f1e-985f2a call 984df0 150->160 161 985f10-985f17 150->161 155 985ec9-985ef9 call 9878ac 151->155 156 985e9a-985ea4 151->156 153->157 154->153 163 985d3e-985d88 call 983970 SetThreadContext 154->163 155->144 156->155 164 985ea6-985ec1 call 984390 156->164 158->157 165 985dc5-985e10 call 983900 call 9874dd 158->165 174 985f2f-985f35 160->174 161->160 167 985f19 call 9843e0 161->167 163->153 164->155 165->157 167->160 178 985f77-985f95 174->178 179 985f37-985f75 ResumeThread call 9878ac 174->179 182 985fa9 178->182 183 985f97-985fa6 178->183 179->174 182->118 183->182
                          APIs
                          • GetCurrentThreadId.KERNEL32 ref: 00985B6B
                          • GetThreadContext.KERNEL32 ref: 00985CD5
                            • Part of subcall function 00985960: GetCurrentThreadId.KERNEL32 ref: 00985964
                          Memory Dump Source
                          • Source File: 0000000C.00000002.606295374.0000000000980000.00000040.00000001.00020000.00000000.sdmp, Offset: 00980000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_12_2_980000_winlogon.jbxd
                          Similarity
                          • API ID: Thread$Current$Context
                          • String ID:
                          • API String ID: 1666949209-0
                          • Opcode ID: aba7c51250b0bd2785b454d2868164715ffdc60c22b63475f1bba81942d6465a
                          • Instruction ID: de1e61afa9cc682ab4801a47341819e8afb3c84dfa84e6b5a3985d8e863b375a
                          • Opcode Fuzzy Hash: aba7c51250b0bd2785b454d2868164715ffdc60c22b63475f1bba81942d6465a
                          • Instruction Fuzzy Hash: C5C19776209F8886DB30EB5AE49435AB7A0F7C8B88F110616EACD47B69DF3CC555CB40
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 009850D0 Relevance: 7.8, APIs: 5, Instructions: 318threadCOMMON
                          Download Yara Rule

                          Control-flow Graph

                          • Executed
                          • Not Executed
                          control_flow_graph 185 9850d0-9850fc 186 98510d-985116 185->186 187 9850fe-985106 185->187 188 985118-985120 186->188 189 985127-985130 186->189 187->186 188->189 190 985141-98514a 189->190 191 985132-98513a 189->191 192 98514c-985151 190->192 193 985156-985161 GetCurrentThreadId 190->193 191->190 194 9856d3-9856da 192->194 195 98516d-985174 193->195 196 985163-985168 193->196 197 985181-98518a 195->197 198 985176-98517c 195->198 196->194 199 98518c-985191 197->199 200 985196-9851a2 197->200 198->194 199->194 201 9851ce-985225 call 9856e0 * 2 200->201 202 9851a4-9851c9 200->202 207 98523a-985243 201->207 208 985227-98522e 201->208 202->194 211 985255-98525e 207->211 212 985245-985252 207->212 209 985230 208->209 210 985236 208->210 213 9852b0-9852b6 209->213 214 9852a6-9852aa 210->214 215 985260-985270 211->215 216 985273-985298 call 987870 211->216 212->211 218 9852b8-9852d4 call 984390 213->218 219 9852e5-9852eb 213->219 214->213 215->216 226 98532d-985342 call 983cc0 216->226 227 98529e 216->227 218->219 228 9852d6-9852de 218->228 220 9852ed-98530c call 9878ac 219->220 221 985315-985328 219->221 220->221 221->194 232 985351-98535a 226->232 233 985344-98534c 226->233 227->214 228->219 234 98536c-9853ba call 988c60 232->234 235 98535c-985369 232->235 233->214 238 9853c2-9853ca 234->238 235->234 239 9853d0-9854bb call 987440 238->239 240 9854d7-9854df 238->240 251 9854bd 239->251 252 9854bf-9854ce call 984060 239->252 242 9854e1-9854f4 call 984590 240->242 243 985523-98552b 240->243 257 9854f8-985521 242->257 258 9854f6 242->258 244 98552d-985535 243->244 245 985537-985546 243->245 244->245 248 985554-985561 244->248 249 985548 245->249 250 98554f 245->250 255 985563 248->255 256 985564-9855b9 call 9885c0 248->256 249->250 250->248 251->240 261 9854d0 252->261 262 9854d2 252->262 255->256 264 9855c8-985661 call 984510 call 984470 VirtualProtect 256->264 265 9855bb-9855c3 256->265 257->240 258->243 261->240 262->238 270 985671-9856d1 264->270 271 985663-985668 GetLastError 264->271 270->194 271->270
                          APIs
                          • GetCurrentThreadId.KERNEL32 ref: 00985156
                          Memory Dump Source
                          • Source File: 0000000C.00000002.606295374.0000000000980000.00000040.00000001.00020000.00000000.sdmp, Offset: 00980000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_12_2_980000_winlogon.jbxd
                          Similarity
                          • API ID: CurrentThread
                          • String ID:
                          • API String ID: 2882836952-0
                          • Opcode ID: a9eeae0eee8a65d3360f20c0190c6c2044be682fe56af66e10426f66e33a6bd7
                          • Instruction ID: eb4513c713898fe13f483d1580a782c07d5217e8d52242941c258c22b5268ea7
                          • Opcode Fuzzy Hash: a9eeae0eee8a65d3360f20c0190c6c2044be682fe56af66e10426f66e33a6bd7
                          • Instruction Fuzzy Hash: 8BF1D332219B8486DB60DB59F49475ABBA5F3C5B94F214416EACE87B68DF7CC488CF00
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 009839E0 Relevance: 4.6, APIs: 3, Instructions: 64memoryCOMMON
                          Download Yara Rule

                          Control-flow Graph

                          • Executed
                          • Not Executed
                          control_flow_graph 272 9839e0-983a01 call 983c30 275 983a06-983a10 272->275 276 983afa 275->276 277 983a16-983a22 275->277 280 983afc-983b00 276->280 278 983a44-983a6e call 988c60 VirtualQuery 277->278 279 983a24-983a30 277->279 284 983a70 278->284 285 983a75-983a7d 278->285 279->278 281 983a32-983a42 279->281 281->275 284->276 286 983add-983af0 call 983c30 285->286 287 983a7f-983a88 285->287 293 983af5 286->293 287->286 288 983a8a-983ab0 VirtualAlloc 287->288 291 983abb-983ac5 GetLastError 288->291 292 983ab2-983ab7 288->292 294 983acb-983adb 291->294 295 983ac7-983ac9 291->295 292->280 293->275 294->293 295->280
                          APIs
                          Memory Dump Source
                          • Source File: 0000000C.00000002.606295374.0000000000980000.00000040.00000001.00020000.00000000.sdmp, Offset: 00980000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_12_2_980000_winlogon.jbxd
                          Similarity
                          • API ID: Virtual$AllocQuery
                          • String ID:
                          • API String ID: 31662377-0
                          • Opcode ID: ad31f8c641c3994e4c662b42b06090e17ab0b09933d29211a4965d6dca603ca4
                          • Instruction ID: b76ddf79c0c697f242140b367fd4cc7d8444f610a5c170c4e87f6716e8690fd8
                          • Opcode Fuzzy Hash: ad31f8c641c3994e4c662b42b06090e17ab0b09933d29211a4965d6dca603ca4
                          • Instruction Fuzzy Hash: 5421FC22219A8481DB34EB69E05531BB7A4F3C8BC4F508929F6CE46B68DF7DC7808B44
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 0098328C Relevance: 4.5, APIs: 3, Instructions: 43threadCOMMON
                          Download Yara Rule

                          Control-flow Graph

                          • Executed
                          • Not Executed
                          control_flow_graph 296 98328c-98329b 297 9832a1-9832b6 GetModuleFileNameW 296->297 298 983323-983325 296->298 301 9832b8-9832cd PathFindFileNameW call 983844 297->301 302 98331f-983321 297->302 299 98332c 298->299 300 983327 call 9836c8 298->300 304 983331-983339 299->304 300->299 301->302 307 9832cf-9832d6 call 983790 301->307 302->304 307->302 310 9832d8-9832df 307->310 310->299 311 9832e1-983318 CreateThread call 981d14 310->311 313 98331d 311->313 313->299
                          APIs
                          • GetModuleFileNameW.KERNEL32 ref: 009832AE
                          • PathFindFileNameW.SHLWAPI ref: 009832BD
                            • Part of subcall function 00983844: StrCmpNIW.SHLWAPI ref: 0098385C
                            • Part of subcall function 00983790: GetModuleHandleW.KERNEL32 ref: 0098379E
                            • Part of subcall function 00983790: GetCurrentProcess.KERNEL32 ref: 009837CC
                            • Part of subcall function 00983790: VirtualProtectEx.KERNEL32 ref: 009837EE
                            • Part of subcall function 00983790: GetCurrentProcess.KERNEL32 ref: 00983809
                            • Part of subcall function 00983790: VirtualProtectEx.KERNEL32 ref: 0098382A
                          • CreateThread.KERNEL32 ref: 0098330B
                            • Part of subcall function 00981D14: GetCurrentThread.KERNEL32 ref: 00981D1F
                          Memory Dump Source
                          • Source File: 0000000C.00000002.606295374.0000000000980000.00000040.00000001.00020000.00000000.sdmp, Offset: 00980000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_12_2_980000_winlogon.jbxd
                          Similarity
                          • API ID: Current$FileModuleNameProcessProtectThreadVirtual$CreateFindHandlePath
                          • String ID:
                          • API String ID: 1683269324-0
                          • Opcode ID: c94412c55dcd243bcd3fbe265bea19663896af10ab27123b85acb7154d5eea14
                          • Instruction ID: e08995fc0cab2e0a4c1ef4a77f0745e28a99efb37f5af323e42bdd2acf432da9
                          • Opcode Fuzzy Hash: c94412c55dcd243bcd3fbe265bea19663896af10ab27123b85acb7154d5eea14
                          • Instruction Fuzzy Hash: 3F012070714741C2FB20BB36F84935D2358B795B85FD0C12AE94A82756EF7CC244C340
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 00984DF0 Relevance: 4.5, APIs: 3, Instructions: 23memoryCOMMON
                          Download Yara Rule

                          Control-flow Graph

                          • Executed
                          • Not Executed
                          control_flow_graph 314 984df0-984e0a GetCurrentProcess 315 984e1a-984e20 314->315 316 984e22-984e51 VirtualProtect FlushInstructionCache 315->316 317 984e53-984e57 315->317 318 984e0c-984e15 316->318 318->315
                          APIs
                          • GetCurrentProcess.KERNEL32 ref: 00984DF4
                          • VirtualProtect.KERNEL32 ref: 00984E37
                          • FlushInstructionCache.KERNEL32 ref: 00984E4C
                          Memory Dump Source
                          • Source File: 0000000C.00000002.606295374.0000000000980000.00000040.00000001.00020000.00000000.sdmp, Offset: 00980000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_12_2_980000_winlogon.jbxd
                          Similarity
                          • API ID: CacheCurrentFlushInstructionProcessProtectVirtual
                          • String ID:
                          • API String ID: 3733156554-0
                          • Opcode ID: efc513032ac2f8104d68ff6d1779eae6f51007478eb3e1ac0120cc0a77f626c8
                          • Instruction ID: 3855f219913d9a4c39fb4c6c38359e821c95b86572f471ac0a42b1137413303b
                          • Opcode Fuzzy Hash: efc513032ac2f8104d68ff6d1779eae6f51007478eb3e1ac0120cc0a77f626c8
                          • Instruction Fuzzy Hash: 77F0F826218B04C0C730EB95E49171AABA1F7C8BE4F244516FACD47B39CE3CC6908B40
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 0095273C Relevance: 3.2, APIs: 2, Instructions: 187memorylibraryCOMMON
                          Download Yara Rule

                          Control-flow Graph

                          • Executed
                          • Not Executed
                          control_flow_graph 319 95273c-9527a4 call 9529d4 * 4 328 9529b2 319->328 329 9527aa-9527ad 319->329 330 9529b4-9529d0 328->330 329->328 331 9527b3-9527b6 329->331 331->328 332 9527bc-9527bf 331->332 332->328 333 9527c5-9527e6 VirtualAlloc 332->333 333->328 334 9527ec-95280c 333->334 335 95280e-952836 334->335 336 952838-95283f 334->336 335->335 335->336 337 952845-952852 336->337 338 9528df-9528e6 336->338 337->338 341 952858-95286a LoadLibraryA 337->341 339 952992-9529b0 338->339 340 9528ec-952901 338->340 339->330 340->339 342 952907 340->342 343 95286c-952878 341->343 344 9528ca-9528d2 341->344 346 95290d-952921 342->346 347 9528c5-9528c8 343->347 344->341 348 9528d4-9528d9 344->348 349 952923-952934 346->349 350 952982-95298c 346->350 347->344 351 95287a-95287d 347->351 348->338 353 952936-95293d 349->353 354 95293f-952943 349->354 350->339 350->346 355 9528a7-9528b7 351->355 356 95287f-9528a5 351->356 357 952970-952980 353->357 358 952945-95294b 354->358 359 95294d-952951 354->359 360 9528ba-9528c1 355->360 356->360 357->349 357->350 358->357 361 952963-952967 359->361 362 952953-952961 359->362 360->347 361->357 364 952969-95296c 361->364 362->357 364->357
                          APIs
                          Memory Dump Source
                          • Source File: 0000000C.00000002.606091107.0000000000950000.00000040.00000001.00020000.00000000.sdmp, Offset: 00950000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_12_2_950000_winlogon.jbxd
                          Similarity
                          • API ID: AllocLibraryLoadVirtual
                          • String ID:
                          • API String ID: 3550616410-0
                          • Opcode ID: 8c1c9448f3dd1088c887dafc1273d9eb4da1e6d2ce59199f574756fa2a1f07a1
                          • Instruction ID: 1616b8d7631542e5846d8bacbff7c6f8aa0e254f6b1e7013256d73c27d67f1c7
                          • Opcode Fuzzy Hash: 8c1c9448f3dd1088c887dafc1273d9eb4da1e6d2ce59199f574756fa2a1f07a1
                          • Instruction Fuzzy Hash: CE615872B016908BCF18CF26D26073DB366FB56BA5F588125DF5A07748DB38E86AC700
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 00981ABC Relevance: 3.1, APIs: 2, Instructions: 68sleepCOMMON
                          Download Yara Rule

                          Control-flow Graph

                          • Executed
                          • Not Executed
                          control_flow_graph 365 981abc-981acb call 981628 368 981ad2-981aef Sleep SleepEx 365->368 369 981baa 368->369 370 981af5-981af8 368->370 371 981bad-981bb5 call 9818b4 369->371 372 981afe-981b01 370->372 373 981ba1-981ba8 370->373 371->368 372->373 375 981b07-981b14 call 981598 372->375 373->371 379 981b94 375->379 380 981b16-981b25 call 981220 375->380 382 981b96-981b98 379->382 380->379 385 981b27-981b36 call 981598 380->385 382->369 384 981b9a 382->384 384->373 385->379 388 981b38-981b47 call 981598 385->388 388->379 391 981b49-981b58 call 981598 388->391 391->379 394 981b5a-981b69 call 981220 391->394 394->379 397 981b6b-981b7a call 981220 394->397 397->379 400 981b7c-981b8b call 981220 397->400 400->379 403 981b8d-981b92 400->403 403->382
                          APIs
                            • Part of subcall function 00981628: GetProcessHeap.KERNEL32 ref: 00981633
                            • Part of subcall function 00981628: HeapAlloc.KERNEL32 ref: 00981642
                            • Part of subcall function 00981628: RegOpenKeyExW.ADVAPI32 ref: 009816B2
                            • Part of subcall function 00981628: RegOpenKeyExW.ADVAPI32 ref: 009816DF
                            • Part of subcall function 00981628: RegCloseKey.ADVAPI32 ref: 009816F9
                            • Part of subcall function 00981628: RegOpenKeyExW.ADVAPI32 ref: 00981719
                            • Part of subcall function 00981628: RegCloseKey.ADVAPI32 ref: 00981734
                            • Part of subcall function 00981628: RegOpenKeyExW.ADVAPI32 ref: 00981754
                            • Part of subcall function 00981628: RegCloseKey.ADVAPI32 ref: 0098176F
                            • Part of subcall function 00981628: RegOpenKeyExW.ADVAPI32 ref: 0098178F
                            • Part of subcall function 00981628: RegCloseKey.ADVAPI32 ref: 009817AA
                            • Part of subcall function 00981628: RegOpenKeyExW.ADVAPI32 ref: 009817CA
                          • Sleep.KERNEL32 ref: 00981AD7
                          • SleepEx.KERNEL32 ref: 00981ADD
                            • Part of subcall function 00981628: RegCloseKey.ADVAPI32 ref: 009817E5
                            • Part of subcall function 00981628: RegOpenKeyExW.ADVAPI32 ref: 00981805
                            • Part of subcall function 00981628: RegCloseKey.ADVAPI32 ref: 00981820
                            • Part of subcall function 00981628: RegOpenKeyExW.ADVAPI32 ref: 00981840
                            • Part of subcall function 00981628: RegCloseKey.ADVAPI32 ref: 0098185B
                            • Part of subcall function 00981628: RegOpenKeyExW.ADVAPI32 ref: 0098187B
                            • Part of subcall function 00981628: RegCloseKey.ADVAPI32 ref: 00981896
                            • Part of subcall function 00981628: RegCloseKey.ADVAPI32 ref: 009818A0
                          Memory Dump Source
                          • Source File: 0000000C.00000002.606295374.0000000000980000.00000040.00000001.00020000.00000000.sdmp, Offset: 00980000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_12_2_980000_winlogon.jbxd
                          Similarity
                          • API ID: CloseOpen$HeapSleep$AllocProcess
                          • String ID:
                          • API String ID: 1534210851-0
                          • Opcode ID: ad614115fa5d2181ccf7742c52f053f5bbac07b16a2f1961ccdf1ed8f9939afa
                          • Instruction ID: 1260e09df73963ff5dae22cd9031e4afae0e0217e9cba08fd7357e1a89d8e5c9
                          • Opcode Fuzzy Hash: ad614115fa5d2181ccf7742c52f053f5bbac07b16a2f1961ccdf1ed8f9939afa
                          • Instruction Fuzzy Hash: AE21C861311A4192DF14BB26EA9137D63ADEBC8BE0F0854229E4E87759FF24C8A3C311
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Non-executed Functions

                          Function 00982B2C Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 264stringlibraryloaderCOMMON
                          Download Yara Rule
                          APIs
                          • GetModuleHandleA.KERNEL32 ref: 00982BD0
                          • lstrlenW.KERNEL32 ref: 00982E0A
                            • Part of subcall function 0098199C: OpenProcess.KERNEL32 ref: 009819C2
                            • Part of subcall function 0098199C: K32GetModuleFileNameExW.KERNEL32 ref: 009819E0
                            • Part of subcall function 0098199C: PathFindFileNameW.SHLWAPI ref: 009819EF
                            • Part of subcall function 0098199C: lstrlenW.KERNEL32 ref: 009819FB
                            • Part of subcall function 0098199C: StrCpyW.SHLWAPI ref: 00981A0E
                            • Part of subcall function 0098199C: CloseHandle.KERNEL32 ref: 00981A1C
                          • GetProcAddress.KERNEL32 ref: 00982BE5
                            • Part of subcall function 0098152C: StrCmpIW.SHLWAPI ref: 0098155D
                            • Part of subcall function 00983844: StrCmpNIW.SHLWAPI ref: 0098385C
                          • StrCmpNIW.SHLWAPI ref: 00982C28
                          • lstrlenW.KERNEL32 ref: 00982D50
                          Strings
                          Memory Dump Source
                          • Source File: 0000000C.00000002.606295374.0000000000980000.00000040.00000001.00020000.00000000.sdmp, Offset: 00980000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_12_2_980000_winlogon.jbxd
                          Similarity
                          • API ID: lstrlen$FileHandleModuleName$AddressCloseFindOpenPathProcProcess
                          • String ID: NtQueryObject$\Device\Nsi$ntdll.dll
                          • API String ID: 2119608203-3850299575
                          • Opcode ID: 4f621fb1587c0d31dffa94ac8be990c76594e3be50ef12941f5ce2f96c448f72
                          • Instruction ID: 64aa32b15d7688960e31987f5daf1be53a43efca5142d01112081382a2b23b84
                          • Opcode Fuzzy Hash: 4f621fb1587c0d31dffa94ac8be990c76594e3be50ef12941f5ce2f96c448f72
                          • Instruction Fuzzy Hash: 6FA10476310B9086DB28EF29D8407AD77A9FB84F94F44502AEE4957B59EF38CD80C740
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 00987D90 Relevance: 10.6, APIs: 7, Instructions: 72COMMON
                          Download Yara Rule
                          APIs
                          • IsProcessorFeaturePresent.KERNEL32 ref: 00987DAC
                          • RtlCaptureContext.NTDLL ref: 00987DD9
                          • RtlLookupFunctionEntry.NTDLL ref: 00987DF3
                          • RtlVirtualUnwind.NTDLL ref: 00987E34
                          • IsDebuggerPresent.KERNEL32 ref: 00987E88
                          • SetUnhandledExceptionFilter.KERNEL32 ref: 00987EA9
                          • UnhandledExceptionFilter.KERNEL32 ref: 00987EB4
                          Memory Dump Source
                          • Source File: 0000000C.00000002.606295374.0000000000980000.00000040.00000001.00020000.00000000.sdmp, Offset: 00980000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_12_2_980000_winlogon.jbxd
                          Similarity
                          • API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
                          • String ID:
                          • API String ID: 3140674995-0
                          • Opcode ID: 781d1b9bde8934adc12bfa83d35ad1be64d2520f1bd2f9e02f1b4bb1ea1a0257
                          • Instruction ID: 2d3ceaf157d6968339cf694424a2c47d33d36aacfd6ca1dc56dc3568d2ea1911
                          • Opcode Fuzzy Hash: 781d1b9bde8934adc12bfa83d35ad1be64d2520f1bd2f9e02f1b4bb1ea1a0257
                          • Instruction Fuzzy Hash: D1314F72215B808AEB60DF64E8907EE7364F784748F44442ADB4E57B99EF38C648C710
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 0098D2A4 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE
                          Download Yara Rule
                          APIs
                          • RtlCaptureContext.NTDLL ref: 0098D31D
                          • RtlLookupFunctionEntry.NTDLL ref: 0098D335
                          • RtlVirtualUnwind.NTDLL ref: 0098D370
                          • IsDebuggerPresent.KERNEL32 ref: 0098D3A9
                          • SetUnhandledExceptionFilter.KERNEL32 ref: 0098D3B3
                          • UnhandledExceptionFilter.KERNEL32 ref: 0098D3BE
                          Memory Dump Source
                          • Source File: 0000000C.00000002.606295374.0000000000980000.00000040.00000001.00020000.00000000.sdmp, Offset: 00980000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_12_2_980000_winlogon.jbxd
                          Similarity
                          • API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
                          • String ID:
                          • API String ID: 1239891234-0
                          • Opcode ID: 056b8809331e045eb0ff6df28b8a67c6be047fb713c0be5e5acd4a9b147221bc
                          • Instruction ID: 35dc8e0a09289f8d7af1a5bab5af8592fe5832f232e63afe922c7b1db121de89
                          • Opcode Fuzzy Hash: 056b8809331e045eb0ff6df28b8a67c6be047fb713c0be5e5acd4a9b147221bc
                          • Instruction Fuzzy Hash: 89317436214F8096DB20DF29E8803AE73A4F789798F54012AEF9D43B59EF38C555CB00
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 009812BC Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 120memoryregistrystringCOMMON
                          Download Yara Rule

                          Control-flow Graph

                          • Executed
                          • Not Executed
                          control_flow_graph 421 9812bc-981321 RegQueryInfoKeyW 422 98148a-9814a0 421->422 423 981327-98134c GetProcessHeap HeapAlloc 421->423 424 981352-98139f RegEnumValueW 423->424 425 981476-981484 GetProcessHeap call 996180 423->425 427 981465-981470 424->427 428 9813a5-9813aa 424->428 425->422 427->424 427->425 428->427 429 9813b0-9813bd call 98152c 428->429 429->427 432 9813c3-9813c6 429->432 432->427 433 9813cc-9813d1 432->433 434 98141e-98145f lstrlenW GetProcessHeap HeapAlloc StrCpyW 433->434 435 9813d3-981418 GetProcessHeap HeapAlloc GetProcessHeap call 996180 433->435 434->427 435->434
                          APIs
                          Strings
                          Memory Dump Source
                          • Source File: 0000000C.00000002.606295374.0000000000980000.00000040.00000001.00020000.00000000.sdmp, Offset: 00980000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_12_2_980000_winlogon.jbxd
                          Similarity
                          • API ID: Heap$Process$Alloc$Free$EnumInfoQueryValuelstrlen
                          • String ID: d
                          • API String ID: 2005889112-2564639436
                          • Opcode ID: 8b653d2a3574a9b9f54f76d34c9bbade1314fe17b6e977058bb62b7e32ce9810
                          • Instruction ID: d94831243540ffa0a4ad7259cd7e2aacb08fc3a7022095339a057cc881f0d5ea
                          • Opcode Fuzzy Hash: 8b653d2a3574a9b9f54f76d34c9bbade1314fe17b6e977058bb62b7e32ce9810
                          • Instruction Fuzzy Hash: B0517F36604B84C6EB24DF66E54839AB7A5F789FD9F448129DE4A07729DF3CC05ACB00
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 00981D14 Relevance: 22.8, APIs: 1, Strings: 12, Instructions: 65threadCOMMON
                          Download Yara Rule

                          Control-flow Graph

                          APIs
                          • GetCurrentThread.KERNEL32 ref: 00981D1F
                            • Part of subcall function 00981FD4: GetModuleHandleA.KERNEL32 ref: 00981FEC
                            • Part of subcall function 00981FD4: GetProcAddress.KERNEL32 ref: 00981FFD
                            • Part of subcall function 00985B30: GetCurrentThreadId.KERNEL32 ref: 00985B6B
                          Strings
                          Memory Dump Source
                          • Source File: 0000000C.00000002.606295374.0000000000980000.00000040.00000001.00020000.00000000.sdmp, Offset: 00980000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_12_2_980000_winlogon.jbxd
                          Similarity
                          • API ID: CurrentThread$AddressHandleModuleProc
                          • String ID: EnumServiceGroupW$EnumServicesStatusExW$NtDeviceIoControlFile$NtEnumerateKey$NtEnumerateValueKey$NtQueryDirectoryFile$NtQueryDirectoryFileEx$NtQuerySystemInformation$NtResumeThread$advapi32.dll$ntdll.dll$sechost.dll
                          • API String ID: 4175298099-1975688563
                          • Opcode ID: 848021bf4701eae64bbfc749c93af06548ec6c37c79a2989ab503d46e0816dd6
                          • Instruction ID: d733cba039dce0f52366a3e75e1714f6dae8ac44ae2ec5362619870840f926d1
                          • Opcode Fuzzy Hash: 848021bf4701eae64bbfc749c93af06548ec6c37c79a2989ab503d46e0816dd6
                          • Instruction Fuzzy Hash: 0531A564201A4AA0EA45EFADEDA17E46334FB45354FC19027D95913637AF7CC24EC391
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 00956910 Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 230COMMON
                          Download Yara Rule

                          Control-flow Graph

                          • Executed
                          • Not Executed
                          control_flow_graph 465 956910-956916 466 956951-95695b 465->466 467 956918-95691b 465->467 470 956a78-956a8d 466->470 468 956945-956984 call 956fc0 467->468 469 95691d-956920 467->469 488 956a52 468->488 489 95698a-95699f call 956e54 468->489 471 956922-956925 469->471 472 956938 __scrt_dllmain_crt_thread_attach 469->472 473 956a9c-956ab6 call 956e54 470->473 474 956a8f 470->474 476 956927-956930 471->476 477 956931-956936 call 956f04 471->477 480 95693d-956944 472->480 486 956aef-956b20 call 957190 473->486 487 956ab8-956aed call 956f7c call 956e1c call 957318 call 957130 call 957154 call 956fac 473->487 478 956a91-956a9b 474->478 477->480 499 956b31-956b37 486->499 500 956b22-956b28 486->500 487->478 493 956a54-956a69 488->493 497 9569a5-9569b6 call 956ec4 489->497 498 956a6a-956a77 call 957190 489->498 515 956a07-956a11 call 957130 497->515 516 9569b8-9569dc call 9572dc call 956e0c call 956e38 call 95ac0c 497->516 498->470 505 956b7e-956b94 call 95268c 499->505 506 956b39-956b43 499->506 500->499 504 956b2a-956b2c 500->504 511 956c1f-956c2c 504->511 526 956b96-956b98 505->526 527 956bcc-956bce 505->527 512 956b45-956b4d 506->512 513 956b4f-956b5d call 965780 506->513 518 956b63-956b78 call 956910 512->518 513->518 530 956c15-956c1d 513->530 515->488 538 956a13-956a1f call 957180 515->538 516->515 568 9569de-9569e5 __scrt_dllmain_after_initialize_c 516->568 518->505 518->530 526->527 535 956b9a-956bbc call 95268c call 956a78 526->535 528 956bd5-956bea call 956910 527->528 529 956bd0-956bd3 527->529 528->530 547 956bec-956bf6 528->547 529->528 529->530 530->511 535->527 562 956bbe-956bc6 call 965780 535->562 555 956a45-956a50 538->555 556 956a21-956a2b call 957098 538->556 552 956c01-956c11 call 965780 547->552 553 956bf8-956bff 547->553 552->530 553->530 555->493 556->555 567 956a2d-956a3b 556->567 562->527 567->555 568->515 569 9569e7-956a04 call 95abc8 568->569 569->515
                          APIs
                          • __scrt_dllmain_crt_thread_attach.LIBCMT ref: 00956938
                          • __scrt_acquire_startup_lock.LIBCMT ref: 0095698A
                          • _RTC_Initialize.LIBCMT ref: 009569B8
                          • __scrt_dllmain_after_initialize_c.LIBCMT ref: 009569DE
                          • __scrt_release_startup_lock.LIBCMT ref: 00956A09
                          Strings
                          Memory Dump Source
                          • Source File: 0000000C.00000002.606091107.0000000000950000.00000040.00000001.00020000.00000000.sdmp, Offset: 00950000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_12_2_950000_winlogon.jbxd
                          Similarity
                          • API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
                          • String ID: `dynamic initializer for '$`eh vector copy constructor iterator'$`eh vector vbase copy constructor iterator'$scriptor'
                          • API String ID: 190073905-1786718095
                          • Opcode ID: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
                          • Instruction ID: 42da185159dcafa04ece4c7af9220281a66757d7fe17fd2559f1da87fcd76acc
                          • Opcode Fuzzy Hash: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
                          • Instruction Fuzzy Hash: 4971243271874186EB14EF67E45131973A4FBC5B82FD88429EE4997716EF39C94E8700
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 0098CE28 Relevance: 18.1, APIs: 12, Instructions: 112COMMONLIBRARYCODE
                          Download Yara Rule
                          APIs
                          • GetLastError.KERNEL32 ref: 0098CE37
                          • FlsGetValue.KERNEL32(?,?,?,00990A6B,?,?,?,0099045C,?,?,?,0098C84F), ref: 0098CE4C
                          • FlsSetValue.KERNEL32(?,?,?,00990A6B,?,?,?,0099045C,?,?,?,0098C84F), ref: 0098CE6D
                          • FlsSetValue.KERNEL32(?,?,?,00990A6B,?,?,?,0099045C,?,?,?,0098C84F), ref: 0098CE9A
                          • FlsSetValue.KERNEL32(?,?,?,00990A6B,?,?,?,0099045C,?,?,?,0098C84F), ref: 0098CEAB
                          • FlsSetValue.KERNEL32(?,?,?,00990A6B,?,?,?,0099045C,?,?,?,0098C84F), ref: 0098CEBC
                          • SetLastError.KERNEL32 ref: 0098CED7
                          • FlsGetValue.KERNEL32(?,?,?,?,?,?,?,00990A6B,?,?,?,0099045C,?,?,?,0098C84F), ref: 0098CF0D
                          • FlsSetValue.KERNEL32(?,?,00000001,0098ECCC,?,?,?,?,0098BF9F,?,?,?,?,?,00987AB0), ref: 0098CF2C
                            • Part of subcall function 0098D6CC: HeapAlloc.KERNEL32 ref: 0098D721
                          • FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00990A6B,?,?,?,0099045C,?,?,?,0098C84F), ref: 0098CF54
                            • Part of subcall function 0098D744: HeapFree.KERNEL32 ref: 0098D75A
                            • Part of subcall function 0098D744: GetLastError.KERNEL32 ref: 0098D764
                          • FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00990A6B,?,?,?,0099045C,?,?,?,0098C84F), ref: 0098CF65
                          • FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00990A6B,?,?,?,0099045C,?,?,?,0098C84F), ref: 0098CF76
                          Memory Dump Source
                          • Source File: 0000000C.00000002.606295374.0000000000980000.00000040.00000001.00020000.00000000.sdmp, Offset: 00980000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_12_2_980000_winlogon.jbxd
                          Similarity
                          • API ID: Value$ErrorLast$Heap$AllocFree
                          • String ID:
                          • API String ID: 570795689-0
                          • Opcode ID: 81ae7dfa4ed2d3c1f1356864241e8c9d76a8deab2a50f3105871727dc9b84e00
                          • Instruction ID: 8c36b78c05c7739e67adbc7a04ed7ffd36c7739c3b1c401cf867c9679fc3c46a
                          • Opcode Fuzzy Hash: 81ae7dfa4ed2d3c1f1356864241e8c9d76a8deab2a50f3105871727dc9b84e00
                          • Instruction Fuzzy Hash: 4731B2A530124842FE28B735956633D22479FC57F0F241B34A9364BBEBEE7CD8418721
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 00982244 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 52filethreadCOMMON
                          Download Yara Rule
                          APIs
                          • GetProcessIdOfThread.KERNEL32 ref: 00982259
                          • GetCurrentProcessId.KERNEL32 ref: 00982263
                            • Part of subcall function 00981934: OpenProcess.KERNEL32 ref: 00981952
                            • Part of subcall function 00981934: IsWow64Process.KERNEL32 ref: 00981968
                            • Part of subcall function 00981934: CloseHandle.KERNEL32 ref: 00981983
                          • CreateFileW.KERNEL32 ref: 009822BC
                          • WriteFile.KERNEL32 ref: 009822E4
                          • ReadFile.KERNEL32 ref: 00982303
                          • CloseHandle.KERNEL32 ref: 0098230C
                          Strings
                          • \\.\pipe\dialerchildproc64, xrefs: 0098228C
                          • \\.\pipe\dialerchildproc32, xrefs: 00982293
                          Memory Dump Source
                          • Source File: 0000000C.00000002.606295374.0000000000980000.00000040.00000001.00020000.00000000.sdmp, Offset: 00980000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_12_2_980000_winlogon.jbxd
                          Similarity
                          • API ID: Process$File$CloseHandle$CreateCurrentOpenReadThreadWow64Write
                          • String ID: \\.\pipe\dialerchildproc32$\\.\pipe\dialerchildproc64
                          • API String ID: 2171963597-1373409510
                          • Opcode ID: d76f145db3bc14c8b60d6abb5b011cd5988a1ad04fc2d4b7169b2a78ec3c4c79
                          • Instruction ID: 62df06682098cf292bd2857e7c87649b127dec6366ce171088c3a37abd16508a
                          • Opcode Fuzzy Hash: d76f145db3bc14c8b60d6abb5b011cd5988a1ad04fc2d4b7169b2a78ec3c4c79
                          • Instruction Fuzzy Hash: 74215E36614B4083EB10DB29F59436A77A5F789BE5F50431AEA9903BA9DF7CC149CF00
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 00959944 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 317COMMON
                          Download Yara Rule
                          APIs
                          • __FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 009599A1
                            • Part of subcall function 0095A814: __GetUnwindTryBlock.LIBCMT ref: 0095A857
                            • Part of subcall function 0095A814: __SetUnwindTryBlock.LIBVCRUNTIME ref: 0095A87C
                          • Is_bad_exception_allowed.LIBVCRUNTIME ref: 00959A79
                          • __FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 00959CCE
                          • std::bad_alloc::bad_alloc.LIBCMT ref: 00959DDA
                          Strings
                          Memory Dump Source
                          • Source File: 0000000C.00000002.606091107.0000000000950000.00000040.00000001.00020000.00000000.sdmp, Offset: 00950000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_12_2_950000_winlogon.jbxd
                          Similarity
                          • API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
                          • String ID: csm$csm$csm
                          • API String ID: 849930591-393685449
                          • Opcode ID: 65b39982983e806640910362ba4e105e6dc551b6220b15538d356c191c28ac3a
                          • Instruction ID: 2fe28436f9339ce626664702fa18f523f8b1a8779f82ecdf4ac98fd9e981be1b
                          • Opcode Fuzzy Hash: 65b39982983e806640910362ba4e105e6dc551b6220b15538d356c191c28ac3a
                          • Instruction Fuzzy Hash: 32D1AD72604B80CAEB20DF7AE48139E77B4F799B9AF101516EE8957B19CF38C499C700
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 0098A544 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 317COMMON
                          Download Yara Rule
                          APIs
                          • __FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 0098A5A1
                            • Part of subcall function 0098B414: __GetUnwindTryBlock.LIBCMT ref: 0098B457
                            • Part of subcall function 0098B414: __SetUnwindTryBlock.LIBVCRUNTIME ref: 0098B47C
                          • Is_bad_exception_allowed.LIBVCRUNTIME ref: 0098A679
                          • __FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 0098A8CE
                          • std::bad_alloc::bad_alloc.LIBCMT ref: 0098A9DA
                          Strings
                          Memory Dump Source
                          • Source File: 0000000C.00000002.606295374.0000000000980000.00000040.00000001.00020000.00000000.sdmp, Offset: 00980000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_12_2_980000_winlogon.jbxd
                          Similarity
                          • API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
                          • String ID: csm$csm$csm
                          • API String ID: 849930591-393685449
                          • Opcode ID: 147a5c394ba4e007c258850d6061d542d969719de9d23a8e277659d08661d77f
                          • Instruction ID: 991436f5cac4a40af8910dd2238c772f9a63ae31ec60c2d870ba3f6035dd4c2e
                          • Opcode Fuzzy Hash: 147a5c394ba4e007c258850d6061d542d969719de9d23a8e277659d08661d77f
                          • Instruction Fuzzy Hash: C9D1AE72A04B848AEB20EF65D4803AD7BA4F795B98F14011AEF8957B19DF38D591CB02
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 0098104C Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 99memoryregistryCOMMON
                          Download Yara Rule
                          APIs
                          Strings
                          Memory Dump Source
                          • Source File: 0000000C.00000002.606295374.0000000000980000.00000040.00000001.00020000.00000000.sdmp, Offset: 00980000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_12_2_980000_winlogon.jbxd
                          Similarity
                          • API ID: Heap$Process$AllocEnumFreeInfoQueryValue
                          • String ID: d
                          • API String ID: 3743429067-2564639436
                          • Opcode ID: 0cc5ceb7d92555702a84a43de404567f212e32e90d8a90c8922560dee2c01182
                          • Instruction ID: ea629e187f59fedf87ee8d6562e38c0bb5af72e3f2ce9ea94021a28cd31970de
                          • Opcode Fuzzy Hash: 0cc5ceb7d92555702a84a43de404567f212e32e90d8a90c8922560dee2c01182
                          • Instruction Fuzzy Hash: 34418173218B84CAE760DF25E44479E77A5F389B98F448129DB8A07B18DF3CC589CB40
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 0098D068 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 54COMMONLIBRARYCODE
                          Download Yara Rule
                          APIs
                          • FlsGetValue.KERNEL32(?,?,?,0098C7DE,?,?,?,?,?,?,?,?,0098CF9D,?,?,00000001), ref: 0098D087
                          • FlsSetValue.KERNEL32(?,?,?,0098C7DE,?,?,?,?,?,?,?,?,0098CF9D,?,?,00000001), ref: 0098D0A6
                          • FlsSetValue.KERNEL32(?,?,?,0098C7DE,?,?,?,?,?,?,?,?,0098CF9D,?,?,00000001), ref: 0098D0CE
                          • FlsSetValue.KERNEL32(?,?,?,0098C7DE,?,?,?,?,?,?,?,?,0098CF9D,?,?,00000001), ref: 0098D0DF
                          • FlsSetValue.KERNEL32(?,?,?,0098C7DE,?,?,?,?,?,?,?,?,0098CF9D,?,?,00000001), ref: 0098D0F0
                          Strings
                          Memory Dump Source
                          • Source File: 0000000C.00000002.606295374.0000000000980000.00000040.00000001.00020000.00000000.sdmp, Offset: 00980000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_12_2_980000_winlogon.jbxd
                          Similarity
                          • API ID: Value
                          • String ID: 1%$Y%
                          • API String ID: 3702945584-1395475152
                          • Opcode ID: eaed261e9eff258ccad1ac5f7a99306e4284ed666e6615725d2dc279c7a103a4
                          • Instruction ID: c9aaa9c029b3eb3c6a9371885c24664d2e1d2d0bc611b229d8ba5090c4e5d0c7
                          • Opcode Fuzzy Hash: eaed261e9eff258ccad1ac5f7a99306e4284ed666e6615725d2dc279c7a103a4
                          • Instruction Fuzzy Hash: 8311A96170634441EE28BB36A96633D63465FC57F0F185735A839877EDEF6CC4428701
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 00987510 Relevance: 12.2, APIs: 8, Instructions: 230COMMON
                          Download Yara Rule
                          APIs
                          • __scrt_dllmain_crt_thread_attach.LIBCMT ref: 00987538
                          • __scrt_acquire_startup_lock.LIBCMT ref: 0098758A
                          • _RTC_Initialize.LIBCMT ref: 009875B8
                          • __scrt_dllmain_after_initialize_c.LIBCMT ref: 009875DE
                          • __scrt_release_startup_lock.LIBCMT ref: 00987609
                          Memory Dump Source
                          • Source File: 0000000C.00000002.606295374.0000000000980000.00000040.00000001.00020000.00000000.sdmp, Offset: 00980000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_12_2_980000_winlogon.jbxd
                          Similarity
                          • API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
                          • String ID:
                          • API String ID: 190073905-0
                          • Opcode ID: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
                          • Instruction ID: e7263661682693c25ddb2e67d2a0ceb0f0a709d360ffd20a77e0de16a4d485e1
                          • Opcode Fuzzy Hash: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
                          • Instruction Fuzzy Hash: 7371F63170C74186EB14FBEAE881369E795FBC6BC0F788529EA0987716EB38C945C711
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 00993DB4 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON
                          Download Yara Rule
                          APIs
                          Strings
                          Memory Dump Source
                          • Source File: 0000000C.00000002.606295374.0000000000980000.00000040.00000001.00020000.00000000.sdmp, Offset: 00980000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_12_2_980000_winlogon.jbxd
                          Similarity
                          • API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
                          • String ID: CONOUT$
                          • API String ID: 3230265001-3130406586
                          • Opcode ID: ea8503a65e9befc0d33d9332805196394b6329e0df61646a9863ad39bb9ae76f
                          • Instruction ID: ab692fba77142f3525ed76623f23046cb6fda3b77ebc16cb70a9bbd9139c51bf
                          • Opcode Fuzzy Hash: ea8503a65e9befc0d33d9332805196394b6329e0df61646a9863ad39bb9ae76f
                          • Instruction Fuzzy Hash: FE115131314B4086E7608F5BF85431977A4F789FE4F044229EA5E877A6DF78C9148744
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 00982F04 Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 93memoryCOMMON
                          Download Yara Rule
                          APIs
                          Strings
                          Memory Dump Source
                          • Source File: 0000000C.00000002.606295374.0000000000980000.00000040.00000001.00020000.00000000.sdmp, Offset: 00980000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_12_2_980000_winlogon.jbxd
                          Similarity
                          • API ID: Heap$Process$AllocFree
                          • String ID: dialer
                          • API String ID: 756756679-3528709123
                          • Opcode ID: 2e24de9146afbba5105044d4fd5602f1f9f0ed558a5ed62472976580c3eaf0ad
                          • Instruction ID: 0e03757e8bf5b78585d5f26fd91c5d543c218a73e9e00b5a2e4be9907ee5532d
                          • Opcode Fuzzy Hash: 2e24de9146afbba5105044d4fd5602f1f9f0ed558a5ed62472976580c3eaf0ad
                          • Instruction Fuzzy Hash: 2731B032701B5593EB25EF1AE94072AA764FB48BC4F088134EF8947B26EF38C4A1C700
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 0098CFA0 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE
                          Download Yara Rule
                          APIs
                          • GetLastError.KERNEL32 ref: 0098CFAF
                          • FlsSetValue.KERNEL32(?,?,?,0098D6B5,?,?,?,?,0098D778), ref: 0098CFE5
                          • FlsSetValue.KERNEL32(?,?,?,0098D6B5,?,?,?,?,0098D778), ref: 0098D012
                          • FlsSetValue.KERNEL32(?,?,?,0098D6B5,?,?,?,?,0098D778), ref: 0098D023
                          • FlsSetValue.KERNEL32(?,?,?,0098D6B5,?,?,?,?,0098D778), ref: 0098D034
                          • SetLastError.KERNEL32 ref: 0098D04F
                          Memory Dump Source
                          • Source File: 0000000C.00000002.606295374.0000000000980000.00000040.00000001.00020000.00000000.sdmp, Offset: 00980000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_12_2_980000_winlogon.jbxd
                          Similarity
                          • API ID: Value$ErrorLast
                          • String ID:
                          • API String ID: 2506987500-0
                          • Opcode ID: 4f148fb448054b99fdb5313590ff83f86fc6d8762bc770a772f95ba4b575ef67
                          • Instruction ID: 6fec2de5146c8e78bb91389b8fa7175bb9818803dc829ced60922e11f8112e2d
                          • Opcode Fuzzy Hash: 4f148fb448054b99fdb5313590ff83f86fc6d8762bc770a772f95ba4b575ef67
                          • Instruction Fuzzy Hash: 1211E36130238482FA28B736A65533D2343AFC97F4F140728E936877EAEE7CC4428710
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 0098199C Relevance: 9.0, APIs: 6, Instructions: 42stringCOMMON
                          Download Yara Rule
                          APIs
                          Memory Dump Source
                          • Source File: 0000000C.00000002.606295374.0000000000980000.00000040.00000001.00020000.00000000.sdmp, Offset: 00980000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_12_2_980000_winlogon.jbxd
                          Similarity
                          • API ID: FileName$CloseFindHandleModuleOpenPathProcesslstrlen
                          • String ID:
                          • API String ID: 517849248-0
                          • Opcode ID: 01214db588610ff501214a343c1506f8e4016efad0e64bbd234dc336c45f59d3
                          • Instruction ID: 91a878bbc2fbeba322f7720d1a5998054158b104edbdc3b872a52bbb249ce04c
                          • Opcode Fuzzy Hash: 01214db588610ff501214a343c1506f8e4016efad0e64bbd234dc336c45f59d3
                          • Instruction Fuzzy Hash: 53014C31305A4082EB24DB56E89875963A9F788FC4F884039DE5E53756DF3CC98AC740
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 009836C8 Relevance: 9.0, APIs: 6, Instructions: 38threadCOMMON
                          Download Yara Rule
                          APIs
                          Memory Dump Source
                          • Source File: 0000000C.00000002.606295374.0000000000980000.00000040.00000001.00020000.00000000.sdmp, Offset: 00980000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_12_2_980000_winlogon.jbxd
                          Similarity
                          • API ID: CurrentProcessProtectVirtual$HandleModuleTerminateThread
                          • String ID:
                          • API String ID: 449555515-0
                          • Opcode ID: 33edae7e4393505c590e6bdf894c2b6337bb17a10dfae21a600636dc78c73843
                          • Instruction ID: 62c7a5ecfeea1d6b718f4a7117066dabd2a5ac094981c47b9834e8ff4e192731
                          • Opcode Fuzzy Hash: 33edae7e4393505c590e6bdf894c2b6337bb17a10dfae21a600636dc78c73843
                          • Instruction Fuzzy Hash: FC0116B5715B4086EF24AB2AF85971A73B4BB89B86F044429CE4D07B66EF3DC508C710
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 00988FE8 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 144COMMON
                          Download Yara Rule
                          APIs
                          • __except_validate_context_record.LIBVCRUNTIME ref: 00989013
                          • _IsNonwritableInCurrentImage.LIBCMT ref: 009890A8
                          • RtlUnwindEx.NTDLL ref: 009890F7
                          Strings
                          Memory Dump Source
                          • Source File: 0000000C.00000002.606295374.0000000000980000.00000040.00000001.00020000.00000000.sdmp, Offset: 00980000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_12_2_980000_winlogon.jbxd
                          Similarity
                          • API ID: CurrentImageNonwritableUnwind__except_validate_context_record
                          • String ID: csm$f
                          • API String ID: 2395640692-629598281
                          • Opcode ID: cf88226c4e0499e864df13b9fa0a288c301b8b6e63eb257c90d52d35e879efeb
                          • Instruction ID: 3722bb476a4f512ccffb78b59b7a02dcd3b06159782e23896302d7e72c447461
                          • Opcode Fuzzy Hash: cf88226c4e0499e864df13b9fa0a288c301b8b6e63eb257c90d52d35e879efeb
                          • Instruction Fuzzy Hash: E851CE3271D6028ACB14EF25E84CB79376AF384BC8F598524EE5757708EB79D981CB00
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 00981A40 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 30stringCOMMON
                          Download Yara Rule
                          APIs
                          Strings
                          Memory Dump Source
                          • Source File: 0000000C.00000002.606295374.0000000000980000.00000040.00000001.00020000.00000000.sdmp, Offset: 00980000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_12_2_980000_winlogon.jbxd
                          Similarity
                          • API ID: FinalHandleNamePathlstrlen
                          • String ID: \\?\
                          • API String ID: 2719912262-4282027825
                          • Opcode ID: c1daab9146f2a1614ef605d22fd4f721266e20aa8a0235322e79b2424596649d
                          • Instruction ID: 694a72ba1e71fb4d07bfc39c6cf8b75b12fb4cb6960d11d34745bbdfdfd4be7d
                          • Opcode Fuzzy Hash: c1daab9146f2a1614ef605d22fd4f721266e20aa8a0235322e79b2424596649d
                          • Instruction Fuzzy Hash: ADF0907230464192EB309F29F9C475A6728F748BC8F848029DA4947A59DF3CC68ECB00
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 0098BC98 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON
                          Download Yara Rule
                          APIs
                          Strings
                          Memory Dump Source
                          • Source File: 0000000C.00000002.606295374.0000000000980000.00000040.00000001.00020000.00000000.sdmp, Offset: 00980000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_12_2_980000_winlogon.jbxd
                          Similarity
                          • API ID: AddressFreeHandleLibraryModuleProc
                          • String ID: CorExitProcess$mscoree.dll
                          • API String ID: 4061214504-1276376045
                          • Opcode ID: 95c54818ea39ae4ab476006ce308989d1f654d2f667890579c20066112978b6c
                          • Instruction ID: ee7e22250e00d6eac3b3fbfed2abcba1729a814585c94560d9437fb94503b2e9
                          • Opcode Fuzzy Hash: 95c54818ea39ae4ab476006ce308989d1f654d2f667890579c20066112978b6c
                          • Instruction Fuzzy Hash: 43F05E62325B0582EF149F6DE88936A6320FB89BA1F58071DDAAA463F5DF3CC549C740
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 00983044 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 27COMMON
                          Download Yara Rule
                          APIs
                          Strings
                          Memory Dump Source
                          • Source File: 0000000C.00000002.606295374.0000000000980000.00000040.00000001.00020000.00000000.sdmp, Offset: 00980000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_12_2_980000_winlogon.jbxd
                          Similarity
                          • API ID: CombinePath
                          • String ID: \\.\pipe\
                          • API String ID: 3422762182-91387939
                          • Opcode ID: 8c685e1f0b85bfe06f91eeefbd03c12bff8419d51c8b157116edbf6ca1c9c829
                          • Instruction ID: 63fbd632a7d1916dbab20037a0f7fbf38eb60f106848028c10d14bb3985dc899
                          • Opcode Fuzzy Hash: 8c685e1f0b85bfe06f91eeefbd03c12bff8419d51c8b157116edbf6ca1c9c829
                          • Instruction Fuzzy Hash: 95F0A020704B8482EA009F1BF9043196360BB48FC0F088138EE4A07B1ADF3CC585C700
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 00985710 Relevance: 7.6, APIs: 5, Instructions: 124threadCOMMON
                          Download Yara Rule
                          APIs
                          • GetCurrentThreadId.KERNEL32 ref: 00985726
                          Memory Dump Source
                          • Source File: 0000000C.00000002.606295374.0000000000980000.00000040.00000001.00020000.00000000.sdmp, Offset: 00980000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_12_2_980000_winlogon.jbxd
                          Similarity
                          • API ID: CurrentThread
                          • String ID:
                          • API String ID: 2882836952-0
                          • Opcode ID: 0c7f3a11ae4e5ff47235e902b7b6ce7055ed727b420134bb2449cab27e882fd8
                          • Instruction ID: bad0ff0ea231d544a2e9db1c686b6b686558ea46d820b5bbc85a7f62cb356b3b
                          • Opcode Fuzzy Hash: 0c7f3a11ae4e5ff47235e902b7b6ce7055ed727b420134bb2449cab27e882fd8
                          • Instruction Fuzzy Hash: 4351F736619F84C6DB60EB56E48431AB7A4F3C8784F51411AFA8E87B68DB7CC848CF41
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 00963504 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE
                          Download Yara Rule
                          APIs
                          Memory Dump Source
                          • Source File: 0000000C.00000002.606091107.0000000000950000.00000040.00000001.00020000.00000000.sdmp, Offset: 00950000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_12_2_950000_winlogon.jbxd
                          Similarity
                          • API ID: _set_statfp
                          • String ID:
                          • API String ID: 1156100317-0
                          • Opcode ID: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
                          • Instruction ID: f8cc2ab8d5f2d585af5d2d219e3a775f2491af984d5c20aab78243ef190fdd08
                          • Opcode Fuzzy Hash: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
                          • Instruction Fuzzy Hash: E901F933E14F6211EB541928E55232911916F9D3B4F98CB39BEBF177EADA3CCB414200
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 00994104 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE
                          Download Yara Rule
                          APIs
                          Memory Dump Source
                          • Source File: 0000000C.00000002.606295374.0000000000980000.00000040.00000001.00020000.00000000.sdmp, Offset: 00980000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_12_2_980000_winlogon.jbxd
                          Similarity
                          • API ID: _set_statfp
                          • String ID:
                          • API String ID: 1156100317-0
                          • Opcode ID: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
                          • Instruction ID: 045238d37db26021e0200b7d5641cb1680b1efc3594eb020233b02471bd5c3ba
                          • Opcode Fuzzy Hash: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
                          • Instruction Fuzzy Hash: 8D01DB32A28F5122FF3B556DE866B6511096BB83F8F180A34E977077E6CB28C8C34601
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 00989650 Relevance: 7.6, APIs: 5, Instructions: 53COMMONLIBRARYCODE
                          Download Yara Rule
                          APIs
                          Memory Dump Source
                          • Source File: 0000000C.00000002.606295374.0000000000980000.00000040.00000001.00020000.00000000.sdmp, Offset: 00980000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_12_2_980000_winlogon.jbxd
                          Similarity
                          • API ID: ErrorLast
                          • String ID:
                          • API String ID: 1452528299-0
                          • Opcode ID: 46c896f13dff0714c7ccebb8ca9383bb675cc38bcf091c92c481f4a556b8b138
                          • Instruction ID: b667fba405c79c76d55b89cfa87253ebdf7a10a681aa5470df8bbd23647aafaa
                          • Opcode Fuzzy Hash: 46c896f13dff0714c7ccebb8ca9383bb675cc38bcf091c92c481f4a556b8b138
                          • Instruction Fuzzy Hash: 9511827571139082EF14BB36A8847393255AB89BE0F1C4A34EA2A5B7DAEF3CCC41C714
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 0095F040 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 182COMMON
                          Download Yara Rule
                          APIs
                          • _invalid_parameter_noinfo.LIBCMT ref: 0095F124
                          Strings
                          Memory Dump Source
                          • Source File: 0000000C.00000002.606091107.0000000000950000.00000040.00000001.00020000.00000000.sdmp, Offset: 00950000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_12_2_950000_winlogon.jbxd
                          Similarity
                          • API ID: _invalid_parameter_noinfo
                          • String ID: Tuesday$Wednesday$or copy constructor iterator'
                          • API String ID: 3215553584-4202648911
                          • Opcode ID: 9e57f18f61c22f0406784eb273be7b0d6046b42052b72e443b30de0c50228f55
                          • Instruction ID: 0c30e8e12cabda23caacc515f0e1fc15219dfe17f4a93b1a15a3a4aea45fb3c4
                          • Opcode Fuzzy Hash: 9e57f18f61c22f0406784eb273be7b0d6046b42052b72e443b30de0c50228f55
                          • Instruction Fuzzy Hash: 6B5138B6608B40C6EB29DB7BE56033A6B65F7857B2F544839CE1A17B65DB38C84DC300
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 0098AA1C Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 147COMMON
                          Download Yara Rule
                          APIs
                          • EncodePointer.KERNEL32 ref: 0098AA68
                          • _CallSETranslator.LIBVCRUNTIME ref: 0098AAB7
                          Strings
                          Memory Dump Source
                          • Source File: 0000000C.00000002.606295374.0000000000980000.00000040.00000001.00020000.00000000.sdmp, Offset: 00980000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_12_2_980000_winlogon.jbxd
                          Similarity
                          • API ID: CallEncodePointerTranslator
                          • String ID: MOC$RCC
                          • API String ID: 3544855599-2084237596
                          • Opcode ID: afa423ce38c0d5e6a55dfbc7a81328fa63e7332d8ee03f3f3ca57a2373e92492
                          • Instruction ID: f97a29d7bbe104737fd60631f51ae02239c2c97817054b28b5757322a3dc6c09
                          • Opcode Fuzzy Hash: afa423ce38c0d5e6a55dfbc7a81328fa63e7332d8ee03f3f3ca57a2373e92492
                          • Instruction Fuzzy Hash: AC519D33600B888AEB24EF65D4803AD77B5F798B8CF184216EF8A17B58DB78D595C701
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 0095A178 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMON
                          Download Yara Rule
                          APIs
                          • __except_validate_context_record.LIBVCRUNTIME ref: 0095A1A0
                          • __FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 0095A288
                          Strings
                          Memory Dump Source
                          • Source File: 0000000C.00000002.606091107.0000000000950000.00000040.00000001.00020000.00000000.sdmp, Offset: 00950000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_12_2_950000_winlogon.jbxd
                          Similarity
                          • API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
                          • String ID: csm$csm
                          • API String ID: 3896166516-3733052814
                          • Opcode ID: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
                          • Instruction ID: b0fed99783faebc9dcb40da191a164f6990b76a4b1c8cb5452872900b5b95f8d
                          • Opcode Fuzzy Hash: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
                          • Instruction Fuzzy Hash: BC519D32104781CACB34CF27A54432D77A4F395B9AF188316DF9987B95CB39D4A9CB0A
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 0098AD78 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMON
                          Download Yara Rule
                          APIs
                          • __except_validate_context_record.LIBVCRUNTIME ref: 0098ADA0
                          • __FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 0098AE88
                          Strings
                          Memory Dump Source
                          • Source File: 0000000C.00000002.606295374.0000000000980000.00000040.00000001.00020000.00000000.sdmp, Offset: 00980000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_12_2_980000_winlogon.jbxd
                          Similarity
                          • API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
                          • String ID: csm$csm
                          • API String ID: 3896166516-3733052814
                          • Opcode ID: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
                          • Instruction ID: 9c8d5b8091478786b3c41e30d55076e22ec2e126ee55de1dec7d892cd99846c7
                          • Opcode Fuzzy Hash: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
                          • Instruction Fuzzy Hash: 9951D272100780CAEB34AF26D58432D77A4F794B99F188617EB9987B95CB38D4A1CB02
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 00958405 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 135COMMON
                          Download Yara Rule
                          APIs
                          • __except_validate_context_record.LIBVCRUNTIME ref: 00958413
                          • _IsNonwritableInCurrentImage.LIBCMT ref: 009584A8
                          Strings
                          Memory Dump Source
                          • Source File: 0000000C.00000002.606091107.0000000000950000.00000040.00000001.00020000.00000000.sdmp, Offset: 00950000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_12_2_950000_winlogon.jbxd
                          Similarity
                          • API ID: CurrentImageNonwritable__except_validate_context_record
                          • String ID: csm$f
                          • API String ID: 3242871069-629598281
                          • Opcode ID: 114af5d7cf0438a1297bb8b9b6869ba79c6078414514cf9bb502ab9f42d0baed
                          • Instruction ID: 800cb2920a283def3cf5b377a9c0b199d3ca99939e8b28f85fc519b936708383
                          • Opcode Fuzzy Hash: 114af5d7cf0438a1297bb8b9b6869ba79c6078414514cf9bb502ab9f42d0baed
                          • Instruction Fuzzy Hash: CA519A327126018ACB18CF26E440B2A3769F354BDAF558564EE5B67708FF39DD8ACB04
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 009583E8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 75COMMON
                          Download Yara Rule
                          APIs
                          • __except_validate_context_record.LIBVCRUNTIME ref: 00958413
                          • _IsNonwritableInCurrentImage.LIBCMT ref: 009584A8
                          Strings
                          Memory Dump Source
                          • Source File: 0000000C.00000002.606091107.0000000000950000.00000040.00000001.00020000.00000000.sdmp, Offset: 00950000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_12_2_950000_winlogon.jbxd
                          Similarity
                          • API ID: CurrentImageNonwritable__except_validate_context_record
                          • String ID: csm$f
                          • API String ID: 3242871069-629598281
                          • Opcode ID: 0036035fc280b7a5a111a049c7edfc77b7be6b9ab52e14187ebc45e366edaa55
                          • Instruction ID: 93052bacb2d8b5fe1948ded594b46ac251a331ae848272ca1ecb7bf4884c1366
                          • Opcode Fuzzy Hash: 0036035fc280b7a5a111a049c7edfc77b7be6b9ab52e14187ebc45e366edaa55
                          • Instruction Fuzzy Hash: 2431AD72211B40D6CB14DF13E844B1A7768F780BDAF558514EE9B27B18EF38D94ACB04
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 00992058 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON
                          Download Yara Rule
                          APIs
                          Memory Dump Source
                          • Source File: 0000000C.00000002.606295374.0000000000980000.00000040.00000001.00020000.00000000.sdmp, Offset: 00980000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_12_2_980000_winlogon.jbxd
                          Similarity
                          • API ID: FileWrite$ConsoleErrorLastOutput
                          • String ID:
                          • API String ID: 2718003287-0
                          • Opcode ID: d9b1ad1a373a674d1985cb33d71231f2b71aece2c14fe5b700ae80922c385091
                          • Instruction ID: 5e4dca57f2c8cbcba79fde853bfab22818227defa680708fb06b3290a2109619
                          • Opcode Fuzzy Hash: d9b1ad1a373a674d1985cb33d71231f2b71aece2c14fe5b700ae80922c385091
                          • Instruction Fuzzy Hash: 6CC10532B14B809ADB11CFB9D4803AC3BB5F798BD8B148216DF5D97BA9DA38C516C740
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 00992980 Relevance: 6.2, APIs: 4, Instructions: 218COMMON
                          Download Yara Rule
                          APIs
                          Memory Dump Source
                          • Source File: 0000000C.00000002.606295374.0000000000980000.00000040.00000001.00020000.00000000.sdmp, Offset: 00980000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_12_2_980000_winlogon.jbxd
                          Similarity
                          • API ID: ConsoleErrorLastMode
                          • String ID:
                          • API String ID: 953036326-0
                          • Opcode ID: c5ecde4312ccfa2e1ed1a2c608d038f857b097ec6549ceb78086129b2e572a94
                          • Instruction ID: d0f55384dd0a93a99419e54d4c934ce893c725d8f0858a9c64339edcdfb9fb5f
                          • Opcode Fuzzy Hash: c5ecde4312ccfa2e1ed1a2c608d038f857b097ec6549ceb78086129b2e572a94
                          • Instruction Fuzzy Hash: 68810373B10A54A9EF20DF7DD4803AD3BA8F755B98F24410ADE4A67B54DB39C886C700
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 00987960 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMONLIBRARYCODE
                          Download Yara Rule
                          APIs
                          • GetSystemTimeAsFileTime.KERNEL32 ref: 0098798C
                          • GetCurrentThreadId.KERNEL32 ref: 0098799A
                          • GetCurrentProcessId.KERNEL32 ref: 009879A6
                          • QueryPerformanceCounter.KERNEL32 ref: 009879B6
                          Memory Dump Source
                          • Source File: 0000000C.00000002.606295374.0000000000980000.00000040.00000001.00020000.00000000.sdmp, Offset: 00980000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_12_2_980000_winlogon.jbxd
                          Similarity
                          • API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
                          • String ID:
                          • API String ID: 2933794660-0
                          • Opcode ID: 561ac6f4885ef0f33bff27beb4ddb95e6a253367b5c72fac45fcb4617ca9122b
                          • Instruction ID: ff01390f35e871d1c3ee1335e734b973775c58508221b735215a9b732da97738
                          • Opcode Fuzzy Hash: 561ac6f4885ef0f33bff27beb4ddb95e6a253367b5c72fac45fcb4617ca9122b
                          • Instruction Fuzzy Hash: 4F115B26714F118AEF10CF64E8553A933A4F71A768F440E25EA6D867A5DF78D1A88380
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 0098253C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 185COMMON
                          Download Yara Rule
                          APIs
                          Strings
                          Memory Dump Source
                          • Source File: 0000000C.00000002.606295374.0000000000980000.00000040.00000001.00020000.00000000.sdmp, Offset: 00980000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_12_2_980000_winlogon.jbxd
                          Similarity
                          • API ID: FileType
                          • String ID: \\.\pipe\
                          • API String ID: 3081899298-91387939
                          • Opcode ID: 41f2590248caa42fa42cbc4740ff50b79ee080d5b4a351d521f36d41c2820f1b
                          • Instruction ID: cacf879600c0f0c9b796ace86fea8e60e64a79b3abc4d60a9d448b89037b591c
                          • Opcode Fuzzy Hash: 41f2590248caa42fa42cbc4740ff50b79ee080d5b4a351d521f36d41c2820f1b
                          • Instruction Fuzzy Hash: CA61B536200B8186CB35FF2BE8543BA6768F389BD4F544026DE4A57B18EE35D645C700
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 00959E1C Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 147COMMON
                          Download Yara Rule
                          APIs
                          • _CallSETranslator.LIBVCRUNTIME ref: 00959EB7
                          Strings
                          Memory Dump Source
                          • Source File: 0000000C.00000002.606091107.0000000000950000.00000040.00000001.00020000.00000000.sdmp, Offset: 00950000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_12_2_950000_winlogon.jbxd
                          Similarity
                          • API ID: CallTranslator
                          • String ID: MOC$RCC
                          • API String ID: 3163161869-2084237596
                          • Opcode ID: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
                          • Instruction ID: d0fd95a8ce291e2ad71b58fffc10059709a4c426d7fe97fa1b48c36f90c3e9e4
                          • Opcode Fuzzy Hash: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
                          • Instruction Fuzzy Hash: B7517A33A05B84CAEB20DF66D48039D77A4F789B8DF144616EF4917B58DB38D599C700
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 00982330 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 141COMMON
                          Download Yara Rule
                          APIs
                          Strings
                          Memory Dump Source
                          • Source File: 0000000C.00000002.606295374.0000000000980000.00000040.00000001.00020000.00000000.sdmp, Offset: 00980000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_12_2_980000_winlogon.jbxd
                          Similarity
                          • API ID: FileType
                          • String ID: \\.\pipe\
                          • API String ID: 3081899298-91387939
                          • Opcode ID: 002250ee4f7fb53d82cbff54f4c55d9c13c210cbd3ade0a461cf797918ee8e55
                          • Instruction ID: c1c6272d8e0c2a29c17d51296ef97956884b591db01744804721e9723cb8d866
                          • Opcode Fuzzy Hash: 002250ee4f7fb53d82cbff54f4c55d9c13c210cbd3ade0a461cf797918ee8e55
                          • Instruction Fuzzy Hash: A241D53260878181D734FF3AE5A837AA759F3D5B80F854129EE9A03B29DE3DC945C790
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 009926F0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON
                          Download Yara Rule
                          APIs
                          Strings
                          Memory Dump Source
                          • Source File: 0000000C.00000002.606295374.0000000000980000.00000040.00000001.00020000.00000000.sdmp, Offset: 00980000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_12_2_980000_winlogon.jbxd
                          Similarity
                          • API ID: ErrorFileLastWrite
                          • String ID: U
                          • API String ID: 442123175-4171548499
                          • Opcode ID: 94e3e9b2e49fb54f8b51ea0afa049cb5a9b4caf00c445db25a5723c425a58a56
                          • Instruction ID: dea70a2d1b394ffc2052cfb502197b40d18748fccc1d977ad10a2865e1686cf0
                          • Opcode Fuzzy Hash: 94e3e9b2e49fb54f8b51ea0afa049cb5a9b4caf00c445db25a5723c425a58a56
                          • Instruction Fuzzy Hash: 1831C332719B8096DB20DF6AE8443AAB7A4F798BD4F504025EE4E87758EF3CC441CB40
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 009894A0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMONLIBRARYCODE
                          Download Yara Rule
                          APIs
                          Strings
                          Memory Dump Source
                          • Source File: 0000000C.00000002.606295374.0000000000980000.00000040.00000001.00020000.00000000.sdmp, Offset: 00980000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_12_2_980000_winlogon.jbxd
                          Similarity
                          • API ID: ExceptionFileHeaderRaise
                          • String ID: csm
                          • API String ID: 2573137834-1018135373
                          • Opcode ID: 596d8aa0106168f831d5a6617a756b303fb26e5894bac8705379b132699e985d
                          • Instruction ID: 42acd8dee187706c0fa6134510d367cf7c68204c8944e07652db1c1eae5a181f
                          • Opcode Fuzzy Hash: 596d8aa0106168f831d5a6617a756b303fb26e5894bac8705379b132699e985d
                          • Instruction Fuzzy Hash: 7F111836214B8082DB218F29F84436AB7A5FB88B94F584225EF8D47B29DF3CC552CB00
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 00957356 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 18COMMON
                          Download Yara Rule
                          APIs
                          • __std_exception_copy.LIBVCRUNTIME ref: 0095737C
                          Strings
                          Memory Dump Source
                          • Source File: 0000000C.00000002.606091107.0000000000950000.00000040.00000001.00020000.00000000.sdmp, Offset: 00950000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_12_2_950000_winlogon.jbxd
                          Similarity
                          • API ID: __std_exception_copy
                          • String ID: ierarchy Descriptor'$riptor at (
                          • API String ID: 592178966-758928094
                          • Opcode ID: 13d46e236c22f038e3183f277bc937bc0c01c293d14bd07e4c5c2ea041926035
                          • Instruction ID: 140e5e8df54540dae20c5eb9a578e21ded10901d5e79843b7ddc591f6fc44b3e
                          • Opcode Fuzzy Hash: 13d46e236c22f038e3183f277bc937bc0c01c293d14bd07e4c5c2ea041926035
                          • Instruction Fuzzy Hash: 6AE08CA1A50B48D0DF068F22E88039833A0EBA8B64F9991229E5C06311FA38D2E9C300
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 009573B4 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 17COMMON
                          Download Yara Rule
                          APIs
                          • __std_exception_copy.LIBVCRUNTIME ref: 009573D8
                          Strings
                          Memory Dump Source
                          • Source File: 0000000C.00000002.606091107.0000000000950000.00000040.00000001.00020000.00000000.sdmp, Offset: 00950000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_12_2_950000_winlogon.jbxd
                          Similarity
                          • API ID: __std_exception_copy
                          • String ID: Locator'$riptor at (
                          • API String ID: 592178966-4215709766
                          • Opcode ID: af0f0512ca75cd806a30771dd11e2a0f17b9e6725b3a9df23089972a8cb9d3f7
                          • Instruction ID: 893736bf7ceaf57e27c8b3a9bebd2fe1c5bccd20ba912ed7d392242c5f8b0a97
                          • Opcode Fuzzy Hash: af0f0512ca75cd806a30771dd11e2a0f17b9e6725b3a9df23089972a8cb9d3f7
                          • Instruction Fuzzy Hash: EAE08C61A11F48C0DF068F22E88039873A0EBA8B64F899122CE4C06311EA38D1E9C300
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 00981BF4 Relevance: 5.1, APIs: 4, Instructions: 52memoryCOMMON
                          Download Yara Rule
                          APIs
                          • GetProcessHeap.KERNEL32 ref: 00981C2D
                          • HeapAlloc.KERNEL32 ref: 00981C3B
                          • GetProcessHeap.KERNEL32 ref: 00981C77
                          • HeapFree.KERNEL32 ref: 00981C85
                            • Part of subcall function 0098152C: StrCmpIW.SHLWAPI ref: 0098155D
                          Memory Dump Source
                          • Source File: 0000000C.00000002.606295374.0000000000980000.00000040.00000001.00020000.00000000.sdmp, Offset: 00980000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_12_2_980000_winlogon.jbxd
                          Similarity
                          • API ID: Heap$Process$AllocFree
                          • String ID:
                          • API String ID: 756756679-0
                          • Opcode ID: e6b128499454e36a5cfdb4ce6de946333e896a2fc86765bea62df52d9c8f7d1a
                          • Instruction ID: 78a44537cd70046452538e32d5671ab0f0a88e9814aceeb5521252be57fc0e28
                          • Opcode Fuzzy Hash: e6b128499454e36a5cfdb4ce6de946333e896a2fc86765bea62df52d9c8f7d1a
                          • Instruction Fuzzy Hash: A6117025701B4482EB14EF6AE80832977A9FB89FD0F184029DE8E97736DF38C442C340
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 00981268 Relevance: 5.0, APIs: 4, Instructions: 21memoryCOMMON
                          Download Yara Rule
                          APIs
                          Memory Dump Source
                          • Source File: 0000000C.00000002.606295374.0000000000980000.00000040.00000001.00020000.00000000.sdmp, Offset: 00980000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_12_2_980000_winlogon.jbxd
                          Similarity
                          • API ID: Heap$AllocProcess
                          • String ID:
                          • API String ID: 1617791916-0
                          • Opcode ID: c7b0d7b4e65e150846e46a28cdf479c2d04166a2b9ed3272f310b0e97a34ba1d
                          • Instruction ID: b78646385601bbf59bc1ec235354a7744713d81ffa3012c3d9906097f73b6c8b
                          • Opcode Fuzzy Hash: c7b0d7b4e65e150846e46a28cdf479c2d04166a2b9ed3272f310b0e97a34ba1d
                          • Instruction Fuzzy Hash: 84E09A35A01A0486EB288F66D80834A3AE1FB8DF4AF08C028C90907362DF7D84D9CB90
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 00981000 Relevance: 5.0, APIs: 4, Instructions: 20memoryCOMMON
                          Download Yara Rule
                          APIs
                          Memory Dump Source
                          • Source File: 0000000C.00000002.606295374.0000000000980000.00000040.00000001.00020000.00000000.sdmp, Offset: 00980000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_12_2_980000_winlogon.jbxd
                          Similarity
                          • API ID: Heap$AllocProcess
                          • String ID:
                          • API String ID: 1617791916-0
                          • Opcode ID: 952b2c0fe5133ab7956e2ef84fe5bf2b2b692290a663e8cebccb5d827e1e35ea
                          • Instruction ID: 39a799a7567d1264fdb0cddc1c090bf93e7f6d4ec543273ac7c5b3e84387bd7d
                          • Opcode Fuzzy Hash: 952b2c0fe5133ab7956e2ef84fe5bf2b2b692290a663e8cebccb5d827e1e35ea
                          • Instruction Fuzzy Hash: BEE04F75611A0487EB289F67D80835A7BE1FB8CF56F48C028C90907326EF3C84D9CB20
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Execution Graph

                          Execution Coverage:2.3%
                          Dynamic/Decrypted Code Coverage:97.6%
                          Signature Coverage:4.7%
                          Total number of Nodes:255
                          Total number of Limit Nodes:25
                          execution_graph 14941 16f394 14943 16f3f1 __vcrt_InitializeCriticalSectionEx 14941->14943 14947 16f3ec __vcrt_InitializeCriticalSectionEx 14941->14947 14942 16f421 LoadLibraryExW 14944 16f4f6 14942->14944 14945 16f446 GetLastError 14942->14945 14944->14943 14946 16f50d FreeLibrary 14944->14946 14945->14947 14946->14943 14947->14942 14947->14943 14948 16f480 LoadLibraryExW 14947->14948 14948->14944 14948->14947 14949 162244 GetProcessIdOfThread GetCurrentProcessId 14950 162275 14949->14950 14952 162312 14949->14952 14956 161934 OpenProcess 14950->14956 14954 162287 CreateFileW 14954->14952 14955 1622cb WriteFile ReadFile CloseHandle 14954->14955 14955->14952 14957 161960 IsWow64Process 14956->14957 14958 161989 14956->14958 14959 161972 14957->14959 14960 161980 CloseHandle 14957->14960 14958->14952 14958->14954 14959->14960 14960->14958 14961 169dc4 14963 169ecd __vcrt_InitializeCriticalSectionEx 14961->14963 14967 169e08 __vcrt_InitializeCriticalSectionEx 14961->14967 14962 169e36 LoadLibraryExW 14964 169e57 GetLastError 14962->14964 14965 169ead 14962->14965 14964->14967 14965->14963 14966 169ec4 FreeLibrary 14965->14966 14966->14963 14967->14962 14967->14963 14968 169e79 LoadLibraryExW 14967->14968 14968->14965 14968->14967 14969 16fa50 14978 16c99c EnterCriticalSection 14969->14978 14971 16fa60 14972 171d0c 33 API calls 14971->14972 14973 16fa69 14972->14973 14974 16f858 35 API calls 14973->14974 14977 16fa77 14973->14977 14975 16fa72 14974->14975 14976 16f948 GetStdHandle GetFileType 14975->14976 14976->14977 14979 176240 14978->14979 14980 165cf0 14981 165cfd 14980->14981 14982 165d09 14981->14982 14991 165e1a 14981->14991 14983 165d8d 14982->14983 14984 165d3e 14982->14984 14985 165d66 SetThreadContext 14984->14985 14985->14983 14986 165e41 VirtualProtect FlushInstructionCache 14986->14991 14987 165efe 14988 165f1e 14987->14988 15002 1643e0 14987->15002 14998 164df0 GetCurrentProcess 14988->14998 14990 165f23 14993 165f77 14990->14993 14994 165f37 ResumeThread 14990->14994 14991->14986 14991->14987 15006 167940 14993->15006 14995 165f6b 14994->14995 14995->14990 14997 165fbf 14999 164e0c 14998->14999 15000 164e22 VirtualProtect FlushInstructionCache 14999->15000 15001 164e53 14999->15001 15000->14999 15001->14990 15004 1643fc 15002->15004 15003 16445f 15003->14988 15004->15003 15005 164412 VirtualFree 15004->15005 15005->15004 15008 167949 _invalid_parameter_noinfo 15006->15008 15007 167954 15007->14997 15008->15007 15011 168320 RtlCaptureContext 15008->15011 15010 168157 15010->14997 15012 16833a capture_previous_context 15011->15012 15012->15010 15013 16d6cc 15019 16d6dd Concurrency::details::SchedulerProxy::DeleteThis 15013->15019 15014 16d72e 15023 16d6ac 15014->15023 15015 16d712 HeapAlloc 15017 16d72c 15015->15017 15015->15019 15019->15014 15019->15015 15020 16b85c 15019->15020 15026 16b89c 15020->15026 15022 16b86e 15022->15019 15029 16cfa0 GetLastError 15023->15029 15025 16d6b5 15025->15017 15027 16c99c Concurrency::details::SchedulerProxy::DeleteThis EnterCriticalSection 15026->15027 15028 16b8a9 15027->15028 15028->15022 15030 16cfe1 FlsSetValue 15029->15030 15033 16cfc4 15029->15033 15031 16cff3 15030->15031 15035 16cfd1 _CreateFrameInfo 15030->15035 15045 16d6cc 15031->15045 15033->15030 15033->15035 15035->15025 15036 16d020 FlsSetValue 15038 16d03e 15036->15038 15039 16d02c FlsSetValue 15036->15039 15037 16d010 FlsSetValue 15040 16d019 15037->15040 15058 16cb94 15038->15058 15039->15040 15052 16d744 15040->15052 15044 16d744 Concurrency::details::SchedulerProxy::DeleteThis 3 API calls 15044->15035 15051 16d6dd Concurrency::details::SchedulerProxy::DeleteThis 15045->15051 15046 16d72e 15048 16d6ac Concurrency::details::SchedulerProxy::DeleteThis 7 API calls 15046->15048 15047 16d712 HeapAlloc 15049 16d002 15047->15049 15047->15051 15048->15049 15049->15036 15049->15037 15050 16b85c Concurrency::details::SchedulerProxy::DeleteThis EnterCriticalSection 15050->15051 15051->15046 15051->15047 15051->15050 15053 16d77a 15052->15053 15054 16d749 Concurrency::details::SchedulerProxy::DeleteThis 15052->15054 15053->15035 15054->15053 15055 16d764 GetLastError 15054->15055 15056 16d771 Concurrency::details::SchedulerProxy::DeleteThis 15055->15056 15057 16d6ac Concurrency::details::SchedulerProxy::DeleteThis 7 API calls 15056->15057 15057->15053 15063 16ca6c 15058->15063 15060 16cc46 15066 16caec 15060->15066 15062 16cc5b 15062->15044 15064 16c99c Concurrency::details::SchedulerProxy::DeleteThis EnterCriticalSection 15063->15064 15065 16ca88 15064->15065 15065->15060 15067 16c99c Concurrency::details::SchedulerProxy::DeleteThis EnterCriticalSection 15066->15067 15068 16cb08 15067->15068 15071 16cd7c 15068->15071 15070 16cb1e 15070->15062 15072 16cdc4 Concurrency::details::SchedulerProxy::DeleteThis 15071->15072 15073 16cd98 Concurrency::details::SchedulerProxy::DeleteThis 15071->15073 15072->15070 15073->15072 15075 1707b4 15073->15075 15076 170850 15075->15076 15079 1707d7 15075->15079 15077 1708a3 15076->15077 15080 16d744 Concurrency::details::SchedulerProxy::DeleteThis 8 API calls 15076->15080 15141 170954 15077->15141 15079->15076 15084 16d744 Concurrency::details::SchedulerProxy::DeleteThis 8 API calls 15079->15084 15086 170816 15079->15086 15081 170874 15080->15081 15082 16d744 Concurrency::details::SchedulerProxy::DeleteThis 8 API calls 15081->15082 15085 170888 15082->15085 15083 170838 15087 16d744 Concurrency::details::SchedulerProxy::DeleteThis 8 API calls 15083->15087 15089 17080a 15084->15089 15090 16d744 Concurrency::details::SchedulerProxy::DeleteThis 8 API calls 15085->15090 15086->15083 15091 16d744 Concurrency::details::SchedulerProxy::DeleteThis 8 API calls 15086->15091 15093 170844 15087->15093 15088 1708af 15092 17090e 15088->15092 15098 16d744 8 API calls Concurrency::details::SchedulerProxy::DeleteThis 15088->15098 15101 172fc8 15089->15101 15095 170897 15090->15095 15096 17082c 15091->15096 15097 16d744 Concurrency::details::SchedulerProxy::DeleteThis 8 API calls 15093->15097 15099 16d744 Concurrency::details::SchedulerProxy::DeleteThis 8 API calls 15095->15099 15129 1730d4 15096->15129 15097->15076 15098->15088 15099->15077 15102 1730cc 15101->15102 15103 172fd1 15101->15103 15102->15086 15104 172feb 15103->15104 15105 16d744 Concurrency::details::SchedulerProxy::DeleteThis 8 API calls 15103->15105 15106 172ffd 15104->15106 15108 16d744 Concurrency::details::SchedulerProxy::DeleteThis 8 API calls 15104->15108 15105->15104 15107 17300f 15106->15107 15109 16d744 Concurrency::details::SchedulerProxy::DeleteThis 8 API calls 15106->15109 15110 173021 15107->15110 15111 16d744 Concurrency::details::SchedulerProxy::DeleteThis 8 API calls 15107->15111 15108->15106 15109->15107 15112 173033 15110->15112 15113 16d744 Concurrency::details::SchedulerProxy::DeleteThis 8 API calls 15110->15113 15111->15110 15114 173045 15112->15114 15115 16d744 Concurrency::details::SchedulerProxy::DeleteThis 8 API calls 15112->15115 15113->15112 15116 173057 15114->15116 15118 16d744 Concurrency::details::SchedulerProxy::DeleteThis 8 API calls 15114->15118 15115->15114 15117 173069 15116->15117 15119 16d744 Concurrency::details::SchedulerProxy::DeleteThis 8 API calls 15116->15119 15120 17307b 15117->15120 15121 16d744 Concurrency::details::SchedulerProxy::DeleteThis 8 API calls 15117->15121 15118->15116 15119->15117 15122 17308d 15120->15122 15123 16d744 Concurrency::details::SchedulerProxy::DeleteThis 8 API calls 15120->15123 15121->15120 15124 1730a2 15122->15124 15125 16d744 Concurrency::details::SchedulerProxy::DeleteThis 8 API calls 15122->15125 15123->15122 15126 1730b7 15124->15126 15127 16d744 Concurrency::details::SchedulerProxy::DeleteThis 8 API calls 15124->15127 15125->15124 15126->15102 15128 16d744 Concurrency::details::SchedulerProxy::DeleteThis 8 API calls 15126->15128 15127->15126 15128->15102 15130 1730d9 15129->15130 15139 17313a 15129->15139 15131 16d744 Concurrency::details::SchedulerProxy::DeleteThis 8 API calls 15130->15131 15133 1730f2 15130->15133 15131->15133 15132 173104 15135 173116 15132->15135 15136 16d744 Concurrency::details::SchedulerProxy::DeleteThis 8 API calls 15132->15136 15133->15132 15134 16d744 Concurrency::details::SchedulerProxy::DeleteThis 8 API calls 15133->15134 15134->15132 15137 173128 15135->15137 15138 16d744 Concurrency::details::SchedulerProxy::DeleteThis 8 API calls 15135->15138 15136->15135 15137->15139 15140 16d744 Concurrency::details::SchedulerProxy::DeleteThis 8 API calls 15137->15140 15138->15137 15139->15083 15140->15139 15142 170959 15141->15142 15143 170985 15141->15143 15142->15143 15147 173174 15142->15147 15143->15088 15146 16d744 Concurrency::details::SchedulerProxy::DeleteThis 8 API calls 15146->15143 15148 17317d 15147->15148 15149 17097d 15147->15149 15183 173140 15148->15183 15149->15146 15152 173140 Concurrency::details::SchedulerProxy::DeleteThis 8 API calls 15153 1731a6 15152->15153 15154 173140 Concurrency::details::SchedulerProxy::DeleteThis 8 API calls 15153->15154 15155 1731b4 15154->15155 15156 173140 Concurrency::details::SchedulerProxy::DeleteThis 8 API calls 15155->15156 15157 1731c2 15156->15157 15158 173140 Concurrency::details::SchedulerProxy::DeleteThis 8 API calls 15157->15158 15159 1731d1 15158->15159 15160 16d744 Concurrency::details::SchedulerProxy::DeleteThis 8 API calls 15159->15160 15161 1731dd 15160->15161 15162 16d744 Concurrency::details::SchedulerProxy::DeleteThis 8 API calls 15161->15162 15163 1731e9 15162->15163 15164 16d744 Concurrency::details::SchedulerProxy::DeleteThis 8 API calls 15163->15164 15165 1731f5 15164->15165 15166 173140 Concurrency::details::SchedulerProxy::DeleteThis 8 API calls 15165->15166 15167 173203 15166->15167 15168 173140 Concurrency::details::SchedulerProxy::DeleteThis 8 API calls 15167->15168 15169 173211 15168->15169 15170 173140 Concurrency::details::SchedulerProxy::DeleteThis 8 API calls 15169->15170 15171 17321f 15170->15171 15172 173140 Concurrency::details::SchedulerProxy::DeleteThis 8 API calls 15171->15172 15173 17322d 15172->15173 15174 173140 Concurrency::details::SchedulerProxy::DeleteThis 8 API calls 15173->15174 15175 17323c 15174->15175 15176 16d744 Concurrency::details::SchedulerProxy::DeleteThis 8 API calls 15175->15176 15177 173248 15176->15177 15178 16d744 Concurrency::details::SchedulerProxy::DeleteThis 8 API calls 15177->15178 15179 173254 15178->15179 15180 16d744 Concurrency::details::SchedulerProxy::DeleteThis 8 API calls 15179->15180 15181 173260 15180->15181 15182 16d744 Concurrency::details::SchedulerProxy::DeleteThis 8 API calls 15181->15182 15182->15149 15184 173167 15183->15184 15186 173156 15183->15186 15184->15152 15185 16d744 Concurrency::details::SchedulerProxy::DeleteThis 8 API calls 15185->15186 15186->15184 15186->15185 15187 162b2c 15189 162b9d 15187->15189 15188 162ee0 15189->15188 15190 162bc9 GetModuleHandleA 15189->15190 15191 162bdb __vcrt_InitializeCriticalSectionEx 15190->15191 15191->15188 15192 162c14 StrCmpNIW 15191->15192 15192->15188 15197 162c39 15192->15197 15193 16199c 6 API calls 15193->15197 15194 162e05 lstrlenW 15194->15197 15195 162d4b lstrlenW 15195->15197 15196 163844 StrCmpNIW 15196->15197 15197->15188 15197->15193 15197->15194 15197->15195 15197->15196 15198 16152c StrCmpIW StrCmpW 15197->15198 15198->15197 15199 16554d 15201 165554 15199->15201 15200 1655bb 15201->15200 15202 165637 VirtualProtect 15201->15202 15203 165663 GetLastError 15202->15203 15204 165671 15202->15204 15203->15204 15205 1628c8 15207 16290e 15205->15207 15206 162970 15207->15206 15209 163844 15207->15209 15210 163851 StrCmpNIW 15209->15210 15211 163866 15209->15211 15210->15211 15211->15207 15212 163ab9 15215 163a06 _invalid_parameter_noinfo 15212->15215 15213 163a70 15214 163a56 VirtualQuery 15214->15213 15214->15215 15215->15213 15215->15214 15216 163a8a VirtualAlloc 15215->15216 15216->15213 15217 163abb GetLastError 15216->15217 15217->15213 15217->15215 15218 13273c 15219 13276a 15218->15219 15220 1327c5 VirtualAlloc 15219->15220 15223 1328d4 15219->15223 15222 1327ec 15220->15222 15220->15223 15221 132858 LoadLibraryA 15221->15222 15222->15221 15222->15223

                          Executed Functions

                          Function 00162B2C Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 264stringlibraryloaderCOMMON
                          Download Yara Rule

                          Control-flow Graph

                          • Executed
                          • Not Executed
                          control_flow_graph 51 162b2c-162b97 call 182ce0 53 162b9d-162ba5 51->53 54 162ee0-162f03 53->54 55 162bab-162bb1 53->55 55->54 56 162bb7-162bba 55->56 56->54 57 162bc0-162bc3 56->57 57->54 58 162bc9-162bd9 GetModuleHandleA 57->58 59 162bed 58->59 60 162bdb-162beb call 176090 58->60 62 162bf0-162c0e 59->62 60->62 62->54 65 162c14-162c33 StrCmpNIW 62->65 65->54 66 162c39-162c3d 65->66 66->54 67 162c43-162c4d 66->67 67->54 68 162c53-162c5a 67->68 68->54 69 162c60-162c73 68->69 70 162c75-162c81 69->70 71 162c83 69->71 72 162c86-162c8a 70->72 71->72 73 162c8c-162c98 72->73 74 162c9a 72->74 75 162c9d-162ca7 73->75 74->75 76 162d9d-162da1 75->76 77 162cad-162cb0 75->77 78 162da7-162daa 76->78 79 162ed2-162eda 76->79 80 162cc2-162ccc 77->80 81 162cb2-162cbf call 16199c 77->81 84 162dac-162db8 call 16199c 78->84 85 162dbb-162dc5 78->85 79->54 79->69 82 162d00-162d0a 80->82 83 162cce-162cdb 80->83 81->80 88 162d0c-162d19 82->88 89 162d3a-162d3d 82->89 83->82 87 162cdd-162cea 83->87 84->85 91 162dc7-162dd4 85->91 92 162df5-162df8 85->92 96 162ced-162cf3 87->96 88->89 97 162d1b-162d28 88->97 98 162d3f-162d49 call 161bbc 89->98 99 162d4b-162d58 lstrlenW 89->99 91->92 101 162dd6-162de3 91->101 94 162e05-162e12 lstrlenW 92->94 95 162dfa-162e03 call 161bbc 92->95 105 162e14-162e1e 94->105 106 162e35-162e3f call 163844 94->106 95->94 121 162e4a-162e55 95->121 103 162d93-162d98 96->103 104 162cf9-162cfe 96->104 107 162d2b-162d31 97->107 98->99 98->103 109 162d5a-162d64 99->109 110 162d7b-162d8d call 163844 99->110 111 162de6-162dec 101->111 114 162e42-162e44 103->114 104->82 104->96 105->106 115 162e20-162e33 call 16152c 105->115 106->114 107->103 116 162d33-162d38 107->116 109->110 119 162d66-162d79 call 16152c 109->119 110->103 110->114 120 162dee-162df3 111->120 111->121 114->79 114->121 115->106 115->121 116->89 116->107 119->103 119->110 120->92 120->111 126 162e57-162e5b 121->126 127 162ecc-162ed0 121->127 130 162e63-162e7d call 1685c0 126->130 131 162e5d-162e61 126->131 127->79 132 162e80-162e83 130->132 131->130 131->132 135 162ea6-162ea9 132->135 136 162e85-162ea3 call 1685c0 132->136 135->127 138 162eab-162ec9 call 1685c0 135->138 136->135 138->127
                          APIs
                          • GetModuleHandleA.KERNEL32 ref: 00162BD0
                          • lstrlenW.KERNEL32 ref: 00162E0A
                            • Part of subcall function 0016199C: OpenProcess.KERNEL32 ref: 001619C2
                            • Part of subcall function 0016199C: K32GetModuleFileNameExW.KERNEL32 ref: 001619E0
                            • Part of subcall function 0016199C: PathFindFileNameW.SHLWAPI ref: 001619EF
                            • Part of subcall function 0016199C: lstrlenW.KERNEL32 ref: 001619FB
                            • Part of subcall function 0016199C: StrCpyW.SHLWAPI ref: 00161A0E
                            • Part of subcall function 0016199C: CloseHandle.KERNEL32 ref: 00161A1C
                          • GetProcAddress.KERNEL32 ref: 00162BE5
                            • Part of subcall function 0016152C: StrCmpIW.SHLWAPI ref: 0016155D
                            • Part of subcall function 00163844: StrCmpNIW.SHLWAPI ref: 0016385C
                          • StrCmpNIW.SHLWAPI ref: 00162C28
                          • lstrlenW.KERNEL32 ref: 00162D50
                          Strings
                          Memory Dump Source
                          • Source File: 0000000D.00000002.408938277.0000000000160000.00000040.00001000.00020000.00000000.sdmp, Offset: 00160000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_13_2_160000_sc.jbxd
                          Similarity
                          • API ID: lstrlen$FileHandleModuleName$AddressCloseFindOpenPathProcProcess
                          • String ID: NtQueryObject$\Device\Nsi$ntdll.dll
                          • API String ID: 2119608203-3850299575
                          • Opcode ID: 4f621fb1587c0d31dffa94ac8be990c76594e3be50ef12941f5ce2f96c448f72
                          • Instruction ID: 3b1f03c625036d8815359b5f0762367b1a23a9f6ca533881e83552d3d7e45829
                          • Opcode Fuzzy Hash: 4f621fb1587c0d31dffa94ac8be990c76594e3be50ef12941f5ce2f96c448f72
                          • Instruction Fuzzy Hash: 10A1AF72311E9086DB29CF69DC507A9B365FB94F98F449026EE4A53B14EF39CDA0C740
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 00162244 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 52filethreadCOMMON
                          Download Yara Rule

                          Control-flow Graph

                          APIs
                          • GetProcessIdOfThread.KERNEL32 ref: 00162259
                          • GetCurrentProcessId.KERNEL32 ref: 00162263
                            • Part of subcall function 00161934: OpenProcess.KERNEL32 ref: 00161952
                            • Part of subcall function 00161934: IsWow64Process.KERNEL32 ref: 00161968
                            • Part of subcall function 00161934: CloseHandle.KERNEL32 ref: 00161983
                          • CreateFileW.KERNEL32 ref: 001622BC
                          • WriteFile.KERNEL32 ref: 001622E4
                          • ReadFile.KERNEL32 ref: 00162303
                          • CloseHandle.KERNEL32 ref: 0016230C
                          Strings
                          • \\.\pipe\dialerchildproc32, xrefs: 00162293
                          • \\.\pipe\dialerchildproc64, xrefs: 0016228C
                          Memory Dump Source
                          • Source File: 0000000D.00000002.408938277.0000000000160000.00000040.00001000.00020000.00000000.sdmp, Offset: 00160000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_13_2_160000_sc.jbxd
                          Similarity
                          • API ID: Process$File$CloseHandle$CreateCurrentOpenReadThreadWow64Write
                          • String ID: \\.\pipe\dialerchildproc32$\\.\pipe\dialerchildproc64
                          • API String ID: 2171963597-1373409510
                          • Opcode ID: d76f145db3bc14c8b60d6abb5b011cd5988a1ad04fc2d4b7169b2a78ec3c4c79
                          • Instruction ID: cf87361d4119941c02c85ff80787c730d24773d4f275703265650bcbb3345d9f
                          • Opcode Fuzzy Hash: d76f145db3bc14c8b60d6abb5b011cd5988a1ad04fc2d4b7169b2a78ec3c4c79
                          • Instruction Fuzzy Hash: D9214A36618B4083EB10CB25F9483AA77B1F789BA5F544215EA9E03BA8DF7CC549CF00
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 00161628 Relevance: 50.9, APIs: 20, Strings: 9, Instructions: 157registrymemoryCOMMON
                          Download Yara Rule

                          Control-flow Graph

                          APIs
                          • GetProcessHeap.KERNEL32 ref: 00161633
                          • HeapAlloc.KERNEL32 ref: 00161642
                            • Part of subcall function 00161268: GetProcessHeap.KERNEL32 ref: 0016126E
                            • Part of subcall function 00161268: HeapAlloc.KERNEL32 ref: 0016127D
                            • Part of subcall function 00161268: GetProcessHeap.KERNEL32 ref: 00161297
                            • Part of subcall function 00161268: HeapAlloc.KERNEL32 ref: 001612A8
                            • Part of subcall function 00161000: GetProcessHeap.KERNEL32 ref: 00161006
                            • Part of subcall function 00161000: HeapAlloc.KERNEL32 ref: 00161015
                            • Part of subcall function 00161000: GetProcessHeap.KERNEL32 ref: 00161028
                            • Part of subcall function 00161000: HeapAlloc.KERNEL32 ref: 00161037
                          • RegOpenKeyExW.ADVAPI32 ref: 001616B2
                          • RegOpenKeyExW.ADVAPI32 ref: 001616DF
                          • RegCloseKey.ADVAPI32 ref: 001616F9
                          • RegOpenKeyExW.ADVAPI32 ref: 00161719
                          • RegCloseKey.ADVAPI32 ref: 00161734
                          • RegOpenKeyExW.ADVAPI32 ref: 00161754
                          • RegCloseKey.ADVAPI32 ref: 0016176F
                          • RegOpenKeyExW.ADVAPI32 ref: 0016178F
                          • RegCloseKey.ADVAPI32 ref: 001617AA
                          • RegOpenKeyExW.ADVAPI32 ref: 001617CA
                          • RegCloseKey.ADVAPI32 ref: 001617E5
                          • RegOpenKeyExW.ADVAPI32 ref: 00161805
                          • RegCloseKey.ADVAPI32 ref: 00161820
                          • RegOpenKeyExW.ADVAPI32 ref: 00161840
                          • RegCloseKey.ADVAPI32 ref: 0016185B
                          • RegOpenKeyExW.ADVAPI32 ref: 0016187B
                          • RegCloseKey.ADVAPI32 ref: 00161896
                          • RegCloseKey.ADVAPI32 ref: 001618A0
                            • Part of subcall function 001612BC: RegQueryInfoKeyW.ADVAPI32 ref: 00161319
                            • Part of subcall function 001612BC: GetProcessHeap.KERNEL32 ref: 00161327
                            • Part of subcall function 001612BC: HeapAlloc.KERNEL32 ref: 00161338
                            • Part of subcall function 001612BC: RegEnumValueW.ADVAPI32 ref: 00161397
                            • Part of subcall function 001612BC: GetProcessHeap.KERNEL32 ref: 001613DF
                            • Part of subcall function 001612BC: HeapAlloc.KERNEL32 ref: 001613ED
                            • Part of subcall function 001612BC: GetProcessHeap.KERNEL32 ref: 0016140A
                            • Part of subcall function 001612BC: HeapFree.KERNEL32 ref: 00161418
                            • Part of subcall function 001612BC: lstrlenW.KERNEL32 ref: 00161421
                            • Part of subcall function 001612BC: GetProcessHeap.KERNEL32 ref: 0016142F
                            • Part of subcall function 001612BC: HeapAlloc.KERNEL32 ref: 0016143D
                          Strings
                          Memory Dump Source
                          • Source File: 0000000D.00000002.408938277.0000000000160000.00000040.00001000.00020000.00000000.sdmp, Offset: 00160000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_13_2_160000_sc.jbxd
                          Similarity
                          • API ID: Heap$CloseOpenProcess$Alloc$EnumFreeInfoQueryValuelstrlen
                          • String ID: SOFTWARE\dialerconfig$paths$pid$process_names$service_names$startup$tcp_local$tcp_remote$udp
                          • API String ID: 2135414181-2879589442
                          • Opcode ID: 84d977f69669bb910c18c90d9c150143eff6fe6f95bc9245a9bd4b5f56132143
                          • Instruction ID: 26410e373d3299a2877a6bc7aed089078f4453a27121c9d8ff51711fb1310f1b
                          • Opcode Fuzzy Hash: 84d977f69669bb910c18c90d9c150143eff6fe6f95bc9245a9bd4b5f56132143
                          • Instruction Fuzzy Hash: 5571F436714E5196EB20AF66EC9079D33B4FB98B88F441126EE4E97B28EF38C454C740
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 0016F394 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117libraryloaderCOMMON
                          Download Yara Rule

                          Control-flow Graph

                          • Executed
                          • Not Executed
                          control_flow_graph 151 16f394-16f3e6 152 16f4d7 151->152 153 16f3ec-16f3ef 151->153 156 16f4d9-16f4f5 152->156 154 16f3f1-16f3f4 153->154 155 16f3f9-16f3fc 153->155 154->156 157 16f402-16f411 155->157 158 16f4bc-16f4cf 155->158 159 16f413-16f416 157->159 160 16f421-16f440 LoadLibraryExW 157->160 158->152 161 16f516-16f525 call 176090 159->161 162 16f41c 159->162 163 16f4f6-16f50b 160->163 164 16f446-16f44f GetLastError 160->164 172 16f4b5 161->172 173 16f527-16f54e 161->173 165 16f4a8-16f4af 162->165 163->161 166 16f50d-16f510 FreeLibrary 163->166 168 16f496-16f4a0 164->168 169 16f451-16f468 call 16c928 164->169 165->157 165->172 166->161 168->165 169->168 175 16f46a-16f47e call 16c928 169->175 172->158 173->156 175->168 178 16f480-16f494 LoadLibraryExW 175->178 178->163 178->168
                          APIs
                          Strings
                          Memory Dump Source
                          • Source File: 0000000D.00000002.408938277.0000000000160000.00000040.00001000.00020000.00000000.sdmp, Offset: 00160000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_13_2_160000_sc.jbxd
                          Similarity
                          • API ID: AddressFreeLibraryProc
                          • String ID: api-ms-$ext-ms-
                          • API String ID: 3013587201-537541572
                          • Opcode ID: a0f3cb97d83f084b5c078ea606d329a918e0789490c159543aff3f4a2fa5ff9f
                          • Instruction ID: dc6aff7189a9e8bcb3460a34039c5544463206499f407ee656cad629cfd3892e
                          • Opcode Fuzzy Hash: a0f3cb97d83f084b5c078ea606d329a918e0789490c159543aff3f4a2fa5ff9f
                          • Instruction Fuzzy Hash: CF41B232315A0091EB16CF66BC0479663A5FB49BE0F594239AD1E87B48EF3CC956C350
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 0016104C Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 99memoryregistryCOMMON
                          Download Yara Rule

                          Control-flow Graph

                          • Executed
                          • Not Executed
                          control_flow_graph 179 16104c-1610b9 RegQueryInfoKeyW 180 1611b5-1611d0 179->180 181 1610bf-1610c9 179->181 181->180 182 1610cf-16111f RegEnumValueW 181->182 183 1611a5-1611af 182->183 184 161125-16112a 182->184 183->180 183->182 184->183 185 16112c-161135 184->185 186 161147-16114c 185->186 187 161137 185->187 188 16114e-161193 GetProcessHeap HeapAlloc GetProcessHeap call 176180 186->188 189 161199-1611a3 186->189 190 16113b-16113f 187->190 188->189 189->183 190->183 191 161141-161145 190->191 191->186 191->190
                          APIs
                          Strings
                          Memory Dump Source
                          • Source File: 0000000D.00000002.408938277.0000000000160000.00000040.00001000.00020000.00000000.sdmp, Offset: 00160000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_13_2_160000_sc.jbxd
                          Similarity
                          • API ID: Heap$Process$AllocEnumFreeInfoQueryValue
                          • String ID: d
                          • API String ID: 3743429067-2564639436
                          • Opcode ID: 0cc5ceb7d92555702a84a43de404567f212e32e90d8a90c8922560dee2c01182
                          • Instruction ID: 20d0f8db0aa766a74e5847f0b90eacf475f10851a284c7450f3faf225feddd53
                          • Opcode Fuzzy Hash: 0cc5ceb7d92555702a84a43de404567f212e32e90d8a90c8922560dee2c01182
                          • Instruction Fuzzy Hash: 21415D73214B84DAE760CF61E84479EB7B1F389B99F448129EB8907B18DF38C599CB40
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 00169DC4 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE
                          Download Yara Rule

                          Control-flow Graph

                          • Executed
                          • Not Executed
                          control_flow_graph 193 169dc4-169e02 194 169ef3 193->194 195 169e08-169e0b 193->195 196 169ef5-169f11 194->196 195->196 197 169e11 195->197 198 169e14 197->198 199 169e1a-169e29 198->199 200 169eeb 198->200 201 169e36-169e55 LoadLibraryExW 199->201 202 169e2b-169e2e 199->202 200->194 205 169e57-169e60 GetLastError 201->205 206 169ead-169ec2 201->206 203 169e34 202->203 204 169ecd-169edc call 176090 202->204 209 169ea1-169ea8 203->209 204->200 214 169ede-169ee9 204->214 210 169e62-169e77 call 16c928 205->210 211 169e8f-169e99 205->211 206->204 207 169ec4-169ec7 FreeLibrary 206->207 207->204 209->198 210->211 216 169e79-169e8d LoadLibraryExW 210->216 211->209 214->196 216->206 216->211
                          APIs
                          Strings
                          Memory Dump Source
                          • Source File: 0000000D.00000002.408938277.0000000000160000.00000040.00001000.00020000.00000000.sdmp, Offset: 00160000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_13_2_160000_sc.jbxd
                          Similarity
                          • API ID: Library$Load$AddressErrorFreeLastProc
                          • String ID: api-ms-
                          • API String ID: 2559590344-2084034818
                          • Opcode ID: 1bec38bed2a9dad19cb8167f1bbce1e92081cdd400658c61ccc26499447e47b7
                          • Instruction ID: aa201af80f25b73ccf688383adafc61c5ef437a35378b83757e59986e78830cd
                          • Opcode Fuzzy Hash: 1bec38bed2a9dad19cb8167f1bbce1e92081cdd400658c61ccc26499447e47b7
                          • Instruction Fuzzy Hash: 3931E831316B40E2DF16DB46AC007A573A8F748BA0F594A25ED2E4B750EF3EC5A5C310
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 00163790 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 44COMMON
                          Download Yara Rule

                          Control-flow Graph

                          • Executed
                          • Not Executed
                          control_flow_graph 217 163790-1637aa GetModuleHandleW 218 163835-163841 217->218 219 1637b0-1637c0 217->219 220 1637c2-1637ca 219->220 221 1637cc-1637f6 call 176038 VirtualProtectEx 219->221 220->218 220->221 221->218 224 1637f8-163830 call 176038 VirtualProtectEx 221->224 224->218
                          APIs
                          Strings
                          Memory Dump Source
                          • Source File: 0000000D.00000002.408938277.0000000000160000.00000040.00001000.00020000.00000000.sdmp, Offset: 00160000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_13_2_160000_sc.jbxd
                          Similarity
                          • API ID: CurrentProcessProtectVirtual$HandleModule
                          • String ID: wr
                          • API String ID: 1092925422-2678910430
                          • Opcode ID: d5ed198cecc284837a9554765ab7ffb778fa62629811cf0fe5ebc999f83bf42b
                          • Instruction ID: 2fffa32d71bd49020788314e8787d7958c152cf1bf73072999cf698940417110
                          • Opcode Fuzzy Hash: d5ed198cecc284837a9554765ab7ffb778fa62629811cf0fe5ebc999f83bf42b
                          • Instruction Fuzzy Hash: 6401293A709B8182EF149B62F8183AA7374FB88B85F440529EE9D07B64EF3DC655C704
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 00165B30 Relevance: 9.2, APIs: 6, Instructions: 240threadCOMMON
                          Download Yara Rule

                          Control-flow Graph

                          • Executed
                          • Not Executed
                          control_flow_graph 227 165b30-165b57 228 165b6b-165b76 GetCurrentThreadId 227->228 229 165b59-165b68 227->229 230 165b82-165b89 228->230 231 165b78-165b7d 228->231 229->228 233 165b9b-165baf 230->233 234 165b8b-165b96 call 165960 230->234 232 165faf-165fc6 call 167940 231->232 237 165bbe-165bc4 233->237 234->232 240 165c95-165cb6 237->240 241 165bca-165bd3 237->241 247 165e1f-165e30 call 1674bf 240->247 248 165cbc-165cdc GetThreadContext 240->248 242 165bd5-165c18 call 1685c0 241->242 243 165c1a-165c8d call 164510 call 1644b0 call 164470 241->243 255 165c90 242->255 243->255 259 165e35-165e3b 247->259 252 165ce2-165d03 248->252 253 165e1a 248->253 252->253 258 165d09-165d12 252->258 253->247 255->237 262 165d14-165d25 258->262 263 165d92-165da3 258->263 264 165e41-165e98 VirtualProtect FlushInstructionCache 259->264 265 165efe-165f0e 259->265 267 165d27-165d3c 262->267 268 165d8d 262->268 271 165e15 263->271 272 165da5-165dc3 263->272 269 165e9a-165ea4 264->269 270 165ec9-165ef9 call 1678ac 264->270 274 165f10-165f17 265->274 275 165f1e-165f2a call 164df0 265->275 267->268 277 165d3e-165d88 call 163970 SetThreadContext 267->277 268->271 269->270 278 165ea6-165ec1 call 164390 269->278 270->259 272->271 279 165dc5-165e10 call 163900 call 1674dd 272->279 274->275 281 165f19 call 1643e0 274->281 288 165f2f-165f35 275->288 277->268 278->270 279->271 281->275 292 165f77-165f95 288->292 293 165f37-165f75 ResumeThread call 1678ac 288->293 296 165f97-165fa6 292->296 297 165fa9 292->297 293->288 296->297 297->232
                          APIs
                          • GetCurrentThreadId.KERNEL32 ref: 00165B6B
                          • GetThreadContext.KERNEL32 ref: 00165CD5
                            • Part of subcall function 00165960: GetCurrentThreadId.KERNEL32 ref: 00165964
                          Memory Dump Source
                          • Source File: 0000000D.00000002.408938277.0000000000160000.00000040.00001000.00020000.00000000.sdmp, Offset: 00160000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_13_2_160000_sc.jbxd
                          Similarity
                          • API ID: Thread$Current$Context
                          • String ID:
                          • API String ID: 1666949209-0
                          • Opcode ID: aba7c51250b0bd2785b454d2868164715ffdc60c22b63475f1bba81942d6465a
                          • Instruction ID: c12ceed1b0a77b50d7795dac8b8477c99aab5f73042b0053e050c3aa755d6183
                          • Opcode Fuzzy Hash: aba7c51250b0bd2785b454d2868164715ffdc60c22b63475f1bba81942d6465a
                          • Instruction Fuzzy Hash: 85C18476209F8882DB34DB0AE89435AB7A5F7C8B88F514216EACD47B68DF3DC551CB40
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 001650D0 Relevance: 7.8, APIs: 5, Instructions: 318threadCOMMON
                          Download Yara Rule

                          Control-flow Graph

                          • Executed
                          • Not Executed
                          control_flow_graph 299 1650d0-1650fc 300 1650fe-165106 299->300 301 16510d-165116 299->301 300->301 302 165127-165130 301->302 303 165118-165120 301->303 304 165132-16513a 302->304 305 165141-16514a 302->305 303->302 304->305 306 165156-165161 GetCurrentThreadId 305->306 307 16514c-165151 305->307 309 165163-165168 306->309 310 16516d-165174 306->310 308 1656d3-1656da 307->308 309->308 311 165176-16517c 310->311 312 165181-16518a 310->312 311->308 313 165196-1651a2 312->313 314 16518c-165191 312->314 315 1651a4-1651c9 313->315 316 1651ce-165225 call 1656e0 * 2 313->316 314->308 315->308 321 165227-16522e 316->321 322 16523a-165243 316->322 323 165236 321->323 324 165230 321->324 325 165255-16525e 322->325 326 165245-165252 322->326 328 1652a6-1652aa 323->328 327 1652b0-1652b6 324->327 329 165273-165298 call 167870 325->329 330 165260-165270 325->330 326->325 332 1652e5-1652eb 327->332 333 1652b8-1652d4 call 164390 327->333 328->327 339 16529e 329->339 340 16532d-165342 call 163cc0 329->340 330->329 334 165315-165328 332->334 335 1652ed-16530c call 1678ac 332->335 333->332 344 1652d6-1652de 333->344 334->308 335->334 339->328 346 165344-16534c 340->346 347 165351-16535a 340->347 344->332 346->328 348 16536c-1653ba call 168c60 347->348 349 16535c-165369 347->349 352 1653c2-1653ca 348->352 349->348 353 1654d7-1654df 352->353 354 1653d0-1654bb call 167440 352->354 356 165523-16552b 353->356 357 1654e1-1654f4 call 164590 353->357 365 1654bf-1654ce call 164060 354->365 366 1654bd 354->366 360 165537-165546 356->360 361 16552d-165535 356->361 371 1654f6 357->371 372 1654f8-165521 357->372 363 16554f 360->363 364 165548 360->364 361->360 362 165554-165561 361->362 369 165564-1655b9 call 1685c0 362->369 370 165563 362->370 363->362 364->363 375 1654d2 365->375 376 1654d0 365->376 366->353 378 1655bb-1655c3 369->378 379 1655c8-165661 call 164510 call 164470 VirtualProtect 369->379 370->369 371->356 372->353 375->352 376->353 384 165663-165668 GetLastError 379->384 385 165671-1656d1 379->385 384->385 385->308
                          APIs
                          • GetCurrentThreadId.KERNEL32 ref: 00165156
                          Memory Dump Source
                          • Source File: 0000000D.00000002.408938277.0000000000160000.00000040.00001000.00020000.00000000.sdmp, Offset: 00160000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_13_2_160000_sc.jbxd
                          Similarity
                          • API ID: CurrentThread
                          • String ID:
                          • API String ID: 2882836952-0
                          • Opcode ID: a9eeae0eee8a65d3360f20c0190c6c2044be682fe56af66e10426f66e33a6bd7
                          • Instruction ID: 2db9514c81519692572a3d9c61cf0553d0f67130ce3dc7c487d59dd305a20514
                          • Opcode Fuzzy Hash: a9eeae0eee8a65d3360f20c0190c6c2044be682fe56af66e10426f66e33a6bd7
                          • Instruction Fuzzy Hash: 73F1B636219B84C6DB64CB59F89476AB7A1F3C5B94F10411AEA8E87B68DF7CC494CF00
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 001639E0 Relevance: 4.6, APIs: 3, Instructions: 64memoryCOMMON
                          Download Yara Rule

                          Control-flow Graph

                          • Executed
                          • Not Executed
                          control_flow_graph 386 1639e0-163a01 call 163c30 389 163a06-163a10 386->389 390 163a16-163a22 389->390 391 163afa 389->391 393 163a44-163a6e call 168c60 VirtualQuery 390->393 394 163a24-163a30 390->394 392 163afc-163b00 391->392 398 163a75-163a7d 393->398 399 163a70 393->399 394->393 395 163a32-163a42 394->395 395->389 400 163a7f-163a88 398->400 401 163add-163af0 call 163c30 398->401 399->391 400->401 402 163a8a-163ab0 VirtualAlloc 400->402 409 163af5 401->409 404 163ab2-163ab7 402->404 405 163abb-163ac5 GetLastError 402->405 404->392 407 163ac7-163ac9 405->407 408 163acb-163adb 405->408 407->392 408->409 409->389
                          APIs
                          Memory Dump Source
                          • Source File: 0000000D.00000002.408938277.0000000000160000.00000040.00001000.00020000.00000000.sdmp, Offset: 00160000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_13_2_160000_sc.jbxd
                          Similarity
                          • API ID: Virtual$AllocQuery
                          • String ID:
                          • API String ID: 31662377-0
                          • Opcode ID: ad31f8c641c3994e4c662b42b06090e17ab0b09933d29211a4965d6dca603ca4
                          • Instruction ID: 4053d297bb6983646c52040ddd794dd17742eacec485c2e93eebbeffc92898a2
                          • Opcode Fuzzy Hash: ad31f8c641c3994e4c662b42b06090e17ab0b09933d29211a4965d6dca603ca4
                          • Instruction Fuzzy Hash: 6B214F22219A8481DB34DB59E85535AA7A4F3887C8F100629F6DE87B68DF7CC7A0DB04
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 0016328C Relevance: 4.5, APIs: 3, Instructions: 43threadCOMMON
                          Download Yara Rule

                          Control-flow Graph

                          • Executed
                          • Not Executed
                          control_flow_graph 410 16328c-16329b 411 163323-163325 410->411 412 1632a1-1632b6 GetModuleFileNameW 410->412 413 163327 call 1636c8 411->413 414 16332c 411->414 415 16331f-163321 412->415 416 1632b8-1632cd PathFindFileNameW call 163844 412->416 413->414 417 163331-163339 414->417 415->417 416->415 421 1632cf-1632d6 call 163790 416->421 421->415 424 1632d8-1632df 421->424 424->414 425 1632e1-163318 CreateThread call 161d14 424->425 427 16331d 425->427 427->414
                          APIs
                          • GetModuleFileNameW.KERNEL32 ref: 001632AE
                          • PathFindFileNameW.SHLWAPI ref: 001632BD
                            • Part of subcall function 00163844: StrCmpNIW.SHLWAPI ref: 0016385C
                            • Part of subcall function 00163790: GetModuleHandleW.KERNEL32 ref: 0016379E
                            • Part of subcall function 00163790: GetCurrentProcess.KERNEL32 ref: 001637CC
                            • Part of subcall function 00163790: VirtualProtectEx.KERNEL32 ref: 001637EE
                            • Part of subcall function 00163790: GetCurrentProcess.KERNEL32 ref: 00163809
                            • Part of subcall function 00163790: VirtualProtectEx.KERNEL32 ref: 0016382A
                          • CreateThread.KERNEL32 ref: 0016330B
                            • Part of subcall function 00161D14: GetCurrentThread.KERNEL32 ref: 00161D1F
                          Memory Dump Source
                          • Source File: 0000000D.00000002.408938277.0000000000160000.00000040.00001000.00020000.00000000.sdmp, Offset: 00160000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_13_2_160000_sc.jbxd
                          Similarity
                          • API ID: Current$FileModuleNameProcessProtectThreadVirtual$CreateFindHandlePath
                          • String ID:
                          • API String ID: 1683269324-0
                          • Opcode ID: c94412c55dcd243bcd3fbe265bea19663896af10ab27123b85acb7154d5eea14
                          • Instruction ID: d4fc3d8981e01565feff5119755670d7579165bbbfb7b0de1e810c522fb74174
                          • Opcode Fuzzy Hash: c94412c55dcd243bcd3fbe265bea19663896af10ab27123b85acb7154d5eea14
                          • Instruction Fuzzy Hash: 8201A771B14B4182FB24AB71FC493E932E4BBA4345F548229E96A86760EF7CC368C710
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 00164DF0 Relevance: 4.5, APIs: 3, Instructions: 23memoryCOMMON
                          Download Yara Rule

                          Control-flow Graph

                          • Executed
                          • Not Executed
                          control_flow_graph 428 164df0-164e0a GetCurrentProcess 429 164e1a-164e20 428->429 430 164e22-164e51 VirtualProtect FlushInstructionCache 429->430 431 164e53-164e57 429->431 432 164e0c-164e15 430->432 432->429
                          APIs
                          • GetCurrentProcess.KERNEL32 ref: 00164DF4
                          • VirtualProtect.KERNEL32 ref: 00164E37
                          • FlushInstructionCache.KERNEL32 ref: 00164E4C
                          Memory Dump Source
                          • Source File: 0000000D.00000002.408938277.0000000000160000.00000040.00001000.00020000.00000000.sdmp, Offset: 00160000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_13_2_160000_sc.jbxd
                          Similarity
                          • API ID: CacheCurrentFlushInstructionProcessProtectVirtual
                          • String ID:
                          • API String ID: 3733156554-0
                          • Opcode ID: efc513032ac2f8104d68ff6d1779eae6f51007478eb3e1ac0120cc0a77f626c8
                          • Instruction ID: 635ef9f5b496f713ea82269a84e2d7c49d4f708c2571252f07adf97fef249e30
                          • Opcode Fuzzy Hash: efc513032ac2f8104d68ff6d1779eae6f51007478eb3e1ac0120cc0a77f626c8
                          • Instruction Fuzzy Hash: EFF0D426219B44C1C624EB05E89575AABA0F3D8BE8F144116FA8D47B68CF3EC6A18B40
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 0013273C Relevance: 3.2, APIs: 2, Instructions: 187memorylibraryCOMMON
                          Download Yara Rule

                          Control-flow Graph

                          • Executed
                          • Not Executed
                          control_flow_graph 433 13273c-1327a4 call 1329d4 * 4 442 1329b2 433->442 443 1327aa-1327ad 433->443 445 1329b4-1329d0 442->445 443->442 444 1327b3-1327b6 443->444 444->442 446 1327bc-1327bf 444->446 446->442 447 1327c5-1327e6 VirtualAlloc 446->447 447->442 448 1327ec-13280c 447->448 449 132838-13283f 448->449 450 13280e-132836 448->450 451 132845-132852 449->451 452 1328df-1328e6 449->452 450->449 450->450 451->452 453 132858-13286a LoadLibraryA 451->453 454 132992-1329b0 452->454 455 1328ec-132901 452->455 456 1328ca-1328d2 453->456 457 13286c-132878 453->457 454->445 455->454 458 132907 455->458 456->453 460 1328d4-1328d9 456->460 459 1328c5-1328c8 457->459 462 13290d-132921 458->462 459->456 463 13287a-13287d 459->463 460->452 464 132923-132934 462->464 465 132982-13298c 462->465 468 1328a7-1328b7 463->468 469 13287f-1328a5 463->469 466 132936-13293d 464->466 467 13293f-132943 464->467 465->454 465->462 471 132970-132980 466->471 472 132945-13294b 467->472 473 13294d-132951 467->473 474 1328ba-1328c1 468->474 469->474 471->464 471->465 472->471 475 132963-132967 473->475 476 132953-132961 473->476 474->459 475->471 478 132969-13296c 475->478 476->471 478->471
                          APIs
                          Memory Dump Source
                          • Source File: 0000000D.00000002.408874255.0000000000130000.00000040.00000400.00020000.00000000.sdmp, Offset: 00130000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_13_2_130000_sc.jbxd
                          Similarity
                          • API ID: AllocLibraryLoadVirtual
                          • String ID:
                          • API String ID: 3550616410-0
                          • Opcode ID: 8c1c9448f3dd1088c887dafc1273d9eb4da1e6d2ce59199f574756fa2a1f07a1
                          • Instruction ID: ab5f85039aeacdbba6adbb52763906f4668a4ae0fb35ad6f33afa90a3e9aee1b
                          • Opcode Fuzzy Hash: 8c1c9448f3dd1088c887dafc1273d9eb4da1e6d2ce59199f574756fa2a1f07a1
                          • Instruction Fuzzy Hash: 1061F472B016A48BCB18EF25D45073DB3A2FB54BA8F598125DF5A17748DB38D862C740
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 0016F948 Relevance: 3.1, APIs: 2, Instructions: 71COMMON
                          Download Yara Rule

                          Control-flow Graph

                          • Executed
                          • Not Executed
                          control_flow_graph 479 16f948-16f963 480 16f966-16f98f 479->480 481 16f991-16f996 480->481 482 16f99b-16f9a4 480->482 483 16fa26-16fa2f 481->483 484 16f9a6-16f9a9 482->484 485 16f9bc 482->485 483->480 486 16fa35-16fa4f 483->486 487 16f9b5-16f9ba 484->487 488 16f9ab-16f9b3 484->488 489 16f9c1-16f9d2 GetStdHandle 485->489 487->489 488->489 490 16f9d4-16f9df GetFileType 489->490 491 16fa01-16fa19 489->491 490->491 493 16f9e1-16f9ec 490->493 491->483 492 16fa1b-16fa1f 491->492 492->483 494 16f9f5-16f9f8 493->494 495 16f9ee-16f9f3 493->495 494->483 496 16f9fa-16f9ff 494->496 495->483 496->483
                          APIs
                          Memory Dump Source
                          • Source File: 0000000D.00000002.408938277.0000000000160000.00000040.00001000.00020000.00000000.sdmp, Offset: 00160000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_13_2_160000_sc.jbxd
                          Similarity
                          • API ID: FileHandleType
                          • String ID:
                          • API String ID: 3000768030-0
                          • Opcode ID: a07d0c2e6d1ea39fb6922406f7202b79799826504b1902530f517849248bbcbd
                          • Instruction ID: 5c96efd3590bbdc8477fb797970168ae9864f22308bff0a91824549b3543ac37
                          • Opcode Fuzzy Hash: a07d0c2e6d1ea39fb6922406f7202b79799826504b1902530f517849248bbcbd
                          • Instruction Fuzzy Hash: 9621A532624F5491DB248B19E9803687B50F346BB4F69531EEBAE473E0CB34D4B2D300
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 00161ABC Relevance: 3.1, APIs: 2, Instructions: 68sleepCOMMON
                          Download Yara Rule

                          Control-flow Graph

                          • Executed
                          • Not Executed
                          control_flow_graph 497 161abc-161acb call 161628 500 161ad2-161aef Sleep SleepEx 497->500 501 161af5-161af8 500->501 502 161baa 500->502 504 161ba1-161ba8 501->504 505 161afe-161b01 501->505 503 161bad-161bb5 call 1618b4 502->503 503->500 504->503 505->504 507 161b07-161b14 call 161598 505->507 511 161b16-161b25 call 161220 507->511 512 161b94 507->512 511->512 517 161b27-161b36 call 161598 511->517 514 161b96-161b98 512->514 514->502 516 161b9a 514->516 516->504 517->512 520 161b38-161b47 call 161598 517->520 520->512 523 161b49-161b58 call 161598 520->523 523->512 526 161b5a-161b69 call 161220 523->526 526->512 529 161b6b-161b7a call 161220 526->529 529->512 532 161b7c-161b8b call 161220 529->532 532->512 535 161b8d-161b92 532->535 535->514
                          APIs
                            • Part of subcall function 00161628: GetProcessHeap.KERNEL32 ref: 00161633
                            • Part of subcall function 00161628: HeapAlloc.KERNEL32 ref: 00161642
                            • Part of subcall function 00161628: RegOpenKeyExW.ADVAPI32 ref: 001616B2
                            • Part of subcall function 00161628: RegOpenKeyExW.ADVAPI32 ref: 001616DF
                            • Part of subcall function 00161628: RegCloseKey.ADVAPI32 ref: 001616F9
                            • Part of subcall function 00161628: RegOpenKeyExW.ADVAPI32 ref: 00161719
                            • Part of subcall function 00161628: RegCloseKey.ADVAPI32 ref: 00161734
                            • Part of subcall function 00161628: RegOpenKeyExW.ADVAPI32 ref: 00161754
                            • Part of subcall function 00161628: RegCloseKey.ADVAPI32 ref: 0016176F
                            • Part of subcall function 00161628: RegOpenKeyExW.ADVAPI32 ref: 0016178F
                            • Part of subcall function 00161628: RegCloseKey.ADVAPI32 ref: 001617AA
                            • Part of subcall function 00161628: RegOpenKeyExW.ADVAPI32 ref: 001617CA
                          • Sleep.KERNEL32 ref: 00161AD7
                          • SleepEx.KERNEL32 ref: 00161ADD
                            • Part of subcall function 00161628: RegCloseKey.ADVAPI32 ref: 001617E5
                            • Part of subcall function 00161628: RegOpenKeyExW.ADVAPI32 ref: 00161805
                            • Part of subcall function 00161628: RegCloseKey.ADVAPI32 ref: 00161820
                            • Part of subcall function 00161628: RegOpenKeyExW.ADVAPI32 ref: 00161840
                            • Part of subcall function 00161628: RegCloseKey.ADVAPI32 ref: 0016185B
                            • Part of subcall function 00161628: RegOpenKeyExW.ADVAPI32 ref: 0016187B
                            • Part of subcall function 00161628: RegCloseKey.ADVAPI32 ref: 00161896
                            • Part of subcall function 00161628: RegCloseKey.ADVAPI32 ref: 001618A0
                          Memory Dump Source
                          • Source File: 0000000D.00000002.408938277.0000000000160000.00000040.00001000.00020000.00000000.sdmp, Offset: 00160000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_13_2_160000_sc.jbxd
                          Similarity
                          • API ID: CloseOpen$HeapSleep$AllocProcess
                          • String ID:
                          • API String ID: 1534210851-0
                          • Opcode ID: ad614115fa5d2181ccf7742c52f053f5bbac07b16a2f1961ccdf1ed8f9939afa
                          • Instruction ID: 3dd424e6ab06c04b37a495c19801f7dfc26f1cf73a7ae83e64a95b86d1cc7599
                          • Opcode Fuzzy Hash: ad614115fa5d2181ccf7742c52f053f5bbac07b16a2f1961ccdf1ed8f9939afa
                          • Instruction Fuzzy Hash: C2210972300A41A2DF14AB27EE513B963B6EB99BC0F1C98259E0A87755FF24C871C311
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 00163844 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 15COMMON
                          Download Yara Rule
                          APIs
                          Strings
                          Memory Dump Source
                          • Source File: 0000000D.00000002.408938277.0000000000160000.00000040.00001000.00020000.00000000.sdmp, Offset: 00160000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_13_2_160000_sc.jbxd
                          Similarity
                          • API ID:
                          • String ID: dialer
                          • API String ID: 0-3528709123
                          • Opcode ID: 9b5e3636378cdd7d8ee1592d3b6b4394701c72bdb5eb6129fb1ea8dd817c1f4c
                          • Instruction ID: 3a6997dab5d6fec5e3b292c3d0c15d77f24a9e5972755ffd4fe309a4b46fcdb9
                          • Opcode Fuzzy Hash: 9b5e3636378cdd7d8ee1592d3b6b4394701c72bdb5eb6129fb1ea8dd817c1f4c
                          • Instruction Fuzzy Hash: BDD0A7703156058AFF14DFA69CC47E02334EB08744F884124D91442110DB188A9DE710
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 0016D6CC Relevance: 1.3, APIs: 1, Instructions: 36memoryCOMMONLIBRARYCODE
                          Download Yara Rule
                          APIs
                          Memory Dump Source
                          • Source File: 0000000D.00000002.408938277.0000000000160000.00000040.00001000.00020000.00000000.sdmp, Offset: 00160000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_13_2_160000_sc.jbxd
                          Similarity
                          • API ID: AllocHeap
                          • String ID:
                          • API String ID: 4292702814-0
                          • Opcode ID: 9655889cf553910685c1d48f5f7b9f3cccd3e5d43ce14746dc0d9623a956201f
                          • Instruction ID: 3b531dc786e6f534db1a8761cb9093780b5a2e63b62790a2951c244be57ec14d
                          • Opcode Fuzzy Hash: 9655889cf553910685c1d48f5f7b9f3cccd3e5d43ce14746dc0d9623a956201f
                          • Instruction Fuzzy Hash: 93F02068B05B0481FF296BB6FC523A122955FD9BC4F4C90308D0EC7782EF2CC8E08622
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Non-executed Functions

                          Function 00167D90 Relevance: 10.6, APIs: 7, Instructions: 72COMMON
                          Download Yara Rule
                          APIs
                          • IsProcessorFeaturePresent.KERNEL32 ref: 00167DAC
                          • RtlCaptureContext.NTDLL ref: 00167DD9
                          • RtlLookupFunctionEntry.NTDLL ref: 00167DF3
                          • RtlVirtualUnwind.NTDLL ref: 00167E34
                          • IsDebuggerPresent.KERNEL32 ref: 00167E88
                          • SetUnhandledExceptionFilter.KERNEL32 ref: 00167EA9
                          • UnhandledExceptionFilter.KERNEL32 ref: 00167EB4
                          Memory Dump Source
                          • Source File: 0000000D.00000002.408938277.0000000000160000.00000040.00001000.00020000.00000000.sdmp, Offset: 00160000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_13_2_160000_sc.jbxd
                          Similarity
                          • API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
                          • String ID:
                          • API String ID: 3140674995-0
                          • Opcode ID: 781d1b9bde8934adc12bfa83d35ad1be64d2520f1bd2f9e02f1b4bb1ea1a0257
                          • Instruction ID: 587145852f70e4f658e67df0c2a5b950eb5a268a595f261d53515f32ab77013a
                          • Opcode Fuzzy Hash: 781d1b9bde8934adc12bfa83d35ad1be64d2520f1bd2f9e02f1b4bb1ea1a0257
                          • Instruction Fuzzy Hash: BB314B76209F808AEB609F60E8907EE7375F794748F44442ADB4E57B98EF38C658C710
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 0016D2A4 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE
                          Download Yara Rule
                          APIs
                          • RtlCaptureContext.NTDLL ref: 0016D31D
                          • RtlLookupFunctionEntry.NTDLL ref: 0016D335
                          • RtlVirtualUnwind.NTDLL ref: 0016D370
                          • IsDebuggerPresent.KERNEL32 ref: 0016D3A9
                          • SetUnhandledExceptionFilter.KERNEL32 ref: 0016D3B3
                          • UnhandledExceptionFilter.KERNEL32 ref: 0016D3BE
                          Memory Dump Source
                          • Source File: 0000000D.00000002.408938277.0000000000160000.00000040.00001000.00020000.00000000.sdmp, Offset: 00160000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_13_2_160000_sc.jbxd
                          Similarity
                          • API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
                          • String ID:
                          • API String ID: 1239891234-0
                          • Opcode ID: 056b8809331e045eb0ff6df28b8a67c6be047fb713c0be5e5acd4a9b147221bc
                          • Instruction ID: f02eee0bd54badde2eb7ac545a8b7215b5c1249ab3823216810f8bb3536c322e
                          • Opcode Fuzzy Hash: 056b8809331e045eb0ff6df28b8a67c6be047fb713c0be5e5acd4a9b147221bc
                          • Instruction Fuzzy Hash: 97314D76618F8096DB60CF25E8803EE73A4F799758F540226EA9D47B68EF38C556CB00
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 001612BC Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 120memoryregistrystringCOMMON
                          Download Yara Rule
                          APIs
                          Strings
                          Memory Dump Source
                          • Source File: 0000000D.00000002.408938277.0000000000160000.00000040.00001000.00020000.00000000.sdmp, Offset: 00160000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_13_2_160000_sc.jbxd
                          Similarity
                          • API ID: Heap$Process$Alloc$Free$EnumInfoQueryValuelstrlen
                          • String ID: d
                          • API String ID: 2005889112-2564639436
                          • Opcode ID: 8b653d2a3574a9b9f54f76d34c9bbade1314fe17b6e977058bb62b7e32ce9810
                          • Instruction ID: 31b649d561b1c1665bb735dc3e80be1e45adc59b25750805df4a2248e8e2164c
                          • Opcode Fuzzy Hash: 8b653d2a3574a9b9f54f76d34c9bbade1314fe17b6e977058bb62b7e32ce9810
                          • Instruction Fuzzy Hash: 24512A76604B84D6EB14CF62E94839AB7B1F789F99F448124DE4A07B29DF3CC459CB40
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 00161D14 Relevance: 22.8, APIs: 1, Strings: 12, Instructions: 65threadCOMMON
                          Download Yara Rule
                          APIs
                          • GetCurrentThread.KERNEL32 ref: 00161D1F
                            • Part of subcall function 00161FD4: GetModuleHandleA.KERNEL32 ref: 00161FEC
                            • Part of subcall function 00161FD4: GetProcAddress.KERNEL32 ref: 00161FFD
                            • Part of subcall function 00165B30: GetCurrentThreadId.KERNEL32 ref: 00165B6B
                          Strings
                          Memory Dump Source
                          • Source File: 0000000D.00000002.408938277.0000000000160000.00000040.00001000.00020000.00000000.sdmp, Offset: 00160000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_13_2_160000_sc.jbxd
                          Similarity
                          • API ID: CurrentThread$AddressHandleModuleProc
                          • String ID: EnumServiceGroupW$EnumServicesStatusExW$NtDeviceIoControlFile$NtEnumerateKey$NtEnumerateValueKey$NtQueryDirectoryFile$NtQueryDirectoryFileEx$NtQuerySystemInformation$NtResumeThread$advapi32.dll$ntdll.dll$sechost.dll
                          • API String ID: 4175298099-1975688563
                          • Opcode ID: 848021bf4701eae64bbfc749c93af06548ec6c37c79a2989ab503d46e0816dd6
                          • Instruction ID: b7820f34b2690c83e8f33eda7cef427f0c92464c56029b4615795d28148aa9c7
                          • Opcode Fuzzy Hash: 848021bf4701eae64bbfc749c93af06548ec6c37c79a2989ab503d46e0816dd6
                          • Instruction Fuzzy Hash: 6131A4B5604A4AA0EB06EFAAFC617E46331BB55384FC59053D81D13535EF79C25DC350
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 00136910 Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 230COMMON
                          Download Yara Rule
                          APIs
                          • __scrt_dllmain_crt_thread_attach.LIBCMT ref: 00136938
                          • __scrt_acquire_startup_lock.LIBCMT ref: 0013698A
                          • _RTC_Initialize.LIBCMT ref: 001369B8
                          • __scrt_dllmain_after_initialize_c.LIBCMT ref: 001369DE
                          • __scrt_release_startup_lock.LIBCMT ref: 00136A09
                          Strings
                          Memory Dump Source
                          • Source File: 0000000D.00000002.408874255.0000000000130000.00000040.00000400.00020000.00000000.sdmp, Offset: 00130000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_13_2_130000_sc.jbxd
                          Similarity
                          • API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
                          • String ID: `dynamic initializer for '$`eh vector copy constructor iterator'$`eh vector vbase copy constructor iterator'$scriptor'
                          • API String ID: 190073905-1786718095
                          • Opcode ID: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
                          • Instruction ID: a96ed21a977a7095c4c114444ba98005fa7edacfcca33046ae4b83fea7a49c2e
                          • Opcode Fuzzy Hash: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
                          • Instruction Fuzzy Hash: 7F714772700741EBEB14EB66E84135977A1FBAAB80F58C425EE499772ADF3CC8458700
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 0016CE28 Relevance: 18.1, APIs: 12, Instructions: 112COMMONLIBRARYCODE
                          Download Yara Rule
                          APIs
                          • GetLastError.KERNEL32 ref: 0016CE37
                          • FlsGetValue.KERNEL32(?,?,?,00170A6B,?,?,?,0017045C,?,?,?,0016C84F), ref: 0016CE4C
                          • FlsSetValue.KERNEL32(?,?,?,00170A6B,?,?,?,0017045C,?,?,?,0016C84F), ref: 0016CE6D
                          • FlsSetValue.KERNEL32(?,?,?,00170A6B,?,?,?,0017045C,?,?,?,0016C84F), ref: 0016CE9A
                          • FlsSetValue.KERNEL32(?,?,?,00170A6B,?,?,?,0017045C,?,?,?,0016C84F), ref: 0016CEAB
                          • FlsSetValue.KERNEL32(?,?,?,00170A6B,?,?,?,0017045C,?,?,?,0016C84F), ref: 0016CEBC
                          • SetLastError.KERNEL32 ref: 0016CED7
                          • FlsGetValue.KERNEL32(?,?,?,?,?,?,?,00170A6B,?,?,?,0017045C,?,?,?,0016C84F), ref: 0016CF0D
                          • FlsSetValue.KERNEL32(?,?,00000001,0016ECCC,?,?,?,?,0016BF9F,?,?,?,?,?,00167AB0), ref: 0016CF2C
                            • Part of subcall function 0016D6CC: HeapAlloc.KERNEL32 ref: 0016D721
                          • FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00170A6B,?,?,?,0017045C,?,?,?,0016C84F), ref: 0016CF54
                            • Part of subcall function 0016D744: HeapFree.KERNEL32 ref: 0016D75A
                            • Part of subcall function 0016D744: GetLastError.KERNEL32 ref: 0016D764
                          • FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00170A6B,?,?,?,0017045C,?,?,?,0016C84F), ref: 0016CF65
                          • FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00170A6B,?,?,?,0017045C,?,?,?,0016C84F), ref: 0016CF76
                          Memory Dump Source
                          • Source File: 0000000D.00000002.408938277.0000000000160000.00000040.00001000.00020000.00000000.sdmp, Offset: 00160000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_13_2_160000_sc.jbxd
                          Similarity
                          • API ID: Value$ErrorLast$Heap$AllocFree
                          • String ID:
                          • API String ID: 570795689-0
                          • Opcode ID: 81ae7dfa4ed2d3c1f1356864241e8c9d76a8deab2a50f3105871727dc9b84e00
                          • Instruction ID: d7d7f2712a0328f35bb76ca47be2ab3bf3aa21fce1d8bd0108a1f9eac00a2cb6
                          • Opcode Fuzzy Hash: 81ae7dfa4ed2d3c1f1356864241e8c9d76a8deab2a50f3105871727dc9b84e00
                          • Instruction Fuzzy Hash: 1831D43070234442EE2CA735AE5533922626FA47F4F244B38B8764B7E5EF69D4628740
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 00139944 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 317COMMON
                          Download Yara Rule
                          APIs
                          • __FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 001399A1
                            • Part of subcall function 0013A814: __GetUnwindTryBlock.LIBCMT ref: 0013A857
                            • Part of subcall function 0013A814: __SetUnwindTryBlock.LIBVCRUNTIME ref: 0013A87C
                          • Is_bad_exception_allowed.LIBVCRUNTIME ref: 00139A79
                          • __FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 00139CCE
                          • std::bad_alloc::bad_alloc.LIBCMT ref: 00139DDA
                          Strings
                          Memory Dump Source
                          • Source File: 0000000D.00000002.408874255.0000000000130000.00000040.00000400.00020000.00000000.sdmp, Offset: 00130000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_13_2_130000_sc.jbxd
                          Similarity
                          • API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
                          • String ID: csm$csm$csm
                          • API String ID: 849930591-393685449
                          • Opcode ID: 65b39982983e806640910362ba4e105e6dc551b6220b15538d356c191c28ac3a
                          • Instruction ID: da2b7e0b976c1e4d8c5939a39caec61411c320863eb03df16e5d68276125e8ce
                          • Opcode Fuzzy Hash: 65b39982983e806640910362ba4e105e6dc551b6220b15538d356c191c28ac3a
                          • Instruction Fuzzy Hash: 94D1BF72604B808AEB24DF69E48139D7BB4F7A9B98F501216EF8A57B19CF78C591C700
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 0016A544 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 317COMMON
                          Download Yara Rule
                          APIs
                          • __FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 0016A5A1
                            • Part of subcall function 0016B414: __GetUnwindTryBlock.LIBCMT ref: 0016B457
                            • Part of subcall function 0016B414: __SetUnwindTryBlock.LIBVCRUNTIME ref: 0016B47C
                          • Is_bad_exception_allowed.LIBVCRUNTIME ref: 0016A679
                          • __FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 0016A8CE
                          • std::bad_alloc::bad_alloc.LIBCMT ref: 0016A9DA
                          Strings
                          Memory Dump Source
                          • Source File: 0000000D.00000002.408938277.0000000000160000.00000040.00001000.00020000.00000000.sdmp, Offset: 00160000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_13_2_160000_sc.jbxd
                          Similarity
                          • API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
                          • String ID: csm$csm$csm
                          • API String ID: 849930591-393685449
                          • Opcode ID: 147a5c394ba4e007c258850d6061d542d969719de9d23a8e277659d08661d77f
                          • Instruction ID: d223ad2fec5a7b79812a636bd1ebd863977e7a25c48f5731676c0e01cd2b035b
                          • Opcode Fuzzy Hash: 147a5c394ba4e007c258850d6061d542d969719de9d23a8e277659d08661d77f
                          • Instruction Fuzzy Hash: 56D1C272604B808ADB20DF79D8803AD7BB4FB95B98F541116EF8967B19CF34D5A1CB02
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 0016D068 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 54COMMONLIBRARYCODE
                          Download Yara Rule
                          APIs
                          • FlsGetValue.KERNEL32(?,?,?,0016C7DE,?,?,?,?,?,?,?,?,0016CF9D,?,?,00000001), ref: 0016D087
                          • FlsSetValue.KERNEL32(?,?,?,0016C7DE,?,?,?,?,?,?,?,?,0016CF9D,?,?,00000001), ref: 0016D0A6
                          • FlsSetValue.KERNEL32(?,?,?,0016C7DE,?,?,?,?,?,?,?,?,0016CF9D,?,?,00000001), ref: 0016D0CE
                          • FlsSetValue.KERNEL32(?,?,?,0016C7DE,?,?,?,?,?,?,?,?,0016CF9D,?,?,00000001), ref: 0016D0DF
                          • FlsSetValue.KERNEL32(?,?,?,0016C7DE,?,?,?,?,?,?,?,?,0016CF9D,?,?,00000001), ref: 0016D0F0
                          Strings
                          Memory Dump Source
                          • Source File: 0000000D.00000002.408938277.0000000000160000.00000040.00001000.00020000.00000000.sdmp, Offset: 00160000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_13_2_160000_sc.jbxd
                          Similarity
                          • API ID: Value
                          • String ID: 1%$Y%
                          • API String ID: 3702945584-1395475152
                          • Opcode ID: eaed261e9eff258ccad1ac5f7a99306e4284ed666e6615725d2dc279c7a103a4
                          • Instruction ID: 5ebb59e697d4ebe1ab739c27699ff9a383ca215318f2df6c25c69ba7fab90e23
                          • Opcode Fuzzy Hash: eaed261e9eff258ccad1ac5f7a99306e4284ed666e6615725d2dc279c7a103a4
                          • Instruction Fuzzy Hash: EC118221B0538441EA28A736BE523396255AFA57F0F388739B83A477E9DF68C5638700
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 00167510 Relevance: 12.2, APIs: 8, Instructions: 230COMMON
                          Download Yara Rule
                          APIs
                          • __scrt_dllmain_crt_thread_attach.LIBCMT ref: 00167538
                          • __scrt_acquire_startup_lock.LIBCMT ref: 0016758A
                          • _RTC_Initialize.LIBCMT ref: 001675B8
                          • __scrt_dllmain_after_initialize_c.LIBCMT ref: 001675DE
                          • __scrt_release_startup_lock.LIBCMT ref: 00167609
                          Memory Dump Source
                          • Source File: 0000000D.00000002.408938277.0000000000160000.00000040.00001000.00020000.00000000.sdmp, Offset: 00160000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_13_2_160000_sc.jbxd
                          Similarity
                          • API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
                          • String ID:
                          • API String ID: 190073905-0
                          • Opcode ID: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
                          • Instruction ID: 4a771d52cab62e88c9b775d8826277df043c9b66f37523e061a5cfceb145150f
                          • Opcode Fuzzy Hash: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
                          • Instruction Fuzzy Hash: 3271193171CB4286EB14AB79EC4139963A4FB95BCCF188525EA09877D6EF38C975C700
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 00173DB4 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON
                          Download Yara Rule
                          APIs
                          Strings
                          Memory Dump Source
                          • Source File: 0000000D.00000002.408938277.0000000000160000.00000040.00001000.00020000.00000000.sdmp, Offset: 00160000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_13_2_160000_sc.jbxd
                          Similarity
                          • API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
                          • String ID: CONOUT$
                          • API String ID: 3230265001-3130406586
                          • Opcode ID: ea8503a65e9befc0d33d9332805196394b6329e0df61646a9863ad39bb9ae76f
                          • Instruction ID: 0ec5b33dc47cc7cbd959ef86ec33a336a3dbdcf1b2e8c348142c18147cb48dba
                          • Opcode Fuzzy Hash: ea8503a65e9befc0d33d9332805196394b6329e0df61646a9863ad39bb9ae76f
                          • Instruction Fuzzy Hash: 6011AC32714F8086E7508B52F858359B7B4F788FE8F548224EE6E87BA4DF38CA148740
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 00162F04 Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 93memoryCOMMON
                          Download Yara Rule
                          APIs
                          Strings
                          Memory Dump Source
                          • Source File: 0000000D.00000002.408938277.0000000000160000.00000040.00001000.00020000.00000000.sdmp, Offset: 00160000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_13_2_160000_sc.jbxd
                          Similarity
                          • API ID: Heap$Process$AllocFree
                          • String ID: dialer
                          • API String ID: 756756679-3528709123
                          • Opcode ID: 2e24de9146afbba5105044d4fd5602f1f9f0ed558a5ed62472976580c3eaf0ad
                          • Instruction ID: cf6ae6cbe3974ef2874550824946c67af24625b15510a1fb935dc98acd8f9777
                          • Opcode Fuzzy Hash: 2e24de9146afbba5105044d4fd5602f1f9f0ed558a5ed62472976580c3eaf0ad
                          • Instruction Fuzzy Hash: 28319C32705F5582EB25DF66E94476AA770FB94B84F088124EF4847B15EF38C8B5C700
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 0016CFA0 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE
                          Download Yara Rule
                          APIs
                          • GetLastError.KERNEL32 ref: 0016CFAF
                          • FlsSetValue.KERNEL32(?,?,?,0016D6B5,?,?,?,?,0016D778), ref: 0016CFE5
                          • FlsSetValue.KERNEL32(?,?,?,0016D6B5,?,?,?,?,0016D778), ref: 0016D012
                          • FlsSetValue.KERNEL32(?,?,?,0016D6B5,?,?,?,?,0016D778), ref: 0016D023
                          • FlsSetValue.KERNEL32(?,?,?,0016D6B5,?,?,?,?,0016D778), ref: 0016D034
                          • SetLastError.KERNEL32 ref: 0016D04F
                          Memory Dump Source
                          • Source File: 0000000D.00000002.408938277.0000000000160000.00000040.00001000.00020000.00000000.sdmp, Offset: 00160000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_13_2_160000_sc.jbxd
                          Similarity
                          • API ID: Value$ErrorLast
                          • String ID:
                          • API String ID: 2506987500-0
                          • Opcode ID: 4f148fb448054b99fdb5313590ff83f86fc6d8762bc770a772f95ba4b575ef67
                          • Instruction ID: a5ee8de057cdd9f99485350305f3ff599e97bb404c56191ac7d9a83986e6f890
                          • Opcode Fuzzy Hash: 4f148fb448054b99fdb5313590ff83f86fc6d8762bc770a772f95ba4b575ef67
                          • Instruction Fuzzy Hash: F611733170578082EA28A736BE5533962526FA87F4F244728F876477E9DF68C8639740
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 0016199C Relevance: 9.0, APIs: 6, Instructions: 42stringCOMMON
                          Download Yara Rule
                          APIs
                          Memory Dump Source
                          • Source File: 0000000D.00000002.408938277.0000000000160000.00000040.00001000.00020000.00000000.sdmp, Offset: 00160000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_13_2_160000_sc.jbxd
                          Similarity
                          • API ID: FileName$CloseFindHandleModuleOpenPathProcesslstrlen
                          • String ID:
                          • API String ID: 517849248-0
                          • Opcode ID: 01214db588610ff501214a343c1506f8e4016efad0e64bbd234dc336c45f59d3
                          • Instruction ID: d8faa2f5f7d694d62b3ab56e04ff7ab663781de929b7fd1c1fffa5467acb0651
                          • Opcode Fuzzy Hash: 01214db588610ff501214a343c1506f8e4016efad0e64bbd234dc336c45f59d3
                          • Instruction Fuzzy Hash: EC014831309A8086EB24DB62A89879A63A5F788FC5F988035DE8D43B55DF3CC989C740
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 001636C8 Relevance: 9.0, APIs: 6, Instructions: 38threadCOMMON
                          Download Yara Rule
                          APIs
                          Memory Dump Source
                          • Source File: 0000000D.00000002.408938277.0000000000160000.00000040.00001000.00020000.00000000.sdmp, Offset: 00160000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_13_2_160000_sc.jbxd
                          Similarity
                          • API ID: CurrentProcessProtectVirtual$HandleModuleTerminateThread
                          • String ID:
                          • API String ID: 449555515-0
                          • Opcode ID: 33edae7e4393505c590e6bdf894c2b6337bb17a10dfae21a600636dc78c73843
                          • Instruction ID: 3a4580fee28cda030058dfd6d5656a641f0f506e25a62a3200705a8cb46569c7
                          • Opcode Fuzzy Hash: 33edae7e4393505c590e6bdf894c2b6337bb17a10dfae21a600636dc78c73843
                          • Instruction Fuzzy Hash: C40156B5315B4082EF259B22F8083AA73B0BB99B86F184528DE5D07764EF3DC218C700
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 00168FE8 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 144COMMON
                          Download Yara Rule
                          APIs
                          • __except_validate_context_record.LIBVCRUNTIME ref: 00169013
                          • _IsNonwritableInCurrentImage.LIBCMT ref: 001690A8
                          • RtlUnwindEx.NTDLL ref: 001690F7
                          Strings
                          Memory Dump Source
                          • Source File: 0000000D.00000002.408938277.0000000000160000.00000040.00001000.00020000.00000000.sdmp, Offset: 00160000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_13_2_160000_sc.jbxd
                          Similarity
                          • API ID: CurrentImageNonwritableUnwind__except_validate_context_record
                          • String ID: csm$f
                          • API String ID: 2395640692-629598281
                          • Opcode ID: cf88226c4e0499e864df13b9fa0a288c301b8b6e63eb257c90d52d35e879efeb
                          • Instruction ID: ea50912edad120e3899f30e72e5351fe906610dc99b702d26367dcd06ccaa674
                          • Opcode Fuzzy Hash: cf88226c4e0499e864df13b9fa0a288c301b8b6e63eb257c90d52d35e879efeb
                          • Instruction Fuzzy Hash: 9051DB327016028BCB18DF25EC48B69376EF386BE8F218524EE5A4770CEB75C9A1C740
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 00161A40 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 30stringCOMMON
                          Download Yara Rule
                          APIs
                          Strings
                          Memory Dump Source
                          • Source File: 0000000D.00000002.408938277.0000000000160000.00000040.00001000.00020000.00000000.sdmp, Offset: 00160000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_13_2_160000_sc.jbxd
                          Similarity
                          • API ID: FinalHandleNamePathlstrlen
                          • String ID: \\?\
                          • API String ID: 2719912262-4282027825
                          • Opcode ID: c1daab9146f2a1614ef605d22fd4f721266e20aa8a0235322e79b2424596649d
                          • Instruction ID: fd688f18d64827e170c74bba277f881d821d4a4c0a47398fc455fe8422418e94
                          • Opcode Fuzzy Hash: c1daab9146f2a1614ef605d22fd4f721266e20aa8a0235322e79b2424596649d
                          • Instruction Fuzzy Hash: B2F06D32308A8192EB208F61F9C479A6730F788B88F988020DA4D4B958DF3DC68DCB00
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 00163044 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 27COMMON
                          Download Yara Rule
                          APIs
                          Strings
                          Memory Dump Source
                          • Source File: 0000000D.00000002.408938277.0000000000160000.00000040.00001000.00020000.00000000.sdmp, Offset: 00160000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_13_2_160000_sc.jbxd
                          Similarity
                          • API ID: CombinePath
                          • String ID: \\.\pipe\
                          • API String ID: 3422762182-91387939
                          • Opcode ID: 8c685e1f0b85bfe06f91eeefbd03c12bff8419d51c8b157116edbf6ca1c9c829
                          • Instruction ID: 1e79bf126211a70526bb3f01501dc4b1812f6fdc421e073003fd6a414bf08526
                          • Opcode Fuzzy Hash: 8c685e1f0b85bfe06f91eeefbd03c12bff8419d51c8b157116edbf6ca1c9c829
                          • Instruction Fuzzy Hash: C7F01574718F8482EA048B53B9183AAA671BB48FD0F089131EE5E4BB28DF3CC599C700
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 0016BC98 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON
                          Download Yara Rule
                          APIs
                          Strings
                          Memory Dump Source
                          • Source File: 0000000D.00000002.408938277.0000000000160000.00000040.00001000.00020000.00000000.sdmp, Offset: 00160000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_13_2_160000_sc.jbxd
                          Similarity
                          • API ID: AddressFreeHandleLibraryModuleProc
                          • String ID: CorExitProcess$mscoree.dll
                          • API String ID: 4061214504-1276376045
                          • Opcode ID: 95c54818ea39ae4ab476006ce308989d1f654d2f667890579c20066112978b6c
                          • Instruction ID: 9571440c06142031fc9a95329a26751b53fb36e9ebaf3d1f147c662fa362f914
                          • Opcode Fuzzy Hash: 95c54818ea39ae4ab476006ce308989d1f654d2f667890579c20066112978b6c
                          • Instruction Fuzzy Hash: ADF05471319F0581EF148F28E8843A96330FB89BA5F540319DA6E462F4DF3CC599C740
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 00165710 Relevance: 7.6, APIs: 5, Instructions: 124threadCOMMON
                          Download Yara Rule
                          APIs
                          • GetCurrentThreadId.KERNEL32 ref: 00165726
                          Memory Dump Source
                          • Source File: 0000000D.00000002.408938277.0000000000160000.00000040.00001000.00020000.00000000.sdmp, Offset: 00160000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_13_2_160000_sc.jbxd
                          Similarity
                          • API ID: CurrentThread
                          • String ID:
                          • API String ID: 2882836952-0
                          • Opcode ID: 0c7f3a11ae4e5ff47235e902b7b6ce7055ed727b420134bb2449cab27e882fd8
                          • Instruction ID: d1d36b1b79573b4eb15a313b3b5e28c3df147353cf33dcde8cecfc733807c1e6
                          • Opcode Fuzzy Hash: 0c7f3a11ae4e5ff47235e902b7b6ce7055ed727b420134bb2449cab27e882fd8
                          • Instruction Fuzzy Hash: 0251B736619B84C7D764CB16E88431AB7A5F388798F505216EA8E47B68DF7CC561CF00
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 00143504 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE
                          Download Yara Rule
                          APIs
                          Memory Dump Source
                          • Source File: 0000000D.00000002.408874255.0000000000130000.00000040.00000400.00020000.00000000.sdmp, Offset: 00130000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_13_2_130000_sc.jbxd
                          Similarity
                          • API ID: _set_statfp
                          • String ID:
                          • API String ID: 1156100317-0
                          • Opcode ID: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
                          • Instruction ID: 46678af44a053e87c9fad9c792cba3bcd3a485404f62b514967b45d3513d7754
                          • Opcode Fuzzy Hash: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
                          • Instruction Fuzzy Hash: 6C01F933A14F5211EB5C2528E49233911816B6C3B4F898B39BE7B5F7FACB28CB415200
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 00174104 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE
                          Download Yara Rule
                          APIs
                          Memory Dump Source
                          • Source File: 0000000D.00000002.408938277.0000000000160000.00000040.00001000.00020000.00000000.sdmp, Offset: 00160000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_13_2_160000_sc.jbxd
                          Similarity
                          • API ID: _set_statfp
                          • String ID:
                          • API String ID: 1156100317-0
                          • Opcode ID: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
                          • Instruction ID: 8bfed9b880ef71f012d51bffc5a2e67cfca2fabdbc7e2732f1b56e501034401c
                          • Opcode Fuzzy Hash: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
                          • Instruction Fuzzy Hash: E901C432A50F5523FB2975A8E86237511356BB83F8F99C634AA7E077E6CB28D9C14301
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 00169650 Relevance: 7.6, APIs: 5, Instructions: 53COMMONLIBRARYCODE
                          Download Yara Rule
                          APIs
                          Memory Dump Source
                          • Source File: 0000000D.00000002.408938277.0000000000160000.00000040.00001000.00020000.00000000.sdmp, Offset: 00160000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_13_2_160000_sc.jbxd
                          Similarity
                          • API ID: ErrorLast
                          • String ID:
                          • API String ID: 1452528299-0
                          • Opcode ID: 46c896f13dff0714c7ccebb8ca9383bb675cc38bcf091c92c481f4a556b8b138
                          • Instruction ID: 9b53bb782e9985cbb877b66cecf7fc3df5ba5eadc80d5cca79dc6acbf141369a
                          • Opcode Fuzzy Hash: 46c896f13dff0714c7ccebb8ca9383bb675cc38bcf091c92c481f4a556b8b138
                          • Instruction Fuzzy Hash: FD11C23131578093EF149B36EC84369365EAB98BE4F188624E96A477D9DF3CC8A2C700
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 0013F040 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 182COMMON
                          Download Yara Rule
                          APIs
                          • _invalid_parameter_noinfo.LIBCMT ref: 0013F124
                          Strings
                          Memory Dump Source
                          • Source File: 0000000D.00000002.408874255.0000000000130000.00000040.00000400.00020000.00000000.sdmp, Offset: 00130000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_13_2_130000_sc.jbxd
                          Similarity
                          • API ID: _invalid_parameter_noinfo
                          • String ID: Tuesday$Wednesday$or copy constructor iterator'
                          • API String ID: 3215553584-4202648911
                          • Opcode ID: 9e57f18f61c22f0406784eb273be7b0d6046b42052b72e443b30de0c50228f55
                          • Instruction ID: 452d7852144276980d85e238ca10d458622c2ff25ce88b1a8723eaf2e62746af
                          • Opcode Fuzzy Hash: 9e57f18f61c22f0406784eb273be7b0d6046b42052b72e443b30de0c50228f55
                          • Instruction Fuzzy Hash: A851E176E04A40C2EB29DB69F98433B6B62F796784F55453EEE0A17769DB38C847C300
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 0016AA1C Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 147COMMON
                          Download Yara Rule
                          APIs
                          • EncodePointer.KERNEL32 ref: 0016AA68
                          • _CallSETranslator.LIBVCRUNTIME ref: 0016AAB7
                          Strings
                          Memory Dump Source
                          • Source File: 0000000D.00000002.408938277.0000000000160000.00000040.00001000.00020000.00000000.sdmp, Offset: 00160000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_13_2_160000_sc.jbxd
                          Similarity
                          • API ID: CallEncodePointerTranslator
                          • String ID: MOC$RCC
                          • API String ID: 3544855599-2084237596
                          • Opcode ID: afa423ce38c0d5e6a55dfbc7a81328fa63e7332d8ee03f3f3ca57a2373e92492
                          • Instruction ID: 4d56caff2a9c014c5d260a2f6e10cf8c5d55ced8734490d10ec1b784e1f83157
                          • Opcode Fuzzy Hash: afa423ce38c0d5e6a55dfbc7a81328fa63e7332d8ee03f3f3ca57a2373e92492
                          • Instruction Fuzzy Hash: A951AE73600B848ADB20DFA5D88039D77B0FB58B8CF444216EF8A27B58DB78D5A5CB41
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 0013A178 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMON
                          Download Yara Rule
                          APIs
                          • __except_validate_context_record.LIBVCRUNTIME ref: 0013A1A0
                          • __FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 0013A288
                          Strings
                          Memory Dump Source
                          • Source File: 0000000D.00000002.408874255.0000000000130000.00000040.00000400.00020000.00000000.sdmp, Offset: 00130000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_13_2_130000_sc.jbxd
                          Similarity
                          • API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
                          • String ID: csm$csm
                          • API String ID: 3896166516-3733052814
                          • Opcode ID: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
                          • Instruction ID: c69cb6d129da29860b04a0120fab61e1352fd718c2bf106b2d462587110b0158
                          • Opcode Fuzzy Hash: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
                          • Instruction Fuzzy Hash: 3351E632104380CACF348F25D54436D7BA4FB65B94F989216EFD987B95CB38D4A5CB02
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 0016AD78 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMON
                          Download Yara Rule
                          APIs
                          • __except_validate_context_record.LIBVCRUNTIME ref: 0016ADA0
                          • __FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 0016AE88
                          Strings
                          Memory Dump Source
                          • Source File: 0000000D.00000002.408938277.0000000000160000.00000040.00001000.00020000.00000000.sdmp, Offset: 00160000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_13_2_160000_sc.jbxd
                          Similarity
                          • API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
                          • String ID: csm$csm
                          • API String ID: 3896166516-3733052814
                          • Opcode ID: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
                          • Instruction ID: 34ab59807bdb02caf35c0ca392b8bbbe3a6e0eb3a457a7dcc9946ad29950f098
                          • Opcode Fuzzy Hash: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
                          • Instruction Fuzzy Hash: 3851A072100380CBCB348F26D99436D77A4FB65B99F988216EB9967B55CB38D4B1CF02
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 00138405 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 135COMMON
                          Download Yara Rule
                          APIs
                          • __except_validate_context_record.LIBVCRUNTIME ref: 00138413
                          • _IsNonwritableInCurrentImage.LIBCMT ref: 001384A8
                          Strings
                          Memory Dump Source
                          • Source File: 0000000D.00000002.408874255.0000000000130000.00000040.00000400.00020000.00000000.sdmp, Offset: 00130000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_13_2_130000_sc.jbxd
                          Similarity
                          • API ID: CurrentImageNonwritable__except_validate_context_record
                          • String ID: csm$f
                          • API String ID: 3242871069-629598281
                          • Opcode ID: 114af5d7cf0438a1297bb8b9b6869ba79c6078414514cf9bb502ab9f42d0baed
                          • Instruction ID: f2b7d3fe7f79701367b933e7174a0f1c45a39f66df782f2048b7b30b0ccd0091
                          • Opcode Fuzzy Hash: 114af5d7cf0438a1297bb8b9b6869ba79c6078414514cf9bb502ab9f42d0baed
                          • Instruction Fuzzy Hash: 4051A8327127008BCB1ADF25E440B6937A6F394B98F658125FE5A47B08EF78DD81CB44
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 001383E8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 75COMMON
                          Download Yara Rule
                          APIs
                          • __except_validate_context_record.LIBVCRUNTIME ref: 00138413
                          • _IsNonwritableInCurrentImage.LIBCMT ref: 001384A8
                          Strings
                          Memory Dump Source
                          • Source File: 0000000D.00000002.408874255.0000000000130000.00000040.00000400.00020000.00000000.sdmp, Offset: 00130000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_13_2_130000_sc.jbxd
                          Similarity
                          • API ID: CurrentImageNonwritable__except_validate_context_record
                          • String ID: csm$f
                          • API String ID: 3242871069-629598281
                          • Opcode ID: 0036035fc280b7a5a111a049c7edfc77b7be6b9ab52e14187ebc45e366edaa55
                          • Instruction ID: 476e4cd016ef536b2cb78e83e825d595004bf4c4df6bd6726dbe36a828414e7d
                          • Opcode Fuzzy Hash: 0036035fc280b7a5a111a049c7edfc77b7be6b9ab52e14187ebc45e366edaa55
                          • Instruction Fuzzy Hash: 6A318772211B40DBDB15DF22E844B6A7B65F790B98F558128FE9A47B18DF38CA41CB04
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 00172058 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON
                          Download Yara Rule
                          APIs
                          Memory Dump Source
                          • Source File: 0000000D.00000002.408938277.0000000000160000.00000040.00001000.00020000.00000000.sdmp, Offset: 00160000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_13_2_160000_sc.jbxd
                          Similarity
                          • API ID: FileWrite$ConsoleErrorLastOutput
                          • String ID:
                          • API String ID: 2718003287-0
                          • Opcode ID: d9b1ad1a373a674d1985cb33d71231f2b71aece2c14fe5b700ae80922c385091
                          • Instruction ID: ca62c7facfb2b4b746de2e62f63cf97ee47497047a673177d90e47fa8642cb6c
                          • Opcode Fuzzy Hash: d9b1ad1a373a674d1985cb33d71231f2b71aece2c14fe5b700ae80922c385091
                          • Instruction Fuzzy Hash: EAC1F172B14A808AE711CFB9D8403AC3BB5F358BE8B548216DE5E97B99DB34C517C340
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 00172980 Relevance: 6.2, APIs: 4, Instructions: 218COMMON
                          Download Yara Rule
                          APIs
                          Memory Dump Source
                          • Source File: 0000000D.00000002.408938277.0000000000160000.00000040.00001000.00020000.00000000.sdmp, Offset: 00160000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_13_2_160000_sc.jbxd
                          Similarity
                          • API ID: ConsoleErrorLastMode
                          • String ID:
                          • API String ID: 953036326-0
                          • Opcode ID: c5ecde4312ccfa2e1ed1a2c608d038f857b097ec6549ceb78086129b2e572a94
                          • Instruction ID: 41f9bdc0b39f1ea3e086899db42a1f2f28d09b078bfcfcfc9647f30f49da9eee
                          • Opcode Fuzzy Hash: c5ecde4312ccfa2e1ed1a2c608d038f857b097ec6549ceb78086129b2e572a94
                          • Instruction Fuzzy Hash: A881D172B14A5089EB25DF6998807AD3BB0F755B88F68C109DE4E67B58DB35C887C700
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 00167960 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMONLIBRARYCODE
                          Download Yara Rule
                          APIs
                          • GetSystemTimeAsFileTime.KERNEL32 ref: 0016798C
                          • GetCurrentThreadId.KERNEL32 ref: 0016799A
                          • GetCurrentProcessId.KERNEL32 ref: 001679A6
                          • QueryPerformanceCounter.KERNEL32 ref: 001679B6
                          Memory Dump Source
                          • Source File: 0000000D.00000002.408938277.0000000000160000.00000040.00001000.00020000.00000000.sdmp, Offset: 00160000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_13_2_160000_sc.jbxd
                          Similarity
                          • API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
                          • String ID:
                          • API String ID: 2933794660-0
                          • Opcode ID: 561ac6f4885ef0f33bff27beb4ddb95e6a253367b5c72fac45fcb4617ca9122b
                          • Instruction ID: 9ae8ec60eb71777fddea86f4fdf44181e3f83b08094e532c0d816fbf61470eea
                          • Opcode Fuzzy Hash: 561ac6f4885ef0f33bff27beb4ddb95e6a253367b5c72fac45fcb4617ca9122b
                          • Instruction Fuzzy Hash: 8B110936715F058AEB00CF60EC553E833B4F759768F441E25EA6D86BA4DF78C2A98380
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 0016253C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 185COMMON
                          Download Yara Rule
                          APIs
                          Strings
                          Memory Dump Source
                          • Source File: 0000000D.00000002.408938277.0000000000160000.00000040.00001000.00020000.00000000.sdmp, Offset: 00160000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_13_2_160000_sc.jbxd
                          Similarity
                          • API ID: FileType
                          • String ID: \\.\pipe\
                          • API String ID: 3081899298-91387939
                          • Opcode ID: 41f2590248caa42fa42cbc4740ff50b79ee080d5b4a351d521f36d41c2820f1b
                          • Instruction ID: 281fbad1b1411647f9de802c292c96ccfd5ecdb10a8ca8a4d1e2abf07aeb8c5f
                          • Opcode Fuzzy Hash: 41f2590248caa42fa42cbc4740ff50b79ee080d5b4a351d521f36d41c2820f1b
                          • Instruction Fuzzy Hash: 4F61AF37200B8186CB25DF2AEC547AA77A4F3A9BC4F554126EE0A57B09DF35CA65C700
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 00139E1C Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 147COMMON
                          Download Yara Rule
                          APIs
                          • _CallSETranslator.LIBVCRUNTIME ref: 00139EB7
                          Strings
                          Memory Dump Source
                          • Source File: 0000000D.00000002.408874255.0000000000130000.00000040.00000400.00020000.00000000.sdmp, Offset: 00130000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_13_2_130000_sc.jbxd
                          Similarity
                          • API ID: CallTranslator
                          • String ID: MOC$RCC
                          • API String ID: 3163161869-2084237596
                          • Opcode ID: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
                          • Instruction ID: 0380b1d1501dafea996fd06a808d692ada339b4bd8a2d5566e6f234f943ae5c3
                          • Opcode Fuzzy Hash: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
                          • Instruction Fuzzy Hash: 45518A37A05B848AEB24DF69D4803AD7BB0F758B8CF144216EF8917B58DBB8D595C700
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 00162330 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 141COMMON
                          Download Yara Rule
                          APIs
                          Strings
                          Memory Dump Source
                          • Source File: 0000000D.00000002.408938277.0000000000160000.00000040.00001000.00020000.00000000.sdmp, Offset: 00160000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_13_2_160000_sc.jbxd
                          Similarity
                          • API ID: FileType
                          • String ID: \\.\pipe\
                          • API String ID: 3081899298-91387939
                          • Opcode ID: 002250ee4f7fb53d82cbff54f4c55d9c13c210cbd3ade0a461cf797918ee8e55
                          • Instruction ID: 49c08c21287253e580d21981a3f568941937c4f1ce9a600650c020c9a058edb4
                          • Opcode Fuzzy Hash: 002250ee4f7fb53d82cbff54f4c55d9c13c210cbd3ade0a461cf797918ee8e55
                          • Instruction Fuzzy Hash: 7141F632208B8281D638DF2AACA83BEA761F3D5784F950125DE5A43B19DF39C965C780
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 001726F0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON
                          Download Yara Rule
                          APIs
                          Strings
                          Memory Dump Source
                          • Source File: 0000000D.00000002.408938277.0000000000160000.00000040.00001000.00020000.00000000.sdmp, Offset: 00160000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_13_2_160000_sc.jbxd
                          Similarity
                          • API ID: ErrorFileLastWrite
                          • String ID: U
                          • API String ID: 442123175-4171548499
                          • Opcode ID: 94e3e9b2e49fb54f8b51ea0afa049cb5a9b4caf00c445db25a5723c425a58a56
                          • Instruction ID: a8265f9502773abef972f6ec856b54a5589e3761c5091451ee1756a23e6a85cb
                          • Opcode Fuzzy Hash: 94e3e9b2e49fb54f8b51ea0afa049cb5a9b4caf00c445db25a5723c425a58a56
                          • Instruction Fuzzy Hash: D831D432719B8086DB20DF25E8503AAB7B1F798B94F508025EE4E87758EF7CC542CB40
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 001694A0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMONLIBRARYCODE
                          Download Yara Rule
                          APIs
                          Strings
                          Memory Dump Source
                          • Source File: 0000000D.00000002.408938277.0000000000160000.00000040.00001000.00020000.00000000.sdmp, Offset: 00160000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_13_2_160000_sc.jbxd
                          Similarity
                          • API ID: ExceptionFileHeaderRaise
                          • String ID: csm
                          • API String ID: 2573137834-1018135373
                          • Opcode ID: 596d8aa0106168f831d5a6617a756b303fb26e5894bac8705379b132699e985d
                          • Instruction ID: 97173cfd7a81415f3205a9e6e0f560865a6bd8018953df1f180e47e8ef74f3f8
                          • Opcode Fuzzy Hash: 596d8aa0106168f831d5a6617a756b303fb26e5894bac8705379b132699e985d
                          • Instruction Fuzzy Hash: 0C111C36218B8082DB218F25F944359B7A5FB88B94F584225EF8D47B29DF3CC565CB00
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 00137356 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 18COMMON
                          Download Yara Rule
                          APIs
                          • __std_exception_copy.LIBVCRUNTIME ref: 0013737C
                          Strings
                          Memory Dump Source
                          • Source File: 0000000D.00000002.408874255.0000000000130000.00000040.00000400.00020000.00000000.sdmp, Offset: 00130000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_13_2_130000_sc.jbxd
                          Similarity
                          • API ID: __std_exception_copy
                          • String ID: ierarchy Descriptor'$riptor at (
                          • API String ID: 592178966-758928094
                          • Opcode ID: 13d46e236c22f038e3183f277bc937bc0c01c293d14bd07e4c5c2ea041926035
                          • Instruction ID: 6e399c9b7bfd5baba3c0fc70cd98301de1fad0792c661c8c48d287048228b1b5
                          • Opcode Fuzzy Hash: 13d46e236c22f038e3183f277bc937bc0c01c293d14bd07e4c5c2ea041926035
                          • Instruction Fuzzy Hash: 32E0E661651B49D1DF018F61E8503D873A5DB68B68F589122995C46365FB38D1E9C300
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 001373B4 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 17COMMON
                          Download Yara Rule
                          APIs
                          • __std_exception_copy.LIBVCRUNTIME ref: 001373D8
                          Strings
                          Memory Dump Source
                          • Source File: 0000000D.00000002.408874255.0000000000130000.00000040.00000400.00020000.00000000.sdmp, Offset: 00130000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_13_2_130000_sc.jbxd
                          Similarity
                          • API ID: __std_exception_copy
                          • String ID: Locator'$riptor at (
                          • API String ID: 592178966-4215709766
                          • Opcode ID: af0f0512ca75cd806a30771dd11e2a0f17b9e6725b3a9df23089972a8cb9d3f7
                          • Instruction ID: 360f9913238574f3a8d60e05ea2128f2065d528bfe4de12a198ac8424357c6a5
                          • Opcode Fuzzy Hash: af0f0512ca75cd806a30771dd11e2a0f17b9e6725b3a9df23089972a8cb9d3f7
                          • Instruction Fuzzy Hash: 67E0EC61A51F48D5DF028F61E89039873A6EB68B68F989122DA5C46365EB38D1E9C310
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 00161BF4 Relevance: 5.1, APIs: 4, Instructions: 52memoryCOMMON
                          Download Yara Rule
                          APIs
                          • GetProcessHeap.KERNEL32 ref: 00161C2D
                          • HeapAlloc.KERNEL32 ref: 00161C3B
                          • GetProcessHeap.KERNEL32 ref: 00161C77
                          • HeapFree.KERNEL32 ref: 00161C85
                            • Part of subcall function 0016152C: StrCmpIW.SHLWAPI ref: 0016155D
                          Memory Dump Source
                          • Source File: 0000000D.00000002.408938277.0000000000160000.00000040.00001000.00020000.00000000.sdmp, Offset: 00160000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_13_2_160000_sc.jbxd
                          Similarity
                          • API ID: Heap$Process$AllocFree
                          • String ID:
                          • API String ID: 756756679-0
                          • Opcode ID: e6b128499454e36a5cfdb4ce6de946333e896a2fc86765bea62df52d9c8f7d1a
                          • Instruction ID: 1b91d5f1f96333ac43e813a980f5195fe6532f6bbbeece10b881082b9c135fd5
                          • Opcode Fuzzy Hash: e6b128499454e36a5cfdb4ce6de946333e896a2fc86765bea62df52d9c8f7d1a
                          • Instruction Fuzzy Hash: 8A115725601F8496EA04DB6AA80836A77A1FBC9FD0F5D8028DE4E97726DF38C852D300
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 00161268 Relevance: 5.0, APIs: 4, Instructions: 21memoryCOMMON
                          Download Yara Rule
                          APIs
                          Memory Dump Source
                          • Source File: 0000000D.00000002.408938277.0000000000160000.00000040.00001000.00020000.00000000.sdmp, Offset: 00160000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_13_2_160000_sc.jbxd
                          Similarity
                          • API ID: Heap$AllocProcess
                          • String ID:
                          • API String ID: 1617791916-0
                          • Opcode ID: c7b0d7b4e65e150846e46a28cdf479c2d04166a2b9ed3272f310b0e97a34ba1d
                          • Instruction ID: 02d2735988e2739375dd3c55a7b8bb9f95b1c605246ed3794c97b47813ca3fe7
                          • Opcode Fuzzy Hash: c7b0d7b4e65e150846e46a28cdf479c2d04166a2b9ed3272f310b0e97a34ba1d
                          • Instruction Fuzzy Hash: 04E0E575A11A0486EB089F62D81C39A77F1FBC9F56F89C024C94D07361DF7D8899CB90
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 00161000 Relevance: 5.0, APIs: 4, Instructions: 20memoryCOMMON
                          Download Yara Rule
                          APIs
                          Memory Dump Source
                          • Source File: 0000000D.00000002.408938277.0000000000160000.00000040.00001000.00020000.00000000.sdmp, Offset: 00160000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_13_2_160000_sc.jbxd
                          Similarity
                          • API ID: Heap$AllocProcess
                          • String ID:
                          • API String ID: 1617791916-0
                          • Opcode ID: 952b2c0fe5133ab7956e2ef84fe5bf2b2b692290a663e8cebccb5d827e1e35ea
                          • Instruction ID: a8c1ec453259f36e61707941bc15d4874977e4049bf1208e5de61792713550e8
                          • Opcode Fuzzy Hash: 952b2c0fe5133ab7956e2ef84fe5bf2b2b692290a663e8cebccb5d827e1e35ea
                          • Instruction Fuzzy Hash: 5EE01A75611A04C7EB089F62D80839A77F1FBCCF16F888024C90D07721EE3C8899CB20
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Execution Graph

                          Execution Coverage:1.1%
                          Dynamic/Decrypted Code Coverage:0%
                          Signature Coverage:0%
                          Total number of Nodes:20
                          Total number of Limit Nodes:7
                          execution_graph 14905 1d273c 14908 1d276a 14905->14908 14906 1d28d4 14907 1d2858 LoadLibraryA 14907->14908 14908->14906 14908->14907 14909 209dc4 14910 209ecd __vcrt_FlsSetValue 14909->14910 14914 209e08 __vcrt_FlsSetValue 14909->14914 14911 209e36 LoadLibraryExW 14912 209e57 GetLastError 14911->14912 14913 209ead 14911->14913 14912->14914 14913->14910 14915 209ec4 FreeLibrary 14913->14915 14914->14910 14914->14911 14916 209e79 LoadLibraryExW 14914->14916 14915->14910 14916->14913 14916->14914 14917 20f394 14918 20f3f1 __vcrt_FlsSetValue 14917->14918 14920 20f3ec __vcrt_FlsSetValue 14917->14920 14919 20f421 LoadLibraryExW 14921 20f4f6 14919->14921 14922 20f446 GetLastError 14919->14922 14920->14918 14920->14919 14924 20f480 LoadLibraryExW 14920->14924 14921->14918 14923 20f50d FreeLibrary 14921->14923 14922->14920 14923->14918 14924->14920 14924->14921

                          Executed Functions

                          Function 00201628 Relevance: 50.9, APIs: 20, Strings: 9, Instructions: 157registrymemoryCOMMON
                          Download Yara Rule

                          Control-flow Graph

                          APIs
                          • GetProcessHeap.KERNEL32 ref: 00201633
                          • HeapAlloc.KERNEL32 ref: 00201642
                            • Part of subcall function 00201268: GetProcessHeap.KERNEL32 ref: 0020126E
                            • Part of subcall function 00201268: HeapAlloc.KERNEL32 ref: 0020127D
                            • Part of subcall function 00201268: GetProcessHeap.KERNEL32 ref: 00201297
                            • Part of subcall function 00201268: HeapAlloc.KERNEL32 ref: 002012A8
                            • Part of subcall function 00201000: GetProcessHeap.KERNEL32 ref: 00201006
                            • Part of subcall function 00201000: HeapAlloc.KERNEL32 ref: 00201015
                            • Part of subcall function 00201000: GetProcessHeap.KERNEL32 ref: 00201028
                            • Part of subcall function 00201000: HeapAlloc.KERNEL32 ref: 00201037
                          • RegOpenKeyExW.ADVAPI32 ref: 002016B2
                          • RegOpenKeyExW.ADVAPI32 ref: 002016DF
                          • RegCloseKey.ADVAPI32 ref: 002016F9
                          • RegOpenKeyExW.ADVAPI32 ref: 00201719
                          • RegCloseKey.ADVAPI32 ref: 00201734
                          • RegOpenKeyExW.ADVAPI32 ref: 00201754
                          • RegCloseKey.ADVAPI32 ref: 0020176F
                          • RegOpenKeyExW.ADVAPI32 ref: 0020178F
                          • RegCloseKey.ADVAPI32 ref: 002017AA
                          • RegOpenKeyExW.ADVAPI32 ref: 002017CA
                          • RegCloseKey.ADVAPI32 ref: 002017E5
                          • RegOpenKeyExW.ADVAPI32 ref: 00201805
                          • RegCloseKey.ADVAPI32 ref: 00201820
                          • RegOpenKeyExW.ADVAPI32 ref: 00201840
                          • RegCloseKey.ADVAPI32 ref: 0020185B
                          • RegOpenKeyExW.ADVAPI32 ref: 0020187B
                          • RegCloseKey.ADVAPI32 ref: 00201896
                          • RegCloseKey.ADVAPI32 ref: 002018A0
                            • Part of subcall function 002012BC: RegQueryInfoKeyW.ADVAPI32 ref: 00201319
                            • Part of subcall function 002012BC: GetProcessHeap.KERNEL32 ref: 00201327
                            • Part of subcall function 002012BC: HeapAlloc.KERNEL32 ref: 00201338
                            • Part of subcall function 002012BC: RegEnumValueW.ADVAPI32 ref: 00201397
                            • Part of subcall function 002012BC: GetProcessHeap.KERNEL32 ref: 002013DF
                            • Part of subcall function 002012BC: HeapAlloc.KERNEL32 ref: 002013ED
                            • Part of subcall function 002012BC: GetProcessHeap.KERNEL32 ref: 0020140A
                            • Part of subcall function 002012BC: HeapFree.KERNEL32 ref: 00201418
                            • Part of subcall function 002012BC: lstrlenW.KERNEL32 ref: 00201421
                            • Part of subcall function 002012BC: GetProcessHeap.KERNEL32 ref: 0020142F
                            • Part of subcall function 002012BC: HeapAlloc.KERNEL32 ref: 0020143D
                          Strings
                          Memory Dump Source
                          • Source File: 0000000F.00000002.410436729.0000000000200000.00000040.00001000.00020000.00000000.sdmp, Offset: 00200000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_15_2_200000_conhost.jbxd
                          Similarity
                          • API ID: Heap$CloseOpenProcess$Alloc$EnumFreeInfoQueryValuelstrlen
                          • String ID: SOFTWARE\dialerconfig$paths$pid$process_names$service_names$startup$tcp_local$tcp_remote$udp
                          • API String ID: 2135414181-2879589442
                          • Opcode ID: 84d977f69669bb910c18c90d9c150143eff6fe6f95bc9245a9bd4b5f56132143
                          • Instruction ID: 5192fa00a71dcae5257b1533c296a313a3eb0785f33ecd6b7758f074772e919e
                          • Opcode Fuzzy Hash: 84d977f69669bb910c18c90d9c150143eff6fe6f95bc9245a9bd4b5f56132143
                          • Instruction Fuzzy Hash: 2271E536320B1186EB20DF66E89879D33B5FB98B88F411121EE4E57B69EF38C564C740
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 0020F394 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117libraryloaderCOMMON
                          Download Yara Rule

                          Control-flow Graph

                          • Executed
                          • Not Executed
                          control_flow_graph 51 20f394-20f3e6 52 20f4d7 51->52 53 20f3ec-20f3ef 51->53 54 20f4d9-20f4f5 52->54 55 20f3f1-20f3f4 53->55 56 20f3f9-20f3fc 53->56 55->54 57 20f402-20f411 56->57 58 20f4bc-20f4cf 56->58 59 20f421-20f440 LoadLibraryExW 57->59 60 20f413-20f416 57->60 58->52 63 20f4f6-20f50b 59->63 64 20f446-20f44f GetLastError 59->64 61 20f516-20f525 call 216090 60->61 62 20f41c 60->62 72 20f4b5 61->72 73 20f527-20f54e 61->73 65 20f4a8-20f4af 62->65 63->61 66 20f50d-20f510 FreeLibrary 63->66 68 20f451-20f468 call 20c928 64->68 69 20f496-20f4a0 64->69 65->57 65->72 66->61 68->69 75 20f46a-20f47e call 20c928 68->75 69->65 72->58 73->54 75->69 78 20f480-20f494 LoadLibraryExW 75->78 78->63 78->69
                          APIs
                          Strings
                          Memory Dump Source
                          • Source File: 0000000F.00000002.410436729.0000000000200000.00000040.00001000.00020000.00000000.sdmp, Offset: 00200000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_15_2_200000_conhost.jbxd
                          Similarity
                          • API ID: AddressFreeLibraryProc
                          • String ID: api-ms-$ext-ms-
                          • API String ID: 3013587201-537541572
                          • Opcode ID: a0f3cb97d83f084b5c078ea606d329a918e0789490c159543aff3f4a2fa5ff9f
                          • Instruction ID: f4f2c07d1da628a7ce0ec5b00590934aac187b0a7ab0bc77a95ba13f4e0aee14
                          • Opcode Fuzzy Hash: a0f3cb97d83f084b5c078ea606d329a918e0789490c159543aff3f4a2fa5ff9f
                          • Instruction Fuzzy Hash: E8410532365B0191EB26CF66A9087963395FB59BE0F5A42399E0E87B96EF3CC455C300
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 00209DC4 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE
                          Download Yara Rule

                          Control-flow Graph

                          • Executed
                          • Not Executed
                          control_flow_graph 79 209dc4-209e02 80 209ef3 79->80 81 209e08-209e0b 79->81 82 209ef5-209f11 80->82 81->82 83 209e11 81->83 84 209e14 83->84 85 209e1a-209e29 84->85 86 209eeb 84->86 87 209e36-209e55 LoadLibraryExW 85->87 88 209e2b-209e2e 85->88 86->80 89 209e57-209e60 GetLastError 87->89 90 209ead-209ec2 87->90 91 209e34 88->91 92 209ecd-209edc call 216090 88->92 94 209e62-209e77 call 20c928 89->94 95 209e8f-209e99 89->95 90->92 96 209ec4-209ec7 FreeLibrary 90->96 93 209ea1-209ea8 91->93 92->86 101 209ede-209ee9 92->101 93->84 94->95 102 209e79-209e8d LoadLibraryExW 94->102 95->93 96->92 101->82 102->90 102->95
                          APIs
                          Strings
                          Memory Dump Source
                          • Source File: 0000000F.00000002.410436729.0000000000200000.00000040.00001000.00020000.00000000.sdmp, Offset: 00200000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_15_2_200000_conhost.jbxd
                          Similarity
                          • API ID: Library$Load$AddressErrorFreeLastProc
                          • String ID: api-ms-
                          • API String ID: 2559590344-2084034818
                          • Opcode ID: 1bec38bed2a9dad19cb8167f1bbce1e92081cdd400658c61ccc26499447e47b7
                          • Instruction ID: 0998b7106a6d08395f19f50f1c5d483dac8e24cb1db05447d405b7ec9df81792
                          • Opcode Fuzzy Hash: 1bec38bed2a9dad19cb8167f1bbce1e92081cdd400658c61ccc26499447e47b7
                          • Instruction Fuzzy Hash: 9631D531322B41E1DF12DF42E8447A52394B748BA0F590626DD2F0B793EF39C8A5C300
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 00201ABC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 68sleepCOMMON
                          Download Yara Rule

                          Control-flow Graph

                          • Executed
                          • Not Executed
                          control_flow_graph 103 201abc-201acb call 201628 106 201ad2-201aef Sleep SleepEx 103->106 107 201af5-201af8 106->107 108 201baa 106->108 110 201ba1-201ba8 107->110 111 201afe-201b01 107->111 109 201bad-201bb5 call 2018b4 108->109 109->106 110->109 111->110 113 201b07-201b14 call 201598 111->113 117 201b94 113->117 118 201b16-201b25 call 201220 113->118 120 201b96-201b98 117->120 118->117 123 201b27-201b36 call 201598 118->123 120->108 122 201b9a 120->122 122->110 123->117 126 201b38-201b47 call 201598 123->126 126->117 129 201b49-201b58 call 201598 126->129 129->117 132 201b5a-201b69 call 201220 129->132 132->117 135 201b6b-201b7a call 201220 132->135 135->117 138 201b7c-201b8b call 201220 135->138 138->117 141 201b8d-201b92 138->141 141->120
                          APIs
                            • Part of subcall function 00201628: GetProcessHeap.KERNEL32 ref: 00201633
                            • Part of subcall function 00201628: HeapAlloc.KERNEL32 ref: 00201642
                            • Part of subcall function 00201628: RegOpenKeyExW.ADVAPI32 ref: 002016B2
                            • Part of subcall function 00201628: RegOpenKeyExW.ADVAPI32 ref: 002016DF
                            • Part of subcall function 00201628: RegCloseKey.ADVAPI32 ref: 002016F9
                            • Part of subcall function 00201628: RegOpenKeyExW.ADVAPI32 ref: 00201719
                            • Part of subcall function 00201628: RegCloseKey.ADVAPI32 ref: 00201734
                            • Part of subcall function 00201628: RegOpenKeyExW.ADVAPI32 ref: 00201754
                            • Part of subcall function 00201628: RegCloseKey.ADVAPI32 ref: 0020176F
                            • Part of subcall function 00201628: RegOpenKeyExW.ADVAPI32 ref: 0020178F
                            • Part of subcall function 00201628: RegCloseKey.ADVAPI32 ref: 002017AA
                            • Part of subcall function 00201628: RegOpenKeyExW.ADVAPI32 ref: 002017CA
                          • Sleep.KERNEL32 ref: 00201AD7
                          • SleepEx.KERNEL32 ref: 00201ADD
                            • Part of subcall function 00201628: RegCloseKey.ADVAPI32 ref: 002017E5
                            • Part of subcall function 00201628: RegOpenKeyExW.ADVAPI32 ref: 00201805
                            • Part of subcall function 00201628: RegCloseKey.ADVAPI32 ref: 00201820
                            • Part of subcall function 00201628: RegOpenKeyExW.ADVAPI32 ref: 00201840
                            • Part of subcall function 00201628: RegCloseKey.ADVAPI32 ref: 0020185B
                            • Part of subcall function 00201628: RegOpenKeyExW.ADVAPI32 ref: 0020187B
                            • Part of subcall function 00201628: RegCloseKey.ADVAPI32 ref: 00201896
                            • Part of subcall function 00201628: RegCloseKey.ADVAPI32 ref: 002018A0
                          Strings
                          Memory Dump Source
                          • Source File: 0000000F.00000002.410436729.0000000000200000.00000040.00001000.00020000.00000000.sdmp, Offset: 00200000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_15_2_200000_conhost.jbxd
                          Similarity
                          • API ID: CloseOpen$HeapSleep$AllocProcess
                          • String ID: p@F
                          • API String ID: 1534210851-3296074466
                          • Opcode ID: ad614115fa5d2181ccf7742c52f053f5bbac07b16a2f1961ccdf1ed8f9939afa
                          • Instruction ID: e21abb48249eba7fc143b6dcc3e771e8857a7db25b1192dad64c763edd5c7e2f
                          • Opcode Fuzzy Hash: ad614115fa5d2181ccf7742c52f053f5bbac07b16a2f1961ccdf1ed8f9939afa
                          • Instruction Fuzzy Hash: 6721BE61321B4296DF149F26DA5136D7365EB88BD4F4854229E0A877DBFF24C872C610
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 0020328C Relevance: 4.5, APIs: 3, Instructions: 43threadCOMMON
                          Download Yara Rule

                          Control-flow Graph

                          • Executed
                          • Not Executed
                          control_flow_graph 142 20328c-20329b 143 2032a1-2032b6 GetModuleFileNameW 142->143 144 203323-203325 142->144 147 2032b8-2032cd PathFindFileNameW call 203844 143->147 148 20331f-203321 143->148 145 203327 call 2036c8 144->145 146 20332c 144->146 145->146 149 203331-203339 146->149 147->148 153 2032cf-2032d6 call 203790 147->153 148->149 153->148 156 2032d8-2032df 153->156 156->146 157 2032e1-203318 CreateThread call 201d14 156->157 159 20331d 157->159 159->146
                          APIs
                          • GetModuleFileNameW.KERNEL32 ref: 002032AE
                          • PathFindFileNameW.SHLWAPI ref: 002032BD
                            • Part of subcall function 00203844: StrCmpNIW.SHLWAPI ref: 0020385C
                            • Part of subcall function 00203790: GetModuleHandleW.KERNEL32 ref: 0020379E
                            • Part of subcall function 00203790: GetCurrentProcess.KERNEL32 ref: 002037CC
                            • Part of subcall function 00203790: VirtualProtectEx.KERNEL32 ref: 002037EE
                            • Part of subcall function 00203790: GetCurrentProcess.KERNEL32 ref: 00203809
                            • Part of subcall function 00203790: VirtualProtectEx.KERNEL32 ref: 0020382A
                          • CreateThread.KERNEL32 ref: 0020330B
                            • Part of subcall function 00201D14: GetCurrentThread.KERNEL32 ref: 00201D1F
                          Memory Dump Source
                          • Source File: 0000000F.00000002.410436729.0000000000200000.00000040.00001000.00020000.00000000.sdmp, Offset: 00200000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_15_2_200000_conhost.jbxd
                          Similarity
                          • API ID: Current$FileModuleNameProcessProtectThreadVirtual$CreateFindHandlePath
                          • String ID:
                          • API String ID: 1683269324-0
                          • Opcode ID: c94412c55dcd243bcd3fbe265bea19663896af10ab27123b85acb7154d5eea14
                          • Instruction ID: c137524fba86aa4022a8fbf61385856923087213ed05b69564581b685a5e350a
                          • Opcode Fuzzy Hash: c94412c55dcd243bcd3fbe265bea19663896af10ab27123b85acb7154d5eea14
                          • Instruction Fuzzy Hash: 9A01D470B30741E2FB20EF61F88D36D226CBB98344F905169D906825E2EF7DC268C780
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 001D273C Relevance: 1.7, APIs: 1, Instructions: 187libraryCOMMON
                          Download Yara Rule

                          Control-flow Graph

                          • Executed
                          • Not Executed
                          control_flow_graph 160 1d273c-1d27a4 call 1d29d4 * 4 169 1d27aa-1d27ad 160->169 170 1d29b2 160->170 169->170 172 1d27b3-1d27b6 169->172 171 1d29b4-1d29d0 170->171 172->170 173 1d27bc-1d27bf 172->173 173->170 174 1d27c5-1d27e6 173->174 174->170 176 1d27ec-1d280c 174->176 177 1d280e-1d2836 176->177 178 1d2838-1d283f 176->178 177->177 177->178 179 1d28df-1d28e6 178->179 180 1d2845-1d2852 178->180 181 1d28ec-1d2901 179->181 182 1d2992-1d29b0 179->182 180->179 183 1d2858-1d286a LoadLibraryA 180->183 181->182 184 1d2907 181->184 182->171 185 1d286c-1d2878 183->185 186 1d28ca-1d28d2 183->186 189 1d290d-1d2921 184->189 190 1d28c5-1d28c8 185->190 186->183 187 1d28d4-1d28d9 186->187 187->179 192 1d2923-1d2934 189->192 193 1d2982-1d298c 189->193 190->186 191 1d287a-1d287d 190->191 197 1d287f-1d28a5 191->197 198 1d28a7-1d28b7 191->198 195 1d293f-1d2943 192->195 196 1d2936-1d293d 192->196 193->182 193->189 200 1d294d-1d2951 195->200 201 1d2945-1d294b 195->201 199 1d2970-1d2980 196->199 202 1d28ba-1d28c1 197->202 198->202 199->192 199->193 203 1d2963-1d2967 200->203 204 1d2953-1d2961 200->204 201->199 202->190 203->199 206 1d2969-1d296c 203->206 204->199 206->199
                          APIs
                          Memory Dump Source
                          • Source File: 0000000F.00000002.410350862.00000000001D0000.00000040.00000001.00020000.00000000.sdmp, Offset: 001D0000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_15_2_1d0000_conhost.jbxd
                          Similarity
                          • API ID: LibraryLoad
                          • String ID:
                          • API String ID: 1029625771-0
                          • Opcode ID: 8c1c9448f3dd1088c887dafc1273d9eb4da1e6d2ce59199f574756fa2a1f07a1
                          • Instruction ID: f4662c11c4cad33f882c395f9c0fd7c360aae8202f159cdb53ba19664c315c63
                          • Opcode Fuzzy Hash: 8c1c9448f3dd1088c887dafc1273d9eb4da1e6d2ce59199f574756fa2a1f07a1
                          • Instruction Fuzzy Hash: 4461D772B016A48BCF18CF25D56063DB3A2FB64BA8F588126DF6917748DB38D862D740
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Non-executed Functions

                          Function 00207D90 Relevance: 10.6, APIs: 7, Instructions: 72COMMON
                          Download Yara Rule
                          APIs
                          • IsProcessorFeaturePresent.KERNEL32 ref: 00207DAC
                          • RtlCaptureContext.NTDLL ref: 00207DD9
                          • RtlLookupFunctionEntry.NTDLL ref: 00207DF3
                          • RtlVirtualUnwind.NTDLL ref: 00207E34
                          • IsDebuggerPresent.KERNEL32 ref: 00207E88
                          • SetUnhandledExceptionFilter.KERNEL32 ref: 00207EA9
                          • UnhandledExceptionFilter.KERNEL32 ref: 00207EB4
                          Memory Dump Source
                          • Source File: 0000000F.00000002.410436729.0000000000200000.00000040.00001000.00020000.00000000.sdmp, Offset: 00200000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_15_2_200000_conhost.jbxd
                          Similarity
                          • API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
                          • String ID:
                          • API String ID: 3140674995-0
                          • Opcode ID: 781d1b9bde8934adc12bfa83d35ad1be64d2520f1bd2f9e02f1b4bb1ea1a0257
                          • Instruction ID: 74165b1ccf02d7bd7751f14c5d981ddfd97a6b9929678d33f6ba32ef6e007351
                          • Opcode Fuzzy Hash: 781d1b9bde8934adc12bfa83d35ad1be64d2520f1bd2f9e02f1b4bb1ea1a0257
                          • Instruction Fuzzy Hash: 98316B72315B808AEB609F60E8847EE7374F794748F44442ADB8E57B99EF38C658CB10
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 00201D14 Relevance: 22.8, APIs: 1, Strings: 12, Instructions: 65threadCOMMON
                          Download Yara Rule

                          Control-flow Graph

                          APIs
                          • GetCurrentThread.KERNEL32 ref: 00201D1F
                            • Part of subcall function 00201FD4: GetModuleHandleA.KERNEL32 ref: 00201FEC
                            • Part of subcall function 00201FD4: GetProcAddress.KERNEL32 ref: 00201FFD
                            • Part of subcall function 00205B30: GetCurrentThreadId.KERNEL32 ref: 00205B6B
                          Strings
                          Memory Dump Source
                          • Source File: 0000000F.00000002.410436729.0000000000200000.00000040.00001000.00020000.00000000.sdmp, Offset: 00200000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_15_2_200000_conhost.jbxd
                          Similarity
                          • API ID: CurrentThread$AddressHandleModuleProc
                          • String ID: EnumServiceGroupW$EnumServicesStatusExW$NtDeviceIoControlFile$NtEnumerateKey$NtEnumerateValueKey$NtQueryDirectoryFile$NtQueryDirectoryFileEx$NtQuerySystemInformation$NtResumeThread$advapi32.dll$ntdll.dll$sechost.dll
                          • API String ID: 4175298099-1975688563
                          • Opcode ID: 848021bf4701eae64bbfc749c93af06548ec6c37c79a2989ab503d46e0816dd6
                          • Instruction ID: 185c1ad076a41f3513f6c9a88f05f55315eb399619ac0cad364fac3f6e64fbc5
                          • Opcode Fuzzy Hash: 848021bf4701eae64bbfc749c93af06548ec6c37c79a2989ab503d46e0816dd6
                          • Instruction Fuzzy Hash: CF319264224B5BF0EB05EFA9EC5D7E86321B764348FC15423A80A13576EF78C26EC790
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 0020CE28 Relevance: 18.1, APIs: 12, Instructions: 112COMMONLIBRARYCODE
                          Download Yara Rule

                          Control-flow Graph

                          • Executed
                          • Not Executed
                          control_flow_graph 356 20ce28-20ce4a GetLastError 357 20ce69-20ce74 FlsSetValue 356->357 358 20ce4c-20ce57 FlsGetValue 356->358 361 20ce76-20ce79 357->361 362 20ce7b-20ce80 357->362 359 20ce63 358->359 360 20ce59-20ce61 358->360 359->357 363 20ced5-20cee0 call 216130 360->363 361->363 364 20ce85 call 20d6cc 362->364 372 20cee2-20cef4 363->372 373 20cef5-20cf0b call 20c748 363->373 366 20ce8a-20ce96 364->366 368 20cea8-20ceb2 FlsSetValue 366->368 369 20ce98-20ce9f FlsSetValue 366->369 370 20ceb4-20cec4 FlsSetValue 368->370 371 20cec6-20ced0 call 20cb94 call 20d744 368->371 374 20cea1-20cea6 call 20d744 369->374 370->374 371->363 383 20cf28-20cf33 FlsSetValue 373->383 384 20cf0d-20cf18 FlsGetValue 373->384 374->361 387 20cf35-20cf3a 383->387 388 20cf98-20cf9f call 20c748 383->388 385 20cf22 384->385 386 20cf1a-20cf1e 384->386 385->383 386->388 389 20cf20 386->389 391 20cf3f call 20d6cc 387->391 392 20cf8f-20cf97 389->392 394 20cf44-20cf50 391->394 395 20cf62-20cf6c FlsSetValue 394->395 396 20cf52-20cf59 FlsSetValue 394->396 398 20cf80-20cf8a call 20cb94 call 20d744 395->398 399 20cf6e-20cf7e FlsSetValue 395->399 397 20cf5b-20cf60 call 20d744 396->397 397->388 398->392 399->397
                          APIs
                          • GetLastError.KERNEL32 ref: 0020CE37
                          • FlsGetValue.KERNEL32(?,?,?,00210A6B,?,?,?,0021045C,?,?,?,0020C84F), ref: 0020CE4C
                          • FlsSetValue.KERNEL32(?,?,?,00210A6B,?,?,?,0021045C,?,?,?,0020C84F), ref: 0020CE6D
                          • FlsSetValue.KERNEL32(?,?,?,00210A6B,?,?,?,0021045C,?,?,?,0020C84F), ref: 0020CE9A
                          • FlsSetValue.KERNEL32(?,?,?,00210A6B,?,?,?,0021045C,?,?,?,0020C84F), ref: 0020CEAB
                          • FlsSetValue.KERNEL32(?,?,?,00210A6B,?,?,?,0021045C,?,?,?,0020C84F), ref: 0020CEBC
                          • SetLastError.KERNEL32 ref: 0020CED7
                          • FlsGetValue.KERNEL32(?,?,?,?,?,?,?,00210A6B,?,?,?,0021045C,?,?,?,0020C84F), ref: 0020CF0D
                          • FlsSetValue.KERNEL32(?,?,00000001,0020ECCC,?,?,?,?,0020BF9F,?,?,?,?,?,00207AB0), ref: 0020CF2C
                            • Part of subcall function 0020D6CC: HeapAlloc.KERNEL32 ref: 0020D721
                          • FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00210A6B,?,?,?,0021045C,?,?,?,0020C84F), ref: 0020CF54
                            • Part of subcall function 0020D744: HeapFree.KERNEL32 ref: 0020D75A
                            • Part of subcall function 0020D744: GetLastError.KERNEL32 ref: 0020D764
                          • FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00210A6B,?,?,?,0021045C,?,?,?,0020C84F), ref: 0020CF65
                          • FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00210A6B,?,?,?,0021045C,?,?,?,0020C84F), ref: 0020CF76
                          Memory Dump Source
                          • Source File: 0000000F.00000002.410436729.0000000000200000.00000040.00001000.00020000.00000000.sdmp, Offset: 00200000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_15_2_200000_conhost.jbxd
                          Similarity
                          • API ID: Value$ErrorLast$Heap$AllocFree
                          • String ID:
                          • API String ID: 570795689-0
                          • Opcode ID: 81ae7dfa4ed2d3c1f1356864241e8c9d76a8deab2a50f3105871727dc9b84e00
                          • Instruction ID: 491481a1bc834f6501985cdb26ce3e37ff7bf5b88feb13de9cf07e446e8cf6ba
                          • Opcode Fuzzy Hash: 81ae7dfa4ed2d3c1f1356864241e8c9d76a8deab2a50f3105871727dc9b84e00
                          • Instruction Fuzzy Hash: 6131C5A037138542EF68AB75965973A62469F947F0F340B34AD3607FE7DE28D4718B01
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 0020A544 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 317COMMON
                          Download Yara Rule

                          Control-flow Graph

                          • Executed
                          • Not Executed
                          control_flow_graph 626 20a544-20a5ac call 20b414 629 20a5b2-20a5b5 626->629 630 20aa13-20aa1b call 20c748 626->630 629->630 631 20a5bb-20a5c1 629->631 634 20a690-20a6a2 631->634 635 20a5c7-20a5cb 631->635 636 20a963-20a967 634->636 637 20a6a8-20a6ac 634->637 635->634 638 20a5d1-20a5dc 635->638 639 20a9a0-20a9aa call 209634 636->639 640 20a969-20a970 636->640 637->636 641 20a6b2-20a6bd 637->641 638->634 642 20a5e2-20a5e7 638->642 639->630 654 20a9ac-20a9cb call 207940 639->654 640->630 644 20a976-20a99b call 20aa1c 640->644 641->636 646 20a6c3-20a6ca 641->646 642->634 643 20a5ed-20a5f7 call 209634 642->643 643->654 657 20a5fd-20a628 call 209634 * 2 call 209d24 643->657 644->639 647 20a6d0-20a707 call 209a10 646->647 648 20a894-20a8a0 646->648 647->648 662 20a70d-20a715 647->662 648->639 655 20a8a6-20a8aa 648->655 659 20a8ba-20a8c2 655->659 660 20a8ac-20a8b8 call 209ce4 655->660 694 20a648-20a652 call 209634 657->694 695 20a62a-20a62e 657->695 659->639 661 20a8c8-20a8d5 call 2098b4 659->661 660->659 670 20a8db-20a8e3 660->670 661->639 661->670 668 20a719-20a74b 662->668 672 20a751-20a75c 668->672 673 20a887-20a88e 668->673 675 20a9f6-20aa12 call 209634 * 2 call 20c6a8 670->675 676 20a8e9-20a8ed 670->676 672->673 677 20a762-20a77b 672->677 673->648 673->668 675->630 679 20a900 676->679 680 20a8ef-20a8fe call 209ce4 676->680 681 20a781-20a7c6 call 209cf8 * 2 677->681 682 20a874-20a879 677->682 690 20a903-20a90d call 20b4ac 679->690 680->690 708 20a804-20a80a 681->708 709 20a7c8-20a7ee call 209cf8 call 20ac38 681->709 687 20a884 682->687 687->673 690->639 705 20a913-20a961 call 209944 call 209b50 690->705 694->634 707 20a654-20a674 call 209634 * 2 call 20b4ac 694->707 695->694 699 20a630-20a63b 695->699 699->694 704 20a63d-20a642 699->704 704->630 704->694 705->639 732 20a676-20a680 call 20b59c 707->732 733 20a68b 707->733 714 20a87b 708->714 715 20a80c-20a810 708->715 726 20a7f0-20a802 709->726 727 20a815-20a872 call 20a470 709->727 719 20a880 714->719 715->681 719->687 726->708 726->709 727->719 736 20a9f0-20a9f5 call 20c6a8 732->736 737 20a686-20a9ef call 2092ac call 20aff4 call 2094a0 732->737 733->634 736->675 737->736
                          APIs
                          • __FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 0020A5A1
                            • Part of subcall function 0020B414: __GetUnwindTryBlock.LIBCMT ref: 0020B457
                            • Part of subcall function 0020B414: __SetUnwindTryBlock.LIBVCRUNTIME ref: 0020B47C
                          • Is_bad_exception_allowed.LIBVCRUNTIME ref: 0020A679
                          • __FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 0020A8CE
                          • std::bad_alloc::bad_alloc.LIBCMT ref: 0020A9DA
                          Strings
                          Memory Dump Source
                          • Source File: 0000000F.00000002.410436729.0000000000200000.00000040.00001000.00020000.00000000.sdmp, Offset: 00200000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_15_2_200000_conhost.jbxd
                          Similarity
                          • API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
                          • String ID: csm$csm$csm
                          • API String ID: 849930591-393685449
                          • Opcode ID: 147a5c394ba4e007c258850d6061d542d969719de9d23a8e277659d08661d77f
                          • Instruction ID: cb8eb7fc710dc7e85440b2cd0d33ba12f56640dce538594a24e822d16a278049
                          • Opcode Fuzzy Hash: 147a5c394ba4e007c258850d6061d542d969719de9d23a8e277659d08661d77f
                          • Instruction Fuzzy Hash: 05D1E172A20B848ADB20DF65D48039D77B4F759B98F904116EF8A57B9BCF34C1A1CB02
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 0020104C Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 99memoryregistryCOMMON
                          Download Yara Rule

                          Control-flow Graph

                          • Executed
                          • Not Executed
                          control_flow_graph 747 20104c-2010b9 RegQueryInfoKeyW 748 2011b5-2011d0 747->748 749 2010bf-2010c9 747->749 749->748 750 2010cf-20111f RegEnumValueW 749->750 751 2011a5-2011af 750->751 752 201125-20112a 750->752 751->748 751->750 752->751 753 20112c-201135 752->753 754 201147-20114c 753->754 755 201137 753->755 757 201199-2011a3 754->757 758 20114e-201193 GetProcessHeap HeapAlloc GetProcessHeap HeapFree 754->758 756 20113b-20113f 755->756 756->751 759 201141-201145 756->759 757->751 758->757 759->754 759->756
                          APIs
                          Strings
                          Memory Dump Source
                          • Source File: 0000000F.00000002.410436729.0000000000200000.00000040.00001000.00020000.00000000.sdmp, Offset: 00200000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_15_2_200000_conhost.jbxd
                          Similarity
                          • API ID: Heap$Process$AllocEnumFreeInfoQueryValue
                          • String ID: d
                          • API String ID: 3743429067-2564639436
                          • Opcode ID: 0cc5ceb7d92555702a84a43de404567f212e32e90d8a90c8922560dee2c01182
                          • Instruction ID: 64126c6de9a48a030a53c8b370488b585c6ec02cc91e88628d072c4374ea26a6
                          • Opcode Fuzzy Hash: 0cc5ceb7d92555702a84a43de404567f212e32e90d8a90c8922560dee2c01182
                          • Instruction Fuzzy Hash: FE416D73214B84DAE764CF21E44879EB7B5F388B98F448129DB8907B58DF38C599CB40
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 0020D068 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 54COMMONLIBRARYCODE
                          Download Yara Rule
                          APIs
                          • FlsGetValue.KERNEL32(?,?,?,0020C7DE,?,?,?,?,?,?,?,?,0020CF9D,?,?,00000001), ref: 0020D087
                          • FlsSetValue.KERNEL32(?,?,?,0020C7DE,?,?,?,?,?,?,?,?,0020CF9D,?,?,00000001), ref: 0020D0A6
                          • FlsSetValue.KERNEL32(?,?,?,0020C7DE,?,?,?,?,?,?,?,?,0020CF9D,?,?,00000001), ref: 0020D0CE
                          • FlsSetValue.KERNEL32(?,?,?,0020C7DE,?,?,?,?,?,?,?,?,0020CF9D,?,?,00000001), ref: 0020D0DF
                          • FlsSetValue.KERNEL32(?,?,?,0020C7DE,?,?,?,?,?,?,?,?,0020CF9D,?,?,00000001), ref: 0020D0F0
                          Strings
                          Memory Dump Source
                          • Source File: 0000000F.00000002.410436729.0000000000200000.00000040.00001000.00020000.00000000.sdmp, Offset: 00200000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_15_2_200000_conhost.jbxd
                          Similarity
                          • API ID: Value
                          • String ID: 1%$Y%
                          • API String ID: 3702945584-1395475152
                          • Opcode ID: eaed261e9eff258ccad1ac5f7a99306e4284ed666e6615725d2dc279c7a103a4
                          • Instruction ID: 8b27e4008e8e78af5ced24cf8ad53aa5826b8975f859ab177f9d322697e96d22
                          • Opcode Fuzzy Hash: eaed261e9eff258ccad1ac5f7a99306e4284ed666e6615725d2dc279c7a103a4
                          • Instruction Fuzzy Hash: 2111EC3072638541EB68ABB56A5573AA1065F547F0F144334A93D07BEBDE69C4728B00
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 00207510 Relevance: 12.2, APIs: 8, Instructions: 230COMMON
                          Download Yara Rule
                          APIs
                          • __scrt_dllmain_crt_thread_attach.LIBCMT ref: 00207538
                          • __scrt_acquire_startup_lock.LIBCMT ref: 0020758A
                          • _RTC_Initialize.LIBCMT ref: 002075B8
                          • __scrt_dllmain_after_initialize_c.LIBCMT ref: 002075DE
                          • __scrt_release_startup_lock.LIBCMT ref: 00207609
                          Memory Dump Source
                          • Source File: 0000000F.00000002.410436729.0000000000200000.00000040.00001000.00020000.00000000.sdmp, Offset: 00200000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_15_2_200000_conhost.jbxd
                          Similarity
                          • API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
                          • String ID:
                          • API String ID: 190073905-0
                          • Opcode ID: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
                          • Instruction ID: ac9fa626c3cde11257a4669965c1677db9063f1111e13c973a7065d3f0089780
                          • Opcode Fuzzy Hash: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
                          • Instruction Fuzzy Hash: 34716731F3874286EB10AF69984835D67A4BB95BC0F548425EE09437E7EF79E875CB00
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 00213DB4 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON
                          Download Yara Rule
                          APIs
                          Strings
                          Memory Dump Source
                          • Source File: 0000000F.00000002.410436729.0000000000200000.00000040.00001000.00020000.00000000.sdmp, Offset: 00200000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_15_2_200000_conhost.jbxd
                          Similarity
                          • API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
                          • String ID: CONOUT$
                          • API String ID: 3230265001-3130406586
                          • Opcode ID: ea8503a65e9befc0d33d9332805196394b6329e0df61646a9863ad39bb9ae76f
                          • Instruction ID: cb537fab80e6747b4a18a336cf23a3a7bd6923b9a49d5ab41f187222dec2f194
                          • Opcode Fuzzy Hash: ea8503a65e9befc0d33d9332805196394b6329e0df61646a9863ad39bb9ae76f
                          • Instruction Fuzzy Hash: 3D119E32320B8186E760DF56E858759B7A0F7A8FE4F044224EE5E877A4CF38C964C740
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 0020199C Relevance: 9.0, APIs: 6, Instructions: 42stringCOMMON
                          Download Yara Rule
                          APIs
                          Memory Dump Source
                          • Source File: 0000000F.00000002.410436729.0000000000200000.00000040.00001000.00020000.00000000.sdmp, Offset: 00200000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_15_2_200000_conhost.jbxd
                          Similarity
                          • API ID: FileName$CloseFindHandleModuleOpenPathProcesslstrlen
                          • String ID:
                          • API String ID: 517849248-0
                          • Opcode ID: 01214db588610ff501214a343c1506f8e4016efad0e64bbd234dc336c45f59d3
                          • Instruction ID: 2ae2bde6e3f78046beabe949f515bc73d770d7fba9b65d4cb8ee23c414055cb5
                          • Opcode Fuzzy Hash: 01214db588610ff501214a343c1506f8e4016efad0e64bbd234dc336c45f59d3
                          • Instruction Fuzzy Hash: 49014831711B8182EB24DB52A89C79AA3A5F798FC4F884035DE9D43B55DF3CC999C740
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 00203044 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 27COMMON
                          Download Yara Rule
                          APIs
                          Strings
                          Memory Dump Source
                          • Source File: 0000000F.00000002.410436729.0000000000200000.00000040.00001000.00020000.00000000.sdmp, Offset: 00200000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_15_2_200000_conhost.jbxd
                          Similarity
                          • API ID: CombinePath
                          • String ID: \\.\pipe\
                          • API String ID: 3422762182-91387939
                          • Opcode ID: 8c685e1f0b85bfe06f91eeefbd03c12bff8419d51c8b157116edbf6ca1c9c829
                          • Instruction ID: 4b874ecff4b0436f0b4224a02841890b94355f99647a2f9fabf8f4ad405b4634
                          • Opcode Fuzzy Hash: 8c685e1f0b85bfe06f91eeefbd03c12bff8419d51c8b157116edbf6ca1c9c829
                          • Instruction Fuzzy Hash: B6F0A030714B8082EB008F13B90C39AA365BB58FC0F088071EE5A07B19DF3CC555C700
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 0020BC98 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON
                          Download Yara Rule
                          APIs
                          Strings
                          Memory Dump Source
                          • Source File: 0000000F.00000002.410436729.0000000000200000.00000040.00001000.00020000.00000000.sdmp, Offset: 00200000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_15_2_200000_conhost.jbxd
                          Similarity
                          • API ID: AddressFreeHandleLibraryModuleProc
                          • String ID: CorExitProcess$mscoree.dll
                          • API String ID: 4061214504-1276376045
                          • Opcode ID: 95c54818ea39ae4ab476006ce308989d1f654d2f667890579c20066112978b6c
                          • Instruction ID: e799ca54c7b9922b80f5058f5f2aa54d50ada41ef0f23cfe504e336f45e47fbc
                          • Opcode Fuzzy Hash: 95c54818ea39ae4ab476006ce308989d1f654d2f667890579c20066112978b6c
                          • Instruction Fuzzy Hash: 3EF09071321B0681EB208F24E84C3A96330FBA8BA1F540219CA6A462E5CF3DC148C300
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 002050D0 Relevance: 7.8, APIs: 5, Instructions: 318threadCOMMON
                          Download Yara Rule
                          APIs
                          • GetCurrentThreadId.KERNEL32 ref: 00205156
                          Memory Dump Source
                          • Source File: 0000000F.00000002.410436729.0000000000200000.00000040.00001000.00020000.00000000.sdmp, Offset: 00200000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_15_2_200000_conhost.jbxd
                          Similarity
                          • API ID: CurrentThread
                          • String ID:
                          • API String ID: 2882836952-0
                          • Opcode ID: e13ad259af2044a9722e5c88be2fea28068701e2040856c8b7ebe2328a6e9181
                          • Instruction ID: 88295e3ebcc83fec28e26f4779c263943142e6811ce58cf7355b12ef70ba9bb9
                          • Opcode Fuzzy Hash: e13ad259af2044a9722e5c88be2fea28068701e2040856c8b7ebe2328a6e9181
                          • Instruction Fuzzy Hash: 65F1B532629B9486DB60CF59E49475BBBA0F3C5794F104016EA8E87BA9DF7DC4A4CF00
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 00214104 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE
                          Download Yara Rule
                          APIs
                          Memory Dump Source
                          • Source File: 0000000F.00000002.410436729.0000000000200000.00000040.00001000.00020000.00000000.sdmp, Offset: 00200000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_15_2_200000_conhost.jbxd
                          Similarity
                          • API ID: _set_statfp
                          • String ID:
                          • API String ID: 1156100317-0
                          • Opcode ID: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
                          • Instruction ID: dd32a663c8fcdcbd423176d4aebb8ba8d903a2debaa0e44ed139e79b45a8211b
                          • Opcode Fuzzy Hash: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
                          • Instruction Fuzzy Hash: BE01DB32A30F5231EB243968E8523E511C56B793F8F590634A97F077E6CB68C8E24600
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 0020AA1C Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 147COMMON
                          Download Yara Rule
                          APIs
                          • EncodePointer.KERNEL32 ref: 0020AA68
                          • _CallSETranslator.LIBVCRUNTIME ref: 0020AAB7
                          Strings
                          Memory Dump Source
                          • Source File: 0000000F.00000002.410436729.0000000000200000.00000040.00001000.00020000.00000000.sdmp, Offset: 00200000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_15_2_200000_conhost.jbxd
                          Similarity
                          • API ID: CallEncodePointerTranslator
                          • String ID: MOC$RCC
                          • API String ID: 3544855599-2084237596
                          • Opcode ID: afa423ce38c0d5e6a55dfbc7a81328fa63e7332d8ee03f3f3ca57a2373e92492
                          • Instruction ID: e8ce495d8bc9bc113541dde8bfda840b15eae65bee52023f384be38cc307f1ff
                          • Opcode Fuzzy Hash: afa423ce38c0d5e6a55dfbc7a81328fa63e7332d8ee03f3f3ca57a2373e92492
                          • Instruction Fuzzy Hash: 05517C33A10B848AEB20DF65D48039D77B4F358B8CF544216EF4A17B9ADB78D5A5C701
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 0020AD78 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMON
                          Download Yara Rule
                          APIs
                          • __except_validate_context_record.LIBVCRUNTIME ref: 0020ADA0
                          • __FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 0020AE88
                          Strings
                          Memory Dump Source
                          • Source File: 0000000F.00000002.410436729.0000000000200000.00000040.00001000.00020000.00000000.sdmp, Offset: 00200000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_15_2_200000_conhost.jbxd
                          Similarity
                          • API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
                          • String ID: csm$csm
                          • API String ID: 3896166516-3733052814
                          • Opcode ID: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
                          • Instruction ID: 2d9f4864eb6d6a2b0affb8708f9a36349a475f007bf3b76377e4e745a3c61270
                          • Opcode Fuzzy Hash: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
                          • Instruction Fuzzy Hash: B6518272120382CACB348F25D58836D77A4F355B95F988226EB9947FD6CB78D4B1CB02
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 00212058 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON
                          Download Yara Rule
                          APIs
                          Memory Dump Source
                          • Source File: 0000000F.00000002.410436729.0000000000200000.00000040.00001000.00020000.00000000.sdmp, Offset: 00200000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_15_2_200000_conhost.jbxd
                          Similarity
                          • API ID: FileWrite$ConsoleErrorLastOutput
                          • String ID:
                          • API String ID: 2718003287-0
                          • Opcode ID: d9b1ad1a373a674d1985cb33d71231f2b71aece2c14fe5b700ae80922c385091
                          • Instruction ID: 7b6ef914d64f17fb56f7e51c73529e416b6f424ce99878b538e18b209f7d8134
                          • Opcode Fuzzy Hash: d9b1ad1a373a674d1985cb33d71231f2b71aece2c14fe5b700ae80922c385091
                          • Instruction Fuzzy Hash: E4C1E332B24B80C9D711CFB9D4403DC3BB5F364798B144216EE5E97B99DA74C5AAC740
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 00212980 Relevance: 6.2, APIs: 4, Instructions: 218COMMON
                          Download Yara Rule
                          APIs
                          Memory Dump Source
                          • Source File: 0000000F.00000002.410436729.0000000000200000.00000040.00001000.00020000.00000000.sdmp, Offset: 00200000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_15_2_200000_conhost.jbxd
                          Similarity
                          • API ID: ConsoleErrorLastMode
                          • String ID:
                          • API String ID: 953036326-0
                          • Opcode ID: c5ecde4312ccfa2e1ed1a2c608d038f857b097ec6549ceb78086129b2e572a94
                          • Instruction ID: 3cc56e665bf05683095f5b93de8b96474433264622ac33bff653b885471d0543
                          • Opcode Fuzzy Hash: c5ecde4312ccfa2e1ed1a2c608d038f857b097ec6549ceb78086129b2e572a94
                          • Instruction Fuzzy Hash: ED81F272724A95D9EB20DF6994843ED3BE4F724B8CF14410AEE0A67A44DB75C9FAC700
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 00207960 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMONLIBRARYCODE
                          Download Yara Rule
                          APIs
                          • GetSystemTimeAsFileTime.KERNEL32 ref: 0020798C
                          • GetCurrentThreadId.KERNEL32 ref: 0020799A
                          • GetCurrentProcessId.KERNEL32 ref: 002079A6
                          • QueryPerformanceCounter.KERNEL32 ref: 002079B6
                          Memory Dump Source
                          • Source File: 0000000F.00000002.410436729.0000000000200000.00000040.00001000.00020000.00000000.sdmp, Offset: 00200000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_15_2_200000_conhost.jbxd
                          Similarity
                          • API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
                          • String ID:
                          • API String ID: 2933794660-0
                          • Opcode ID: 561ac6f4885ef0f33bff27beb4ddb95e6a253367b5c72fac45fcb4617ca9122b
                          • Instruction ID: 2f06c51284be4cb808357535fe07e7a75a662903d07563a5885789c33fc563ef
                          • Opcode Fuzzy Hash: 561ac6f4885ef0f33bff27beb4ddb95e6a253367b5c72fac45fcb4617ca9122b
                          • Instruction Fuzzy Hash: 59111E36710F059AEF00CFA0E8593A833A4F769758F441E25DE6D467A4DF78D2A88380
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 0020ED0C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 194COMMON
                          Download Yara Rule
                          APIs
                            • Part of subcall function 0020E668: GetOEMCP.KERNEL32 ref: 0020E692
                          • IsValidCodePage.KERNEL32 ref: 0020ED79
                          • GetCPInfo.KERNEL32 ref: 0020EDBD
                          Strings
                          Memory Dump Source
                          • Source File: 0000000F.00000002.410436729.0000000000200000.00000040.00001000.00020000.00000000.sdmp, Offset: 00200000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_15_2_200000_conhost.jbxd
                          Similarity
                          • API ID: CodeInfoPageValid
                          • String ID: y!
                          • API String ID: 546120528-1453672061
                          • Opcode ID: 6822e0a37001ac49409c30972473f96305db3612451a533fd16fefc89a3cd06d
                          • Instruction ID: 63a02a9334310f7cbd61e1a8d05578d4277692b0d46d4571a835ed8b17f48a9a
                          • Opcode Fuzzy Hash: 6822e0a37001ac49409c30972473f96305db3612451a533fd16fefc89a3cd06d
                          • Instruction Fuzzy Hash: BA7159B332578A86EF34CF29E048369BB61F354790F5A4416DB9A07A92DB39D9E5C300
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 0020253C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 185COMMON
                          Download Yara Rule
                          APIs
                          Strings
                          Memory Dump Source
                          • Source File: 0000000F.00000002.410436729.0000000000200000.00000040.00001000.00020000.00000000.sdmp, Offset: 00200000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_15_2_200000_conhost.jbxd
                          Similarity
                          • API ID: FileType
                          • String ID: \\.\pipe\
                          • API String ID: 3081899298-91387939
                          • Opcode ID: 41f2590248caa42fa42cbc4740ff50b79ee080d5b4a351d521f36d41c2820f1b
                          • Instruction ID: 8232cff6dfdcbfd0a1deae1a2ccba97a01305d2c6e55b233f8d629726da8dfb0
                          • Opcode Fuzzy Hash: 41f2590248caa42fa42cbc4740ff50b79ee080d5b4a351d521f36d41c2820f1b
                          • Instruction Fuzzy Hash: 3061E836220B82C6C735DF26D8483BEA765F389B94F540027DE4A53BAADE35C669C700
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 002094A0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMONLIBRARYCODE
                          Download Yara Rule
                          APIs
                          Strings
                          Memory Dump Source
                          • Source File: 0000000F.00000002.410436729.0000000000200000.00000040.00001000.00020000.00000000.sdmp, Offset: 00200000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_15_2_200000_conhost.jbxd
                          Similarity
                          • API ID: ExceptionFileHeaderRaise
                          • String ID: csm
                          • API String ID: 2573137834-1018135373
                          • Opcode ID: 596d8aa0106168f831d5a6617a756b303fb26e5894bac8705379b132699e985d
                          • Instruction ID: b78d9468854614cd48a1353f79d4efdabfbbe30ed6b5fa9e0513bf9ad8cb9063
                          • Opcode Fuzzy Hash: 596d8aa0106168f831d5a6617a756b303fb26e5894bac8705379b132699e985d
                          • Instruction Fuzzy Hash: 94112E36215B8082DB218F15F84435ABBA5FB88B94F594225EFCD07B6ADF3CC5A1CB00
                          Uniqueness

                          Uniqueness Score: -1.00%

                          Function 00201000 Relevance: 5.0, APIs: 4, Instructions: 20memoryCOMMON
                          Download Yara Rule
                          APIs
                          Memory Dump Source
                          • Source File: 0000000F.00000002.410436729.0000000000200000.00000040.00001000.00020000.00000000.sdmp, Offset: 00200000, based on PE: true
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_15_2_200000_conhost.jbxd
                          Similarity
                          • API ID: Heap$AllocProcess
                          • String ID:
                          • API String ID: 1617791916-0
                          • Opcode ID: 952b2c0fe5133ab7956e2ef84fe5bf2b2b692290a663e8cebccb5d827e1e35ea
                          • Instruction ID: af72f8aed71b7b690d2f2ad3051bc8db4e4966935ddb6ccb9ecfb86dd33e4759
                          • Opcode Fuzzy Hash: 952b2c0fe5133ab7956e2ef84fe5bf2b2b692290a663e8cebccb5d827e1e35ea
                          • Instruction Fuzzy Hash: D5E01AB5611A0497EB089F62D80C39E76E1FB9CF16F498024C90D07321EE7C8499CBA0
                          Uniqueness

                          Uniqueness Score: -1.00%