Edit tour

Windows Analysis Report
vulkan-1.dll

Overview

General Information

Sample name:	vulkan-1.dll
Analysis ID:	1431065
MD5:	5e162bcda79c966d63a15e49c8bf8c13
SHA1:	2f2c77e120b66a34648c22fa23d525b1ead0df67
SHA256:	25d6b4ef0a74f1a04476dc2944def16d4ca2b015277add2ebcfbc1c3df13793c
Infos:

Detection

Score:	6
Range:	0 - 100
Whitelisted:	false
Confidence:	40%

Signatures

AV process strings found (often used to terminate AV products)

Checks if the current process is being debugged

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query locales information (e.g. system language)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Found potential string decryption / allocating functions

One or more processes crash

PE file contains more sections than normal

PE file contains sections with non-standard names

Sample execution stops while process was sleeping (likely an evasion)

Uses code obfuscation techniques (call, push, ret)

Classification

Analysis Advice

Sample searches for specific file, try point organization specific fake files to the analysis machine

Sample tries to load a library which is not present or installed on the analysis machine, adding the library might reveal more behavior

Sample crashes during execution, try analyze it on another analysis machine

Process Tree

System is w10x64

loaddll64.exe (PID: 7292 cmdline: loaddll64.exe "C:\Users\user\Desktop\vulkan-1.dll" MD5: 763455F9DCB24DFEECC2B9D9F8D46D52)

conhost.exe (PID: 7300 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 7344 cmdline: cmd.exe /C rundll32.exe "C:\Users\user\Desktop\vulkan-1.dll",#1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

rundll32.exe (PID: 7368 cmdline: rundll32.exe "C:\Users\user\Desktop\vulkan-1.dll",#1 MD5: EF3179D498793BF4234F708D3BE28633)

WerFault.exe (PID: 7480 cmdline: C:\Windows\system32\WerFault.exe -u -p 7368 -s 348 MD5: FD27D9F6D02763BDE32511B5DF7FF7A0)

rundll32.exe (PID: 7352 cmdline: rundll32.exe C:\Users\user\Desktop\vulkan-1.dll,vkAcquireNextImage2KHR MD5: EF3179D498793BF4234F708D3BE28633)

WerFault.exe (PID: 7472 cmdline: C:\Windows\system32\WerFault.exe -u -p 7352 -s 316 MD5: FD27D9F6D02763BDE32511B5DF7FF7A0)

rundll32.exe (PID: 7632 cmdline: rundll32.exe C:\Users\user\Desktop\vulkan-1.dll,vkAcquireNextImageKHR MD5: EF3179D498793BF4234F708D3BE28633)

WerFault.exe (PID: 7680 cmdline: C:\Windows\system32\WerFault.exe -u -p 7632 -s 340 MD5: FD27D9F6D02763BDE32511B5DF7FF7A0)

rundll32.exe (PID: 7776 cmdline: rundll32.exe C:\Users\user\Desktop\vulkan-1.dll,vkAllocateCommandBuffers MD5: EF3179D498793BF4234F708D3BE28633)

WerFault.exe (PID: 7832 cmdline: C:\Windows\system32\WerFault.exe -u -p 7776 -s 348 MD5: FD27D9F6D02763BDE32511B5DF7FF7A0)

rundll32.exe (PID: 7888 cmdline: rundll32.exe "C:\Users\user\Desktop\vulkan-1.dll",vkAcquireNextImage2KHR MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 7896 cmdline: rundll32.exe "C:\Users\user\Desktop\vulkan-1.dll",vkAcquireNextImageKHR MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 7920 cmdline: rundll32.exe "C:\Users\user\Desktop\vulkan-1.dll",vkAllocateCommandBuffers MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 7956 cmdline: rundll32.exe "C:\Users\user\Desktop\vulkan-1.dll",vkWaitSemaphores MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 7992 cmdline: rundll32.exe "C:\Users\user\Desktop\vulkan-1.dll",vkWaitForFences MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 8024 cmdline: rundll32.exe "C:\Users\user\Desktop\vulkan-1.dll",vkUpdateDescriptorSets MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 8064 cmdline: rundll32.exe "C:\Users\user\Desktop\vulkan-1.dll",vkUpdateDescriptorSetWithTemplate MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 8100 cmdline: rundll32.exe "C:\Users\user\Desktop\vulkan-1.dll",vkUnmapMemory MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 8132 cmdline: rundll32.exe "C:\Users\user\Desktop\vulkan-1.dll",vkTrimCommandPool MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 8172 cmdline: rundll32.exe "C:\Users\user\Desktop\vulkan-1.dll",vkSignalSemaphore MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 1432 cmdline: rundll32.exe "C:\Users\user\Desktop\vulkan-1.dll",vkSetPrivateData MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 5780 cmdline: rundll32.exe "C:\Users\user\Desktop\vulkan-1.dll",vkSetEvent MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 7028 cmdline: rundll32.exe "C:\Users\user\Desktop\vulkan-1.dll",vkResetQueryPool MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 1360 cmdline: rundll32.exe "C:\Users\user\Desktop\vulkan-1.dll",vkResetFences MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 180 cmdline: rundll32.exe "C:\Users\user\Desktop\vulkan-1.dll",vkResetEvent MD5: EF3179D498793BF4234F708D3BE28633)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: vulkan-1.dll

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF

Source:

Binary string: C:\projects\src\out\Default\vulkan-1.dll.pdb source: loaddll64.exe, 00000000.00000002.2924751005.00007FFDFF2BA000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000003.00000002.1834242401.00007FFDFF2BA000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000004.00000002.1825910461.00007FFDFF2BA000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 0000000A.00000002.1799004776.00007FFDFF2BA000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 0000000D.00000002.1809105234.00007FFDFF2BA000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000010.00000002.1760012512.00007FFDFF2BA000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000011.00000002.1760822003.00007FFDFF2BA000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000013.00000002.1763354731.00007FFDFF2BA000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000015.00000002.1764637957.00007FFDFF2BA000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000017.00000002.1766989763.00007FFDFF2BA000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000019.00000002.1769289710.00007FFDFF2BA000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 0000001B.00000002.1769782887.00007FFDFF2BA000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 0000001D.00000002.1770951904.00007FFDFF2BA000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 0000001F.00000002.1777449017.00007FFDFF2BA000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000021.00000002.1776291770.00007FFDFF2BA000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000022.00000002.1776295862.00007FFDFF2BA000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000023.00000002.1776321834.00007FFDFF2BA000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000024.00000002.1775214464.00007FFDFF2BA000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000026.00000002.1777112962.00007FFDFF2BA000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000028.00000002.1777529817.00007FFDFF2BA000.00000002.00000001.01000000.00000003.sdmp, vulkan-1.dll

Source: C:\Windows\System32\WerFault.exe	File opened: C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_vul_d2be42f9ca26f5b1c98ace275864247822806def_20b95fe6_fb6bb36d-6fd7-4e37-9ac7-808a63498779\	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	File opened: C:\ProgramData\Microsoft\Windows\WER\ReportQueue\	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	File opened: C:\ProgramData\Microsoft\Windows\	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	File opened: C:\ProgramData\Microsoft\Windows\WER\	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	File opened: C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_vul_8a98533a1ee59e3066e2be1dd9ba698f1f7c53_20b95fe6_efed0deb-ab6a-419b-abdf-f64dadf15c15\	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	File opened: C:\ProgramData\Microsoft\Windows\WER\ReportQueue	Jump to behavior

Source: Amcache.hve.8.dr

String found in binary or memory: http://upx.sf.net

Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDFF284804	0_2_00007FFDFF284804
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDFF2A8000	0_2_00007FFDFF2A8000
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDFF28B7E8	0_2_00007FFDFF28B7E8
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDFF225830	0_2_00007FFDFF225830
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDFF227F50	0_2_00007FFDFF227F50
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDFF295740	0_2_00007FFDFF295740
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDFF227F30	0_2_00007FFDFF227F30
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDFF228610	0_2_00007FFDFF228610
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDFF2A2618	0_2_00007FFDFF2A2618
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDFF284E10	0_2_00007FFDFF284E10
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDFF222613	0_2_00007FFDFF222613
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDFF284600	0_2_00007FFDFF284600
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDFF222620	0_2_00007FFDFF222620
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDFF222490	0_2_00007FFDFF222490
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDFF2834C0	0_2_00007FFDFF2834C0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDFF2A3504	0_2_00007FFDFF2A3504
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDFF2234F0	0_2_00007FFDFF2234F0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDFF29D4EC	0_2_00007FFDFF29D4EC
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDFF227D30	0_2_00007FFDFF227D30
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDFF231D20	0_2_00007FFDFF231D20
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDFF28D3B4	0_2_00007FFDFF28D3B4
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDFF284C0C	0_2_00007FFDFF284C0C
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDFF2843FC	0_2_00007FFDFF2843FC
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDFF285C50	0_2_00007FFDFF285C50
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDFF294C28	0_2_00007FFDFF294C28
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDFF282420	0_2_00007FFDFF282420
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDFF2AB294	0_2_00007FFDFF2AB294
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDFF241990	0_2_00007FFDFF241990
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDFF2829D0	0_2_00007FFDFF2829D0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDFF2219B0	0_2_00007FFDFF2219B0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDFF2281A0	0_2_00007FFDFF2281A0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDFF2ABA14	0_2_00007FFDFF2ABA14
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDFF284A08	0_2_00007FFDFF284A08
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDFF29D204	0_2_00007FFDFF29D204
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDFF283A58	0_2_00007FFDFF283A58
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDFF23787C	0_2_00007FFDFF23787C
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDFF29D8E4	0_2_00007FFDFF29D8E4

Source: C:\Windows\System32\loaddll64.exe

Code function: String function: 00007FFDFF295090 appears 1217 times

Source: C:\Windows\System32\rundll32.exe

Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 7352 -s 316

Source: vulkan-1.dll

Static PE information: Number of sections : 11 > 10

Source: classification engine

Classification label: clean6.winDLL@102/17@0/0

Source: C:\Windows\System32\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7352
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7300:120:WilError_03
Source: C:\Windows\System32\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7776
Source: C:\Windows\System32\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7368
Source: C:\Windows\System32\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7632

Source: C:\Windows\System32\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\c0b4815a-8c8e-4303-9a82-1eb7d039b9bb

Jump to behavior

Source: vulkan-1.dll

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\System32\loaddll64.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Windows\System32\loaddll64.exe

Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\vulkan-1.dll,vkAcquireNextImage2KHR

Source: unknown	Process created: C:\Windows\System32\loaddll64.exe loaddll64.exe "C:\Users\user\Desktop\vulkan-1.dll"
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\vulkan-1.dll",#1
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\vulkan-1.dll,vkAcquireNextImage2KHR
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\vulkan-1.dll",#1
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 7352 -s 316
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 7368 -s 348
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\vulkan-1.dll,vkAcquireNextImageKHR
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 7632 -s 340
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\vulkan-1.dll,vkAllocateCommandBuffers
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 7776 -s 348
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\vulkan-1.dll",vkAcquireNextImage2KHR
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\vulkan-1.dll",vkAcquireNextImageKHR
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\vulkan-1.dll",vkAllocateCommandBuffers
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\vulkan-1.dll",vkWaitSemaphores
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\vulkan-1.dll",vkWaitForFences
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\vulkan-1.dll",vkUpdateDescriptorSets
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\vulkan-1.dll",vkUpdateDescriptorSetWithTemplate
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\vulkan-1.dll",vkUnmapMemory
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\vulkan-1.dll",vkTrimCommandPool
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\vulkan-1.dll",vkSignalSemaphore
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\vulkan-1.dll",vkSetPrivateData
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\vulkan-1.dll",vkSetEvent
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\vulkan-1.dll",vkResetQueryPool
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\vulkan-1.dll",vkResetFences
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\vulkan-1.dll",vkResetEvent
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\vulkan-1.dll",#1	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\vulkan-1.dll,vkAcquireNextImage2KHR	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\vulkan-1.dll,vkAcquireNextImageKHR	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\vulkan-1.dll,vkAllocateCommandBuffers	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\vulkan-1.dll",vkAcquireNextImage2KHR	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\vulkan-1.dll",vkAcquireNextImageKHR	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\vulkan-1.dll",vkAllocateCommandBuffers	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\vulkan-1.dll",vkWaitSemaphores	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\vulkan-1.dll",vkWaitForFences	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\vulkan-1.dll",vkUpdateDescriptorSets	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\vulkan-1.dll",vkUpdateDescriptorSetWithTemplate	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\vulkan-1.dll",vkUnmapMemory	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\vulkan-1.dll",vkTrimCommandPool	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\vulkan-1.dll",vkSignalSemaphore	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\vulkan-1.dll",vkSetPrivateData	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\vulkan-1.dll",vkSetEvent	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\vulkan-1.dll",vkResetQueryPool	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\vulkan-1.dll",vkResetFences	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\vulkan-1.dll",vkResetEvent	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 7352 -s 316	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\vulkan-1.dll",#1	Jump to behavior

Source: C:\Windows\System32\loaddll64.exe	Section loaded: apphelp.dll			Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Section loaded: dxgi.dll			Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: vulkan-1.dll

Static PE information: More than 245 > 100 exports found

Source: vulkan-1.dll

Static PE information: Image base 0x180000000 > 0x60000000

Source: vulkan-1.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: vulkan-1.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: vulkan-1.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: vulkan-1.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: vulkan-1.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: vulkan-1.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: vulkan-1.dll

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF

Source: vulkan-1.dll

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:

Source: vulkan-1.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: vulkan-1.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: vulkan-1.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: vulkan-1.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: vulkan-1.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: vulkan-1.dll	Static PE information: section name: .00cfg
Source: vulkan-1.dll	Static PE information: section name: .gxfg
Source: vulkan-1.dll	Static PE information: section name: .retplne
Source: vulkan-1.dll	Static PE information: section name: _RDATA

Source: C:\Windows\System32\loaddll64.exe

Code function: 0_2_00007FFDFF234C67 push rax; ret

0_2_00007FFDFF234C6D

Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Windows\System32\WerFault.exe	File opened: C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_vul_d2be42f9ca26f5b1c98ace275864247822806def_20b95fe6_fb6bb36d-6fd7-4e37-9ac7-808a63498779\	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	File opened: C:\ProgramData\Microsoft\Windows\WER\ReportQueue\	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	File opened: C:\ProgramData\Microsoft\Windows\	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	File opened: C:\ProgramData\Microsoft\Windows\WER\	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	File opened: C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_vul_8a98533a1ee59e3066e2be1dd9ba698f1f7c53_20b95fe6_efed0deb-ab6a-419b-abdf-f64dadf15c15\	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	File opened: C:\ProgramData\Microsoft\Windows\WER\ReportQueue	Jump to behavior

Source: Amcache.hve.8.dr	Binary or memory string: VMware
Source: Amcache.hve.8.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.8.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.8.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.8.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.8.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.8.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.8.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.8.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.8.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.8.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.8.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.8.dr	Binary or memory string: vmci.sys
Source: Amcache.hve.8.dr	Binary or memory string: VMware-56 4d 43 71 48 15 3d ed-ae e6 c7 5a ec d9 3b f0
Source: Amcache.hve.8.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.8.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.8.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.8.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.8.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.8.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.8.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.8.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.8.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.8.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.8.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.8.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.8.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.8.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.8.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort

Source: C:\Windows\System32\loaddll64.exe

Code function: 0_2_00007FFDFF29C85C RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00007FFDFF29C85C

Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDFF29C85C RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		0_2_00007FFDFF29C85C
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDFF27EC38 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		0_2_00007FFDFF27EC38

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\vulkan-1.dll",#1

Jump to behavior

Source: C:\Windows\System32\loaddll64.exe	Code function: GetLocaleInfoW,	0_2_00007FFDFF29AF84
Source: C:\Windows\System32\loaddll64.exe	Code function: EnumSystemLocalesW,	0_2_00007FFDFF29B7B8
Source: C:\Windows\System32\loaddll64.exe	Code function: EnumSystemLocalesW,	0_2_00007FFDFF2A07EC
Source: C:\Windows\System32\loaddll64.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	0_2_00007FFDFF2A0D98
Source: C:\Windows\System32\loaddll64.exe	Code function: EnumSystemLocalesW,GetUserDefaultLCID,ProcessCodePage,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	0_2_00007FFDFF2A04EC
Source: C:\Windows\System32\loaddll64.exe	Code function: EnumSystemLocalesW,	0_2_00007FFDFF2A0B08

Source: C:\Windows\System32\loaddll64.exe

Code function: 0_2_00007FFDFF27EFE0 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00007FFDFF27EFE0

Source: C:\Windows\System32\loaddll64.exe

Code function: 0_2_00007FFDFF2AA5B4 _get_daylight,_get_daylight,_get_daylight,GetTimeZoneInformation,

0_2_00007FFDFF2AA5B4

Source: Amcache.hve.8.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.8.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.8.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.8.dr	Binary or memory string: MsMpEng.exe

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 DLL Side-Loading	11 Process Injection	1 Virtualization/Sandbox Evasion	OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Rundll32	LSASS Memory	31 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Deobfuscate/Decode Files or Information	NTDS	1 File and Directory Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	12 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	2 Obfuscated Files or Information	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
vulkan-1.dll	0%	ReversingLabs
vulkan-1.dll	0%	Virustotal		Browse

Name	Source	Malicious	Antivirus Detection	Reputation
http://upx.sf.net	Amcache.hve.8.dr	false		high

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1431065
Start date and time:	2024-04-24 14:39:32 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 5s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Run name:	Potential for more IOCs and behavior
Number of analysed new started processes analysed:	42
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	vulkan-1.dll
Detection:	CLEAN
Classification:	clean6.winDLL@102/17@0/0
EGA Information:	Failed
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .dll

Warnings

Exclude process from analysis (whitelisted): WerFault.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 20.42.65.92
Excluded domains from analysis (whitelisted): onedsblobprdeus17.eastus.cloudapp.azure.com, ocsp.digicert.com, login.live.com, slscr.update.microsoft.com, blobcollector.events.data.trafficmanager.net, ctldl.windowsupdate.com, umwatson.events.data.microsoft.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target loaddll64.exe, PID 7292 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.

Simulations

Behavior and APIs

Time	Type	Description
14:40:35	API Interceptor	4x Sleep call for process: WerFault.exe modified

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_vul_8a98533a1ee59e3066e2be1dd9ba698f1f7c53_20b95fe6_efed0deb-ab6a-419b-abdf-f64dadf15c15\Report.wer

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.7758381445230415
Encrypted:	false
SSDEEP:	96:9QFWwjiCyKyesjwK4RvtpQa8foQXIDcQGc6zHcEDcw3CXaXz+HbHgSQgJjAdo8Fr:eriCyeU0Y/pUjGUzuiFyZ24lO85
MD5:	446EA6C9E4CE1F8813DBEDC4B79BCB2F
SHA1:	3B520A79D0DDCAFB62F7AA94EA5B0A3CEEB9801A
SHA-256:	D45991B0FDDDC0AA9E49545F6B9726757F0BA10655F70FF6A24E9F5B0B1D0859
SHA-512:	72FAE908423AB27FBEC8DE29DCC03AE850BF9C9F19842A07619B59322538697A9EFC26EE231E0F75AB84DC89F272FDD0CA401143DE079AFFF09C061B6262ED2F
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.5.8.4.3.6.0.2.2.3.9.2.0.9.6.4.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.5.8.4.3.6.0.2.3.0.4.8.3.4.8.7.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.e.f.e.d.0.d.e.b.-.a.b.6.a.-.4.1.9.b.-.a.b.d.f.-.f.6.4.d.a.d.f.1.5.c.1.5.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.7.1.3.7.7.3.3.0.-.5.7.4.f.-.4.e.2.b.-.a.5.9.f.-.a.d.0.b.e.2.4.1.0.2.a.5.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....N.s.A.p.p.N.a.m.e.=.r.u.n.d.l.l.3.2...e.x.e._.v.u.l.k.a.n.-.1...d.l.l.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.R.U.N.D.L.L.3.2...E.X.E.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.c.c.8.-.0.0.0.1.-.0.0.1.4.-.d.e.2.c.-.6.f.9.2.4.4.9.6.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.0.f.5.1.9.f.e.e.c.4.8.6.d.e.8.7.e.d.7.3.c.b.9.2.d.3.c.a.c.8.0.2.4.0.0.0.0.0.0.0.0.!.0.0.0.0.d.d.3.9.9.a.e.4.6.3.0.3.3.4.3.f.9.f.0.d.a.1.8.9.a.e.e.1.1.c.6.7.b.d.8.6.8.2.2.2.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_vul_8a98533a1ee59e3066e2be1dd9ba698f1f7c53_20b95fe6_f1d6bd2e-9a5c-402a-bf9b-fffb0991a373\Report.wer

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.7761060808634885
Encrypted:	false
SSDEEP:	96:gsFm7pwjiIyKyXsjwK4RvtpQa8foQXIDcQGc6zHcEDcw3CXaXz+HbHgSQgJjAdoa:hhiIyXU0Y/pUjGUzuiFyZ24lO85
MD5:	0B93DBAC07B584DBA9E81C6222B42294
SHA1:	AF08BB520883BFE0C3246ED6630F48B4FCAB9AC7
SHA-256:	9F7A8042D4091AD1254BDC62D4885A4BEA6CDC229479314D12A09B3C9E4F07A5
SHA-512:	0F8CDB15764F5D29F671A6B646C3D160C7E8B556A794A344472FEA178804DE8C1EAEE8D9802AF04FF2D7F74A7F7EB04EE9A4A3AD157238E2BB80655DEB4DD346
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.5.8.4.3.6.0.2.2.3.8.3.9.2.5.0.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.5.8.4.3.6.0.2.2.9.3.0.8.0.2.9.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.f.1.d.6.b.d.2.e.-.9.a.5.c.-.4.0.2.a.-.b.f.9.b.-.f.f.f.b.0.9.9.1.a.3.7.3.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.a.0.5.3.9.c.7.7.-.e.a.6.e.-.4.8.2.2.-.b.0.7.a.-.9.8.a.b.5.4.d.b.a.e.9.7.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....N.s.A.p.p.N.a.m.e.=.r.u.n.d.l.l.3.2...e.x.e._.v.u.l.k.a.n.-.1...d.l.l.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.R.U.N.D.L.L.3.2...E.X.E.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.c.b.8.-.0.0.0.1.-.0.0.1.4.-.c.7.9.4.-.6.d.9.2.4.4.9.6.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.0.f.5.1.9.f.e.e.c.4.8.6.d.e.8.7.e.d.7.3.c.b.9.2.d.3.c.a.c.8.0.2.4.0.0.0.0.0.0.0.0.!.0.0.0.0.d.d.3.9.9.a.e.4.6.3.0.3.3.4.3.f.9.f.0.d.a.1.8.9.a.e.e.1.1.c.6.7.b.d.8.6.8.2.2.2.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_vul_d2be42f9ca26f5b1c98ace275864247822806def_20b95fe6_fb6bb36d-6fd7-4e37-9ac7-808a63498779\Report.wer

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.7758654923958672
Encrypted:	false
SSDEEP:	96:+spFVAtwjivyKytsjwK4RvtpQa8fNQXIDcQGc6zHcEBzcw3BzUXaXz+HbHgSQgJ/:tfAKivytJ0Y/rzVmjGUzuiFyZ24lO85
MD5:	86801B2537950342C7BE3EB7E7829C4A
SHA1:	32CDD3B5B597834E0FBCBC361DD6FCC36EB710BD
SHA-256:	211E612CFE6BF7D51DCA71E7291031FF9339B1BEE3CE1706868356CA67FEE507
SHA-512:	E0B908AB9C687FF481A1695C8839D02E79209206BF6F38811BFC0A1A014408FDA4361E59933A092F3913269ECACC46E4ADFFBBD9D16A9E4A1E3170326B161681
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.5.8.4.3.6.0.2.5.4.0.5.8.0.7.4.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.5.8.4.3.6.0.2.5.8.5.8.9.3.3.5.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.f.b.6.b.b.3.6.d.-.6.f.d.7.-.4.e.3.7.-.9.a.c.7.-.8.0.8.a.6.3.4.9.8.7.7.9.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.5.f.e.8.d.0.4.a.-.d.7.2.5.-.4.1.7.0.-.a.0.1.0.-.e.e.0.5.3.2.e.1.b.6.f.4.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....N.s.A.p.p.N.a.m.e.=.r.u.n.d.l.l.3.2...e.x.e._.v.u.l.k.a.n.-.1...d.l.l.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.R.U.N.D.L.L.3.2...E.X.E.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.d.d.0.-.0.0.0.1.-.0.0.1.4.-.d.e.f.f.-.3.9.9.4.4.4.9.6.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.0.f.5.1.9.f.e.e.c.4.8.6.d.e.8.7.e.d.7.3.c.b.9.2.d.3.c.a.c.8.0.2.4.0.0.0.0.0.0.0.0.!.0.0.0.0.d.d.3.9.9.a.e.4.6.3.0.3.3.4.3.f.9.f.0.d.a.1.8.9.a.e.e.1.1.c.6.7.b.d.8.6.8.2.2.2.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_vul_f81a78fb38adc0648cfeb4514965597f248381b_20b95fe6_2b7c5b8b-ad79-4160-9e69-1ee53bd9092b\Report.wer

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.7760779009045959
Encrypted:	false
SSDEEP:	96:tRgFPOFwjioyKyxsjwK4RvtpQa8ftQXIDcQGc6zHcE+cw32XaXz+HbHgSQgJjAdd:ty91ioyx50Y/kYjGUzuiFyZ24lO85
MD5:	AEAA6BE9D473AFD4DD80E4BDE9B5EFE6
SHA1:	4FA0978EA7417124B45E8E07D172B318ECD73539
SHA-256:	9BE5D5BE48EDBEB6A31D94216586DC68539BC1DB196EEE5DC078D8488EEC3CB2
SHA-512:	254D8699112B2936E62201F0132FD6964A66D00C100DCBCB4CDAD18BA3CBA4D131D086112B8F364ABE46EB51C350D7A0C9F5E0679BD57CCD3A1F809721E468A4
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.5.8.4.3.6.0.2.8.4.5.3.6.4.2.5.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.5.8.4.3.6.0.2.8.7.5.0.5.1.9.8.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.2.b.7.c.5.b.8.b.-.a.d.7.9.-.4.1.6.0.-.9.e.6.9.-.1.e.e.5.3.b.d.9.0.9.2.b.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.a.d.a.8.a.c.4.d.-.8.1.9.d.-.4.c.a.7.-.9.7.a.b.-.2.c.b.c.d.d.4.6.8.4.9.0.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....N.s.A.p.p.N.a.m.e.=.r.u.n.d.l.l.3.2...e.x.e._.v.u.l.k.a.n.-.1...d.l.l.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.R.U.N.D.L.L.3.2...E.X.E.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.e.6.0.-.0.0.0.1.-.0.0.1.4.-.7.d.1.4.-.1.2.9.6.4.4.9.6.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.0.f.5.1.9.f.e.e.c.4.8.6.d.e.8.7.e.d.7.3.c.b.9.2.d.3.c.a.c.8.0.2.4.0.0.0.0.0.0.0.0.!.0.0.0.0.d.d.3.9.9.a.e.4.6.3.0.3.3.4.3.f.9.f.0.d.a.1.8.9.a.e.e.1.1.c.6.7.b.d.8.6.8.2.2.2.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER677D.tmp.dmp

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Wed Apr 24 12:40:22 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	56868
Entropy (8bit):	1.6468263471947209
Encrypted:	false
SSDEEP:	192:99Svf/ScOMOOyNbnKwYMHsHwXpS9keJ9nHN:wSTVOyNbnEoIgY7JhH
MD5:	BE11AECC61A673314A74DA96B9351BC9
SHA1:	A0A3C9718FEC93E1CBB582D84296860F02C222C0
SHA-256:	589F8A785D8FF44B414C375068FD02D23177C5F88E3C496E29165B7798BD61AD
SHA-512:	3D00AE0AC3608F588BF483F30EFDB28AF7E22F508BAF4524D58672ACCD7F417C07E80E55DEF6FC518E93BC8D2397E3F732AFDF424A5CBF5BEB510250AA1E5882
Malicious:	false
Preview:	MDMP..a..... .........(f........................$...............(*..........T.......8...........T...............T.......................................................................................................eJ......D.......Lw......................T.............(f.............................0..................W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .S.u.m.m.e.r. .T.i.m.e...........................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER67FB.tmp.dmp

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Wed Apr 24 12:40:22 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	57856
Entropy (8bit):	1.6334161064102024
Encrypted:	false
SSDEEP:	192:95amqBKScOMOpZEaJFpS9o0wU/4m9gWXqQ:5vSTVpZEaJFYGi/4XW3
MD5:	DD77C4E6272B337BEFD030D054EBCA00
SHA1:	028DF128D64217BD3F87979A9286E13C6F297B09
SHA-256:	9EF60A7D81E22CD0D4D3838F89532424FF59AD32937A2DD1B525A31119B0363E
SHA-512:	837CE1E98BCCF883D531361A5D690CC98DCCAC1BBA4A74F4BB870FBE1D61E82FE0713FAB9B3AD0F1A130403BE5EE261F524123344FB738BE9717603EEAB23DD5
Malicious:	false
Preview:	MDMP..a..... .........(f........................$...............(*..........T.......8...........T........... ...........................................................................................................eJ......D.......Lw......................T.............(f.............................0..................W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .S.u.m.m.e.r. .T.i.m.e...........................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER6849.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8758
Entropy (8bit):	3.7027820897932333
Encrypted:	false
SSDEEP:	192:R6l7wVeJWIHW6b6YfEjngmfRHGtprr89bj5DfABm:R6lXJJ26b6Y8jngmfRmcjNfb
MD5:	F5F15550724C3D2D7B55F47A249330A7
SHA1:	1352031D3010C4B52A154195D2A6D33EACE7E582
SHA-256:	47AD4CD577BBF9B2E2053DEC69ED49D59DE0669F6E7CEF719A1F029B5147E600
SHA-512:	E71D39364836F193ACE14599A2C6BA24B93E4A1B53ED75D2054972A35892BFD2C8EE93E32948AA57D4F171DFE6F95F1494A2A37448AB77E8CFE6CE15DC97120F
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.3.5.2.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER6879.tmp.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4748
Entropy (8bit):	4.475725015046485
Encrypted:	false
SSDEEP:	48:cvIwWl8zsWJg771I9P8WpW8VYkZYm8M4JCcC6kFeDyq85mhQptSTSsd:uIjfsI7A17VoJXDspoOsd
MD5:	9A67378BE35E1FE831897A02E69050BC
SHA1:	725DCE708A5644F300FE724E21F502F5BB1F684F
SHA-256:	D5C3A11F36BE839340ECC402EC32258DA58BB93B1B89BE836FD2348A2AB65612
SHA-512:	F5B6844738854651AB3286D7E11242DC5BF0FC419CDF3416167C16B7FB681840CAC3BF19A9624E5223099213E68889F741435656B88A94C15554B66080633CEA
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="293983" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WER6898.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8766
Entropy (8bit):	3.7027665211747043
Encrypted:	false
SSDEEP:	192:R6l7wVeJPYHS6K6Y3i8fgmfRHGtprr89bjRDfhBm:R6lXJgy6K6YycgmfRmcjlf2
MD5:	2E960BEF620DCB9FE8E24D94D929B8F2
SHA1:	98516525C9B7EEEBAA871057021EE058396CDD6D
SHA-256:	66BC261C35D5818CFE9F8AD24729301994FA79C99038E0B2EDD61C3B70DEF1A8
SHA-512:	C82CD9C5462930BFAE09A4E9EFD4734B625E692FC75EDA2CA30492D557F7B3BE527DDAC4E940D19933DFA5849006902FB3807D131CF62B06021AB4D4A50E5D93
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.3.6.8.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER6906.tmp.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4748
Entropy (8bit):	4.477105197641119
Encrypted:	false
SSDEEP:	48:cvIwWl8zsWJg771I9P8WpW8VYWYm8M4JCcC6kFUYyq85mhl4ptSTSRd:uIjfsI7A17VWJ1YCpoORd
MD5:	399D73FFB3CB2E28FCE4AFA0FAD867E5
SHA1:	1DA797FE81DA4E9C7331141FC0D09DEAA04CB65B
SHA-256:	E69E89B6BFF3B7F656E1B0815CE6508A6C19FAE654A352DFB8F8CEDE2096EBA0
SHA-512:	0DEAF72DA107263F2359B561335BFBD8F7B03B77586635772E71047F28B3AF900884CF5833D1B65B2B909E8F770580555BDB37E1E5D191FA915BCEE1F675AD20
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="293983" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WER7335.tmp.dmp

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Wed Apr 24 12:40:25 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	56508
Entropy (8bit):	1.6567185660001948
Encrypted:	false
SSDEEP:	192:2vh1+40eOMOSJBCi30YWvP44K3CuwsMwGal197z:C/T0ZV6BCa0YWvCy0MwGav97
MD5:	D1955C363F665A5C1F86C253B5B82AA2
SHA1:	D8BE876D448534EA4CA90E7E41BA32B6ED234B21
SHA-256:	615515938DE0322CAC84AB6AECE4097C01DAE030466AFE2B94E7A45260F887F6
SHA-512:	F6D25EA4EA0882A72338A0D8D55FCB8D4B3F1716881B9D78325BD4E9433AB25A808D4046BB181136315B4695041A05836FE150AAF651E870FEB8739F4CEEE58F
Malicious:	false
Preview:	MDMP..a..... .........(f........................$...............(*..........T.......8...........T.......................................................................................................................eJ......D.......Lw......................T.............(f.............................0..................W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .S.u.m.m.e.r. .T.i.m.e...........................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER7430.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8764
Entropy (8bit):	3.7026596669900953
Encrypted:	false
SSDEEP:	192:R6l7wVeJNjHu6g6YfjjngmfRH9nprQ89bMoDfWbkm:R6lXJ5O6g6Y7jngmfRdHMkfWd
MD5:	D21AA428429882919156E6CD652EF1D4
SHA1:	77EFEF2BFA195CEC3743129B430909E7863642E8
SHA-256:	B356DBC299CF3BFE1D4670D540ED1AB9C012B25D6C113DB2A6542CBC6235EF05
SHA-512:	B815A54F15054229CD13462EF5D85929C4E468F20A3481C08BC6855DAD22ED9E3946D93909A3942F1CC2FAB248092A3985649781EB7238171A07B483E15F949E
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.6.3.2.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER7460.tmp.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4748
Entropy (8bit):	4.475044827652875
Encrypted:	false
SSDEEP:	48:cvIwWl8zsWJg771I9P8WpW8VY3Ym8M4JCcC6HFO7Pyq85mhoPptSTSYd:uIjfsI7A17VXJgDQpoOYd
MD5:	F9AB8F2BFDD90CA26C6076E683CE250B
SHA1:	F80A1B2CA8354EE848E37C03273D629B18A566DF
SHA-256:	B589A73926D17F25D2DD25B1DB747CFFF2D21223BEA0147072BF0EC3D78F582E
SHA-512:	071738F693DDD0160232B1A29773B9DE510431C81F8B4AB0475FDC5422F3962BCE5DEF9F5E7397C839352EB405BC21F7CA1BE28CA1D016D3ACABCD3DDFA9A8D8
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="293983" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WER7F1C.tmp.dmp

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Wed Apr 24 12:40:28 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	57068
Entropy (8bit):	1.6550227507184851
Encrypted:	false
SSDEEP:	192:PNk42OOMObPq7VLqahnw5nohywMQHZlA:h2JVbPq7VHWnohFM
MD5:	0F990E3CC7F646C7972E3D3C0A42488B
SHA1:	0AA6458E0696F2BF43C6A6B1E5B6DD98BF3F9DCE
SHA-256:	077784AE0FF87C0B81DAE51800CBEB2D7E82A471E178C4F7B34F7E8D360A31D0
SHA-512:	D5D0F606A817ABFF0C506351C5C8AB80F83691235F45C4505EB628B9B57F99F9E547670982A711149AF0D1D74824E843A189D44A13D744432FC1A22FBA78B225
Malicious:	false
Preview:	MDMP..a..... .........(f........................$...............(*..........T.......8...........T.......................................................................................................................eJ......D.......Lw......................T.......`.....(f.............................0..................W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .S.u.m.m.e.r. .T.i.m.e...........................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER7F7A.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8760
Entropy (8bit):	3.7011777789555023
Encrypted:	false
SSDEEP:	192:R6l7wVeJ0RH56V6YfnjngmfRH9spr+89b5drfabzm:R6lXJCZ6V6YPjngmfRd+5Rf7
MD5:	ED8C4E06F2E88754052FD371BE8CC0FE
SHA1:	7F20C9D21C61E5C4FA5B2D3BCFABBD890D92C8A1
SHA-256:	D6CBB64FC9FDA6C9F4B106F173A41894168E773B787A650AD8B6CD8655D1B5AE
SHA-512:	A25CBB2727F3168CAA2FC722CEC6FFD7705F0F3B2B618A04007CD16AAA2806DFD0888914C202C5915B8AB33692E70E74A5D2BB2838B98D84389A1DFB5C988C07
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.7.7.6.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER7F9B.tmp.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4748
Entropy (8bit):	4.473697913127928
Encrypted:	false
SSDEEP:	48:cvIwWl8zsWJg771I9P8WpW8VYIYm8M4JCcC61F4W2yq85mh5ptSTSMd:uIjfsI7A17VUJ8tpoOMd
MD5:	FC5524F047DC7AEFAA377B348D20D680
SHA1:	D33CF3518EC45EED6E5EE79E2B2E2B0F9C282947
SHA-256:	149E3EA6B93932CEA57DBC886F27D1232CB123DD3F65D4CC9669637BEE48EB3B
SHA-512:	A3905F18D526288B523E7FDB69F336140FA28AE671A1ACC9174E01DA67C551C6B76A897E8AC4438B9AB2BDC5FA60448CD20AC427D21495A108E371DA59F3DA3C
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="293983" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.466397250677987
Encrypted:	false
SSDEEP:	6144:1IXfpi67eLPU9skLmb0b4zWSPKaJG8nAgejZMMhA2gX4WABl0uNcdwBCswSb9:2XD94zWlLZMM6YFHa+9
MD5:	1DD49A2EA0F5C601AFDAAB4B05D3AAAE
SHA1:	E54B47B1643073129A7EC63244A9ECA6DF394FB8
SHA-256:	0E080DD746D27C2D4CA75D3FF6A62121784AD2C030F332B252C79722CAB20638
SHA-512:	D583EDC6CCB1DB5BB3A6C2C45B57C4F6A0A8FF9532180EE97DB97CD20606F112CE719737472BFD56B23C504AC3923BB97AAEB2AFCD4D246AA534BFBA3CEFBF5C
Malicious:	false
Preview:	regf6...6....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm..D...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Entropy (8bit):	6.5737856921703965
TrID:	Win64 Dynamic Link Library (generic) (102004/3) 86.43% Win64 Executable (generic) (12005/4) 10.17% Generic Win/DOS Executable (2004/3) 1.70% DOS Executable Generic (2002/1) 1.70% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.01%
File name:	vulkan-1.dll
File size:	939'520 bytes
MD5:	5e162bcda79c966d63a15e49c8bf8c13
SHA1:	2f2c77e120b66a34648c22fa23d525b1ead0df67
SHA256:	25d6b4ef0a74f1a04476dc2944def16d4ca2b015277add2ebcfbc1c3df13793c
SHA512:	10a89f1618b9aa96fd524f92b29506045cac8f00ee846e950591d59f6fb49a79268044424e2497e3c75815c140a458c9fb27e781a2fe1949f5eed408abe3326d
SSDEEP:	24576:WV9nIy2kwpHHPDnCo3A1XpQ66Z5WoDYsHs6g3P0zAk7IG3:it2zNLnxA1+66Z5WoDYsHs6g3P0zAk7z
TLSH:	28155E139A944569D476C034C9C28607CA7178921B25B9CF03A85B09BFAFBF43B7D73A
File Content Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d....t.e.........." ......................................................................`A.......................................

File Icon


Icon Hash:	7ae282899bbab082

Static PE Info

General

Entrypoint:	0x18005efa0
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x180000000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, DLL
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF
Time Stamp:	0x65BA74B4 [Wed Jan 31 16:26:28 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	2
File Version Major:	5
File Version Minor:	2
Subsystem Version Major:	5
Subsystem Version Minor:	2
Import Hash:	49ed29c3ff417b26c7cd92ecc9b7dcb3

Entrypoint Preview

Instruction
dec eax
mov dword ptr [esp+08h], ebx
dec eax
mov dword ptr [esp+10h], esi
push edi
dec eax
sub esp, 20h
dec ecx
mov edi, eax
mov ebx, edx
dec eax
mov esi, ecx
cmp edx, 01h
jne 00007F4149346FB7h
call 00007F4149346FD4h
dec esp
mov eax, edi
mov edx, ebx
dec eax
mov ecx, esi
dec eax
mov ebx, dword ptr [esp+30h]
dec eax
mov esi, dword ptr [esp+38h]
dec eax
add esp, 20h
pop edi
jmp 00007F4149346E38h
int3
int3
int3
dec eax
mov dword ptr [esp+20h], ebx
push ebp
dec eax
mov ebp, esp
dec eax
sub esp, 20h
dec eax
mov eax, dword ptr [0007A034h]
dec eax
mov ebx, 2DDFA232h
cdq
sub eax, dword ptr [eax]
add byte ptr [eax+3Bh], cl
ret
jne 00007F4149347026h
dec eax
and dword ptr [ebp+18h], 00000000h
dec eax
lea ecx, dword ptr [ebp+18h]
call dword ptr [00070726h]
dec eax
mov eax, dword ptr [ebp+18h]
dec eax
mov dword ptr [ebp+10h], eax
call dword ptr [00070668h]
mov eax, eax
dec eax
xor dword ptr [ebp+10h], eax
call dword ptr [00070654h]
mov eax, eax
dec eax
lea ecx, dword ptr [ebp+20h]
dec eax
xor dword ptr [ebp+10h], eax
call dword ptr [000707BCh]
mov eax, dword ptr [ebp+20h]
dec eax
lea ecx, dword ptr [ebp+10h]
dec eax
shl eax, 20h
dec eax
xor eax, dword ptr [ebp+20h]
dec eax
xor eax, dword ptr [ebp+10h]
dec eax
xor eax, ecx
dec eax
mov ecx, FFFFFFFFh

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0xcd018	0x213c	.rdata
IMAGE_DIRECTORY_ENTRY_IMPORT	0xcf154	0x50	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xed000	0x2c8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0xde000	0x714c	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xee000	0xd4c	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0xcb39c	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0xcb280	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x9a140	0x140	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0xcf5a0	0x3f8	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x98c56	0x98e00	7d9459c034a2b1e77524de6601155da1	False	0.4289464942763696	data	6.428057492996419	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x9a000	0x3ec24	0x3ee00	48da9fc4753d70b961a0d1a3f98930cd	False	0.28377780193836977	data	5.872584339924801	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xd9000	0x4d08	0x2000	85cd634b0cd291bef9250c92b0b07ec5	False	0.135986328125	data	3.7115356666419217	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0xde000	0x714c	0x7200	eac2c977073d252368a24ecff480d0e6	False	0.45405016447368424	data	5.697387191345565	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.00cfg	0xe6000	0x38	0x200	0eabc74ee2b74be0000d5307c6bfc109	False	0.07421875	data	0.5091857957461216	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.gxfg	0xe7000	0x2850	0x2a00	f7f00c585fb61b195ca74ce323e3c88a	False	0.41824776785714285	data	5.0826292433871645	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.retplne	0xea000	0x8c	0x200	8c950f651287cbc1296bcb4e8cd7e990	False	0.126953125	data	1.050583247971927
.tls	0xeb000	0x9	0x200	1f354d76203061bfdd5a53dae48d5435	False	0.033203125	data	0.020393135236084953	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
_RDATA	0xec000	0x15c	0x200	0dc89475c6b7258f116c09e2902e949c	False	0.41015625	data	3.3020016390485534	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0xed000	0x2c8	0x400	3989971319ec05c0ebf165ce2cdf2c89	False	0.318359375	data	2.4313997086474464	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xee000	0xd4c	0xe00	b202b89afd3f26da910e8dfc7e3cb950	False	0.45926339285714285	data	5.334857138296712	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0xed060	0x268	MS Windows COFF Motorola 68000 object file	English	United States	0.47564935064935066

Imports

DLL	Import
KERNEL32.dll	AcquireSRWLockExclusive, CloseHandle, CompareStringW, CreateEventW, CreateFileW, DeleteCriticalSection, EncodePointer, EnterCriticalSection, EnumSystemLocalesW, ExitProcess, FileTimeToSystemTime, FindClose, FindFirstFileExW, FindNextFileW, FlsAlloc, FlsFree, FlsGetValue, FlsSetValue, FlushFileBuffers, FreeEnvironmentStringsW, FreeLibrary, GetACP, GetCPInfo, GetCommandLineA, GetCommandLineW, GetConsoleMode, GetConsoleOutputCP, GetCurrentProcess, GetCurrentProcessId, GetCurrentThreadId, GetDateFormatW, GetEnvironmentStringsW, GetEnvironmentVariableW, GetFileAttributesExW, GetFileSizeEx, GetFileType, GetLastError, GetLocaleInfoW, GetModuleFileNameA, GetModuleFileNameW, GetModuleHandleA, GetModuleHandleExA, GetModuleHandleExW, GetModuleHandleW, GetOEMCP, GetProcAddress, GetProcessHeap, GetStartupInfoW, GetStdHandle, GetStringTypeW, GetSystemDirectoryW, GetSystemTimeAsFileTime, GetTimeFormatW, GetTimeZoneInformation, GetUserDefaultLCID, HeapAlloc, HeapFree, HeapReAlloc, HeapSize, InitializeCriticalSection, InitializeCriticalSectionAndSpinCount, InitializeSListHead, InterlockedFlushSList, IsDebuggerPresent, IsProcessorFeaturePresent, IsValidCodePage, IsValidLocale, IsWow64Process, LCMapStringW, LeaveCriticalSection, LoadLibraryA, LoadLibraryExW, LoadLibraryW, MultiByteToWideChar, OutputDebugStringA, QueryPerformanceCounter, RaiseException, ReadConsoleW, ReadFile, ReleaseSRWLockExclusive, ResetEvent, RtlCaptureContext, RtlLookupFunctionEntry, RtlPcToFileHeader, RtlUnwind, RtlUnwindEx, RtlVirtualUnwind, SetEndOfFile, SetEnvironmentVariableW, SetEvent, SetFilePointerEx, SetLastError, SetStdHandle, SetUnhandledExceptionFilter, SleepConditionVariableSRW, SystemTimeToTzSpecificLocalTime, TerminateProcess, TlsAlloc, TlsFree, TlsGetValue, TlsSetValue, UnhandledExceptionFilter, WaitForSingleObjectEx, WakeAllConditionVariable, WideCharToMultiByte, WriteConsoleW, WriteFile
ADVAPI32.dll	GetSidSubAuthority, GetSidSubAuthorityCount, GetTokenInformation, OpenProcessToken, RegCloseKey, RegEnumValueA, RegOpenKeyExA, RegQueryValueExA
CFGMGR32.dll	CM_Get_Child, CM_Get_DevNode_Registry_PropertyW, CM_Get_DevNode_Status, CM_Get_Device_IDW, CM_Get_Device_ID_ListW, CM_Get_Device_ID_List_SizeW, CM_Get_Sibling, CM_Locate_DevNodeW, CM_Open_DevNode_Key

Exports

Name	Ordinal	Address
vkAcquireNextImage2KHR	1	0x1800428b0
vkAcquireNextImageKHR	2	0x180041730
vkAllocateCommandBuffers	3	0x180032e70
vkAllocateDescriptorSets	4	0x180032a50
vkAllocateMemory	5	0x1800315e0
vkBeginCommandBuffer	6	0x180032f60
vkBindBufferMemory	7	0x180031810
vkBindBufferMemory2	8	0x1800346d0
vkBindImageMemory	9	0x180031860
vkBindImageMemory2	10	0x180034730
vkCmdBeginQuery	11	0x180033d40
vkCmdBeginRenderPass	12	0x180033f80
vkCmdBeginRenderPass2	13	0x180034d40
vkCmdBeginRendering	14	0x1800351f0
vkCmdBindDescriptorSets	15	0x180033440
vkCmdBindIndexBuffer	16	0x1800334a0
vkCmdBindPipeline	17	0x180033080
vkCmdBindVertexBuffers	18	0x180033500
vkCmdBindVertexBuffers2	19	0x180035230
vkCmdBlitImage	20	0x180033860
vkCmdBlitImage2	21	0x180035270
vkCmdClearAttachments	22	0x180033b00
vkCmdClearColorImage	23	0x180033a40
vkCmdClearDepthStencilImage	24	0x180033aa0
vkCmdCopyBuffer	25	0x1800337a0
vkCmdCopyBuffer2	26	0x1800352b0
vkCmdCopyBufferToImage	27	0x1800338c0
vkCmdCopyBufferToImage2	28	0x1800352f0
vkCmdCopyImage	29	0x180033800
vkCmdCopyImage2	30	0x180035330
vkCmdCopyImageToBuffer	31	0x180033920
vkCmdCopyImageToBuffer2	32	0x180035370
vkCmdCopyQueryPoolResults	33	0x180033ec0
vkCmdDispatch	34	0x1800336e0
vkCmdDispatchBase	35	0x180034850
vkCmdDispatchIndirect	36	0x180033740
vkCmdDraw	37	0x180033560
vkCmdDrawIndexed	38	0x1800335c0
vkCmdDrawIndexedIndirect	39	0x180033680
vkCmdDrawIndexedIndirectCount	40	0x180034ec0
vkCmdDrawIndirect	41	0x180033620
vkCmdDrawIndirectCount	42	0x180034e60
vkCmdEndQuery	43	0x180033da0
vkCmdEndRenderPass	44	0x180034040
vkCmdEndRenderPass2	45	0x180034e00
vkCmdEndRendering	46	0x1800353b0
vkCmdExecuteCommands	47	0x1800340a0
vkCmdFillBuffer	48	0x1800339e0
vkCmdNextSubpass	49	0x180033fe0
vkCmdNextSubpass2	50	0x180034da0
vkCmdPipelineBarrier	51	0x180033ce0
vkCmdPipelineBarrier2	52	0x1800353f0
vkCmdPushConstants	53	0x180033f20
vkCmdResetEvent	54	0x180033c20
vkCmdResetEvent2	55	0x180035430
vkCmdResetQueryPool	56	0x180033e00
vkCmdResolveImage	57	0x180033b60
vkCmdResolveImage2	58	0x180035470
vkCmdSetBlendConstants	59	0x180033260
vkCmdSetCullMode	60	0x1800354b0
vkCmdSetDepthBias	61	0x180033200
vkCmdSetDepthBiasEnable	62	0x1800354f0
vkCmdSetDepthBounds	63	0x1800332c0
vkCmdSetDepthBoundsTestEnable	64	0x180035530
vkCmdSetDepthCompareOp	65	0x180035570
vkCmdSetDepthTestEnable	66	0x1800355b0
vkCmdSetDepthWriteEnable	67	0x1800355f0
vkCmdSetDeviceMask	68	0x1800347f0
vkCmdSetEvent	69	0x180033bc0
vkCmdSetEvent2	70	0x180035630
vkCmdSetFrontFace	71	0x180035670
vkCmdSetLineWidth	72	0x1800331a0
vkCmdSetPrimitiveRestartEnable	73	0x1800356b0
vkCmdSetPrimitiveTopology	74	0x1800356f0
vkCmdSetRasterizerDiscardEnable	75	0x180035730
vkCmdSetScissor	76	0x180033140
vkCmdSetScissorWithCount	77	0x180035770
vkCmdSetStencilCompareMask	78	0x180033320
vkCmdSetStencilOp	79	0x1800357b0
vkCmdSetStencilReference	80	0x1800333e0
vkCmdSetStencilTestEnable	81	0x1800357f0
vkCmdSetStencilWriteMask	82	0x180033380
vkCmdSetViewport	83	0x1800330e0
vkCmdSetViewportWithCount	84	0x180035830
vkCmdUpdateBuffer	85	0x180033980
vkCmdWaitEvents	86	0x180033c80
vkCmdWaitEvents2	87	0x180035870
vkCmdWriteTimestamp	88	0x180033e60
vkCmdWriteTimestamp2	89	0x1800358b0
vkCreateBuffer	90	0x180032030
vkCreateBufferView	91	0x1800320f0
vkCreateCommandPool	92	0x180032d50
vkCreateComputePipelines	93	0x180032630
vkCreateDescriptorPool	94	0x180032930
vkCreateDescriptorSetLayout	95	0x180032870
vkCreateDescriptorUpdateTemplate	96	0x180034bc0
vkCreateDevice	97	0x1800311d0
vkCreateDisplayModeKHR	98	0x180042040
vkCreateDisplayPlaneSurfaceKHR	99	0x180042200
vkCreateEvent	100	0x180031d30
vkCreateFence	101	0x180031a90
vkCreateFramebuffer	102	0x180032b70
vkCreateGraphicsPipelines	103	0x1800325d0
vkCreateHeadlessSurfaceEXT	104	0x180041ac0
vkCreateImage	105	0x1800321b0
vkCreateImageView	106	0x1800322d0
vkCreateInstance	107	0x180030750
vkCreatePipelineCache	108	0x180032450
vkCreatePipelineLayout	109	0x1800326f0
vkCreatePrivateDataSlot	110	0x1800358f0
vkCreateQueryPool	111	0x180031f10
vkCreateRenderPass	112	0x180032c30
vkCreateRenderPass2	113	0x180034ce0
vkCreateSampler	114	0x1800327b0
vkCreateSamplerYcbcrConversion	115	0x180034aa0
vkCreateSemaphore	116	0x180031c70
vkCreateShaderModule	117	0x180032390
vkCreateSharedSwapchainsKHR	118	0x180042430
vkCreateSwapchainKHR	119	0x1800414a0
vkCreateWin32SurfaceKHR	120	0x1800417f0
vkDestroyBuffer	121	0x180032090
vkDestroyBufferView	122	0x180032150
vkDestroyCommandPool	123	0x180032db0
vkDestroyDescriptorPool	124	0x180032990
vkDestroyDescriptorSetLayout	125	0x1800328d0
vkDestroyDescriptorUpdateTemplate	126	0x180034c20
vkDestroyDevice	127	0x180031260
vkDestroyEvent	128	0x180031d90
vkDestroyFence	129	0x180031af0
vkDestroyFramebuffer	130	0x180032bd0
vkDestroyImage	131	0x180032210
vkDestroyImageView	132	0x180032330
vkDestroyInstance	133	0x180030d20
vkDestroyPipeline	134	0x180032690
vkDestroyPipelineCache	135	0x1800324b0
vkDestroyPipelineLayout	136	0x180032750
vkDestroyPrivateDataSlot	137	0x180035930
vkDestroyQueryPool	138	0x180031f70
vkDestroyRenderPass	139	0x180032c90
vkDestroySampler	140	0x180032810
vkDestroySamplerYcbcrConversion	141	0x180034b00
vkDestroySemaphore	142	0x180031cd0
vkDestroyShaderModule	143	0x1800323f0
vkDestroySurfaceKHR	144	0x180040f30
vkDestroySwapchainKHR	145	0x180041670
vkDeviceWaitIdle	146	0x180031590
vkEndCommandBuffer	147	0x180032fc0
vkEnumerateDeviceExtensionProperties	148	0x1800312f0
vkEnumerateDeviceLayerProperties	149	0x180031380
vkEnumerateInstanceExtensionProperties	150	0x18002fff0
vkEnumerateInstanceLayerProperties	151	0x180030260
vkEnumerateInstanceVersion	152	0x1800304d0
vkEnumeratePhysicalDeviceGroups	153	0x180034100
vkEnumeratePhysicalDevices	154	0x180030ec0
vkFlushMappedMemoryRanges	155	0x180031720
vkFreeCommandBuffers	156	0x180032f00
vkFreeDescriptorSets	157	0x180032ab0
vkFreeMemory	158	0x180031630
vkGetBufferDeviceAddress	159	0x180035040
vkGetBufferMemoryRequirements	160	0x1800318b0
vkGetBufferMemoryRequirements2	161	0x180034910
vkGetBufferOpaqueCaptureAddress	162	0x1800350a0
vkGetDescriptorSetLayoutSupport	163	0x180034b60
vkGetDeviceBufferMemoryRequirements	164	0x180035970
vkGetDeviceGroupPeerMemoryFeatures	165	0x180034790
vkGetDeviceGroupPresentCapabilitiesKHR	166	0x180042630
vkGetDeviceGroupSurfacePresentModesKHR	167	0x180042690
vkGetDeviceImageMemoryRequirements	168	0x1800359b0
vkGetDeviceImageSparseMemoryRequirements	169	0x1800359f0
vkGetDeviceMemoryCommitment	170	0x1800317c0
vkGetDeviceMemoryOpaqueCaptureAddress	171	0x180035100
vkGetDeviceProcAddr	172	0x18002ff70
vkGetDeviceQueue	173	0x180031480
vkGetDeviceQueue2	174	0x180034a30
vkGetDisplayModeProperties2KHR	175	0x180042d10
vkGetDisplayModePropertiesKHR	176	0x180041f60
vkGetDisplayPlaneCapabilities2KHR	177	0x180042f30
vkGetDisplayPlaneCapabilitiesKHR	178	0x180042110
vkGetDisplayPlaneSupportedDisplaysKHR	179	0x180041e80
vkGetEventStatus	180	0x180031df0
vkGetFenceStatus	181	0x180031bb0
vkGetImageMemoryRequirements	182	0x180031910
vkGetImageMemoryRequirements2	183	0x1800348b0
vkGetImageSparseMemoryRequirements	184	0x180031970
vkGetImageSparseMemoryRequirements2	185	0x180034970
vkGetImageSubresourceLayout	186	0x180032270
vkGetInstanceProcAddr	187	0x18002fe60
vkGetPhysicalDeviceDisplayPlaneProperties2KHR	188	0x180042b20
vkGetPhysicalDeviceDisplayPlanePropertiesKHR	189	0x180041da0
vkGetPhysicalDeviceDisplayProperties2KHR	190	0x180042910
vkGetPhysicalDeviceDisplayPropertiesKHR	191	0x180041cc0
vkGetPhysicalDeviceExternalBufferProperties	192	0x180034550
vkGetPhysicalDeviceExternalFenceProperties	193	0x180034650
vkGetPhysicalDeviceExternalSemaphoreProperties	194	0x1800345d0
vkGetPhysicalDeviceFeatures	195	0x180030f90
vkGetPhysicalDeviceFeatures2	196	0x1800341d0
vkGetPhysicalDeviceFormatProperties	197	0x180030ff0
vkGetPhysicalDeviceFormatProperties2	198	0x1800342d0
vkGetPhysicalDeviceImageFormatProperties	199	0x180031050
vkGetPhysicalDeviceImageFormatProperties2	200	0x180034350
vkGetPhysicalDeviceMemoryProperties	201	0x180031170
vkGetPhysicalDeviceMemoryProperties2	202	0x180034450
vkGetPhysicalDevicePresentRectanglesKHR	203	0x1800427d0
vkGetPhysicalDeviceProperties	204	0x1800310b0
vkGetPhysicalDeviceProperties2	205	0x180034250
vkGetPhysicalDeviceQueueFamilyProperties	206	0x180031110
vkGetPhysicalDeviceQueueFamilyProperties2	207	0x1800343d0
vkGetPhysicalDeviceSparseImageFormatProperties	208	0x1800319d0
vkGetPhysicalDeviceSparseImageFormatProperties2	209	0x1800344d0
vkGetPhysicalDeviceSurfaceCapabilities2KHR	210	0x180043050
vkGetPhysicalDeviceSurfaceCapabilitiesKHR	211	0x180041160
vkGetPhysicalDeviceSurfaceFormats2KHR	212	0x180043290
vkGetPhysicalDeviceSurfaceFormatsKHR	213	0x180041280
vkGetPhysicalDeviceSurfacePresentModesKHR	214	0x180041390
vkGetPhysicalDeviceSurfaceSupportKHR	215	0x180041050
vkGetPhysicalDeviceToolProperties	216	0x1800351c0
vkGetPhysicalDeviceWin32PresentationSupportKHR	217	0x180041a00
vkGetPipelineCacheData	218	0x180032510
vkGetPrivateData	219	0x180035a30
vkGetQueryPoolResults	220	0x180031fd0
vkGetRenderAreaGranularity	221	0x180032cf0
vkGetSemaphoreCounterValue	222	0x180034f20
vkGetSwapchainImagesKHR	223	0x1800416d0
vkInvalidateMappedMemoryRanges	224	0x180031770
vkMapMemory	225	0x180031680
vkMergePipelineCaches	226	0x180032570
vkQueueBindSparse	227	0x180031a30
vkQueuePresentKHR	228	0x180041790
vkQueueSubmit	229	0x1800314f0
vkQueueSubmit2	230	0x180035ab0
vkQueueWaitIdle	231	0x180031540
vkResetCommandBuffer	232	0x180033020
vkResetCommandPool	233	0x180032e10
vkResetDescriptorPool	234	0x1800329f0
vkResetEvent	235	0x180031eb0
vkResetFences	236	0x180031b50
vkResetQueryPool	237	0x180035160
vkSetEvent	238	0x180031e50
vkSetPrivateData	239	0x180035a70
vkSignalSemaphore	240	0x180034fe0
vkTrimCommandPool	241	0x1800349d0
vkUnmapMemory	242	0x1800316d0
vkUpdateDescriptorSetWithTemplate	243	0x180034c80
vkUpdateDescriptorSets	244	0x180032b10
vkWaitForFences	245	0x180031c10
vkWaitSemaphores	246	0x180034f80

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Target ID:	0
Start time:	14:40:21
Start date:	24/04/2024
Path:	C:\Windows\System32\loaddll64.exe
Wow64 process (32bit):	false
Commandline:	loaddll64.exe "C:\Users\user\Desktop\vulkan-1.dll"
Imagebase:	0x7ff69ffc0000
File size:	165'888 bytes
MD5 hash:	763455F9DCB24DFEECC2B9D9F8D46D52
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	1
Start time:	14:40:21
Start date:	24/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	14:40:21
Start date:	24/04/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd.exe /C rundll32.exe "C:\Users\user\Desktop\vulkan-1.dll",#1
Imagebase:	0x7ff7f0850000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	14:40:21
Start date:	24/04/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe C:\Users\user\Desktop\vulkan-1.dll,vkAcquireNextImage2KHR
Imagebase:	0x7ff6a9480000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	14:40:21
Start date:	24/04/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\vulkan-1.dll",#1
Imagebase:	0x7ff6a9480000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	14:40:22
Start date:	24/04/2024
Path:	C:\Windows\System32\WerFault.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WerFault.exe -u -p 7352 -s 316
Imagebase:	0x7ff718b90000
File size:	570'736 bytes
MD5 hash:	FD27D9F6D02763BDE32511B5DF7FF7A0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	14:40:22
Start date:	24/04/2024
Path:	C:\Windows\System32\WerFault.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WerFault.exe -u -p 7368 -s 348
Imagebase:	0x7ff718b90000
File size:	570'736 bytes
MD5 hash:	FD27D9F6D02763BDE32511B5DF7FF7A0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	14:40:25
Start date:	24/04/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe C:\Users\user\Desktop\vulkan-1.dll,vkAcquireNextImageKHR
Imagebase:	0x7ff6a9480000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	14:40:25
Start date:	24/04/2024
Path:	C:\Windows\System32\WerFault.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WerFault.exe -u -p 7632 -s 340
Imagebase:	0x7ff718b90000
File size:	570'736 bytes
MD5 hash:	FD27D9F6D02763BDE32511B5DF7FF7A0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	14:40:28
Start date:	24/04/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe C:\Users\user\Desktop\vulkan-1.dll,vkAllocateCommandBuffers
Imagebase:	0x7ff6a9480000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	14:40:28
Start date:	24/04/2024
Path:	C:\Windows\System32\WerFault.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WerFault.exe -u -p 7776 -s 348
Imagebase:	0x7ff718b90000
File size:	570'736 bytes
MD5 hash:	FD27D9F6D02763BDE32511B5DF7FF7A0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	14:40:31
Start date:	24/04/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\vulkan-1.dll",vkAcquireNextImage2KHR
Imagebase:	0x7ff6a9480000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	14:40:31
Start date:	24/04/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\vulkan-1.dll",vkAcquireNextImageKHR
Imagebase:	0x7ff6a9480000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	14:40:31
Start date:	24/04/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\vulkan-1.dll",vkAllocateCommandBuffers
Imagebase:	0x7ff6a9480000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	14:40:31
Start date:	24/04/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\vulkan-1.dll",vkWaitSemaphores
Imagebase:	0x7ff6a9480000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	14:40:31
Start date:	24/04/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\vulkan-1.dll",vkWaitForFences
Imagebase:	0x7ff6a9480000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	14:40:31
Start date:	24/04/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\vulkan-1.dll",vkUpdateDescriptorSets
Imagebase:	0x7ff6a9480000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	14:40:32
Start date:	24/04/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\vulkan-1.dll",vkUpdateDescriptorSetWithTemplate
Imagebase:	0x7ff6a9480000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	14:40:32
Start date:	24/04/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\vulkan-1.dll",vkUnmapMemory
Imagebase:	0x7ff6a9480000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	14:40:32
Start date:	24/04/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\vulkan-1.dll",vkTrimCommandPool
Imagebase:	0x7ff6a9480000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	14:40:32
Start date:	24/04/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\vulkan-1.dll",vkSignalSemaphore
Imagebase:	0x7ff6a9480000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	14:40:32
Start date:	24/04/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\vulkan-1.dll",vkSetPrivateData
Imagebase:	0x7ff6a9480000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	14:40:32
Start date:	24/04/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\vulkan-1.dll",vkSetEvent
Imagebase:	0x7ff6a9480000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	36
Start time:	14:40:32
Start date:	24/04/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\vulkan-1.dll",vkResetQueryPool
Imagebase:	0x7ff6a9480000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	38
Start time:	14:40:32
Start date:	24/04/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\vulkan-1.dll",vkResetFences
Imagebase:	0x7ff6a9480000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	40
Start time:	14:40:32
Start date:	24/04/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\vulkan-1.dll",vkResetEvent
Imagebase:	0x7ff6a9480000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Function 00007FFDFF231D20 Relevance: 110.8, Strings: 88, Instructions: 822COMMON

Download Yara Rule

Strings

CreateDisplayModeKHR, xrefs: 00007FFDFF232451
CreateWin32SurfaceKHR, xrefs: 00007FFDFF232496
GetPhysicalDeviceDisplayPlanePropertiesKHR, xrefs: 00007FFDFF232410
CreateDisplayPlaneSurfaceKHR, xrefs: 00007FFDFF23247F
GetPhysicalDevicePresentRectanglesKHR, xrefs: 00007FFDFF23233E
SubmitDebugUtilsMessageEXT, xrefs: 00007FFDFF232929
GetPhysicalDeviceImageFormatProperties2, xrefs: 00007FFDFF23221B
GetPhysicalDeviceFormatProperties, xrefs: 00007FFDFF232075
GetPhysicalDeviceMemoryProperties2, xrefs: 00007FFDFF232241
GetPhysicalDeviceToolPropertiesEXT, xrefs: 00007FFDFF23296E
GetPhysicalDeviceCalibrateableTimeDomainsEXT, xrefs: 00007FFDFF232957
EnumeratePhysicalDevices, xrefs: 00007FFDFF23204F
GetPhysicalDeviceProperties2, xrefs: 00007FFDFF2321F5
GetPhysicalDeviceWin32PresentationSupportKHR, xrefs: 00007FFDFF2324AD
AcquireWinrtDisplayNV, xrefs: 00007FFDFF232A15
GetPhysicalDeviceFeatures2KHR, xrefs: 00007FFDFF2324F2
DestroyDebugUtilsMessengerEXT, xrefs: 00007FFDFF232912
vkSetDebugUtilsObjectNameEXT: Invalid device [VUID-vkSetDebugUtilsObjectNameEXT-device-parameter], xrefs: 00007FFDFF231F0F
GetPhysicalDeviceExternalImageFormatPropertiesNV, xrefs: 00007FFDFF23284A
GetInstanceProcAddr, xrefs: 00007FFDFF2320E4
GetDisplayPlaneCapabilitiesKHR, xrefs: 00007FFDFF232468
GetPhysicalDeviceFormatProperties2KHR, xrefs: 00007FFDFF232520
GetPhysicalDeviceProperties2KHR, xrefs: 00007FFDFF232509
DestroySurfaceKHR, xrefs: 00007FFDFF2322CB
GetPhysicalDeviceSparseImageFormatProperties2KHR, xrefs: 00007FFDFF23261C
EnumerateDeviceExtensionProperties, xrefs: 00007FFDFF2320FB
GetPhysicalDeviceFeatures2, xrefs: 00007FFDFF23214B
GetPhysicalDeviceFragmentShadingRatesKHR, xrefs: 00007FFDFF2327D7
GetPhysicalDeviceToolProperties, xrefs: 00007FFDFF2322B4
GetPhysicalDeviceExternalBufferProperties, xrefs: 00007FFDFF23226F
DestroyInstance, xrefs: 00007FFDFF23203C
GetDisplayModePropertiesKHR, xrefs: 00007FFDFF23243A
GetPhysicalDeviceSurfaceCapabilitiesKHR, xrefs: 00007FFDFF2322F9
GetPhysicalDeviceSurfaceFormatsKHR, xrefs: 00007FFDFF232310
GetPhysicalDeviceQueueFamilyProperties, xrefs: 00007FFDFF2320B6
GetPhysicalDeviceImageFormatProperties, xrefs: 00007FFDFF232088
AcquireDrmDisplayEXT, xrefs: 00007FFDFF2329E7
ReleaseDisplayEXT, xrefs: 00007FFDFF232861
GetPhysicalDeviceQueueFamilyProperties2, xrefs: 00007FFDFF23222E
GetPhysicalDeviceMemoryProperties2KHR, xrefs: 00007FFDFF232605
GetPhysicalDeviceSurfaceFormats2KHR, xrefs: 00007FFDFF2326D4
GetPhysicalDeviceExternalSemaphorePropertiesKHR, xrefs: 00007FFDFF232661
GetPhysicalDeviceSurfaceSupportKHR, xrefs: 00007FFDFF2322E2
vkDebugMarkerSetObjectNameEXT: Invalid device [VUID-vkDebugMarkerSetObjectNameEXT-device-parameter], xrefs: 00007FFDFF231E56
GetPhysicalDeviceSurfaceCapabilities2KHR, xrefs: 00007FFDFF2326BD
CreateDebugUtilsMessengerEXT, xrefs: 00007FFDFF23288F
DestroyDebugReportCallbackEXT, xrefs: 00007FFDFF23281C
vkSetDebugUtilsObjectTagEXT: Invalid device [VUID-vkSetDebugUtilsObjectTagEXT-device-parameter], xrefs: 00007FFDFF231FC8
GetPhysicalDeviceSparseImageFormatProperties2, xrefs: 00007FFDFF232258
GetPhysicalDeviceQueueFamilyProperties2KHR, xrefs: 00007FFDFF2325F2
GetPhysicalDeviceExternalSemaphoreProperties, xrefs: 00007FFDFF23229D
GetPhysicalDeviceExternalBufferPropertiesKHR, xrefs: 00007FFDFF23264A
GetWinrtDisplayNV, xrefs: 00007FFDFF232A2C
GetPhysicalDeviceVideoFormatPropertiesKHR, xrefs: 00007FFDFF2324DB
GetPhysicalDeviceProperties, xrefs: 00007FFDFF23209F
EnumeratePhysicalDeviceQueueFamilyPerformanceQueryCountersKHR, xrefs: 00007FFDFF23268F
GetPhysicalDeviceOpticalFlowImageFormatsNV, xrefs: 00007FFDFF232A43
GetPhysicalDeviceDisplayPropertiesKHR, xrefs: 00007FFDFF2323FD
GetPhysicalDeviceFormatProperties2, xrefs: 00007FFDFF232208
GetPhysicalDeviceQueueFamilyPerformanceQueryPassesKHR, xrefs: 00007FFDFF2326A6
GetPhysicalDeviceExternalFenceProperties, xrefs: 00007FFDFF232286
GetPhysicalDeviceSurfacePresentModesKHR, xrefs: 00007FFDFF232327
EnumeratePhysicalDeviceGroups, xrefs: 00007FFDFF232138
EnumeratePhysicalDeviceGroupsKHR, xrefs: 00007FFDFF232633
GetPhysicalDeviceMultisamplePropertiesEXT, xrefs: 00007FFDFF232940
GetPhysicalDeviceDisplayPlaneProperties2KHR, xrefs: 00007FFDFF232702
GetPhysicalDeviceDisplayProperties2KHR, xrefs: 00007FFDFF2326EB
GetPhysicalDeviceExternalFencePropertiesKHR, xrefs: 00007FFDFF232678
GetPhysicalDeviceSurfaceCapabilities2EXT, xrefs: 00007FFDFF232878
GetDrmDisplayEXT, xrefs: 00007FFDFF2329FE
GetDisplayPlaneSupportedDisplaysKHR, xrefs: 00007FFDFF232423
GetPhysicalDeviceCooperativeMatrixPropertiesNV, xrefs: 00007FFDFF232985
GetDisplayPlaneCapabilities2KHR, xrefs: 00007FFDFF2327C0
k, xrefs: 00007FFDFF232007
CreateDebugReportCallbackEXT, xrefs: 00007FFDFF232805
CreateHeadlessSurfaceEXT, xrefs: 00007FFDFF2329D0
GetPhysicalDeviceFeatures, xrefs: 00007FFDFF232062
GetPhysicalDeviceVideoCapabilitiesKHR, xrefs: 00007FFDFF2324C4
GetPhysicalDeviceMemoryProperties, xrefs: 00007FFDFF2320CD
DebugReportMessageEXT, xrefs: 00007FFDFF232833
GetPhysicalDeviceVideoEncodeQualityLevelPropertiesKHR, xrefs: 00007FFDFF2327EE
EnumerateDeviceLayerProperties, xrefs: 00007FFDFF232112
GetPhysicalDeviceSparseImageFormatProperties, xrefs: 00007FFDFF232125
GetPhysicalDeviceSupportedFramebufferMixedSamplesCombinationsNV, xrefs: 00007FFDFF2328F6
GetDisplayModeProperties2KHR, xrefs: 00007FFDFF2327A9
GetPhysicalDeviceImageFormatProperties2KHR, xrefs: 00007FFDFF2325DF
GetPhysicalDeviceSurfacePresentModes2EXT, xrefs: 00007FFDFF2329B9
vkDebugMarkerSetObjectTagEXT: Invalid device [VUID-vkDebugMarkerSetObjectTagEXT-device-parameter], xrefs: 00007FFDFF231DAF

Memory Dump Source

Source File: 00000000.00000002.2924661177.00007FFDFF221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFF220000, based on PE: true

Associated: 00000000.00000002.2924538361.00007FFDFF220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924751005.00007FFDFF2BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924794258.00007FFDFF2F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924817209.00007FFDFF2FE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924817209.00007FFDFF307000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924865675.00007FFDFF30C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdff220000_loaddll64.jbxd

Similarity

API ID: FeaturePresentProcessor
String ID: AcquireDrmDisplayEXT$AcquireWinrtDisplayNV$CreateDebugReportCallbackEXT$CreateDebugUtilsMessengerEXT$CreateDisplayModeKHR$CreateDisplayPlaneSurfaceKHR$CreateHeadlessSurfaceEXT$CreateWin32SurfaceKHR$DebugReportMessageEXT$DestroyDebugReportCallbackEXT$DestroyDebugUtilsMessengerEXT$DestroyInstance$DestroySurfaceKHR$EnumerateDeviceExtensionProperties$EnumerateDeviceLayerProperties$EnumeratePhysicalDeviceGroups$EnumeratePhysicalDeviceGroupsKHR$EnumeratePhysicalDeviceQueueFamilyPerformanceQueryCountersKHR$EnumeratePhysicalDevices$GetDisplayModeProperties2KHR$GetDisplayModePropertiesKHR$GetDisplayPlaneCapabilities2KHR$GetDisplayPlaneCapabilitiesKHR$GetDisplayPlaneSupportedDisplaysKHR$GetDrmDisplayEXT$GetInstanceProcAddr$GetPhysicalDeviceCalibrateableTimeDomainsEXT$GetPhysicalDeviceCooperativeMatrixPropertiesNV$GetPhysicalDeviceDisplayPlaneProperties2KHR$GetPhysicalDeviceDisplayPlanePropertiesKHR$GetPhysicalDeviceDisplayProperties2KHR$GetPhysicalDeviceDisplayPropertiesKHR$GetPhysicalDeviceExternalBufferProperties$GetPhysicalDeviceExternalBufferPropertiesKHR$GetPhysicalDeviceExternalFenceProperties$GetPhysicalDeviceExternalFencePropertiesKHR$GetPhysicalDeviceExternalImageFormatPropertiesNV$GetPhysicalDeviceExternalSemaphoreProperties$GetPhysicalDeviceExternalSemaphorePropertiesKHR$GetPhysicalDeviceFeatures$GetPhysicalDeviceFeatures2$GetPhysicalDeviceFeatures2KHR$GetPhysicalDeviceFormatProperties$GetPhysicalDeviceFormatProperties2$GetPhysicalDeviceFormatProperties2KHR$GetPhysicalDeviceFragmentShadingRatesKHR$GetPhysicalDeviceImageFormatProperties$GetPhysicalDeviceImageFormatProperties2$GetPhysicalDeviceImageFormatProperties2KHR$GetPhysicalDeviceMemoryProperties$GetPhysicalDeviceMemoryProperties2$GetPhysicalDeviceMemoryProperties2KHR$GetPhysicalDeviceMultisamplePropertiesEXT$GetPhysicalDeviceOpticalFlowImageFormatsNV$GetPhysicalDevicePresentRectanglesKHR$GetPhysicalDeviceProperties$GetPhysicalDeviceProperties2$GetPhysicalDeviceProperties2KHR$GetPhysicalDeviceQueueFamilyPerformanceQueryPassesKHR$GetPhysicalDeviceQueueFamilyProperties$GetPhysicalDeviceQueueFamilyProperties2$GetPhysicalDeviceQueueFamilyProperties2KHR$GetPhysicalDeviceSparseImageFormatProperties$GetPhysicalDeviceSparseImageFormatProperties2$GetPhysicalDeviceSparseImageFormatProperties2KHR$GetPhysicalDeviceSupportedFramebufferMixedSamplesCombinationsNV$GetPhysicalDeviceSurfaceCapabilities2EXT$GetPhysicalDeviceSurfaceCapabilities2KHR$GetPhysicalDeviceSurfaceCapabilitiesKHR$GetPhysicalDeviceSurfaceFormats2KHR$GetPhysicalDeviceSurfaceFormatsKHR$GetPhysicalDeviceSurfacePresentModes2EXT$GetPhysicalDeviceSurfacePresentModesKHR$GetPhysicalDeviceSurfaceSupportKHR$GetPhysicalDeviceToolProperties$GetPhysicalDeviceToolPropertiesEXT$GetPhysicalDeviceVideoCapabilitiesKHR$GetPhysicalDeviceVideoEncodeQualityLevelPropertiesKHR$GetPhysicalDeviceVideoFormatPropertiesKHR$GetPhysicalDeviceWin32PresentationSupportKHR$GetWinrtDisplayNV$ReleaseDisplayEXT$SubmitDebugUtilsMessageEXT$k$vkDebugMarkerSetObjectNameEXT: Invalid device [VUID-vkDebugMarkerSetObjectNameEXT-device-parameter]$vkDebugMarkerSetObjectTagEXT: Invalid device [VUID-vkDebugMarkerSetObjectTagEXT-device-parameter]$vkSetDebugUtilsObjectNameEXT: Invalid device [VUID-vkSetDebugUtilsObjectNameEXT-device-parameter]$vkSetDebugUtilsObjectTagEXT: Invalid device [VUID-vkSetDebugUtilsObjectTagEXT-device-parameter]
API String ID: 2325560087-4131477650
Opcode ID: 9ae06b1564898ab072d42bf5a9e5e4302c110994cdf425cb80e5c91c18cade9c
Instruction ID: 8ba7b44c75a5bc7a937c74ffd7666d914321b5b629f9d61876a075569e0d4714
Opcode Fuzzy Hash: 9ae06b1564898ab072d42bf5a9e5e4302c110994cdf425cb80e5c91c18cade9c
Instruction Fuzzy Hash: BB721FA5B0D75381FB689B259471AB913A0AF64B80F445231DE7ECB2DDDFACF485E200

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDFF23787C Relevance: 28.4, Strings: 22, Instructions: 875COMMON

Download Yara Rule

Strings

vkCmdSetStencilTestEnableEXT: Invalid commandBuffer [VUID-vkCmdSetStencilTestEnableEXT-commandBuffer-parameter], xrefs: 00007FFDFF237DB5
vkResetQueryPoolEXT: Invalid device [VUID-vkResetQueryPoolEXT-device-parameter], xrefs: 00007FFDFF237995
vkAcquireDrmDisplayEXT: Invalid physicalDevice [VUID-vkAcquireDrmDisplayEXT-physicalDevice-parameter], xrefs: 00007FFDFF238178
vkCreateIndirectCommandsLayoutNV: Invalid device [VUID-vkCreateIndirectCommandsLayoutNV-device-parameter], xrefs: 00007FFDFF238055
vkCmdSetDepthWriteEnableEXT: Invalid commandBuffer [VUID-vkCmdSetDepthWriteEnableEXT-commandBuffer-parameter], xrefs: 00007FFDFF237C95
vkCmdSetScissorWithCountEXT: Invalid commandBuffer [VUID-vkCmdSetScissorWithCountEXT-commandBuffer-parameter], xrefs: 00007FFDFF237B75
ICD associated with VkPhysicalDevice does not support AcquireDrmDisplayEXT, xrefs: 00007FFDFF2381CA
vkCmdSetDepthBias2EXT: Invalid commandBuffer [VUID-vkCmdSetDepthBias2EXT-commandBuffer-parameter], xrefs: 00007FFDFF238115
vkDestroyIndirectCommandsLayoutNV: Invalid device [VUID-vkDestroyIndirectCommandsLayoutNV-device-parameter], xrefs: 00007FFDFF2380B5
vkCmdExecuteGeneratedCommandsNV: Invalid commandBuffer [VUID-vkCmdExecuteGeneratedCommandsNV-commandBuffer-parameter], xrefs: 00007FFDFF237F95
vkCmdSetDepthCompareOpEXT: Invalid commandBuffer [VUID-vkCmdSetDepthCompareOpEXT-commandBuffer-parameter], xrefs: 00007FFDFF237CF5
vkCmdSetCullModeEXT: Invalid commandBuffer [VUID-vkCmdSetCullModeEXT-commandBuffer-parameter], xrefs: 00007FFDFF2379F5
vkCmdSetStencilOpEXT: Invalid commandBuffer [VUID-vkCmdSetStencilOpEXT-commandBuffer-parameter], xrefs: 00007FFDFF237E15, 00007FFDFF237E75, 00007FFDFF237ED5
vkCmdSetLineStippleEXT: Invalid commandBuffer [VUID-vkCmdSetLineStippleEXT-commandBuffer-parameter], xrefs: 00007FFDFF237935
vkCmdBindPipelineShaderGroupNV: Invalid commandBuffer [VUID-vkCmdBindPipelineShaderGroupNV-commandBuffer-parameter], xrefs: 00007FFDFF237FF5
vkCmdSetDepthTestEnableEXT: Invalid commandBuffer [VUID-vkCmdSetDepthTestEnableEXT-commandBuffer-parameter], xrefs: 00007FFDFF237C35
vkCmdSetViewportWithCountEXT: Invalid commandBuffer [VUID-vkCmdSetViewportWithCountEXT-commandBuffer-parameter], xrefs: 00007FFDFF237B15
vkReleaseFullScreenExclusiveModeEXT: Invalid device [VUID-vkReleaseFullScreenExclusiveModeEXT-device-parameter], xrefs: 00007FFDFF2378D5
vkCmdPreprocessGeneratedCommandsNV: Invalid commandBuffer [VUID-vkCmdPreprocessGeneratedCommandsNV-commandBuffer-parameter], xrefs: 00007FFDFF237F35
vkCmdBindVertexBuffers2EXT: Invalid commandBuffer [VUID-vkCmdBindVertexBuffers2EXT-commandBuffer-parameter], xrefs: 00007FFDFF237BD5
vkCmdSetFrontFaceEXT: Invalid commandBuffer [VUID-vkCmdSetFrontFaceEXT-commandBuffer-parameter], xrefs: 00007FFDFF237A55, 00007FFDFF237AB5
vkCmdSetDepthBoundsTestEnableEXT: Invalid commandBuffer [VUID-vkCmdSetDepthBoundsTestEnableEXT-commandBuffer-parameter], xrefs: 00007FFDFF237D55

Memory Dump Source

Source File: 00000000.00000002.2924661177.00007FFDFF221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFF220000, based on PE: true

Associated: 00000000.00000002.2924538361.00007FFDFF220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924751005.00007FFDFF2BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924794258.00007FFDFF2F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924817209.00007FFDFF2FE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924817209.00007FFDFF307000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924865675.00007FFDFF30C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdff220000_loaddll64.jbxd

Similarity

API ID: FeaturePresentProcessor
String ID: ICD associated with VkPhysicalDevice does not support AcquireDrmDisplayEXT$vkAcquireDrmDisplayEXT: Invalid physicalDevice [VUID-vkAcquireDrmDisplayEXT-physicalDevice-parameter]$vkCmdBindPipelineShaderGroupNV: Invalid commandBuffer [VUID-vkCmdBindPipelineShaderGroupNV-commandBuffer-parameter]$vkCmdBindVertexBuffers2EXT: Invalid commandBuffer [VUID-vkCmdBindVertexBuffers2EXT-commandBuffer-parameter]$vkCmdExecuteGeneratedCommandsNV: Invalid commandBuffer [VUID-vkCmdExecuteGeneratedCommandsNV-commandBuffer-parameter]$vkCmdPreprocessGeneratedCommandsNV: Invalid commandBuffer [VUID-vkCmdPreprocessGeneratedCommandsNV-commandBuffer-parameter]$vkCmdSetCullModeEXT: Invalid commandBuffer [VUID-vkCmdSetCullModeEXT-commandBuffer-parameter]$vkCmdSetDepthBias2EXT: Invalid commandBuffer [VUID-vkCmdSetDepthBias2EXT-commandBuffer-parameter]$vkCmdSetDepthBoundsTestEnableEXT: Invalid commandBuffer [VUID-vkCmdSetDepthBoundsTestEnableEXT-commandBuffer-parameter]$vkCmdSetDepthCompareOpEXT: Invalid commandBuffer [VUID-vkCmdSetDepthCompareOpEXT-commandBuffer-parameter]$vkCmdSetDepthTestEnableEXT: Invalid commandBuffer [VUID-vkCmdSetDepthTestEnableEXT-commandBuffer-parameter]$vkCmdSetDepthWriteEnableEXT: Invalid commandBuffer [VUID-vkCmdSetDepthWriteEnableEXT-commandBuffer-parameter]$vkCmdSetFrontFaceEXT: Invalid commandBuffer [VUID-vkCmdSetFrontFaceEXT-commandBuffer-parameter]$vkCmdSetLineStippleEXT: Invalid commandBuffer [VUID-vkCmdSetLineStippleEXT-commandBuffer-parameter]$vkCmdSetScissorWithCountEXT: Invalid commandBuffer [VUID-vkCmdSetScissorWithCountEXT-commandBuffer-parameter]$vkCmdSetStencilOpEXT: Invalid commandBuffer [VUID-vkCmdSetStencilOpEXT-commandBuffer-parameter]$vkCmdSetStencilTestEnableEXT: Invalid commandBuffer [VUID-vkCmdSetStencilTestEnableEXT-commandBuffer-parameter]$vkCmdSetViewportWithCountEXT: Invalid commandBuffer [VUID-vkCmdSetViewportWithCountEXT-commandBuffer-parameter]$vkCreateIndirectCommandsLayoutNV: Invalid device [VUID-vkCreateIndirectCommandsLayoutNV-device-parameter]$vkDestroyIndirectCommandsLayoutNV: Invalid device [VUID-vkDestroyIndirectCommandsLayoutNV-device-parameter]$vkReleaseFullScreenExclusiveModeEXT: Invalid device [VUID-vkReleaseFullScreenExclusiveModeEXT-device-parameter]$vkResetQueryPoolEXT: Invalid device [VUID-vkResetQueryPoolEXT-device-parameter]
API String ID: 2325560087-239374435
Opcode ID: a92a97de641d95d8b0b30945e9de9544daffe6d0b59642d1faa1ba378a70f97e
Instruction ID: 820df02618830885365aedaca1881f1ab0c7ac8c31ce468a2ebc9dad3b1e06d9
Opcode Fuzzy Hash: a92a97de641d95d8b0b30945e9de9544daffe6d0b59642d1faa1ba378a70f97e
Instruction Fuzzy Hash: 08128451B0EB5681FF58AB798431E742390EF46B48F984237DA7DCB7DACE2CA5918700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDFF2A8000 Relevance: 25.7, APIs: 9, Strings: 5, Instructions: 1226COMMON

Download Yara Rule

APIs

fegetenv.LIBCMT ref: 00007FFDFF2A804E
_invalid_parameter_noinfo.LIBCMT ref: 00007FFDFF2A86BA
_invalid_parameter_noinfo.LIBCMT ref: 00007FFDFF2A8830
_invalid_parameter_noinfo.LIBCMT ref: 00007FFDFF2A8AEE
_invalid_parameter_noinfo.LIBCMT ref: 00007FFDFF2A8D0E
_invalid_parameter_noinfo.LIBCMT ref: 00007FFDFF2A8F4B
memcpy_s.LIBCPMT ref: 00007FFDFF2A9026
memcpy_s.LIBCPMT ref: 00007FFDFF2A90D1
memcpy_s.LIBCPMT ref: 00007FFDFF2A91A0

Strings

MZx, xrefs: 00007FFDFF2A86DB, 00007FFDFF2A8740, 00007FFDFF2A8AFE, 00007FFDFF2A8BC1, 00007FFDFF2A8C2D, 00007FFDFF2A8F58
1#SNAN, xrefs: 00007FFDFF2A815E
1#QNAN, xrefs: 00007FFDFF2A8167
1#INF, xrefs: 00007FFDFF2A8177
1#IND, xrefs: 00007FFDFF2A813B

Memory Dump Source

Source File: 00000000.00000002.2924661177.00007FFDFF221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFF220000, based on PE: true

Associated: 00000000.00000002.2924538361.00007FFDFF220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924751005.00007FFDFF2BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924794258.00007FFDFF2F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924817209.00007FFDFF2FE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924817209.00007FFDFF307000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924865675.00007FFDFF30C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdff220000_loaddll64.jbxd

Similarity

API ID: _invalid_parameter_noinfo$memcpy_s$fegetenv
String ID: 1#IND$1#INF$1#QNAN$1#SNAN$MZx
API String ID: 808467561-2638907429
Opcode ID: 0864d8761d377ff06162134d18ac48dceeb17a4f5813fe803bb02b078f7f6222
Instruction ID: 23753fb0f1f789d156839be35b6ec9d723e34f518862a35b6c9f8542b9603a66
Opcode Fuzzy Hash: 0864d8761d377ff06162134d18ac48dceeb17a4f5813fe803bb02b078f7f6222
Instruction Fuzzy Hash: 90B2D073B182829BE7648F64D460BFD77A1FB54788F445235DA39DBAC8DB38A900CB44

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDFF2234F0 Relevance: 14.2, APIs: 4, Strings: 4, Instructions: 245COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32 ref: 00007FFDFF22354B
MultiByteToWideChar.KERNEL32 ref: 00007FFDFF2235A3
_fread_nolock.LIBCMT ref: 00007FFDFF2236D5
_fread_nolock.LIBCMT ref: 00007FFDFF22375A

Strings

loader_get_json: Failed to open JSON file %s, xrefs: 00007FFDFF2235BE
loader_get_json: Failed to allocate space for JSON file %s buffer of length %d, xrefs: 00007FFDFF223645
loader_get_json: Failed to parse JSON file %s, this is usually because something ran out of memory., xrefs: 00007FFDFF22387D
loader_get_json: Failed to read JSON file %s., xrefs: 00007FFDFF223771

Memory Dump Source

Source File: 00000000.00000002.2924661177.00007FFDFF221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFF220000, based on PE: true

Associated: 00000000.00000002.2924538361.00007FFDFF220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924751005.00007FFDFF2BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924794258.00007FFDFF2F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924817209.00007FFDFF2FE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924817209.00007FFDFF307000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924865675.00007FFDFF30C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdff220000_loaddll64.jbxd

Similarity

API ID: ByteCharMultiWide_fread_nolock
String ID: loader_get_json: Failed to allocate space for JSON file %s buffer of length %d$loader_get_json: Failed to open JSON file %s$loader_get_json: Failed to parse JSON file %s, this is usually because something ran out of memory.$loader_get_json: Failed to read JSON file %s.
API String ID: 3812296561-2796195209
Opcode ID: eb0bdeff3eb3f2d18b6849f84434333c51a15a1f5077ef218fc57ae1c8bdef7d
Instruction ID: 21f0fb9b9b2639a50e46cb57bf6a4b8771394f0baaa0d81e26a3ba1768037a92
Opcode Fuzzy Hash: eb0bdeff3eb3f2d18b6849f84434333c51a15a1f5077ef218fc57ae1c8bdef7d
Instruction Fuzzy Hash: 25814723F1854281F738AB766462BB61351AF99798F505331DE7DCBBCAEE3C92524B00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDFF2AB294 Relevance: 13.8, APIs: 9, Instructions: 276fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FFDFF2AB748: _invalid_parameter_noinfo.LIBCMT ref: 00007FFDFF2AB789
Part of subcall function 00007FFDFF2AB748: _invalid_parameter_noinfo.LIBCMT ref: 00007FFDFF2AB807
Part of subcall function 00007FFDFF2AB748: _invalid_parameter_noinfo.LIBCMT ref: 00007FFDFF2AB858

CreateFileW.KERNEL32 ref: 00007FFDFF2AB39A
CreateFileW.KERNEL32 ref: 00007FFDFF2AB3EA
GetLastError.KERNEL32 ref: 00007FFDFF2AB41A
GetFileType.KERNEL32 ref: 00007FFDFF2AB42F
GetLastError.KERNEL32 ref: 00007FFDFF2AB439
CloseHandle.KERNEL32 ref: 00007FFDFF2AB46C
CloseHandle.KERNEL32 ref: 00007FFDFF2AB5CF
CreateFileW.KERNEL32 ref: 00007FFDFF2AB604
GetLastError.KERNEL32 ref: 00007FFDFF2AB613

Memory Dump Source

Source File: 00000000.00000002.2924661177.00007FFDFF221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFF220000, based on PE: true

Associated: 00000000.00000002.2924538361.00007FFDFF220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924751005.00007FFDFF2BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924794258.00007FFDFF2F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924817209.00007FFDFF2FE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924817209.00007FFDFF307000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924865675.00007FFDFF30C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdff220000_loaddll64.jbxd

Similarity

API ID: File$CreateErrorLast_invalid_parameter_noinfo$CloseHandle$Type
String ID:
API String ID: 1617910340-0
Opcode ID: 30131b0af599f996b6e997088e329ec7f82c7e5e1fbc0c240dcfa0a14e01c61b
Instruction ID: adff8ac47812668aa8d2fc31c30b3e6002e63c75c0d36f1a4e444d736dbdffec
Opcode Fuzzy Hash: 30131b0af599f996b6e997088e329ec7f82c7e5e1fbc0c240dcfa0a14e01c61b
Instruction Fuzzy Hash: 64C1B037B28A4296EB10CF65C4A0AAC3761EB48B98B015325DA3EDB7E9DF38D155C300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDFF225830 Relevance: 11.7, Strings: 9, Instructions: 416COMMON

Download Yara Rule

Strings

VK_EXT_tooling_info, xrefs: 00007FFDFF225D0C
ICD associated with VkPhysicalDevice does not support GetPhysicalDeviceSurfacePresentModes2EXT, xrefs: 00007FFDFF225A2A
vkGetDeviceGroupSurfacePresentModes2EXT: Invalid pSurfaceInfo pointer [VUID-vkGetDeviceGroupSurfacePresentModes2EXT-pSurfaceInfo-parameter], xrefs: 00007FFDFF225B82
vkGetPhysicalDeviceToolPropertiesEXT: Invalid physicalDevice [VUID-vkGetPhysicalDeviceToolPropertiesEXT-physicalDevice-parameter], xrefs: 00007FFDFF225BE8
ICD "%s" associated with VkPhysicalDevice does not support vkReleaseDisplayEXT - Consequently, the call is invalid because it should not be possible to acquire a display on this device, xrefs: 00007FFDFF2258C5
vkGetPhysicalDeviceSurfacePresentModes2EXT: Invalid physicalDevice [VUID-vkGetPhysicalDeviceSurfacePresentModes2EXT-physicalDevice-parameter], xrefs: 00007FFDFF225918
vkGetDeviceGroupSurfacePresentModes2EXT: Invalid device [VUID-vkGetDeviceGroupSurfacePresentModes2EXT-device-parameter], xrefs: 00007FFDFF225A85
vkGetDeviceGroupSurfacePresentModes2EXT Terminator: Invalid device handle. This is likely the result of a layer wrapping device handles and failing to unwrap them in all functions. [VUID-vkGetDeviceGroupSurfacePresentModes2EXT-device-parameter], xrefs: 00007FFDFF225B8B
vkReleaseDisplayEXT: Invalid physicalDevice [VUID-vkReleaseDisplayEXT-physicalDevice-parameter], xrefs: 00007FFDFF225868

Memory Dump Source

Source File: 00000000.00000002.2924661177.00007FFDFF221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFF220000, based on PE: true

Associated: 00000000.00000002.2924538361.00007FFDFF220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924751005.00007FFDFF2BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924794258.00007FFDFF2F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924817209.00007FFDFF2FE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924817209.00007FFDFF307000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924865675.00007FFDFF30C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdff220000_loaddll64.jbxd

Similarity

API ID:
String ID: ICD "%s" associated with VkPhysicalDevice does not support vkReleaseDisplayEXT - Consequently, the call is invalid because it should not be possible to acquire a display on this device$ICD associated with VkPhysicalDevice does not support GetPhysicalDeviceSurfacePresentModes2EXT$VK_EXT_tooling_info$vkGetDeviceGroupSurfacePresentModes2EXT Terminator: Invalid device handle. This is likely the result of a layer wrapping device handles and failing to unwrap them in all functions. [VUID-vkGetDeviceGroupSurfacePresentModes2EXT-device-parameter]$vkGetDeviceGroupSurfacePresentModes2EXT: Invalid device [VUID-vkGetDeviceGroupSurfacePresentModes2EXT-device-parameter]$vkGetDeviceGroupSurfacePresentModes2EXT: Invalid pSurfaceInfo pointer [VUID-vkGetDeviceGroupSurfacePresentModes2EXT-pSurfaceInfo-parameter]$vkGetPhysicalDeviceSurfacePresentModes2EXT: Invalid physicalDevice [VUID-vkGetPhysicalDeviceSurfacePresentModes2EXT-physicalDevice-parameter]$vkGetPhysicalDeviceToolPropertiesEXT: Invalid physicalDevice [VUID-vkGetPhysicalDeviceToolPropertiesEXT-physicalDevice-parameter]$vkReleaseDisplayEXT: Invalid physicalDevice [VUID-vkReleaseDisplayEXT-physicalDevice-parameter]
API String ID: 0-4260310560
Opcode ID: 5d09a38bbd8c4f016eda6a847f0b10370dabde49c0d53c23b21bdd1d8f4e4292
Instruction ID: 752ade8511805ed5ad09dba519e9b9ca859c31dd3358b217a775ef3d1c9d5034
Opcode Fuzzy Hash: 5d09a38bbd8c4f016eda6a847f0b10370dabde49c0d53c23b21bdd1d8f4e4292
Instruction Fuzzy Hash: 00D1A132B09A5581FB54DF1A9861EA923A0FB49F94F948232DE6DC77D8DE3CD582C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDFF2A04EC Relevance: 10.7, APIs: 7, Instructions: 172COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFDFF29A4C4: GetLastError.KERNEL32(?,?,00000000,00007FFDFF29F9FF,?,?,00000000,00007FFDFF29AC1C,?,?,?,00007FFDFF2822AF,?,?,?,00007FFDFF290387), ref: 00007FFDFF29A4D3
Part of subcall function 00007FFDFF29A4C4: FlsGetValue.KERNEL32(?,?,00000000,00007FFDFF29F9FF,?,?,00000000,00007FFDFF29AC1C,?,?,?,00007FFDFF2822AF,?,?,?,00007FFDFF290387), ref: 00007FFDFF29A4E8
Part of subcall function 00007FFDFF29A4C4: SetLastError.KERNEL32(?,?,00000000,00007FFDFF29F9FF,?,?,00000000,00007FFDFF29AC1C,?,?,?,00007FFDFF2822AF,?,?,?,00007FFDFF290387), ref: 00007FFDFF29A573

Part of subcall function 00007FFDFF29A4C4: FlsSetValue.KERNEL32(?,?,00000000,00007FFDFF29F9FF,?,?,00000000,00007FFDFF29AC1C,?,?,?,00007FFDFF2822AF,?,?,?,00007FFDFF290387), ref: 00007FFDFF29A509

GetUserDefaultLCID.KERNEL32(00000000,00000092,?,?), ref: 00007FFDFF2A065C

Part of subcall function 00007FFDFF29A4C4: FlsSetValue.KERNEL32(?,?,00000000,00007FFDFF29F9FF,?,?,00000000,00007FFDFF29AC1C,?,?,?,00007FFDFF2822AF,?,?,?,00007FFDFF290387), ref: 00007FFDFF29A536
Part of subcall function 00007FFDFF29A4C4: FlsSetValue.KERNEL32(?,?,00000000,00007FFDFF29F9FF,?,?,00000000,00007FFDFF29AC1C,?,?,?,00007FFDFF2822AF,?,?,?,00007FFDFF290387), ref: 00007FFDFF29A547
Part of subcall function 00007FFDFF29A4C4: FlsSetValue.KERNEL32(?,?,00000000,00007FFDFF29F9FF,?,?,00000000,00007FFDFF29AC1C,?,?,?,00007FFDFF2822AF,?,?,?,00007FFDFF290387), ref: 00007FFDFF29A558

EnumSystemLocalesW.KERNEL32(00000000,00000092,?,?,00000000,?,?,00007FFDFF28B999), ref: 00007FFDFF2A0643
ProcessCodePage.LIBCMT ref: 00007FFDFF2A0686
IsValidCodePage.KERNEL32 ref: 00007FFDFF2A0698
IsValidLocale.KERNEL32 ref: 00007FFDFF2A06AE
GetLocaleInfoW.KERNEL32 ref: 00007FFDFF2A070A
GetLocaleInfoW.KERNEL32 ref: 00007FFDFF2A0726

Memory Dump Source

Source File: 00000000.00000002.2924661177.00007FFDFF221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFF220000, based on PE: true

Associated: 00000000.00000002.2924538361.00007FFDFF220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924751005.00007FFDFF2BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924794258.00007FFDFF2F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924817209.00007FFDFF2FE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924817209.00007FFDFF307000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924865675.00007FFDFF30C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdff220000_loaddll64.jbxd

Similarity

API ID: Value$Locale$CodeErrorInfoLastPageValid$DefaultEnumLocalesProcessSystemUser
String ID:
API String ID: 2591520935-0
Opcode ID: b389cb804ebdd4df06c3efddc40f505aedd555c5c6e434f690ee730413dd6373
Instruction ID: 77f4831d3287f098aa99e0f1089566cdd9d354aa1c94f70e50ddae706d8ec917
Opcode Fuzzy Hash: b389cb804ebdd4df06c3efddc40f505aedd555c5c6e434f690ee730413dd6373
Instruction Fuzzy Hash: CC714923F04643A9EB50DB61D860ABC23A4BB44B48F444635CA7DDB7D9EF3CA945C711

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDFF227F30 Relevance: 9.1, APIs: 6, Instructions: 139COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32 ref: 00007FFDFF227D77
MultiByteToWideChar.KERNEL32 ref: 00007FFDFF227DD7
GetEnvironmentVariableW.KERNEL32 ref: 00007FFDFF227DF8
GetEnvironmentVariableW.KERNEL32 ref: 00007FFDFF227E41
WideCharToMultiByte.KERNEL32 ref: 00007FFDFF227E86

Memory Dump Source

Source File: 00000000.00000002.2924661177.00007FFDFF221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFF220000, based on PE: true

Associated: 00000000.00000002.2924538361.00007FFDFF220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924751005.00007FFDFF2BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924794258.00007FFDFF2F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924817209.00007FFDFF2FE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924817209.00007FFDFF307000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924865675.00007FFDFF30C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdff220000_loaddll64.jbxd

Similarity

API ID: ByteCharMultiWide$EnvironmentVariable
String ID:
API String ID: 91125387-0
Opcode ID: e0d391a9fcf90051357c1dbadb4a9db2dbc1d9c09379b68e883e99c35a58e491
Instruction ID: 67e79d87dac1bfbca083936394fc35c9baf191ebc39668154a0a71a74ba5e4e3
Opcode Fuzzy Hash: e0d391a9fcf90051357c1dbadb4a9db2dbc1d9c09379b68e883e99c35a58e491
Instruction Fuzzy Hash: FB410662F2858181F764AB776C22B765391AF987E8F144331DD3DC6BEAEE3C91924700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDFF227D30 Relevance: 9.1, APIs: 6, Instructions: 135COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32 ref: 00007FFDFF227D77
MultiByteToWideChar.KERNEL32 ref: 00007FFDFF227DD7
GetEnvironmentVariableW.KERNEL32 ref: 00007FFDFF227DF8
GetEnvironmentVariableW.KERNEL32 ref: 00007FFDFF227E41
WideCharToMultiByte.KERNEL32 ref: 00007FFDFF227E86
WideCharToMultiByte.KERNEL32 ref: 00007FFDFF227EDA

Memory Dump Source

Source File: 00000000.00000002.2924661177.00007FFDFF221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFF220000, based on PE: true

Associated: 00000000.00000002.2924538361.00007FFDFF220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924751005.00007FFDFF2BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924794258.00007FFDFF2F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924817209.00007FFDFF2FE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924817209.00007FFDFF307000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924865675.00007FFDFF30C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdff220000_loaddll64.jbxd

Similarity

API ID: ByteCharMultiWide$EnvironmentVariable
String ID:
API String ID: 91125387-0
Opcode ID: 756e1d96fcd05fc78ebade323a8fb36e81d60b370346a81c02012c6c5c38cc20
Instruction ID: ba1887eb8b5607c1a8507f57b467566a836808db8ed15d71edfa6d6a10bac765
Opcode Fuzzy Hash: 756e1d96fcd05fc78ebade323a8fb36e81d60b370346a81c02012c6c5c38cc20
Instruction Fuzzy Hash: F0411762F2458181F764AB776C21B755391AF987E8F144331DD3DC6BEADE3C91924700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDFF29C85C Relevance: 9.1, APIs: 6, Instructions: 83COMMON

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00007FFDFF29C8D5
RtlLookupFunctionEntry.KERNEL32 ref: 00007FFDFF29C8ED
RtlVirtualUnwind.KERNEL32 ref: 00007FFDFF29C928
IsDebuggerPresent.KERNEL32 ref: 00007FFDFF29C961
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FFDFF29C96B
UnhandledExceptionFilter.KERNEL32 ref: 00007FFDFF29C976

Memory Dump Source

Source File: 00000000.00000002.2924661177.00007FFDFF221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFF220000, based on PE: true

Associated: 00000000.00000002.2924538361.00007FFDFF220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924751005.00007FFDFF2BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924794258.00007FFDFF2F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924817209.00007FFDFF2FE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924817209.00007FFDFF307000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924865675.00007FFDFF30C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdff220000_loaddll64.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: 43b39515860647d8dfd7d1fab87e030f9bbeb7b3729af778d7fe6040a1a4a100
Instruction ID: 231bffc89f3321f53437402a7d6b8b8c2a2e1206ae621930f25bd52117b4aa03
Opcode Fuzzy Hash: 43b39515860647d8dfd7d1fab87e030f9bbeb7b3729af778d7fe6040a1a4a100
Instruction Fuzzy Hash: 0D314336718B8186E764CF25E8506AD73A4FB88758F500235EABD83B99DF3CD555C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDFF228610 Relevance: 9.1, Strings: 7, Instructions: 304COMMON

Download Yara Rule

Strings

VK_INSTANCE_LAYERS, xrefs: 00007FFDFF228644
env var '%s' defined and adding layers "%s", xrefs: 00007FFDFF2286BE
Layer "%s" ignored because it has been disabled by env var '%s', xrefs: 00007FFDFF2289EC
VK_LOADER_LAYERS_DISABLE, xrefs: 00007FFDFF2289D0
Layer "%s" was not found but was requested by env var VK_INSTANCE_LAYERS!, xrefs: 00007FFDFF228738
Layer "%s" forced enabled due to env var '%s', xrefs: 00007FFDFF228A54
VK_LOADER_LAYERS_ENABLE, xrefs: 00007FFDFF228A38

Memory Dump Source

Source File: 00000000.00000002.2924661177.00007FFDFF221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFF220000, based on PE: true

Associated: 00000000.00000002.2924538361.00007FFDFF220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924751005.00007FFDFF2BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924794258.00007FFDFF2F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924817209.00007FFDFF2FE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924817209.00007FFDFF307000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924865675.00007FFDFF30C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdff220000_loaddll64.jbxd

Similarity

API ID: ByteCharMultiWide$EnvironmentVariable
String ID: Layer "%s" forced enabled due to env var '%s'$Layer "%s" ignored because it has been disabled by env var '%s'$Layer "%s" was not found but was requested by env var VK_INSTANCE_LAYERS!$VK_INSTANCE_LAYERS$VK_LOADER_LAYERS_DISABLE$VK_LOADER_LAYERS_ENABLE$env var '%s' defined and adding layers "%s"
API String ID: 91125387-3385112186
Opcode ID: 94ad51a3ea54c75d454ef16afeb586dae5a2cf060e9e609bd55faa9ff8958fe2
Instruction ID: f3a5e598895c47e4decaff1c5938765eae3afbc79e109f54be1e105f0abebe8a
Opcode Fuzzy Hash: 94ad51a3ea54c75d454ef16afeb586dae5a2cf060e9e609bd55faa9ff8958fe2
Instruction Fuzzy Hash: BEC1D276F1468185FB249F76A8617FA23A0BB09798F544232DE7CD3BDADE38D6418700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDFF2AA5B4 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 135timeCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FFDFF29F490: _invalid_parameter_noinfo.LIBCMT ref: 00007FFDFF29F4C3

_get_daylight.LIBCMT ref: 00007FFDFF2AA662
_get_daylight.LIBCMT ref: 00007FFDFF2AA673
_get_daylight.LIBCMT ref: 00007FFDFF2AA684
GetTimeZoneInformation.KERNEL32(?,?,00000000,00000000,?,00007FFDFF2AAB90), ref: 00007FFDFF2AA6AB

Strings

@, xrefs: 00007FFDFF2AA5FB

Memory Dump Source

Source File: 00000000.00000002.2924661177.00007FFDFF221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFF220000, based on PE: true

Associated: 00000000.00000002.2924538361.00007FFDFF220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924751005.00007FFDFF2BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924794258.00007FFDFF2F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924817209.00007FFDFF2FE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924817209.00007FFDFF307000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924865675.00007FFDFF30C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdff220000_loaddll64.jbxd

Similarity

API ID: _get_daylight$InformationTimeZone_invalid_parameter_noinfo
String ID: @
API String ID: 3482513350-2766056989
Opcode ID: 30f2e726b487e83322b04c240b3fd6d20610cfacb7071e1919aacc7c93ddd9b2
Instruction ID: 88c358f038d8912bfa4f234d16bee20d6ae67f0c9e9c5616bfdc24220559a008
Opcode Fuzzy Hash: 30f2e726b487e83322b04c240b3fd6d20610cfacb7071e1919aacc7c93ddd9b2
Instruction Fuzzy Hash: 19518332B18682D6E710DF25E8A18A96761FF48784F444235EA7DC7BDADF3CE5418B40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDFF241990 Relevance: 6.5, Strings: 5, Instructions: 252COMMON

Download Yara Rule

Strings

Meta-layer "%s" API version %u.%u, component layer "%s" version %u.%u, may have incompatibilities (Policy #LLP_LAYER_8)!, xrefs: 00007FFDFF241B53
Layer "%s" forced disabled because name matches filter of env var '%s'., xrefs: 00007FFDFF241BA6
VK_LOADER_LAYERS_DISABLE, xrefs: 00007FFDFF241B8A
Failed to find layer name "%s" component layer "%s" to activate (Policy #LLP_LAYER_7), xrefs: 00007FFDFF241A79
Meta Layer "%s" component layer "%s" disabled., xrefs: 00007FFDFF241BC7

Memory Dump Source

Source File: 00000000.00000002.2924661177.00007FFDFF221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFF220000, based on PE: true

Associated: 00000000.00000002.2924538361.00007FFDFF220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924751005.00007FFDFF2BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924794258.00007FFDFF2F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924817209.00007FFDFF2FE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924817209.00007FFDFF307000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924865675.00007FFDFF30C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdff220000_loaddll64.jbxd

Similarity

API ID:
String ID: Failed to find layer name "%s" component layer "%s" to activate (Policy #LLP_LAYER_7)$Layer "%s" forced disabled because name matches filter of env var '%s'.$Meta Layer "%s" component layer "%s" disabled.$Meta-layer "%s" API version %u.%u, component layer "%s" version %u.%u, may have incompatibilities (Policy #LLP_LAYER_8)!$VK_LOADER_LAYERS_DISABLE
API String ID: 0-2946974830
Opcode ID: d9246e810cfcd743120633983af25b096571044bed3147c4fcdd317693b02efe
Instruction ID: 95d33d63db4ec0f69af90d242f5d5b91fb67086d48241a051045612478b2ae4f
Opcode Fuzzy Hash: d9246e810cfcd743120633983af25b096571044bed3147c4fcdd317693b02efe
Instruction Fuzzy Hash: CDA1C33270868185E7658B15A420BBAB790EB46B94F440236EEBDC7BDEDFBCD541CB00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDFF2281A0 Relevance: 6.4, Strings: 5, Instructions: 185COMMON

Download Yara Rule

Strings

parse_layers_disable_filter_environment_var: Failed to allocate space for parsing env var 'VK_LAYERS_DISABLE_ENV_VAR', xrefs: 00007FFDFF228267
~explicit~, xrefs: 00007FFDFF228435
VK_LOADER_LAYERS_DISABLE, xrefs: 00007FFDFF2281D8
~implicit~, xrefs: 00007FFDFF228422
~all~, xrefs: 00007FFDFF2283E9

Memory Dump Source

Source File: 00000000.00000002.2924661177.00007FFDFF221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFF220000, based on PE: true

Associated: 00000000.00000002.2924538361.00007FFDFF220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924751005.00007FFDFF2BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924794258.00007FFDFF2F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924817209.00007FFDFF2FE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924817209.00007FFDFF307000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924865675.00007FFDFF30C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdff220000_loaddll64.jbxd

Similarity

API ID: ByteCharMultiWide$EnvironmentVariable
String ID: VK_LOADER_LAYERS_DISABLE$parse_layers_disable_filter_environment_var: Failed to allocate space for parsing env var 'VK_LAYERS_DISABLE_ENV_VAR'$~all~$~explicit~$~implicit~
API String ID: 91125387-3685033191
Opcode ID: 709e55417e8d7e65876a8bdf062af5f298ab1197c5194c5b913827250b223387
Instruction ID: f04fb46e780aa7f00fbaa80c156a70971871b7b06a8f1f6cf085654d0c55393a
Opcode Fuzzy Hash: 709e55417e8d7e65876a8bdf062af5f298ab1197c5194c5b913827250b223387
Instruction Fuzzy Hash: 3E61CE61B1858241FB24D721A835BFA17816F49B94FC89732DE3ECA2CAEE7CE144D210

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDFF2A2618 Relevance: 5.5, APIs: 3, Instructions: 1005COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FFDFF2A2A4E
_get_daylight.LIBCMT ref: 00007FFDFF2A2AE9
_get_daylight.LIBCMT ref: 00007FFDFF2A2B02

Memory Dump Source

Source File: 00000000.00000002.2924661177.00007FFDFF221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFF220000, based on PE: true

Associated: 00000000.00000002.2924538361.00007FFDFF220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924751005.00007FFDFF2BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924794258.00007FFDFF2F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924817209.00007FFDFF2FE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924817209.00007FFDFF307000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924865675.00007FFDFF30C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdff220000_loaddll64.jbxd

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo
String ID:
API String ID: 1286766494-0
Opcode ID: ef6ebfa85aa33ccd5d3fc288b79da82fd906a950c4488f3cfe4f8d6df136ba5e
Instruction ID: 7737ca25a76658cde977cce44ab8e7fb0e129c87f03b9e972021f03bf8a1f5b1
Opcode Fuzzy Hash: ef6ebfa85aa33ccd5d3fc288b79da82fd906a950c4488f3cfe4f8d6df136ba5e
Instruction Fuzzy Hash: F392CD33B0864296E7258F2494A097A37A1FB45B84F148236DAADCBBDDDF7DE914D300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDFF285C50 Relevance: 4.8, APIs: 3, Instructions: 340COMMON

Download Yara Rule

APIs

memcpy_s.LIBCPMT ref: 00007FFDFF285CB6
memcpy_s.LIBCPMT ref: 00007FFDFF285CE1

Memory Dump Source

Source File: 00000000.00000002.2924661177.00007FFDFF221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFF220000, based on PE: true

Associated: 00000000.00000002.2924538361.00007FFDFF220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924751005.00007FFDFF2BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924794258.00007FFDFF2F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924817209.00007FFDFF2FE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924817209.00007FFDFF307000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924865675.00007FFDFF30C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdff220000_loaddll64.jbxd

Similarity

API ID: memcpy_s
String ID:
API String ID: 1502251526-0
Opcode ID: 1a770d0f50c9e6081db329ab1c74fccbac916a2b2593d8212b292b9baeb92a28
Instruction ID: c3b9a67ced55b685410076fa7c3c27e2aac52349941a17799179217c01e1c086
Opcode Fuzzy Hash: 1a770d0f50c9e6081db329ab1c74fccbac916a2b2593d8212b292b9baeb92a28
Instruction Fuzzy Hash: 0BC10572B1828687E724CF15A054A6EBB91F794B94F44C636DB6AC7788DB3DF801CB00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDFF222490 Relevance: 4.1, Strings: 3, Instructions: 398COMMON

Download Yara Rule

Strings

null, xrefs: 00007FFDFF2224A5
true, xrefs: 00007FFDFF2224D7
false, xrefs: 00007FFDFF2224BE

Memory Dump Source

Source File: 00000000.00000002.2924661177.00007FFDFF221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFF220000, based on PE: true

Associated: 00000000.00000002.2924538361.00007FFDFF220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924751005.00007FFDFF2BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924794258.00007FFDFF2F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924817209.00007FFDFF2FE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924817209.00007FFDFF307000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924865675.00007FFDFF30C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdff220000_loaddll64.jbxd

Similarity

API ID:
String ID: false$null$true
API String ID: 0-2913297407
Opcode ID: a2e097f99ca4be0baac10f25123e993d998a9191062ba5a107f408024870c752
Instruction ID: ace8288afa51b8850f00ae20e4e32413a249587fb47a590ce9cfdabc09abf21f
Opcode Fuzzy Hash: a2e097f99ca4be0baac10f25123e993d998a9191062ba5a107f408024870c752
Instruction Fuzzy Hash: 1AE1F712F0C68242FB658A154530BB96791AF95B90FD59330CEBDC63D9DFAEE5928300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDFF29D4EC Relevance: 3.9, Strings: 3, Instructions: 195COMMON

Download Yara Rule

Strings

gfff, xrefs: 00007FFDFF29D676
-, xrefs: 00007FFDFF29D72F
e+000, xrefs: 00007FFDFF29D5F9

Memory Dump Source

Source File: 00000000.00000002.2924661177.00007FFDFF221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFF220000, based on PE: true

Associated: 00000000.00000002.2924538361.00007FFDFF220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924751005.00007FFDFF2BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924794258.00007FFDFF2F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924817209.00007FFDFF2FE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924817209.00007FFDFF307000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924865675.00007FFDFF30C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdff220000_loaddll64.jbxd

Similarity

API ID:
String ID: -$e+000$gfff
API String ID: 0-2620144452
Opcode ID: 1f82757e05d9b544845f10cbc1f8dc8cc3ef7b21b1ff864a325851eff725c646
Instruction ID: e63e666206be8affbeb0b64e0aa7e5d65e5f261ab79dfa5f1d007b9e0445fda0
Opcode Fuzzy Hash: 1f82757e05d9b544845f10cbc1f8dc8cc3ef7b21b1ff864a325851eff725c646
Instruction Fuzzy Hash: BB71F032B1878586E7208F25A810B6977A1F744B98F588335DABCCBBD9DF3DD4419B00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDFF29AF84 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 37COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,?,?,?,?,00007FFDFF28BB72), ref: 00007FFDFF29AFF8

Strings

GetLocaleInfoEx, xrefs: 00007FFDFF29AFA0, 00007FFDFF29AFB1

Memory Dump Source

Source File: 00000000.00000002.2924661177.00007FFDFF221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFF220000, based on PE: true

Associated: 00000000.00000002.2924538361.00007FFDFF220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924751005.00007FFDFF2BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924794258.00007FFDFF2F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924817209.00007FFDFF2FE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924817209.00007FFDFF307000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924865675.00007FFDFF30C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdff220000_loaddll64.jbxd

Similarity

API ID: InfoLocale
String ID: GetLocaleInfoEx
API String ID: 2299586839-2904428671
Opcode ID: 8d04ab10dbeea1318364e937e2424577d64eb620bc1350f66ae35f8cd8dace78
Instruction ID: c7f0cadfb6412602ccf34577b3f05d34bfc5468d43f77dbbb5b91a1359595c4d
Opcode Fuzzy Hash: 8d04ab10dbeea1318364e937e2424577d64eb620bc1350f66ae35f8cd8dace78
Instruction Fuzzy Hash: 0E01A720B0874185E7109B56B4509AAA760EF84BD4F588136DF7DC7BFDCE3CD6458740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDFF2A3504 Relevance: 2.9, Strings: 2, Instructions: 358COMMON

Download Yara Rule

Strings

a/p, xrefs: 00007FFDFF2A381E
am/pm, xrefs: 00007FFDFF2A37B3

Memory Dump Source

Source File: 00000000.00000002.2924661177.00007FFDFF221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFF220000, based on PE: true

Associated: 00000000.00000002.2924538361.00007FFDFF220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924751005.00007FFDFF2BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924794258.00007FFDFF2F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924817209.00007FFDFF2FE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924817209.00007FFDFF307000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924865675.00007FFDFF30C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdff220000_loaddll64.jbxd

Similarity

API ID:
String ID: a/p$am/pm
API String ID: 0-3206640213
Opcode ID: 47a0266881d2106c43db8d46b09a19883fcae7d5e655427111c0a15e450823fd
Instruction ID: 2b41f740e18a3f13775f6f0b7307deef63ce43f8bb029dfd3a094d5b48e988e7
Opcode Fuzzy Hash: 47a0266881d2106c43db8d46b09a19883fcae7d5e655427111c0a15e450823fd
Instruction Fuzzy Hash: DFE1AE23F08642A5E7648E1495A5EB863A0FF15784F544232EA7EEB6D8DF3EED44C301

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDFF2A07EC Relevance: 1.6, APIs: 1, Instructions: 61COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFDFF29A4C4: GetLastError.KERNEL32(?,?,00000000,00007FFDFF29F9FF,?,?,00000000,00007FFDFF29AC1C,?,?,?,00007FFDFF2822AF,?,?,?,00007FFDFF290387), ref: 00007FFDFF29A4D3
Part of subcall function 00007FFDFF29A4C4: FlsGetValue.KERNEL32(?,?,00000000,00007FFDFF29F9FF,?,?,00000000,00007FFDFF29AC1C,?,?,?,00007FFDFF2822AF,?,?,?,00007FFDFF290387), ref: 00007FFDFF29A4E8
Part of subcall function 00007FFDFF29A4C4: SetLastError.KERNEL32(?,?,00000000,00007FFDFF29F9FF,?,?,00000000,00007FFDFF29AC1C,?,?,?,00007FFDFF2822AF,?,?,?,00007FFDFF290387), ref: 00007FFDFF29A573

EnumSystemLocalesW.KERNEL32(?,?,?,00007FFDFF2A05EF,00000000,00000092,?,?,00000000,?,?,00007FFDFF28B999), ref: 00007FFDFF2A088A

Memory Dump Source

Source File: 00000000.00000002.2924661177.00007FFDFF221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFF220000, based on PE: true

Associated: 00000000.00000002.2924538361.00007FFDFF220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924751005.00007FFDFF2BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924794258.00007FFDFF2F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924817209.00007FFDFF2FE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924817209.00007FFDFF307000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924865675.00007FFDFF30C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdff220000_loaddll64.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystemValue
String ID:
API String ID: 3029459697-0
Opcode ID: a223d5c5b5275852db72347a930bd4240cc7e4bfc39e93d694eb5f775f581936
Instruction ID: 21dc9a112b8007d85920e10580152bdf31d15c4e9b765b63c86effbc31b8f264
Opcode Fuzzy Hash: a223d5c5b5275852db72347a930bd4240cc7e4bfc39e93d694eb5f775f581936
Instruction Fuzzy Hash: B911D263F08646DAEB14CF15D090AA87BA0FB90BE0F448235C679C73C8DA68E5D1C780

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDFF2A0B08 Relevance: 1.5, APIs: 1, Instructions: 41COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFDFF29A4C4: GetLastError.KERNEL32(?,?,00000000,00007FFDFF29F9FF,?,?,00000000,00007FFDFF29AC1C,?,?,?,00007FFDFF2822AF,?,?,?,00007FFDFF290387), ref: 00007FFDFF29A4D3
Part of subcall function 00007FFDFF29A4C4: FlsGetValue.KERNEL32(?,?,00000000,00007FFDFF29F9FF,?,?,00000000,00007FFDFF29AC1C,?,?,?,00007FFDFF2822AF,?,?,?,00007FFDFF290387), ref: 00007FFDFF29A4E8
Part of subcall function 00007FFDFF29A4C4: SetLastError.KERNEL32(?,?,00000000,00007FFDFF29F9FF,?,?,00000000,00007FFDFF29AC1C,?,?,?,00007FFDFF2822AF,?,?,?,00007FFDFF290387), ref: 00007FFDFF29A573

EnumSystemLocalesW.KERNEL32(?,?,?,00007FFDFF2A05AB,00000000,00000092,?,?,00000000,?,?,00007FFDFF28B999), ref: 00007FFDFF2A0B86

Memory Dump Source

Source File: 00000000.00000002.2924661177.00007FFDFF221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFF220000, based on PE: true

Associated: 00000000.00000002.2924538361.00007FFDFF220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924751005.00007FFDFF2BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924794258.00007FFDFF2F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924817209.00007FFDFF2FE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924817209.00007FFDFF307000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924865675.00007FFDFF30C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdff220000_loaddll64.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystemValue
String ID:
API String ID: 3029459697-0
Opcode ID: 4a82a38936335ba0a66a5866fdded4b29bcf054ce54b31a551c39ef21ed99c17
Instruction ID: bc27a7b0cb838e66df079493369bcf2893ce7051d2994ea93babfc7250a05994
Opcode Fuzzy Hash: 4a82a38936335ba0a66a5866fdded4b29bcf054ce54b31a551c39ef21ed99c17
Instruction Fuzzy Hash: 96019263F0824696E7108F15E570BA977A1EB54BA8F459331D67ACB3C8DF6894818700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDFF29B7B8 Relevance: 1.5, APIs: 1, Instructions: 32COMMON

Download Yara Rule

APIs

EnumSystemLocalesW.KERNEL32(?,?,00000000,00007FFDFF29AE93,?,?,?,?,?,?,?,?,00000000,00007FFDFF2A0214), ref: 00007FFDFF29B807

Memory Dump Source

Source File: 00000000.00000002.2924661177.00007FFDFF221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFF220000, based on PE: true

Associated: 00000000.00000002.2924538361.00007FFDFF220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924751005.00007FFDFF2BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924794258.00007FFDFF2F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924817209.00007FFDFF2FE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924817209.00007FFDFF307000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924865675.00007FFDFF30C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdff220000_loaddll64.jbxd

Similarity

API ID: EnumLocalesSystem
String ID:
API String ID: 2099609381-0
Opcode ID: 1fcd2dd32a63798af67355fa3b24fc0584e96b67de5b437395b4a300747efc36
Instruction ID: 4d0bf02949d0f70e117bdf622a588bdd65862438c3a692b3f35b9aeeafbad4c8
Opcode Fuzzy Hash: 1fcd2dd32a63798af67355fa3b24fc0584e96b67de5b437395b4a300747efc36
Instruction Fuzzy Hash: B5F06976B18A8582E714DB15F8A09A93361FB98B80F548235DA3DC33B8DE3CD5908700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDFF29D8E4 Relevance: 1.5, Strings: 1, Instructions: 254COMMON

Download Yara Rule

Strings

gfffffff, xrefs: 00007FFDFF29DC26

Memory Dump Source

Source File: 00000000.00000002.2924661177.00007FFDFF221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFF220000, based on PE: true

Associated: 00000000.00000002.2924538361.00007FFDFF220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924751005.00007FFDFF2BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924794258.00007FFDFF2F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924817209.00007FFDFF2FE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924817209.00007FFDFF307000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924865675.00007FFDFF30C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdff220000_loaddll64.jbxd

Similarity

API ID:
String ID: gfffffff
API String ID: 0-1523873471
Opcode ID: e6e5690fb70cd2f1f843bbdca14745086465f4459325480fe67479074bdf2d7d
Instruction ID: 3f92e045f61ff37e63ef10d4531cf6c8e07f821c6b93e65fe432f91f9a392484
Opcode Fuzzy Hash: e6e5690fb70cd2f1f843bbdca14745086465f4459325480fe67479074bdf2d7d
Instruction Fuzzy Hash: 91A13762B0D78586EB31CB25A030BA97791EB51B88F448231DABDC77C9EE3DD501E701

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDFF222620 Relevance: 1.5, Strings: 1, Instructions: 234COMMON

Download Yara Rule

Strings

, xrefs: 00007FFDFF222E0D

Memory Dump Source

Source File: 00000000.00000002.2924661177.00007FFDFF221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFF220000, based on PE: true

Associated: 00000000.00000002.2924538361.00007FFDFF220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924751005.00007FFDFF2BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924794258.00007FFDFF2F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924817209.00007FFDFF2FE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924817209.00007FFDFF307000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924865675.00007FFDFF30C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdff220000_loaddll64.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: e185d6654c5bd0963836f54c68892c3f3b73cf15f800ffa13d027394874171c1
Instruction ID: d5811fa94ccd07cf5fc0dd8ea1f8184bd577a869b05317f802dde7583b298c86
Opcode Fuzzy Hash: e185d6654c5bd0963836f54c68892c3f3b73cf15f800ffa13d027394874171c1
Instruction Fuzzy Hash: B581CD22B1A61182FB259E169424F7A6B90BF45BD4F894634DE3DC73D9EFBEE0018300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDFF227F50 Relevance: 1.4, Strings: 1, Instructions: 160COMMON

Download Yara Rule

Strings

parse_generic_filter_environment_var: Failed to allocate space for parsing env var '%s', xrefs: 00007FFDFF228023

Memory Dump Source

Source File: 00000000.00000002.2924661177.00007FFDFF221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFF220000, based on PE: true

Associated: 00000000.00000002.2924538361.00007FFDFF220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924751005.00007FFDFF2BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924794258.00007FFDFF2F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924817209.00007FFDFF2FE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924817209.00007FFDFF307000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924865675.00007FFDFF30C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdff220000_loaddll64.jbxd

Similarity

API ID: ByteCharMultiWide$EnvironmentVariable
String ID: parse_generic_filter_environment_var: Failed to allocate space for parsing env var '%s'
API String ID: 91125387-3626846036
Opcode ID: 24a092dde7f80ca8d3594466686b8e3eddfe9e337b33af3d3922dcf50fe88906
Instruction ID: a6e564e313a3e77c4ec616a7131352e6bdb93c18000e4717c5a81bf117d9d7c0
Opcode Fuzzy Hash: 24a092dde7f80ca8d3594466686b8e3eddfe9e337b33af3d3922dcf50fe88906
Instruction Fuzzy Hash: 76510762B1C24145FB249B219825BFA2780AF45BD4F884336DE3ECB3CADE7CE2449344

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDFF222613 Relevance: .4, Instructions: 440COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2924661177.00007FFDFF221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFF220000, based on PE: true

Associated: 00000000.00000002.2924538361.00007FFDFF220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924751005.00007FFDFF2BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924794258.00007FFDFF2F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924817209.00007FFDFF2FE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924817209.00007FFDFF307000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924865675.00007FFDFF30C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdff220000_loaddll64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5afd9c479b65d332a9d29b3505c3174d145d674aee0159a2e0df896b2a6f2198
Instruction ID: af24dde8ce64e8deabf1a5d7c3f642473fef1de22c713ebc14839747271f26c5
Opcode Fuzzy Hash: 5afd9c479b65d332a9d29b3505c3174d145d674aee0159a2e0df896b2a6f2198
Instruction Fuzzy Hash: A702DD22B1969282FB208F169460B6A6794EF84BD4F854635DE7EC37C9EF7DE9018700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDFF2829D0 Relevance: .4, Instructions: 351COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2924661177.00007FFDFF221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFF220000, based on PE: true

Associated: 00000000.00000002.2924538361.00007FFDFF220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924751005.00007FFDFF2BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924794258.00007FFDFF2F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924817209.00007FFDFF2FE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924817209.00007FFDFF307000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924865675.00007FFDFF30C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdff220000_loaddll64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa7af5f43f8e51451141f2e20c5a6020d333a07cfd4d7f7a994b334252badd89
Instruction ID: 628a17919e7863acb65d4a29c6214b6c73caea04a77d0a98f6df852aa42a1e97
Opcode Fuzzy Hash: aa7af5f43f8e51451141f2e20c5a6020d333a07cfd4d7f7a994b334252badd89
Instruction Fuzzy Hash: D2E1AE72B0860285E7688A28C578B7D2791EF45B54F18CB36CA3DDA6DDCFB9E841C350

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDFF28B7E8 Relevance: .3, Instructions: 339COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2924661177.00007FFDFF221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFF220000, based on PE: true

Associated: 00000000.00000002.2924538361.00007FFDFF220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924751005.00007FFDFF2BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924794258.00007FFDFF2F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924817209.00007FFDFF2FE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924817209.00007FFDFF307000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924865675.00007FFDFF30C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdff220000_loaddll64.jbxd

Similarity

API ID: ErrorLastNameTranslate$CodePageValidValue_invalid_parameter_noinfo
String ID:
API String ID: 4023145424-0
Opcode ID: 17473de9ea127c9980f7c8e3d056c0e343dbd20dec12ac9e1aa60466b6f03884
Instruction ID: 8b7deb77667950df3fe9fc348a14eb12ad7a2780930f8a7472f81bb8dccc1794
Opcode Fuzzy Hash: 17473de9ea127c9980f7c8e3d056c0e343dbd20dec12ac9e1aa60466b6f03884
Instruction Fuzzy Hash: E9D1B866B0868285E7609B65D820BBE27A0FB84788F44863ADE7DC76EDDF3CD545C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDFF283A58 Relevance: .3, Instructions: 327COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2924661177.00007FFDFF221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFF220000, based on PE: true

Associated: 00000000.00000002.2924538361.00007FFDFF220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924751005.00007FFDFF2BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924794258.00007FFDFF2F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924817209.00007FFDFF2FE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924817209.00007FFDFF307000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924865675.00007FFDFF30C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdff220000_loaddll64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05b27c9d620e7296983b3df4bbc82e2464ad3deacd73f58bf869d63c83ae93de
Instruction ID: c75b5570cae39248af8d9a0a3af5479876c2264ead452db081d228b934bcf538
Opcode Fuzzy Hash: 05b27c9d620e7296983b3df4bbc82e2464ad3deacd73f58bf869d63c83ae93de
Instruction Fuzzy Hash: 48D18562B0864285E7688A25C4B0A7D27A0AF45B48F1C8B36CE7DE76D9DF3DDC55C340

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDFF282420 Relevance: .2, Instructions: 250COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2924661177.00007FFDFF221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFF220000, based on PE: true

Associated: 00000000.00000002.2924538361.00007FFDFF220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924751005.00007FFDFF2BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924794258.00007FFDFF2F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924817209.00007FFDFF2FE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924817209.00007FFDFF307000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924865675.00007FFDFF30C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdff220000_loaddll64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 377b07c898fd7b4eaf577047f65da30f9ff3c7ad5acd3d9ead0e0927dddd6cac
Instruction ID: 27d85f2cf1a61e04af71c7e45ebeb2068d4c4c49b1c4871ba4480a02acd978f0
Opcode Fuzzy Hash: 377b07c898fd7b4eaf577047f65da30f9ff3c7ad5acd3d9ead0e0927dddd6cac
Instruction Fuzzy Hash: 01B19E72B0865586E7648F29C060A3D3BA0EB46B48F149636CA7EC73DDCFB9E440C711

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDFF2834C0 Relevance: .2, Instructions: 241COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2924661177.00007FFDFF221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFF220000, based on PE: true

Associated: 00000000.00000002.2924538361.00007FFDFF220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924751005.00007FFDFF2BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924794258.00007FFDFF2F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924817209.00007FFDFF2FE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924817209.00007FFDFF307000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924865675.00007FFDFF30C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdff220000_loaddll64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b5bbd047a36b89562fab9d560add7da9865760e45eebbf064ac33053bcb32c3a
Instruction ID: 984a08cefea2582e9bdfa43997ea0d4ebad00e217413d24c0150e80c2dd870e0
Opcode Fuzzy Hash: b5bbd047a36b89562fab9d560add7da9865760e45eebbf064ac33053bcb32c3a
Instruction Fuzzy Hash: 14B16D72A0879585E7648F29C0A463D3BA0E749B48F288B36CA6ED73D9CF39D841C745

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDFF294C28 Relevance: .2, Instructions: 205COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2924661177.00007FFDFF221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFF220000, based on PE: true

Associated: 00000000.00000002.2924538361.00007FFDFF220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924751005.00007FFDFF2BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924794258.00007FFDFF2F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924817209.00007FFDFF2FE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924817209.00007FFDFF307000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924865675.00007FFDFF30C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdff220000_loaddll64.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 7ef47b174ce97ac485c95a28e4f8b8ec9c44e4e38a6d9134eeae6b573c0c6f73
Instruction ID: edad3e1085b4be8e4b5fe283aaa903274bbfdeb9d74a2086aac114dd877c4586
Opcode Fuzzy Hash: 7ef47b174ce97ac485c95a28e4f8b8ec9c44e4e38a6d9134eeae6b573c0c6f73
Instruction Fuzzy Hash: 1B816C22B05A5182EB64DE29D4A5B7923A0FB84B98F148736EE7EC77D9CF39D041D300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDFF29D204 Relevance: .2, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2924661177.00007FFDFF221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFF220000, based on PE: true

Associated: 00000000.00000002.2924538361.00007FFDFF220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924751005.00007FFDFF2BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924794258.00007FFDFF2F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924817209.00007FFDFF2FE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924817209.00007FFDFF307000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924865675.00007FFDFF30C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdff220000_loaddll64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6cdce1c0042cc829c08694b7dbfa95e65a8e62209a31982410496e32b84eebcb
Instruction ID: 51a7612dc61815a4ca5eb0b6244ab1c770bdc724a3697e22f968b1b44c2e524e
Opcode Fuzzy Hash: 6cdce1c0042cc829c08694b7dbfa95e65a8e62209a31982410496e32b84eebcb
Instruction Fuzzy Hash: 6981A572B0868186D774CF19A460B69A790FB45798F944339DAFDC7BD9EE3CE400AB00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDFF2ABA14 Relevance: .2, Instructions: 183COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2924661177.00007FFDFF221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFF220000, based on PE: true

Associated: 00000000.00000002.2924538361.00007FFDFF220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924751005.00007FFDFF2BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924794258.00007FFDFF2F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924817209.00007FFDFF2FE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924817209.00007FFDFF307000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924865675.00007FFDFF30C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdff220000_loaddll64.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 51dd60c6b0bffe6307a9def54d45411e0abcd99a32e06e15e4f89c32e8ea47c4
Instruction ID: d8032a2b625d720606e81240ec44fa5a27a57a9ba9859b864c57f65a67fcac23
Opcode Fuzzy Hash: 51dd60c6b0bffe6307a9def54d45411e0abcd99a32e06e15e4f89c32e8ea47c4
Instruction Fuzzy Hash: 9B619223F1829266FB658A2894B4E7D6781BF50760F144735DA3DCEAEDEE6DE840C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDFF284804 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2924661177.00007FFDFF221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFF220000, based on PE: true

Associated: 00000000.00000002.2924538361.00007FFDFF220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924751005.00007FFDFF2BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924794258.00007FFDFF2F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924817209.00007FFDFF2FE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924817209.00007FFDFF307000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924865675.00007FFDFF30C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdff220000_loaddll64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9facbfb16090b4c3ef9b9707116871a52312dcf35b5ef93a1c89335e964d8522
Instruction ID: f40358614c9c5459b28265fc8fef7bc03794817456a6ccf8627c11e99d95b172
Opcode Fuzzy Hash: 9facbfb16090b4c3ef9b9707116871a52312dcf35b5ef93a1c89335e964d8522
Instruction Fuzzy Hash: 66516A76B1869187E7348B29C49473C37A0EB44B58F248632CE6DD77D9CB3AE952C740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDFF284E10 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2924661177.00007FFDFF221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFF220000, based on PE: true

Associated: 00000000.00000002.2924538361.00007FFDFF220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924751005.00007FFDFF2BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924794258.00007FFDFF2F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924817209.00007FFDFF2FE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924817209.00007FFDFF307000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924865675.00007FFDFF30C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdff220000_loaddll64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e605d247d8ad643fc844f6f6de7e0a51e25e3fd7db6dbea84394ca03e4495203
Instruction ID: a136e1c64a64a2b69cbfb740caeda8d2d6e2a4375e554ea6c2182398988f52f8
Opcode Fuzzy Hash: e605d247d8ad643fc844f6f6de7e0a51e25e3fd7db6dbea84394ca03e4495203
Instruction Fuzzy Hash: E2516136B1865187E7248B29C0A4A3C37A1EB54B58F248636DE6DD77DCCF3AE852C740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDFF284600 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2924661177.00007FFDFF221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFF220000, based on PE: true

Associated: 00000000.00000002.2924538361.00007FFDFF220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924751005.00007FFDFF2BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924794258.00007FFDFF2F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924817209.00007FFDFF2FE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924817209.00007FFDFF307000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924865675.00007FFDFF30C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdff220000_loaddll64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 869f8b68312d7f00acf28102a5c50f6fd0ca47537f0d1e2ecd08b31f74345a38
Instruction ID: 143513188f7dec19b06897794a5a8bdba62374897d5803e998876ea38e888aed
Opcode Fuzzy Hash: 869f8b68312d7f00acf28102a5c50f6fd0ca47537f0d1e2ecd08b31f74345a38
Instruction Fuzzy Hash: 5C516836B1466187E7248B29C0A0A3C27A0EB45F58F258632CE6DD77DDCF3AE852C740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDFF284C0C Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2924661177.00007FFDFF221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFF220000, based on PE: true

Associated: 00000000.00000002.2924538361.00007FFDFF220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924751005.00007FFDFF2BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924794258.00007FFDFF2F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924817209.00007FFDFF2FE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924817209.00007FFDFF307000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924865675.00007FFDFF30C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdff220000_loaddll64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 58f535c9898a0e3619f52b763fdd91a9a4cff7162ebf7b3c1911ac73238f233d
Instruction ID: 2fd8bcca3baaced30a4471434ceb80e752f77d6f072216d7146481eb2c38dd79
Opcode Fuzzy Hash: 58f535c9898a0e3619f52b763fdd91a9a4cff7162ebf7b3c1911ac73238f233d
Instruction Fuzzy Hash: 96514276B1965186E7248B29C0A0A2C27A4EB54B58F24C633CE6DD77D9CB3AE853C740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDFF2843FC Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2924661177.00007FFDFF221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFF220000, based on PE: true

Associated: 00000000.00000002.2924538361.00007FFDFF220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924751005.00007FFDFF2BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924794258.00007FFDFF2F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924817209.00007FFDFF2FE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924817209.00007FFDFF307000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924865675.00007FFDFF30C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdff220000_loaddll64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a45b2afdb5adcbd47fd8121981e7574c9ec5f000d46a8791f9b014900ad8a3c
Instruction ID: 1d479c2447c260cc4828e70a225a4966d10f7b793e9f2d3f966f1394e2133b51
Opcode Fuzzy Hash: 8a45b2afdb5adcbd47fd8121981e7574c9ec5f000d46a8791f9b014900ad8a3c
Instruction Fuzzy Hash: AB514376B1865187E7248B29C0A0A3C27A0EB55B58F24C632DA6DD77DCCB3EE853C740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDFF284A08 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2924661177.00007FFDFF221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFF220000, based on PE: true

Associated: 00000000.00000002.2924538361.00007FFDFF220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924751005.00007FFDFF2BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924794258.00007FFDFF2F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924817209.00007FFDFF2FE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924817209.00007FFDFF307000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924865675.00007FFDFF30C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdff220000_loaddll64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b290a9d382abb998b6b1288de9fa3e457f7af4d254bc4cb7944553ff80b1f889
Instruction ID: 773c1978a6dbebc84af917b0d69a7143428b1a0310b36a23732d54ac16cc41aa
Opcode Fuzzy Hash: b290a9d382abb998b6b1288de9fa3e457f7af4d254bc4cb7944553ff80b1f889
Instruction Fuzzy Hash: 1E515536B1865187E7248B19C0B072D27A4EB54B58F348632CA6CDB7D9DB3AE852C784

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDFF295740 Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2924661177.00007FFDFF221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFF220000, based on PE: true

Associated: 00000000.00000002.2924538361.00007FFDFF220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924751005.00007FFDFF2BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924794258.00007FFDFF2F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924817209.00007FFDFF2FE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924817209.00007FFDFF307000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924865675.00007FFDFF30C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdff220000_loaddll64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e13b74b0b529d91a8ac9ee6727b9f2d590474870fceb05c3e17ea5803dfc50d
Instruction ID: 1b548d1e1899c223e4bceb2c7e16fada6ee826127fb6e7b4cd776472b1477a69
Opcode Fuzzy Hash: 7e13b74b0b529d91a8ac9ee6727b9f2d590474870fceb05c3e17ea5803dfc50d
Instruction Fuzzy Hash: BB418652B0A78A44EB7589184535EF417C0BF12FA8D685374DDBDD37CECA0C6AC69301

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDFF28D3B4 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2924661177.00007FFDFF221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFF220000, based on PE: true

Associated: 00000000.00000002.2924538361.00007FFDFF220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924751005.00007FFDFF2BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924794258.00007FFDFF2F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924817209.00007FFDFF2FE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924817209.00007FFDFF307000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924865675.00007FFDFF30C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdff220000_loaddll64.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: ba614506ea72de7b26c3c53c394573dd81260d0d3936fe42649905d0d2a4148d
Instruction ID: ca68b3af5ad33b95519fc63804072eb010f7bdba7589e1659ecb4301853838dc
Opcode Fuzzy Hash: ba614506ea72de7b26c3c53c394573dd81260d0d3936fe42649905d0d2a4148d
Instruction Fuzzy Hash: 64410672714A5582EF08CF2AD9249A973A1AB48FE4B49D137DE2DD7B9CDE3CD0458300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDFF2219B0 Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2924661177.00007FFDFF221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFF220000, based on PE: true

Associated: 00000000.00000002.2924538361.00007FFDFF220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924751005.00007FFDFF2BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924794258.00007FFDFF2F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924817209.00007FFDFF2FE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924817209.00007FFDFF307000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924865675.00007FFDFF30C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdff220000_loaddll64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d74e26640ddbf34650e12ac84ed1397349d424b454de5e0bfc79576bff8bab2
Instruction ID: ad17709fb60be4e86aaae3d9f4c22bea82ecad57dcd32f400484724ed27a6674
Opcode Fuzzy Hash: 1d74e26640ddbf34650e12ac84ed1397349d424b454de5e0bfc79576bff8bab2
Instruction Fuzzy Hash: 8A412822F18AC20AE3268A349561E7B67139F52790F908333EA77E55E9DF2C6192C200

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDFF24C070 Relevance: 21.2, APIs: 3, Strings: 9, Instructions: 248COMMON

Download Yara Rule

APIs

OutputDebugStringA.KERNEL32 ref: 00007FFDFF24C471
OutputDebugStringA.KERNEL32 ref: 00007FFDFF24C476
OutputDebugStringA.KERNEL32 ref: 00007FFDFF24C47F

Strings

| , xrefs: 00007FFDFF24C301, 00007FFDFF24C351, 00007FFDFF24C3A1
, xrefs: 00007FFDFF24C40D
LAYER, xrefs: 00007FFDFF24C3C6
DRIVER, xrefs: 00007FFDFF24C376
Loader Message, xrefs: 00007FFDFF24C1BD
PERF, xrefs: 00007FFDFF24C326
ERRO, xrefs: 00007FFDFF24C2F5
R, xrefs: 00007FFDFF24C2DA
WARNING, xrefs: 00007FFDFF24C2B2

Memory Dump Source

Source File: 00000000.00000002.2924661177.00007FFDFF221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFF220000, based on PE: true

Associated: 00000000.00000002.2924538361.00007FFDFF220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924751005.00007FFDFF2BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924794258.00007FFDFF2F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924817209.00007FFDFF2FE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924817209.00007FFDFF307000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924865675.00007FFDFF30C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdff220000_loaddll64.jbxd

Similarity

API ID: DebugOutputString
String ID: $ | $DRIVER$ERRO$LAYER$Loader Message$PERF$R$WARNING
API String ID: 1166629820-2709638948
Opcode ID: 8834b5f0ed476774e6dceba6e207bcf24c8c581eed3c68b34a742d96ba8169dc
Instruction ID: 0f00e4348593ba43458c5d05af0cdde6a5335518c7c7f3f254119954b57fe13b
Opcode Fuzzy Hash: 8834b5f0ed476774e6dceba6e207bcf24c8c581eed3c68b34a742d96ba8169dc
Instruction Fuzzy Hash: 8CB1AF72B0878696F7609B18E525BE9A7A1EF90794F400236DA7CC76DAEF7CD241C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDFF29B5BC Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 117libraryloaderCOMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,?,00000000,00007FFDFF29E377,?,?,00000003,00007FFDFF28B1C1,?,?,?,?,00007FFDFF28B1E9,?,?,00000003), ref: 00007FFDFF29B738
GetProcAddress.KERNEL32(?,?,00000000,00007FFDFF29E377,?,?,00000003,00007FFDFF28B1C1,?,?,?,?,00007FFDFF28B1E9,?,?,00000003), ref: 00007FFDFF29B744

Strings

ext-ms-, xrefs: 00007FFDFF29B695
MZx, xrefs: 00007FFDFF29B5DB, 00007FFDFF29B6C1, 00007FFDFF29B721
api-ms-, xrefs: 00007FFDFF29B682

Memory Dump Source

Source File: 00000000.00000002.2924661177.00007FFDFF221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFF220000, based on PE: true

Associated: 00000000.00000002.2924538361.00007FFDFF220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924751005.00007FFDFF2BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924794258.00007FFDFF2F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924817209.00007FFDFF2FE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924817209.00007FFDFF307000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924865675.00007FFDFF30C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdff220000_loaddll64.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: MZx$api-ms-$ext-ms-
API String ID: 3013587201-2431898299
Opcode ID: 17db1a87dc4499d5258352f7d4679ad0c6d5c283d53f224883f5f021f21eb4fd
Instruction ID: 95e72f9da036910d94f6314db4def032c7a6f57a946e70684b918fe197591f71
Opcode Fuzzy Hash: 17db1a87dc4499d5258352f7d4679ad0c6d5c283d53f224883f5f021f21eb4fd
Instruction Fuzzy Hash: 3441E022B19A4681FB269B169820DB92391BF45BA4F49433ADD3DC77ECDE3CE6059300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDFF2A7364 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 88libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,?,00000000,00007FFDFF2A728B,?,?,?,00007FFDFF296716,?,?,?,00007FFDFF2966D1), ref: 00007FFDFF2A73E9
GetLastError.KERNEL32(?,?,?,00007FFDFF296716,?,?,?,00007FFDFF2966D1,?,?,?,?,00007FFDFF27F27A), ref: 00007FFDFF2A73F7
LoadLibraryExW.KERNEL32(?,?,?,00007FFDFF296716,?,?,?,00007FFDFF2966D1,?,?,?,?,00007FFDFF27F27A), ref: 00007FFDFF2A7421
FreeLibrary.KERNEL32(?,?,?,00007FFDFF296716,?,?,?,00007FFDFF2966D1,?,?,?,?,00007FFDFF27F27A), ref: 00007FFDFF2A7467
GetProcAddress.KERNEL32(?,?,?,00007FFDFF296716,?,?,?,00007FFDFF2966D1,?,?,?,?,00007FFDFF27F27A), ref: 00007FFDFF2A7473

Strings

MZx, xrefs: 00007FFDFF2A7382, 00007FFDFF2A7432, 00007FFDFF2A7450
api-ms-, xrefs: 00007FFDFF2A7409

Memory Dump Source

Source File: 00000000.00000002.2924661177.00007FFDFF221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFF220000, based on PE: true

Associated: 00000000.00000002.2924538361.00007FFDFF220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924751005.00007FFDFF2BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924794258.00007FFDFF2F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924817209.00007FFDFF2FE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924817209.00007FFDFF307000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924865675.00007FFDFF30C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdff220000_loaddll64.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: MZx$api-ms-
API String ID: 2559590344-259127448
Opcode ID: 23a6abf148d4f9863a7241b4dd2aaad5f8c95e74e99a10ca0954b798652c7c3f
Instruction ID: 57a02f043e9e5d8d78638511bcb2bb8f3eaed6c98e9d1b7870235d75cff37efc
Opcode Fuzzy Hash: 23a6abf148d4f9863a7241b4dd2aaad5f8c95e74e99a10ca0954b798652c7c3f
Instruction Fuzzy Hash: 5131DC22B1AA42A2FF119F02A820D7567A4FF49BA0F590231DE3DCA3C9DE3CE540C704

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDFF2902D8 Relevance: 11.0, APIs: 3, Strings: 3, Instructions: 494COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FFDFF29031B
_invalid_parameter_noinfo.LIBCMT ref: 00007FFDFF290708
_invalid_parameter_noinfo.LIBCMT ref: 00007FFDFF2909A4

Strings

f, xrefs: 00007FFDFF29043D
p, xrefs: 00007FFDFF290445
p, xrefs: 00007FFDFF2903CD

Memory Dump Source

Source File: 00000000.00000002.2924661177.00007FFDFF221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFF220000, based on PE: true

Associated: 00000000.00000002.2924538361.00007FFDFF220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924751005.00007FFDFF2BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924794258.00007FFDFF2F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924817209.00007FFDFF2FE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924817209.00007FFDFF307000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924865675.00007FFDFF30C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdff220000_loaddll64.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: f$p$p
API String ID: 3215553584-1995029353
Opcode ID: f6e5b21ea778a78dda175c04fd418f402bd25be9d2b8a671e02ca15de573fc89
Instruction ID: 82733185a5910ac7843acc0bf2a5e55d0b182cd945dd082fd4c4b1a08220e76e
Opcode Fuzzy Hash: f6e5b21ea778a78dda175c04fd418f402bd25be9d2b8a671e02ca15de573fc89
Instruction Fuzzy Hash: 10126F62F0824B86FB74DB25D064AB967A1FB80758F844235D6B9C77CCDB3CE480AB45

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDFF2A5664 Relevance: 10.8, APIs: 7, Instructions: 290COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FFDFF2A5A91

Memory Dump Source

Source File: 00000000.00000002.2924661177.00007FFDFF221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFF220000, based on PE: true

Associated: 00000000.00000002.2924538361.00007FFDFF220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924751005.00007FFDFF2BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924794258.00007FFDFF2F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924817209.00007FFDFF2FE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924817209.00007FFDFF307000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924865675.00007FFDFF30C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdff220000_loaddll64.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 4bb48a2b39757ce176506678cfcde187da147b68e690b669203bd40ad4191424
Instruction ID: bbc377d50547d69d7d25912f32557a6d06bc9cc52ce47b5f66dd0364ee821e24
Opcode Fuzzy Hash: 4bb48a2b39757ce176506678cfcde187da147b68e690b669203bd40ad4191424
Instruction Fuzzy Hash: FAC1D123B08687A1E7609B159461ABE7B50EF82B90F554331DA7ECB7D9DF7CE8488301

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDFF29A4C4 Relevance: 10.6, APIs: 7, Instructions: 62COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00000000,00007FFDFF29F9FF,?,?,00000000,00007FFDFF29AC1C,?,?,?,00007FFDFF2822AF,?,?,?,00007FFDFF290387), ref: 00007FFDFF29A4D3
FlsGetValue.KERNEL32(?,?,00000000,00007FFDFF29F9FF,?,?,00000000,00007FFDFF29AC1C,?,?,?,00007FFDFF2822AF,?,?,?,00007FFDFF290387), ref: 00007FFDFF29A4E8
FlsSetValue.KERNEL32(?,?,00000000,00007FFDFF29F9FF,?,?,00000000,00007FFDFF29AC1C,?,?,?,00007FFDFF2822AF,?,?,?,00007FFDFF290387), ref: 00007FFDFF29A509
FlsSetValue.KERNEL32(?,?,00000000,00007FFDFF29F9FF,?,?,00000000,00007FFDFF29AC1C,?,?,?,00007FFDFF2822AF,?,?,?,00007FFDFF290387), ref: 00007FFDFF29A536
FlsSetValue.KERNEL32(?,?,00000000,00007FFDFF29F9FF,?,?,00000000,00007FFDFF29AC1C,?,?,?,00007FFDFF2822AF,?,?,?,00007FFDFF290387), ref: 00007FFDFF29A547
FlsSetValue.KERNEL32(?,?,00000000,00007FFDFF29F9FF,?,?,00000000,00007FFDFF29AC1C,?,?,?,00007FFDFF2822AF,?,?,?,00007FFDFF290387), ref: 00007FFDFF29A558
SetLastError.KERNEL32(?,?,00000000,00007FFDFF29F9FF,?,?,00000000,00007FFDFF29AC1C,?,?,?,00007FFDFF2822AF,?,?,?,00007FFDFF290387), ref: 00007FFDFF29A573

Memory Dump Source

Source File: 00000000.00000002.2924661177.00007FFDFF221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFF220000, based on PE: true

Associated: 00000000.00000002.2924538361.00007FFDFF220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924751005.00007FFDFF2BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924794258.00007FFDFF2F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924817209.00007FFDFF2FE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924817209.00007FFDFF307000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924865675.00007FFDFF30C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdff220000_loaddll64.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 704e2090b368d0266b8edebe94992b4d74d25c30698011627ab2072f45f0d0e8
Instruction ID: 29ca6c6d6e5bc9c7da57f78a27053b5489326a20a91619470cf822dae01729c5
Opcode Fuzzy Hash: 704e2090b368d0266b8edebe94992b4d74d25c30698011627ab2072f45f0d0e8
Instruction Fuzzy Hash: 07211A20F0D34242FB75A72195759397392AF897B8F144778D97EC7ADEDE2CE801AA00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDFF227C30 Relevance: 10.6, APIs: 7, Instructions: 55COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 00007FFDFF227C5D
OpenProcessToken.ADVAPI32 ref: 00007FFDFF227C6E
GetTokenInformation.ADVAPI32 ref: 00007FFDFF227CBF
GetSidSubAuthorityCount.ADVAPI32 ref: 00007FFDFF227CCE
GetSidSubAuthority.ADVAPI32 ref: 00007FFDFF227CDE
CloseHandle.KERNEL32 ref: 00007FFDFF227CEB
CloseHandle.KERNEL32 ref: 00007FFDFF227D02

Memory Dump Source

Source File: 00000000.00000002.2924661177.00007FFDFF221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFF220000, based on PE: true

Associated: 00000000.00000002.2924538361.00007FFDFF220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924751005.00007FFDFF2BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924794258.00007FFDFF2F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924817209.00007FFDFF2FE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924817209.00007FFDFF307000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924865675.00007FFDFF30C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdff220000_loaddll64.jbxd

Similarity

API ID: AuthorityCloseHandleProcessToken$CountCurrentInformationOpen
String ID:
API String ID: 3581356705-0
Opcode ID: 7376fb42852224173900ca7f343380a5048157c247d77ddb1755e2e03819531a
Instruction ID: e3fd975a922baa1cce4492f2656ba6c35b3712b385c9f498a4e5e2e5f1d5452f
Opcode Fuzzy Hash: 7376fb42852224173900ca7f343380a5048157c247d77ddb1755e2e03819531a
Instruction Fuzzy Hash: FF214C31A19A8192E7509B25F8217A973E0EFC5B81F504231DAAED37A8DF3CD6858700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDFF2ACC28 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 00007FFDFF2ACC59
GetLastError.KERNEL32 ref: 00007FFDFF2ACC65
CloseHandle.KERNEL32 ref: 00007FFDFF2ACC7D
CreateFileW.KERNEL32 ref: 00007FFDFF2ACCA8
WriteConsoleW.KERNEL32 ref: 00007FFDFF2ACCC7

Strings

CONOUT$, xrefs: 00007FFDFF2ACC89

Memory Dump Source

Source File: 00000000.00000002.2924661177.00007FFDFF221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFF220000, based on PE: true

Associated: 00000000.00000002.2924538361.00007FFDFF220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924751005.00007FFDFF2BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924794258.00007FFDFF2F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924817209.00007FFDFF2FE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924817209.00007FFDFF307000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924865675.00007FFDFF30C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdff220000_loaddll64.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: f90fff8f549bd5dfb5aa7a9f11d6eb4df14cfa702c181c105ad1893af69bdfc3
Instruction ID: 2dfc5e702b93f8a9e797a1e9c7a707b7234bf89621bda267c970ad92c020f390
Opcode Fuzzy Hash: f90fff8f549bd5dfb5aa7a9f11d6eb4df14cfa702c181c105ad1893af69bdfc3
Instruction Fuzzy Hash: 4C117C32B18A4186E7509B56E864B2963A0FB88FE4F144334EA7DC77E8DF3CD5048700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDFF29A63C Relevance: 9.1, APIs: 6, Instructions: 57COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00007FFDFF28D705,?,?,?,?,00007FFDFF299BB0), ref: 00007FFDFF29A64B
FlsSetValue.KERNEL32(?,?,?,00007FFDFF28D705,?,?,?,?,00007FFDFF299BB0), ref: 00007FFDFF29A681
FlsSetValue.KERNEL32(?,?,?,00007FFDFF28D705,?,?,?,?,00007FFDFF299BB0), ref: 00007FFDFF29A6AE
FlsSetValue.KERNEL32(?,?,?,00007FFDFF28D705,?,?,?,?,00007FFDFF299BB0), ref: 00007FFDFF29A6BF
FlsSetValue.KERNEL32(?,?,?,00007FFDFF28D705,?,?,?,?,00007FFDFF299BB0), ref: 00007FFDFF29A6D0
SetLastError.KERNEL32(?,?,?,00007FFDFF28D705,?,?,?,?,00007FFDFF299BB0), ref: 00007FFDFF29A6EB

Memory Dump Source

Source File: 00000000.00000002.2924661177.00007FFDFF221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFF220000, based on PE: true

Associated: 00000000.00000002.2924538361.00007FFDFF220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924751005.00007FFDFF2BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924794258.00007FFDFF2F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924817209.00007FFDFF2FE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924817209.00007FFDFF307000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924865675.00007FFDFF30C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdff220000_loaddll64.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 73656e7ebc1e05da77aa8ab3b1c616587ea216361fd2ffbd3858a98d25199bad
Instruction ID: 50ef1a6071d3ab3e5a0541068b1769656304ba693584202a7a20f697cf7e3eb2
Opcode Fuzzy Hash: 73656e7ebc1e05da77aa8ab3b1c616587ea216361fd2ffbd3858a98d25199bad
Instruction Fuzzy Hash: CB11FC20B0D74282FB64A726957597973925F88BB8F144778D87EC77DEDE2CA401AE00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDFF2A4AD0 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 299fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 00007FFDFF2A4B4F
WriteFile.KERNEL32 ref: 00007FFDFF2A4E17
WriteFile.KERNEL32 ref: 00007FFDFF2A4E5D
GetLastError.KERNEL32 ref: 00007FFDFF2A4F13

Strings

MZx, xrefs: 00007FFDFF2A4B26, 00007FFDFF2A4BA7, 00007FFDFF2A4C5C

Memory Dump Source

Source File: 00000000.00000002.2924661177.00007FFDFF221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFF220000, based on PE: true

Associated: 00000000.00000002.2924538361.00007FFDFF220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924751005.00007FFDFF2BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924794258.00007FFDFF2F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924817209.00007FFDFF2FE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924817209.00007FFDFF307000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924865675.00007FFDFF30C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdff220000_loaddll64.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID: MZx
API String ID: 2718003287-2575928145
Opcode ID: e430d823cdf19127bbe80281ed12688dbdf67d811ced7f433012cd59fa247be4
Instruction ID: a432345ca01f07e086b18e5e556c44f9bca298f7fd288de02a9345e80e726f5c
Opcode Fuzzy Hash: e430d823cdf19127bbe80281ed12688dbdf67d811ced7f433012cd59fa247be4
Instruction Fuzzy Hash: 32D1BD33B18A8199E711CF79D490AAC37A1FB44798B504226DE7DDBBE9DE38D506C300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDFF29FAC8 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 167COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFDFF29A4C4: GetLastError.KERNEL32(?,?,00000000,00007FFDFF29F9FF,?,?,00000000,00007FFDFF29AC1C,?,?,?,00007FFDFF2822AF,?,?,?,00007FFDFF290387), ref: 00007FFDFF29A4D3
Part of subcall function 00007FFDFF29A4C4: FlsGetValue.KERNEL32(?,?,00000000,00007FFDFF29F9FF,?,?,00000000,00007FFDFF29AC1C,?,?,?,00007FFDFF2822AF,?,?,?,00007FFDFF290387), ref: 00007FFDFF29A4E8
Part of subcall function 00007FFDFF29A4C4: SetLastError.KERNEL32(?,?,00000000,00007FFDFF29F9FF,?,?,00000000,00007FFDFF29AC1C,?,?,?,00007FFDFF2822AF,?,?,?,00007FFDFF290387), ref: 00007FFDFF29A573

TranslateName.LIBCMT ref: 00007FFDFF29FB32
TranslateName.LIBCMT ref: 00007FFDFF29FB6D
GetACP.KERNEL32(?,?,?,00000000,00000092,00007FFDFF28B9A0), ref: 00007FFDFF29FBB4
IsValidCodePage.KERNEL32(?,?,?,00000000,00000092,00007FFDFF28B9A0), ref: 00007FFDFF29FBEC

Strings

utf8, xrefs: 00007FFDFF29FCD0

Memory Dump Source

Source File: 00000000.00000002.2924661177.00007FFDFF221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFF220000, based on PE: true

Associated: 00000000.00000002.2924538361.00007FFDFF220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924751005.00007FFDFF2BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924794258.00007FFDFF2F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924817209.00007FFDFF2FE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924817209.00007FFDFF307000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924865675.00007FFDFF30C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdff220000_loaddll64.jbxd

Similarity

API ID: ErrorLastNameTranslate$CodePageValidValue
String ID: utf8
API String ID: 1791977518-905460609
Opcode ID: 36fcc85fbf6ad3db5adfd8a41bdfbca038e87d0d0f818caa2772903de3056e41
Instruction ID: d803948679205e3fda681638db5894f6da24af38cd96b22309745cd7ec39776d
Opcode Fuzzy Hash: 36fcc85fbf6ad3db5adfd8a41bdfbca038e87d0d0f818caa2772903de3056e41
Instruction Fuzzy Hash: 26614B22B0874281EBB49F61D430AB923A4AF45B88F144635CE3DC7BD9EE3DE691D351

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDFF2AA634 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 106timeCOMMON

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 00007FFDFF2AA662

Part of subcall function 00007FFDFF2AA4B4: _invalid_parameter_noinfo.LIBCMT ref: 00007FFDFF2AA4C8

_get_daylight.LIBCMT ref: 00007FFDFF2AA684

Part of subcall function 00007FFDFF2AA484: _invalid_parameter_noinfo.LIBCMT ref: 00007FFDFF2AA498

Part of subcall function 00007FFDFF299B7C: HeapFree.KERNEL32 ref: 00007FFDFF299B92
Part of subcall function 00007FFDFF299B7C: GetLastError.KERNEL32 ref: 00007FFDFF299B9C

GetTimeZoneInformation.KERNEL32(?,?,00000000,00000000,?,00007FFDFF2AAB90), ref: 00007FFDFF2AA6AB
_get_daylight.LIBCMT ref: 00007FFDFF2AA673

Part of subcall function 00007FFDFF2AA454: _invalid_parameter_noinfo.LIBCMT ref: 00007FFDFF2AA468

Strings

?, xrefs: 00007FFDFF2AA865

Memory Dump Source

Source File: 00000000.00000002.2924661177.00007FFDFF221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFF220000, based on PE: true

Associated: 00000000.00000002.2924538361.00007FFDFF220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924751005.00007FFDFF2BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924794258.00007FFDFF2F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924817209.00007FFDFF2FE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924817209.00007FFDFF307000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924865675.00007FFDFF30C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdff220000_loaddll64.jbxd

Similarity

API ID: _get_daylight_invalid_parameter_noinfo$ErrorFreeHeapInformationLastTimeZone
String ID: ?
API String ID: 3458911817-1684325040
Opcode ID: bb015cec371fd27057b660b2554351533079983a56e98ad0dd1a68f14fba5906
Instruction ID: ef92aba54633e62d5448fb586c0449631866b6f09fed95a1df3b2d857143032b
Opcode Fuzzy Hash: bb015cec371fd27057b660b2554351533079983a56e98ad0dd1a68f14fba5906
Instruction Fuzzy Hash: E4417032B18242D6E720DF35E8A18A96761FF48788B445235EA3DC77DADF3CE5418B40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDFF28B148 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 00007FFDFF28B16D
GetProcAddress.KERNEL32 ref: 00007FFDFF28B183
FreeLibrary.KERNEL32 ref: 00007FFDFF28B1AA

Strings

CorExitProcess, xrefs: 00007FFDFF28B17C
mscoree.dll, xrefs: 00007FFDFF28B164

Memory Dump Source

Source File: 00000000.00000002.2924661177.00007FFDFF221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFF220000, based on PE: true

Associated: 00000000.00000002.2924538361.00007FFDFF220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924751005.00007FFDFF2BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924794258.00007FFDFF2F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924817209.00007FFDFF2FE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924817209.00007FFDFF307000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924865675.00007FFDFF30C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdff220000_loaddll64.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 7078e7cb49e6d80303ecd3e8bee293257328286c29dc15c5ef647e926d81ceb1
Instruction ID: ca77392e0949b353e766a91348cb910f3a180a512d0b0a86e031f149117aef3e
Opcode Fuzzy Hash: 7078e7cb49e6d80303ecd3e8bee293257328286c29dc15c5ef647e926d81ceb1
Instruction Fuzzy Hash: F1F04F61B1860682FB109B24A864B396360EF89B65F54573ADA7DC91FCCF2CE548C350

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDFF29A748 Relevance: 7.6, APIs: 5, Instructions: 54COMMON

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,00007FFDFF29CAD3,?,?,00000000,00007FFDFF29C9EA,?,?,?,?,?,00007FFDFF29CB96), ref: 00007FFDFF29A767
FlsSetValue.KERNEL32(?,?,?,00007FFDFF29CAD3,?,?,00000000,00007FFDFF29C9EA,?,?,?,?,?,00007FFDFF29CB96), ref: 00007FFDFF29A786
FlsSetValue.KERNEL32(?,?,?,00007FFDFF29CAD3,?,?,00000000,00007FFDFF29C9EA,?,?,?,?,?,00007FFDFF29CB96), ref: 00007FFDFF29A7AE
FlsSetValue.KERNEL32(?,?,?,00007FFDFF29CAD3,?,?,00000000,00007FFDFF29C9EA,?,?,?,?,?,00007FFDFF29CB96), ref: 00007FFDFF29A7BF
FlsSetValue.KERNEL32(?,?,?,00007FFDFF29CAD3,?,?,00000000,00007FFDFF29C9EA,?,?,?,?,?,00007FFDFF29CB96), ref: 00007FFDFF29A7D0

Memory Dump Source

Source File: 00000000.00000002.2924661177.00007FFDFF221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFF220000, based on PE: true

Associated: 00000000.00000002.2924538361.00007FFDFF220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924751005.00007FFDFF2BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924794258.00007FFDFF2F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924817209.00007FFDFF2FE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924817209.00007FFDFF307000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924865675.00007FFDFF30C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdff220000_loaddll64.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: b0030259709fe60e399af429c683c0e017a99c58ce5eb43bc5a089ff788e328b
Instruction ID: 100ba5f808d5167d27ff30d437f1f24018636fbc3590c85b95dde565cf77f0b1
Opcode Fuzzy Hash: b0030259709fe60e399af429c683c0e017a99c58ce5eb43bc5a089ff788e328b
Instruction Fuzzy Hash: E9113010F0D34241FB74AB26A57697973916F883B8E144378D83DC77DEDE2CB441AA01

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDFF29A598 Relevance: 7.6, APIs: 5, Instructions: 50COMMON

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,?,?,?,?,00007FFDFF29F9FF,?,?,00000000,00007FFDFF29AC1C,?,?,?,00007FFDFF2822AF), ref: 00007FFDFF29A5A9
FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00007FFDFF29F9FF,?,?,00000000,00007FFDFF29AC1C,?,?,?,00007FFDFF2822AF), ref: 00007FFDFF29A5C8
FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00007FFDFF29F9FF,?,?,00000000,00007FFDFF29AC1C,?,?,?,00007FFDFF2822AF), ref: 00007FFDFF29A5F0
FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00007FFDFF29F9FF,?,?,00000000,00007FFDFF29AC1C,?,?,?,00007FFDFF2822AF), ref: 00007FFDFF29A601
FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00007FFDFF29F9FF,?,?,00000000,00007FFDFF29AC1C,?,?,?,00007FFDFF2822AF), ref: 00007FFDFF29A612

Memory Dump Source

Source File: 00000000.00000002.2924661177.00007FFDFF221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFF220000, based on PE: true

Associated: 00000000.00000002.2924538361.00007FFDFF220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924751005.00007FFDFF2BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924794258.00007FFDFF2F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924817209.00007FFDFF2FE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924817209.00007FFDFF307000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924865675.00007FFDFF30C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdff220000_loaddll64.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: e6f4134a7624959d5bf43d5acec596483f9881d8610b0fdfecb887b398475a5d
Instruction ID: a917636dae42e4d212109c31dbaecddd7b4213ac7381152249f2907c4223574f
Opcode Fuzzy Hash: e6f4134a7624959d5bf43d5acec596483f9881d8610b0fdfecb887b398475a5d
Instruction Fuzzy Hash: 40110650F0A34742FF78A725587597933815F89778E180778D83ECB2DEDD2CB442AA00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDFF2A3D6C Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 219COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FFDFF2A404B

Part of subcall function 00007FFDFF2A9934: _invalid_parameter_noinfo.LIBCMT ref: 00007FFDFF2A9951

Strings

UTF-16LEUNICODE, xrefs: 00007FFDFF2A3FE9
UTF-8, xrefs: 00007FFDFF2A3FCA
ccs, xrefs: 00007FFDFF2A3F86

Memory Dump Source

Source File: 00000000.00000002.2924661177.00007FFDFF221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFF220000, based on PE: true

Associated: 00000000.00000002.2924538361.00007FFDFF220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924751005.00007FFDFF2BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924794258.00007FFDFF2F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924817209.00007FFDFF2FE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924817209.00007FFDFF307000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924865675.00007FFDFF30C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdff220000_loaddll64.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: UTF-16LEUNICODE$UTF-8$ccs
API String ID: 3215553584-1196891531
Opcode ID: 4c28aed6233b4b015a3662bf10234d213bb956c43fbe52ee3a9792630a153e18
Instruction ID: f9b383ab72bb7db6687c8cb6808f50663391424e63dcd788196be99d9d6afc72
Opcode Fuzzy Hash: 4c28aed6233b4b015a3662bf10234d213bb956c43fbe52ee3a9792630a153e18
Instruction Fuzzy Hash: BA81A233F2D243A5F7644E3581B0A7967A0EB11B48F558235DA3AEB2DDDB2EEC019701

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDFF2A46A8 Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

GetConsoleMode.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00007FFDFF2A4ABB,FFFFFFEF), ref: 00007FFDFF2A47C4
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00007FFDFF2A4ABB,FFFFFFEF), ref: 00007FFDFF2A484F

Memory Dump Source

Source File: 00000000.00000002.2924661177.00007FFDFF221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFF220000, based on PE: true

Associated: 00000000.00000002.2924538361.00007FFDFF220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924751005.00007FFDFF2BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924794258.00007FFDFF2F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924817209.00007FFDFF2FE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924817209.00007FFDFF307000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924865675.00007FFDFF30C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdff220000_loaddll64.jbxd

Similarity

API ID: ConsoleErrorLastMode
String ID:
API String ID: 953036326-0
Opcode ID: d62f1c9b14739e45e24fb0c33fe520784971a1c2be492079a1142b1629369066
Instruction ID: 428bbc3e8f4dec1ffd6fd94a8c9628aa600a118584bdbc9412ffd937e6806ad2
Opcode Fuzzy Hash: d62f1c9b14739e45e24fb0c33fe520784971a1c2be492079a1142b1629369066
Instruction Fuzzy Hash: C891CA23F1869299F7508F6598A0A7D2BA0BB45B88F544235DE3EDB6E9DF3CD441C300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDFF2A5AB4 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 204fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00008000), ref: 00007FFDFF2A5B82
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00008000), ref: 00007FFDFF2A5D29

Strings

MZx, xrefs: 00007FFDFF2A5ACD, 00007FFDFF2A5B93, 00007FFDFF2A5BE8, 00007FFDFF2A5BF9, 00007FFDFF2A5D3D

Memory Dump Source

Source File: 00000000.00000002.2924661177.00007FFDFF221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFF220000, based on PE: true

Associated: 00000000.00000002.2924538361.00007FFDFF220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924751005.00007FFDFF2BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924794258.00007FFDFF2F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924817209.00007FFDFF2FE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924817209.00007FFDFF307000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924865675.00007FFDFF30C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdff220000_loaddll64.jbxd

Similarity

API ID: ErrorFileLastRead
String ID: MZx
API String ID: 1948546556-2575928145
Opcode ID: 78ecd6875f2012e623538b26ed1772030f43468d3ba1cdc9ed735aef2aefa767
Instruction ID: e10df5d907c0725b803ef2e35b33216aca8841d925adb8b8fb473249c852ad54
Opcode Fuzzy Hash: 78ecd6875f2012e623538b26ed1772030f43468d3ba1cdc9ed735aef2aefa767
Instruction Fuzzy Hash: 9391F113B1D685A5FB214B249465BBA2B82BB12F94F184736CA7ECB6CDCE3CD445C701

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDFF2A5168 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 00007FFDFF2A527F
GetLastError.KERNEL32 ref: 00007FFDFF2A52A1

Strings

U, xrefs: 00007FFDFF2A522B

Memory Dump Source

Source File: 00000000.00000002.2924661177.00007FFDFF221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFF220000, based on PE: true

Associated: 00000000.00000002.2924538361.00007FFDFF220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924751005.00007FFDFF2BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924794258.00007FFDFF2F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924817209.00007FFDFF2FE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924817209.00007FFDFF307000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924865675.00007FFDFF30C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdff220000_loaddll64.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: 7a11ae47297e962d18786bffd31e9e2ed0fcaf65763b44c9a3347e96ed73a44a
Instruction ID: de49236a9b01540d12e60fc4d308031a4df939ce4c8a7a2f4a142a6a50d3c208
Opcode Fuzzy Hash: 7a11ae47297e962d18786bffd31e9e2ed0fcaf65763b44c9a3347e96ed73a44a
Instruction Fuzzy Hash: 9541A223B18A8196EB608F25E855BAA67A0FB88B94F504231EE6DC77DCDF3CD401C740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFDFF27F144 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42COMMON

Download Yara Rule

APIs

RtlPcToFileHeader.KERNEL32(?,?,?,?,?,?,?,?,?,00007FFDFF2ADD33), ref: 00007FFDFF27F188
RaiseException.KERNEL32(?,?,?,?,?,?,?,?,?,00007FFDFF2ADD33), ref: 00007FFDFF27F1CE

Strings

csm, xrefs: 00007FFDFF27F1BB

Memory Dump Source

Source File: 00000000.00000002.2924661177.00007FFDFF221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFF220000, based on PE: true

Associated: 00000000.00000002.2924538361.00007FFDFF220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924751005.00007FFDFF2BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924794258.00007FFDFF2F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924817209.00007FFDFF2FE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924817209.00007FFDFF307000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2924865675.00007FFDFF30C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdff220000_loaddll64.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: f0fe1fa0b8c9f782d5d72e1a70e8e7099cd1117b7e2de6f808cb3394ee563a78
Instruction ID: c3baed7bd2d8c4a3658043b80cfc30e28b45751f23c18a2734a2323dba66ae63
Opcode Fuzzy Hash: f0fe1fa0b8c9f782d5d72e1a70e8e7099cd1117b7e2de6f808cb3394ee563a78
Instruction Fuzzy Hash: E7113A32618B8582EB208B15F55066977E1FB88B98F184231DEED87BA8DF3CD651CB40

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads (ex: `rundll32.exe {DLLname, DLLfunction}` ).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report vulkan-1.dll

Overview

General Information

Detection

Signatures

Classification

Analysis Advice

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_vul_8a98533a1ee59e3066e2be1dd9ba698f1f7c53_20b95fe6_efed0deb-ab6a-419b-abdf-f64dadf15c15\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_vul_8a98533a1ee59e3066e2be1dd9ba698f1f7c53_20b95fe6_f1d6bd2e-9a5c-402a-bf9b-fffb0991a373\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_vul_d2be42f9ca26f5b1c98ace275864247822806def_20b95fe6_fb6bb36d-6fd7-4e37-9ac7-808a63498779\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_vul_f81a78fb38adc0648cfeb4514965597f248381b_20b95fe6_2b7c5b8b-ad79-4160-9e69-1ee53bd9092b\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WER677D.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER67FB.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER6849.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER6879.tmp.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER6898.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER6906.tmp.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER7335.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER7430.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER7460.tmp.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER7F1C.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER7F7A.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER7F9B.tmp.xml

C:\Windows\appcompat\Programs\Amcache.hve

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Windows Analysis Report
vulkan-1.dll